.ics file includes complete fields with a stable UID across modifications
Why it matters
Calendar events that arrive without a stable UID create duplicate entries on every resend — a customer's calendar fills with phantom copies of the same appointment every time the booking system regenerates an invite. RFC 5545 mandates a persistent, globally unique UID for each VEVENT precisely to enable clients to match updates to existing events rather than creating new ones. Missing mandatory fields (ORGANIZER, DTEND, ATTENDEE) causes some calendar clients to silently reject the invite. A UID generated with uuidv4() on each call guarantees that every invite opens as a new event, making reschedules and cancellations invisible to the customer's calendar app.
Severity rationale
High because a randomly generated or absent UID causes calendar clients to treat every invite as a new event, making updates and cancellations invisible and filling customer calendars with duplicate entries.
Remediation
Use the ics library in src/lib/calendar.ts and derive the UID from the booking ID — never generate it with uuidv4() inside the generation function. Include all 6 mandatory VEVENT fields plus ATTENDEE, ORGANIZER, LOCATION, and METHOD:
import { createEvent } from 'ics'
export async function generateBookingICS(booking: Booking, host: User) {
const event = {
uid: `${booking.id}@yourdomain.com`, // Stable — never random
title: `Appointment: ${booking.service_name}`,
start: parseICSDate(booking.start_time),
end: parseICSDate(booking.end_time),
description: booking.notes ?? '',
organizer: { name: host.name, email: host.email },
attendees: [{ name: booking.customer_name, email: booking.customer_email, rsvp: true }],
location: booking.location ?? '',
method: 'PUBLISH',
}
return createEvent(event)
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Booking Notifications & Reminders Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · RFC5545 — Internet Calendaring and Scheduling Core Object Specification (iCalendar)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from booking-notifications-reminders·automated