{"record":{"id":"faadafb4c608344e","repo":"calcom/cal.diy","slug":"could-not-add-this-apple-calendar-account-reaso","errorCode":null,"errorMessage":"Could not add this apple calendar account: ${reason}","messagePattern":"Could not add this apple calendar account: (.+?)","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/platform/calendars/services/apple-calendar.service.ts","lineNumber":134,"sourceCode":"          process.env.CALENDSO_ENCRYPTION_KEY || \"\"\n        ),\n        userId: userId,\n        teamId: null,\n        appId: APPLE_CALENDAR_ID,\n        invalid: false,\n        delegationCredentialId: null,\n        encryptedKey: null,\n      };\n\n      const dav = BuildCalendarService({\n        id: 0,\n        ...data,\n        user: { email: userEmail },\n      });\n      await dav?.listCalendars();\n      await this.credentialRepository.upsertUserAppCredential(APPLE_CALENDAR_TYPE, data.key, userId);\n    } catch (reason) {\n      throw new BadRequestException(`Could not add this apple calendar account: ${reason}`);\n    }\n\n    return {\n      status: SUCCESS_STATUS,\n    };\n  }\n}\n","sourceCodeStart":116,"sourceCodeEnd":142,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/calendars/services/apple-calendar.service.ts#L116-L142","documentation":"Thrown by AppleCalendarService.saveCalendarCredentials (apple-calendar.service.ts:134) as BadRequestException (HTTP 400) from a catch-all around BuildCalendarService + dav.listCalendars() + upsert. The caught error is stringified into the message via template literal (`${reason}`), which discards the original stack/cause and can leak internal detail. The '${reason}' segment usually contains the real underlying error text.","triggerScenarios":"Wrong Apple credentials causing DAV auth failure; CALENDSO_ENCRYPTION_KEY unset/mismatched so symmetricEncrypt/symmetricDecrypt misbehave; Apple CalDAV endpoint unreachable; BuildCalendarService returns a service whose listCalendars() rejects.","commonSituations":"Missing or rotated CALENDSO_ENCRYPTION_KEY env var across deploys; user supplied wrong app-specific password; network egress blocked to caldav.apple.com; apple_calendar app not registered so BuildCalendarService yields a failing service.","solutions":["Read the text after 'Could not add this apple calendar account: ' in the 400 body — it carries the underlying error message.","Verify process.env.CALENDSO_ENCRYPTION_KEY is set and identical across all instances (encryption key rotation breaks old credentials).","Test the supplied credentials directly against Apple's CalDAV endpoint to isolate provider vs. app error.","If reason mentions 'cannot read property' or null service, confirm the apple_calendar app is installed/registered in BuildCalendarService's registry."],"exampleFix":"// before (service): swallows original error\n} catch (reason) {\n  throw new BadRequestException(`Could not add this apple calendar account: ${reason}`);\n}\n\n// after: log stack and preserve cause for diagnosability\n} catch (reason) {\n  this.logger?.error?.('apple save failed', reason);\n  throw new BadRequestException(`Could not add this apple calendar account: ${(reason as Error).message}`, { cause: reason });\n}","handlingStrategy":"try-catch","validationCode":"// Pre-flight: ensure encryption key is set and credentials look valid\nif (!process.env.CALENDSO_ENCRYPTION_KEY) {\n  throw new Error('CALENDSO_ENCRYPTION_KEY is not set — Apple save will fail.');\n}\n// Validate input before calling save (see error 364 validation)","typeGuard":"function isEncryptionKeyConfigured() {\n  return typeof process.env.CALENDSO_ENCRYPTION_KEY === 'string'\n    && process.env.CALENDSO_ENCRYPTION_KEY.length > 0;\n}","tryCatchPattern":"try {\n  await api.post('/v2/calendars/apple_calendar/save', { username, password });\n} catch (e) {\n  const reason = e.response?.data?.message?.replace(/.*:\\s*/, ''); // text after the colon\n  if (/encrypt|key/i.test(reason)) {\n    throw new ConfigError('CALENDSO_ENCRYPTION_KEY issue — contact admin');\n  }\n  if (/auth|credential|unauthorized/i.test(reason)) {\n    throw new UserError('Apple credentials are incorrect — re-enter them.');\n  }\n  throw e;\n}","preventionTips":["Keep CALENDSO_ENCRYPTION_KEY identical across all instances and deploys; never rotate without re-encrypting existing credentials.","Log the underlying reason server-side (it is currently only in the HTTP message).","Test credentials against Apple's CalDAV endpoint directly during onboarding to fail fast."],"tags":["apple-calendar","encryption","env","error-swallowing","http-400"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}