From be249a94de226491206017c904890b98196cf21d Mon Sep 17 00:00:00 2001
From: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Date: Wed, 17 Sep 2025 10:05:10 +0300
Subject: [PATCH] chore: add auth strategy test only x-cal-client-id (#23872)

---
 .../api-auth/api-auth.strategy.e2e-spec.ts    | 25 ++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.e2e-spec.ts b/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.e2e-spec.ts
index 65a1e9f6bd..72ba40b14e 100644
--- a/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.e2e-spec.ts
+++ b/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.e2e-spec.ts
@@ -32,7 +32,7 @@ import { randomString } from "test/utils/randomString";
 import { X_CAL_CLIENT_ID, X_CAL_SECRET_KEY } from "@calcom/platform-constants";
 import type { PlatformOAuthClient, Team, User } from "@calcom/prisma/client";
 
-import { ApiAuthGuardRequest } from "./api-auth.strategy";
+import { ApiAuthGuardRequest, ONLY_CLIENT_ID_PROVIDED_MESSAGE } from "./api-auth.strategy";
 import { ApiAuthStrategy } from "./api-auth.strategy";
 
 describe("ApiAuthStrategy", () => {
@@ -244,6 +244,29 @@ describe("ApiAuthStrategy", () => {
       }
     });
 
+    it("should throw 401 if only OAuth ID is provided", async () => {
+      const context: ExecutionContext = {
+        switchToHttp: () => ({
+          getRequest: () => ({
+            headers: {
+              [X_CAL_CLIENT_ID]: `${oAuthClient.id}gibberish`,
+            },
+            get: (key: string) => ({ origin: "http://localhost:3000" }[key]),
+          }),
+        }),
+      } as ExecutionContext;
+      const request = context.switchToHttp().getRequest();
+
+      try {
+        await strategy.authenticate(request);
+      } catch (error) {
+        if (error instanceof HttpException) {
+          expect(error.getStatus()).toEqual(401);
+          expect(error.message).toContain(ONLY_CLIENT_ID_PROVIDED_MESSAGE);
+        }
+      }
+    });
+
     it("should throw 401 if OAuth ID is invalid", async () => {
       const context: ExecutionContext = {
         switchToHttp: () => ({