fix: add authentication guard to /apps/installed routes#23092
Conversation
- Add session validation before making tRPC calls in server component - Redirect unauthenticated users to /auth/login instead of throwing 500 errors - Follows existing authentication patterns used throughout the codebase - Fixes 500 error when accessing /apps/installed/calendar and other categories Co-Authored-By: alex@cal.com <me@alexvanandel.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
WalkthroughAdds a server-side authentication guard to apps/web/app/(use-page-wrapper)/apps/installed/[category]/page.tsx. Imports cookies, headers (next/headers), buildLegacyRequest, and getServerSession. Constructs a server request from current headers and cookies, retrieves the session, and redirects to /auth/login if no session or missing user.id. This check executes before TRPC calls (calendarsRouter, appsRouter) and after query param validation. Existing logic for parsing params and redirecting to the default calendar remains unchanged. No exported/public signatures are modified. Possibly related PRs
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ |
Graphite Automations"Add foundation team as reviewer" took an action on this PR • (08/14/25)1 reviewer was added to this PR based on Keith Williams's automation. |
dosubot
bot
added
app-store
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
apps/web/app/(use-page-wrapper)/apps/installed/[category]/page.tsx (1)
38-41: Nit: remove unnecessary awaits and call redirect directly; confirm callback behavior.
- headers() and cookies() are sync; awaiting them is unnecessary and adds noise.
- redirect() throws; returning it is unnecessary. Elsewhere in the file you call redirect() without return—make this consistent.
Apply this diff:
- const session = await getServerSession({ req: buildLegacyRequest(await headers(), await cookies()) }); + const session = await getServerSession({ req: buildLegacyRequest(headers(), cookies()) }); if (!session?.user?.id) { - return redirect("/auth/login"); + redirect("/auth/login"); }Additionally, if your middleware doesn’t reliably set a return-to cookie, consider appending a callbackUrl to preserve the intended destination after login (or confirm that middleware handles this path).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these settings in your CodeRabbit configuration.
📒 Files selected for processing (1)
apps/web/app/(use-page-wrapper)/apps/installed/[category]/page.tsx(2 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
**/*.tsx
📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)
Always use
t()for text localization in frontend code; direct text embedding should trigger a warning
Files:
apps/web/app/(use-page-wrapper)/apps/installed/[category]/page.tsx
**/*.{ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)
Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js
.utc()in hot paths like loops
Files:
apps/web/app/(use-page-wrapper)/apps/installed/[category]/page.tsx
🧬 Code Graph Analysis (1)
apps/web/app/(use-page-wrapper)/apps/installed/[category]/page.tsx (2)
packages/features/auth/lib/getServerSession.ts (1)
getServerSession(32-136)apps/web/lib/buildLegacyCtx.tsx (1)
buildLegacyRequest(47-49)
🔇 Additional comments (3)
apps/web/app/(use-page-wrapper)/apps/installed/[category]/page.tsx (3)
4-4: Good use of next/headers primitives for server-only auth.Importing cookies() and headers() is appropriate here for building the server-side request.
8-8: Using getServerSession to guard tRPC calls is correct.This aligns with patterns elsewhere and prevents 500s due to missing session in the tRPC context.
13-14: Correct bridge to NextApiRequest via buildLegacyRequest.This matches the expected signature (ReadonlyHeaders, ReadonlyRequestCookies) and keeps getServerSession usage consistent across the app.
E2E results are ready! |
* fix: add authentication guard to /apps/installed routes - Add session validation before making tRPC calls in server component - Redirect unauthenticated users to /auth/login instead of throwing 500 errors - Follows existing authentication patterns used throughout the codebase - Fixes 500 error when accessing /apps/installed/calendar and other categories Co-Authored-By: alex@cal.com <me@alexvanandel.com> * fix: Missing return; was that so hard, DevinAI? --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
3 participants
fix: add authentication guard to /apps/installed routes
Summary
This PR fixes a 500 error that occurs when unauthenticated users access
/apps/installed/calendar(and other installed app categories). The issue was caused by the server component making tRPC calls without first validating that a user session exists.Changes made:
getServerSessionbefore making tRPC calls in the/apps/installed/[category]server component/auth/logininstead of allowing the server to throw 500 errorsRoot cause: The server component was calling
createRouterCallerfor tRPC operations without ensuring a valid session existed first. WhengetTRPCContextis called without a session, subsequent database queries fail, resulting in 500 errors.Review & Testing Checklist for Human
/availability/page.tsxand/event-types/page.tsxto ensure consistency/apps/installed/calendarwithout being logged in and verify it redirects to/auth/logininstead of showing a 500 error/apps/installed/calendarand other categories normally without any regressionsreturn-tocookies for/apps/installedroutesDiagram
%%{ init : { "theme" : "default" }}%% graph TB User[["User Access<br/>/apps/installed/calendar"]] --> Middleware[["middleware.ts<br/>(return-to cookie logic)"]]:::context Middleware --> PageComponent[["apps/installed/[category]/page.tsx<br/><br/>NEW: Session Check Added"]]:::major-edit PageComponent --> SessionCheck{{"getServerSession()<br/>validation"}} SessionCheck -->|"No Session"| LoginRedirect[["redirect('/auth/login')"]]:::major-edit SessionCheck -->|"Valid Session"| TRPCCalls[["createRouterCaller()<br/>calendarsRouter & appsRouter"]]:::context TRPCCalls --> GetServerSession[["@calcom/features/auth/lib/<br/>getServerSession"]]:::context TRPCCalls --> BuildLegacyRequest[["@lib/buildLegacyCtx"]]:::context subgraph Legend L1[Major Edit]:::major-edit L2[Minor Edit]:::minor-edit L3[Context/No Edit]:::context end classDef major-edit fill:#90EE90 classDef minor-edit fill:#87CEEB classDef context fill:#FFFFFFNotes
Testing performed:
yarn type-check:ci --force)/auth/login/calendar,/conferencing) - both redirect correctly@calcom/libpackage (not related to this change)Session details:
Screenshots of successful redirect:
