calcom/cal.diy · warning · HttpError

Unauthorized

Error message

Unauthorized

What it means

Thrown by the Basecamp 3 project mutation handler when req.session.user.id is missing - the request has no authenticated Cal.com session. Surfaced as HTTP 401 via HttpError.

Source

Thrown at packages/app-store/basecamp3/api/projectMutation.ts:23

import { refreshAccessToken } from "@calcom/app-store/basecamp3/lib/helpers";
import type { BasecampToken } from "@calcom/app-store/basecamp3/lib/types";
import { HttpError } from "@calcom/lib/http-error";
import { defaultHandler } from "@calcom/lib/server/defaultHandler";
import { defaultResponder } from "@calcom/lib/server/defaultResponder";
import prisma from "@calcom/prisma";
import { credentialForCalendarServiceSelect } from "@calcom/prisma/selects/credential";

interface IDock {
  id: number;
  name: string;
}

const ZProjectMutationInputSchema = z.object({ projectId: z.string() });

async function handler(req: NextApiRequest) {
  const userId = req.session?.user?.id;
  if (!userId) {
    throw new HttpError({ statusCode: 401, message: "Unauthorized" });
  }

  const parsed = ZProjectMutationInputSchema.safeParse(req.body ?? {});
  if (!parsed.success) {
    throw new HttpError({
      statusCode: 400,
      message: "Invalid request body",
    });
  }
  const { projectId } = parsed.data;

  const { user_agent } = await getAppKeysFromSlug("basecamp3");

  const credential = await prisma.credential.findFirst({
    where: { userId },
    select: credentialForCalendarServiceSelect,
  });

View on GitHub (pinned to 176037d0af)

Solutions

1. Ensure the request includes a valid Cal.com session cookie.
2. Re-authenticate the user before retrying.
3. Use the in-app UI (which carries the session) rather than direct unauthenticated API calls.

if (!req.session?.user?.id) {
  // redirect to login or return 401 before reaching the handler logic
}

const isAuthenticated = (req: NextApiRequest): req is NextApiRequest & { session: { user: { id: number } } } =>
  typeof req.session?.user?.id === 'number';

When it happens

Trigger: Calling POST /api/basecamp3/project without a session cookie; an expired session; the route hit by an unauthenticated script or curl.

Common situations: Session cookie expired; calling the API from outside the authenticated browser context; middleware/auth misroute stripping the session.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized
• Not authenticated
• NextAuthStrategy - Authentication token is missing or invali
• Invalid Access token.
• Invalid Access token.

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/5b4e2a98e678e275. Report an issue: GitHub.