calcom/cal.diy · error · HttpException

${err.message}

Error message

${err.message}

What it means

Thrown by handleClientError when the error is an ErrorWithCode. Unlike the OAuth2-specific handlers, this produces a Nest HttpException whose body is the raw err.message string (not an OAuth2-shaped object) and whose status is getHttpStatusCode(err). It is used by the OAuth client management endpoints (CRUD on OAuth clients) rather than the protocol endpoints.

Source

Thrown at apps/api/v2/src/modules/auth/oauth2/services/oauth2-error.service.ts:68

      );
    }
    this.logger.error(err);
    throw new OAuth2HttpException(
      {
        error: "server_error",
        error_description: "An unexpected error occurred",
      },
      500
    );
  }

  handleClientError(err: unknown, fallbackMessage: string): never {
    if (err instanceof ErrorWithCode) {
      const statusCode = getHttpStatusCode(err);
      if (statusCode >= 500) {
        this.logger.error(err);
      }
      throw new HttpException(err.message, statusCode);
    }
    this.logger.error(err);
    throw new InternalServerErrorException(fallbackMessage);
  }
}

View on GitHub (pinned to 176037d0af)

Solutions

1. Treat the HTTP status code as authoritative (400 bad request, 403 forbidden, 404 not found) and read err.message for the specific reason.
2. For 403, confirm the authenticated user/org owns the OAuth client id in the request.
3. For 400, validate the request body against the OpenAPI schema for the endpoint before retrying.
4. If statusCode >= 500, the error was also logged — check server logs as it indicates a server-side fault.

// Validate ownership and body shape before calling client-management endpoints
const OWNED_CLIENT_IDS = new Set((await getMyOAuthClients()).map(c => c.id));
if (!OWNED_CLIENT_IDS.has(targetClientId)) throw new Error('not owned — will 403/404');

function isHttpExceptionWithStatus(err: unknown, status: number): boolean {
  return err instanceof Error && (err as any).status === status;
}

try {
  await updateOAuthClient(clientId, patch);
} catch (err) {
  if (isHttpExceptionWithStatus(err, 403)) { showPermissionError(); return; }
  if (isHttpExceptionWithStatus(err, 400)) { showValidationErrors(err.response?.message); return; }
  throw err;
}

When it happens

Trigger: Calling a client-management route (e.g., create/update/delete OAuth client) with input that fails validation or authorization in a way that raises an ErrorWithCode — for example attempting to delete a client you do not own, or supplying a redirect_uri that fails server-side validation.

Common situations: Operating on an OAuth client id belonging to a different organization; submitting malformed metadata fields; the platform-constants error codes map to 400/403/404 and the developer sees the raw message.

Related errors

• ${err.message}
• ${reason}
• ${reason ?? err.message}
• err.getResponse()

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/109c5e8c6f9a41d5. Report an issue: GitHub.