calcom/cal.diy · warning · BadRequestException

Username or password cannot be empty

Error message

Username or password cannot be empty

What it means

Thrown by AppleCalendarService.saveCalendarCredentials (apple-calendar.service.ts:64) as BadRequestException (HTTP 400) when username or password is falsy or has length <= 1. Pure input validation; fully preventable on the client before the request is sent.

Source

Thrown at apps/api/v2/src/platform/calendars/services/apple-calendar.service.ts:64

    const { connectedCalendars } = await this.calendarsService.getCalendars(userId);
    const appleCalendar = connectedCalendars.find(
      (cal: { integration: { type: string } }) => cal.integration.type === APPLE_CALENDAR_TYPE
    );
    if (!appleCalendar) {
      throw new UnauthorizedException("Apple calendar not connected.");
    }
    if (appleCalendar.error?.message) {
      throw new UnauthorizedException(appleCalendar.error?.message);
    }

    return {
      status: SUCCESS_STATUS,
    };
  }

  async saveCalendarCredentials(userId: number, userEmail: string, username: string, password: string) {
    if (!username || !password || username.length <= 1 || password.length <= 1) {
      throw new BadRequestException(`Username or password cannot be empty`);
    }

    const existingAppleCalendarCredentials = await this.credentialRepository.getAllUserCredentialsByTypeAndId(
      APPLE_CALENDAR_TYPE,
      userId
    );

    let hasMatchingUsernameAndPassword = false;

    if (existingAppleCalendarCredentials.length > 0) {
      const hasCalendarWithGivenCredentials = existingAppleCalendarCredentials.find(
        (calendarCredential: Credential) => {
          const decryptedKey = JSON.parse(
            symmetricDecrypt(calendarCredential.key as string, process.env.CALENDSO_ENCRYPTION_KEY || "")
          );

          if (decryptedKey.username === username) {
            if (decryptedKey.password === password) {

View on GitHub (pinned to 176037d0af)

Solutions

1. Validate on the client that both username and password are non-empty strings of length >= 2 before calling save.
2. Add a Zod/schema check on the request DTO mirroring the service's guard.
3. Return a form-level validation error instead of hitting the API.

Example fix

// before: no client validation
await api.post('/v2/calendars/apple_calendar/save', { username, password }); // 400 if empty

// after: validate before sending
const Schema = z.object({
  username: z.string().trim().min(2),
  password: z.string().min(2),
});
const body = Schema.parse({ username, password });
await api.post('/v2/calendars/apple_calendar/save', body);

// Validate client-side before calling save
import { z } from 'zod';
const SaveAppleSchema = z.object({
  username: z.string().trim().min(2, 'username too short'),
  password: z.string().min(2, 'password too short'),
});
const body = SaveAppleSchema.parse({ username, password });
await api.post('/v2/calendars/apple_calendar/save', body);

function isValidAppleInput(username, password) {
  return typeof username === 'string' && typeof password === 'string'
    && username.trim().length > 1 && password.length > 1;
}

When it happens

Trigger: POST /v2/calendars/apple_calendar/save with empty/undefined username or password; whitespace-only fields; malformed request body missing keys; integration test omitting fields.

Common situations: Frontend bug not trimming/validating input; API client forgetting to populate both fields; form submitted before the user typed a value.

Related errors

• Event operations for this connection are currently only avai
• ${action} is currently only available for Google Calendar. O
• Credentials for apple calendar not found.
• Invalid apple calendar credentials.
• Could not add this apple calendar account: ${reason}

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/8faf844b2e3d90e8. Report an issue: GitHub.