From e06249d2df0040e8ad02973fb44215797c6c5439 Mon Sep 17 00:00:00 2001
From: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Date: Wed, 26 Nov 2025 16:53:58 +0530
Subject: [PATCH] fix: wrong credentials (#25394)

---
 apps/web/test/lib/confirm.handler.test.ts              |  1 +
 .../server/routers/viewer/bookings/confirm.handler.ts  | 10 +++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/apps/web/test/lib/confirm.handler.test.ts b/apps/web/test/lib/confirm.handler.test.ts
index ca85519cfb..0ef053d381 100644
--- a/apps/web/test/lib/confirm.handler.test.ts
+++ b/apps/web/test/lib/confirm.handler.test.ts
@@ -73,6 +73,7 @@ describe("confirmHandler", () => {
             location: "integrations:daily",
             attendees: [attendeeUser],
             responses: { name: attendeeUser.name, email: attendeeUser.email, notes: "Sensitive information" },
+            user: { id: organizer.id },
           },
         ],
         organizer,
diff --git a/packages/trpc/server/routers/viewer/bookings/confirm.handler.ts b/packages/trpc/server/routers/viewer/bookings/confirm.handler.ts
index 558d98d996..a170e1a730 100644
--- a/packages/trpc/server/routers/viewer/bookings/confirm.handler.ts
+++ b/packages/trpc/server/routers/viewer/bookings/confirm.handler.ts
@@ -45,7 +45,6 @@ type ConfirmOptions = {
 };
 
 export const confirmHandler = async ({ ctx, input }: ConfirmOptions) => {
-  const { user } = ctx;
   const {
     bookingId,
     recurringEventId,
@@ -139,12 +138,17 @@ export const confirmHandler = async ({ ctx, input }: ConfirmOptions) => {
     },
   });
 
+  const user = booking.user;
+  if (!user) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "Booking must have an organizer" });
+  }
+
   await checkIfUserIsAuthorizedToConfirmBooking({
     eventTypeId: booking.eventTypeId,
-    loggedInUserId: user.id,
+    loggedInUserId: ctx.user.id,
     teamId: booking.eventType?.teamId || booking.eventType?.parent?.teamId,
     bookingUserId: booking.userId,
-    userRole: user.role,
+    userRole: ctx.user.role,
   });
 
   // Do not move this before authorization check.