From 2c7cb530a11109beb2bd840f2d00f673644afa97 Mon Sep 17 00:00:00 2001
From: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
Date: Tue, 30 Dec 2025 19:03:38 +0530
Subject: [PATCH] fix: add eventTypeId and eventTypeSlug guard (#25773)

* fix: add eventTypeId and eventTypeSlug guard

* chore: update test

* refactor: improvemnt

* revert:

---------

Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com>
---
 apps/api/v1/test/lib/bookings/_post.test.ts                  | 4 +++-
 .../features/bookings/lib/handleNewBooking/getEventType.ts   | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/apps/api/v1/test/lib/bookings/_post.test.ts b/apps/api/v1/test/lib/bookings/_post.test.ts
index 3e397eefc2..de13aeb627 100644
--- a/apps/api/v1/test/lib/bookings/_post.test.ts
+++ b/apps/api/v1/test/lib/bookings/_post.test.ts
@@ -245,7 +245,9 @@ describe("POST /api/bookings", () => {
 
       const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
         method: "POST",
-        body: {},
+        body: {
+          eventTypeId: 2,
+        },
       });
 
       await handler(req, res);
diff --git a/packages/features/bookings/lib/handleNewBooking/getEventType.ts b/packages/features/bookings/lib/handleNewBooking/getEventType.ts
index bb5313375b..ba0fa32b8c 100644
--- a/packages/features/bookings/lib/handleNewBooking/getEventType.ts
+++ b/packages/features/bookings/lib/handleNewBooking/getEventType.ts
@@ -1,4 +1,5 @@
 import { getDefaultEvent } from "@calcom/features/eventtypes/lib/defaultEvents";
+import { HttpError } from "@calcom/lib/http-error";
 import { withReporting } from "@calcom/lib/sentryWrapper";
 
 import { getBookingFieldsWithSystemFields } from "../getBookingFields";
@@ -11,6 +12,10 @@ const _getEventType = async ({
   eventTypeId: number;
   eventTypeSlug?: string;
 }) => {
+  if (!eventTypeId && !eventTypeSlug) {
+    throw new HttpError({ statusCode: 400, message: "Either eventTypeId or eventTypeSlug must be provided" });
+  }
+
   // handle dynamic user
   const eventType =
     !eventTypeId && !!eventTypeSlug ? getDefaultEvent(eventTypeSlug) : await getEventTypesFromDB(eventTypeId);