calcom/cal.diy · warning · BadRequestException

Email, code, and user ID are required

Error message

Email, code, and user ID are required

What it means

Thrown by verifyEmailCodeAuthenticated when the upstream rejects with an Error whose message equals 'BAD_REQUEST'. Like errors 23/25, this branch is unreachable today because verifyCodeAuthenticated is a stub that returns false and never throws (packages/platform/libraries/index.ts:175). The message also embeds 'user ID' to reflect that the authenticated path has the user context.

Source

Thrown at apps/api/v2/src/modules/atoms/services/verification-atom.service.ts:57

      }
      throw new BadRequestException("Verification failed");
    }
  }

  async verifyEmailCodeAuthenticated(user: UserWithProfile, input: VerifyEmailCodeInput) {
    try {
      return await verifyCodeAuthenticated({
        user,
        email: input.email,
        code: input.code,
      });
    } catch (error) {
      if (error instanceof Error) {
        if (error.message === "invalid_code") {
          throw new BadRequestException("Invalid verification code");
        }
        if (error.message === "BAD_REQUEST") {
          throw new BadRequestException("Email, code, and user ID are required");
        }
      }
      throw new UnauthorizedException("Verification failed");
    }
  }

  async sendEmailVerificationCode(input: SendVerificationEmailInput) {
    return await sendEmailVerificationByCode({
      email: input.email,
      username: input.username,
      language: input.language,
      isVerifyingEmail: input.isVerifyingEmail,
    });
  }

  async getVerifiedEmails(input: GetVerifiedEmailsInput): Promise<string[]> {
    const { userId, userEmail, teamId } = input;
    const userEmailWithoutOauthClientId = this.removeClientIdFromEmail(userEmail);

View on GitHub (pinned to 176037d0af)

Solutions

1. In CE this code path is inert — verify your edition before debugging.
2. When implementing verifyCodeAuthenticated, prefer a typed ErrorWithCode and matching instanceof check over fragile string equality.
3. Add a DTO validator on VerifyEmailCodeInput so missing fields never reach this catch.

if (!input?.email || !input?.code || !user?.id) {
  throw new BadRequestException('Email, code, and user ID are required');
}

function hasAuthenticatedVerifyInput(u: unknown, v: unknown): v is { email: string; code: string } {
  return typeof u === 'object' && u !== null && typeof (u as any).id === 'number' &&
    typeof v === 'object' && v !== null &&
    typeof (v as any).email === 'string' && typeof (v as any).code === 'string';
}

When it happens

Trigger: Unreachable against the current stub. Would fire only if a real verifyCodeAuthenticated implementation throws new Error('BAD_REQUEST') on missing email/code/userId.

Common situations: Calling authenticated verify in community edition (no-op); enabling EE; library contract drift.

Related errors

• Email and code are required
• Invalid verification code
• Verification failed
• Email already exists
• ApiKeysService -Cannot set both apiKeyDaysValid and apiKeyNe

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/265c6bcf4523afd7. Report an issue: GitHub.