fix: prevent 500 error when deleting calendar events with empty uid (#27500)

* fix: prevent 500 error when deleting calendar events with empty uid

This fix addresses a 500 error that occurs when trying to delete a Google
Calendar event with an empty event ID, which results in a malformed API URL.

Root cause: When calendar event creation fails or returns without an ID,
booking references were being created with empty uids. Later, when trying
to delete these events (e.g., during reschedule), the empty uid caused
a 404 from Google Calendar API which was then thrown as a 500 error.

Changes:
1. CalendarManager.deleteEvent: Added validation to skip deletion if
   bookingRefUid is empty, with appropriate error logging. This is a
   safety net for existing bad data in the database.

2. EventManager.create: Added filtering to exclude booking references
   with empty uids from being stored, with error logging to help
   diagnose the root cause of missing event IDs.

3. EventManager.updateLocation: Same filtering applied for consistency.

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* fix: revert EventManager filtering to preserve existing behavior

The test expects that booking references with empty uids are still created
when calendar event creation fails. This is intentional behavior to track
failed calendar syncs. The CalendarManager.deleteEvent fix handles the
deletion case gracefully by skipping the API call when uid is empty.

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* fix: throw ErrorWithCode instead of silently returning when bookingRefUid is empty

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* fix: validate uid before calling calendar.deleteEvent to prevent 500 error

- Add uid check in lastAttendeeDeleteBooking.ts before calling calendar.deleteEvent
- Add uid check in EventManager.updateAllCalendarEvents before calling calendar.deleteEvent
- Revert CalendarManager.deleteEvent changes (validation at call sites is the proper fix)

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* fix: add error logging safeguard in CalendarManager.deleteEvent for empty bookingRefUid

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* fix: move bookingRefUid check before getCalendar call

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* fix: prevent storing booking references with empty uid when calendar event creation fails

Root cause fix: Change the check from 'if (createdEvent)' to 'if (createdEvent.createdEvent)'
in createAllCalendarEvents to prevent failed calendar events from being added to results.

This prevents empty uids from being stored in the database in the first place, which
was causing 500 errors when trying to delete non-existent calendar events later.

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* test: update test to expect no calendar reference when calendar event creation fails

The root cause fix changes behavior so that failed calendar events no longer
create booking references with empty uids. This test now expects an empty
references array when calendar event creation fails, which is the correct
behavior that prevents 500 errors later when trying to delete non-existent
calendar events.

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* refactor: use createdEvent.success instead of createdEvent.createdEvent

Using success is more semantically clear since it explicitly checks the
success status rather than checking if the nested object exists.

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* refactor: use optional chaining for createdEvent?.success

Using optional chaining is safer in case createdEvent is somehow undefined.

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* revert: remove root cause fix to preserve backfilling script compatibility

The root cause fix (checking createdEvent?.success instead of createdEvent)
would break the backfilling script that relies on booking references with
empty uids to identify which bookings need backfilling.

This PR now only includes defensive checks to prevent 500 errors when
deleting calendar events with empty uids.

Co-Authored-By: benny@cal.com <sldisek783@gmail.com>

* revert

* fix

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: hbjORbj

packages/features/calendars/lib/CalendarManager.test.ts

@@ -1,17 +1,22 @@
 import { prisma } from "@calcom/prisma/__mocks__/prisma";
-
-import { describe, expect, it, vi, beforeEach } from "vitest";
-
+import type { CalendarEvent } from "@calcom/types/Calendar";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import {
-  getCalendarCredentials,
   deduplicateCredentialsBasedOnSelectedCalendars,
+  deleteEvent,
+  getCalendarCredentials,
   processEvent,
 } from "./CalendarManager";
+import { getCalendar } from "@calcom/app-store/_utils/getCalendar";
 
 vi.mock("@calcom/prisma", () => ({
   prisma,
 }));
 
+vi.mock("@calcom/app-store/_utils/getCalendar", () => ({
+  getCalendar: vi.fn(),
+}));
+
 vi.mock("@calcom/lib/constants", () => ({
   ORGANIZER_EMAIL_EXEMPT_DOMAINS: "",
   IS_PRODUCTION: false,
@@ -560,4 +565,37 @@ describe("CalendarManager tests", () => {
       expect(uniqueCredentials).toEqual(credentials);
     });
   });
+
+  describe("fn: deleteEvent", () => {
+    beforeEach(() => {
+      vi.clearAllMocks();
+    });
+
+    it("should return early when bookingRefUid is empty string", async () => {
+      vi.mocked(getCalendar).mockResolvedValue({ deleteEvent: vi.fn() } as any);
+
+      const credential = {
+        id: 1,
+        type: "google_calendar",
+        key: { access_token: "test_token" },
+        encryptedKey: null,
+        userId: 1,
+        user: { email: "test@example.com" },
+        teamId: null,
+        appId: "google-calendar",
+        invalid: false,
+        delegationCredentialId: null,
+        delegatedTo: null,
+      };
+
+      const result = await deleteEvent({
+        credential,
+        bookingRefUid: "",
+        event: buildCalendarEvent(),
+        externalCalendarId: "calendar-id",
+      });
+
+      expect(result).toEqual({});
+    });
+  });
 });

packages/features/calendars/lib/CalendarManager.ts

@@ -546,6 +546,16 @@ export const deleteEvent = async ({
   event: CalendarEvent;
   externalCalendarId?: string | null;
 }): Promise<unknown> => {
+  if (!bookingRefUid) {
+    log.error(
+      "deleteEvent failed - bookingRefUid is empty, skipping calendar deletion to prevent malformed API request",
+      safeStringify({
+        credential: getPiiFreeCredential(credential),
+        event: getPiiFreeCalendarEvent(event),
+      })
+    );
+    return Promise.resolve({});
+  }
   const calendar = await getCalendar(credential, "booking");
   log.debug(
     "Deleting calendar event",