calcom/cal.diy · warning · HttpError

parsedQuery.error.message

Error message

parsedQuery.error.message

What it means

Thrown by the /api/auth/setup handler (HttpError, HTTP 422) when the zod querySchema fails safeParse on the request body. The message is the raw zod error string, which lists every failed field constraint (username length, full_name min 3, email regex, password policy).

Source

Thrown at apps/web/app/api/auth/setup/route.ts:37

    .refine((val) => val.trim().length >= 1, { message: "Please enter at least one character" }),
  full_name: z.string().min(3, "Please enter at least 3 characters"),
  email_address: z.string().regex(emailRegex, { message: "Please enter a valid email" }),
  password: z.string().refine((val) => isPasswordValid(val.trim(), false, true), {
    message:
      "The password must be a minimum of 15 characters long containing at least one number and have a mixture of uppercase and lowercase letters",
  }),
});

async function handler(req: NextRequest) {
  const userCount = await prisma.user.count();
  if (userCount !== 0) {
    throw new HttpError({ statusCode: 400, message: "No setup needed." });
  }
  const body = await parseRequestData(req);

  const parsedQuery = querySchema.safeParse(body);
  if (!parsedQuery.success) {
    throw new HttpError({ statusCode: 422, message: parsedQuery.error.message });
  }

  const username = slugify(parsedQuery.data.username.trim());
  const userEmail = parsedQuery.data.email_address.toLowerCase();

  const hashedPassword = await hashPassword(parsedQuery.data.password);

  await prisma.user.create({
    data: {
      username,
      email: userEmail,
      password: { create: { hash: hashedPassword } },
      role: "ADMIN",
      name: parsedQuery.data.full_name,
      emailVerified: new Date(),
      locale: "en", // TODO: We should revisit this
      identityProvider: IdentityProvider.CAL,
      creationSource: CreationSource.WEBAPP,

View on GitHub (pinned to 176037d0af)

Solutions

1. Run the same zod schema (or an equivalent) on the client and show per-field errors before submit.
2. Ensure password >=15 chars containing uppercase, lowercase, and at least one digit.
3. Trim username/full_name client-side and reject empty values.
4. Re-read the exact zod message returned to identify the failing field.

Example fix

// before
await fetch('/api/auth/setup', { method:'POST', body: JSON.stringify(form) });

// after
const parsed = querySchema.safeParse(form);
if (!parsed.success) {
  setFieldErrors(parsed.error.flatten().fieldErrors);
  return;
}
await fetch('/api/auth/setup', { method:'POST', body: JSON.stringify(parsed.data) });

// Mirror the server schema on the client and validate before submit
const result = querySchema.safeParse(form);
if (!result.success) {
  setErrors(result.error.flatten().fieldErrors);
  return;
}
await fetch('/api/auth/setup', { method: 'POST', body: JSON.stringify(result.data) });

function isPasswordPolicyCompliant(pw: string): boolean {
  return pw.length >= 15 && /[A-Z]/.test(pw) && /[a-z]/.test(pw) && /[0-9]/.test(pw);
}

try {
  await fetch('/api/auth/setup', { method: 'POST', body });
} catch (e) {
  if (e instanceof HttpError && e.statusCode === 422) {
    showFormErrors(e.message); // zod detail string
    return;
  }
  throw e;
}

When it happens

Trigger: POST /api/auth/setup with username shorter than 1 char, full_name under 3 chars, malformed email, or a password that fails isPasswordValid (must be >=15 chars with upper, lower, and a digit).

Common situations: Weak passwords (policy is 15+ chars), whitespace-only username, typo'd email, browser autofill truncating a field.

Related errors

• No setup needed.
• Invalid username
• Invalid refreshed tokens were returned
• Bad Request
• Invalid request body

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/cc06f6335096b911. Report an issue: GitHub.