calcom/cal.diy · warning · HttpError

Unauthorized

Error message

Unauthorized

What it means

Thrown by the Basecamp 3 projects listing handler (GET) when req.session.user.id is missing - the request has no authenticated Cal.com session. Surfaced as HTTP 401 via HttpError. Identical auth guard to the projectMutation endpoint.

Source

Thrown at packages/app-store/basecamp3/api/projects.ts:15

import type { NextApiRequest } from "next";

import getAppKeysFromSlug from "@calcom/app-store/_utils/getAppKeysFromSlug";
import { refreshAccessToken } from "@calcom/app-store/basecamp3/lib/helpers";
import type { BasecampToken } from "@calcom/app-store/basecamp3/lib/types";
import { defaultHandler } from "@calcom/lib/server/defaultHandler";
import { defaultResponder } from "@calcom/lib/server/defaultResponder";
import prisma from "@calcom/prisma";
import { credentialForCalendarServiceSelect } from "@calcom/prisma/selects/credential";
import { HttpError } from "@calcom/lib/http-error";

async function handler(req: NextApiRequest) {
  const userId = req.session?.user?.id;
  if (!userId) {
    throw new HttpError({ statusCode: 401, message: "Unauthorized" });
  }

  const { user_agent } = await getAppKeysFromSlug("basecamp3");

  const credential = await prisma.credential.findFirst({
    where: { userId },
    select: credentialForCalendarServiceSelect,
  });

  if (!credential) {
    throw new HttpError({ statusCode: 403, message: "No credential found for user" });
  }

  let credentialKey = credential.key as BasecampToken;

  if (!credentialKey.account) {
    return { currentProject: null, projects: [] };
  }

View on GitHub (pinned to 176037d0af)

Solutions

1. Ensure the request includes a valid Cal.com session cookie.
2. Re-authenticate the user before retrying.
3. Drive the call from the authenticated in-app UI.

if (!req.session?.user?.id) {
  // redirect to login or return 401
}

const isAuthenticated = (req: NextApiRequest): req is NextApiRequest & { session: { user: { id: number } } } =>
  typeof req.session?.user?.id === 'number';

When it happens

Trigger: Unauthenticated GET to /api/basecamp3/projects; an expired session; direct URL access without login.

Common situations: Session timeout; opening the projects API URL directly in a browser tab without an active session; script fetching without cookies.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized
• Not authenticated
• NextAuthStrategy - Authentication token is missing or invali
• Invalid Access token.
• Invalid Access token.

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/fa28782d202ab6a8. Report an issue: GitHub.