Skip to content

fix: return 400 instead of 500 for invalid eventTypeId in booking flow #26732

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keithwillcode merged 3 commits into from
Jan 12, 2026
Merged

fix: return 400 instead of 500 for invalid eventTypeId in booking flow #26732

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
796c31d
fix: return 400 instead of 500 for invalid eventTypeId in booking flow
devin-ai-integration[bot] Jan 12, 2026
54b4da5
refactor: use ErrorWithCode instead of HttpError in BotDetectionService
devin-ai-integration[bot] Jan 12, 2026
920da0b
refactor: use vi.stubEnv for safer environment variable handling in t…
devin-ai-integration[bot] Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 48 additions & 12 deletions packages/features/bot-detection/BotDetectionService.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
import type { IncomingHttpHeaders } from "node:http";
import { beforeEach, describe, expect, it, vi } from "vitest";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

import type { EventTypeRepository } from "@calcom/features/eventtypes/repositories/eventTypeRepository";
import type { FeaturesRepository } from "@calcom/features/flags/features.repository";
import { ErrorCode } from "@calcom/lib/errorCodes";
import { ErrorWithCode } from "@calcom/lib/errors";
import { HttpError } from "@calcom/lib/http-error";

import { BotDetectionService } from "./BotDetectionService";
Expand Down Expand Up @@ -30,10 +32,8 @@ describe("BotDetectionService", () => {
let mockHeaders: IncomingHttpHeaders;

beforeEach(() => {
// Reset all mocks before each test
vi.clearAllMocks();

// Setup mock repositories
mockFeaturesRepository = {
checkIfTeamHasFeature: vi.fn(),
} as unknown as FeaturesRepository;
Expand All @@ -48,14 +48,15 @@ describe("BotDetectionService", () => {
};

botDetectionService = new BotDetectionService(mockFeaturesRepository, mockEventTypeRepository);
});

// Reset environment variable
delete process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER;
afterEach(() => {
vi.unstubAllEnvs();
});

describe("checkBotDetection", () => {
it("should return early if BotID is not enabled at instance level", async () => {
process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER = "0";
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "0");

await botDetectionService.checkBotDetection({
eventTypeId: 123,
Expand All @@ -66,7 +67,7 @@ describe("BotDetectionService", () => {
});

it("should return early if no eventTypeId is provided", async () => {
process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER = "1";
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "1");

await botDetectionService.checkBotDetection({
headers: mockHeaders,
Expand All @@ -75,8 +76,43 @@ describe("BotDetectionService", () => {
expect(mockEventTypeRepository.getTeamIdByEventTypeId).not.toHaveBeenCalled();
});

it("should throw ErrorWithCode for invalid eventTypeId", async () => {
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "1");

await expect(
botDetectionService.checkBotDetection({
eventTypeId: "3823346KiEg1Zk6') OR 370=(SELECT 370 FROM PG_SLEEP(15))--" as unknown as number,
headers: mockHeaders,
})
).rejects.toThrow(ErrorWithCode);

await expect(
botDetectionService.checkBotDetection({
eventTypeId: -1,
headers: mockHeaders,
})
).rejects.toThrow(ErrorWithCode);

await expect(
botDetectionService.checkBotDetection({
eventTypeId: 1.5,
headers: mockHeaders,
})
).rejects.toThrow(ErrorWithCode);

try {
await botDetectionService.checkBotDetection({
eventTypeId: -1,
headers: mockHeaders,
});
} catch (error) {
expect(error).toBeInstanceOf(ErrorWithCode);
expect((error as ErrorWithCode).code).toBe(ErrorCode.BadRequest);
}
});

it("should return early if event type has no teamId", async () => {
process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER = "1";
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "1");
vi.mocked(mockEventTypeRepository.getTeamIdByEventTypeId).mockResolvedValue({
teamId: null,
});
Expand All @@ -90,7 +126,7 @@ describe("BotDetectionService", () => {
});

it("should return early if BotID feature is not enabled for the team", async () => {
process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER = "1";
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "1");
vi.mocked(mockEventTypeRepository.getTeamIdByEventTypeId).mockResolvedValue({
teamId: 456,
});
Expand All @@ -107,7 +143,7 @@ describe("BotDetectionService", () => {
});

it("should throw HttpError when a bot is detected", async () => {
process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER = "1";
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "1");
vi.mocked(mockEventTypeRepository.getTeamIdByEventTypeId).mockResolvedValue({
teamId: 456,
});
Expand Down Expand Up @@ -140,7 +176,7 @@ describe("BotDetectionService", () => {
});

it("should pass when a human is detected", async () => {
process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER = "1";
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "1");
vi.mocked(mockEventTypeRepository.getTeamIdByEventTypeId).mockResolvedValue({
teamId: 456,
});
Expand All @@ -167,7 +203,7 @@ describe("BotDetectionService", () => {

it("should check feature flag with correct teamId", async () => {
const teamId = 789;
process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER = "1";
vi.stubEnv("NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER", "1");
vi.mocked(mockEventTypeRepository.getTeamIdByEventTypeId).mockResolvedValue({
teamId,
});
Expand Down
7 changes: 6 additions & 1 deletion packages/features/bot-detection/BotDetectionService.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ import type { IncomingHttpHeaders } from "node:http";

import type { EventTypeRepository } from "@calcom/features/eventtypes/repositories/eventTypeRepository";
import type { FeaturesRepository } from "@calcom/features/flags/features.repository";
import { ErrorCode } from "@calcom/lib/errorCodes";
import { ErrorWithCode } from "@calcom/lib/errors";
import { HttpError } from "@calcom/lib/http-error";
import logger from "@calcom/lib/logger";

Expand Down Expand Up @@ -34,7 +36,10 @@ export class BotDetectionService {
}

if (!Number.isInteger(eventTypeId) || eventTypeId <= 0) {
throw new Error(`Invalid eventTypeId: ${eventTypeId}. Must be a positive integer.`);
throw new ErrorWithCode(
ErrorCode.BadRequest,
`Invalid eventTypeId: ${eventTypeId}. Must be a positive integer.`
);
Comment on lines +39 to +42
Copy link
Contributor Author

@hbjORbj hbjORbj Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This gets converted to HttpError later:

  1. BotDetectionService throws ErrorWithCode(ErrorCode.BadRequest, "Invalid eventTypeId...")
  2. defaultResponder catches the error and calls getServerErrorFromUnknown()
  3. getServerErrorFromUnknown detects ErrorWithCode and calls getHttpStatusCode(cause)
  4. getHttpStatusCode maps ErrorCode.BadRequest to status 400
  5. Response is sent with status 400

}

// Fetch only the teamId from the event type
Expand Down
Loading