From ebf696a991ceea768225a9cda457aa27fc4f0928 Mon Sep 17 00:00:00 2001
From: lucadapice <ufficio@lucadapice.com>
Date: Fri, 19 Jun 2026 07:23:23 +0200
Subject: [PATCH] fix: remove console.log and improve type safety in tRPC
 routers (#29529)

- Remove two console.log statements dumping private hashed link data
  in update.handler.ts (fixes production data leakage)
- Replace console.log(e) with structured logger.error in
  getScheduleByEventTypeSlug.handler.ts
- Fix @ts-expect-error by typing reduce accumulator as
  Record<string, unknown> in update.handler.ts
- Narrow Prisma include to select in duplicate.handler.ts:
  team and webhooks now fetch only required fields

Fixes #29500

Co-authored-by: lucadapice <dapice.lc@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Bandhan Majumder <133476557+bandhan-majumder@users.noreply.github.com>
---
 .../schedule/getScheduleByEventTypeSlug.handler.ts   |  3 ++-
 .../viewer/eventTypes/heavy/duplicate.handler.ts     | 12 ++++++++++--
 .../viewer/eventTypes/heavy/update.handler.ts        |  5 +----
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/packages/trpc/server/routers/viewer/availability/schedule/getScheduleByEventTypeSlug.handler.ts b/packages/trpc/server/routers/viewer/availability/schedule/getScheduleByEventTypeSlug.handler.ts
index a279cbe48b..e93af6927f 100644
--- a/packages/trpc/server/routers/viewer/availability/schedule/getScheduleByEventTypeSlug.handler.ts
+++ b/packages/trpc/server/routers/viewer/availability/schedule/getScheduleByEventTypeSlug.handler.ts
@@ -1,5 +1,6 @@
 import type { PrismaClient } from "@calcom/prisma";
 
+import logger from "@calcom/lib/logger";
 import type { TrpcSessionUser } from "../../../../types";
 import { getHandler } from "./get.handler";
 import type { TGetByEventSlugInputSchema } from "./getScheduleByEventTypeSlug.schema";
@@ -57,7 +58,7 @@ export const getScheduleByEventSlugHandler = async ({ ctx, input }: GetOptions)
       },
     });
   } catch (e) {
-    console.log(e);
+    logger.error(e);
     return {
       id: -1,
       name: "No schedules found",
diff --git a/packages/trpc/server/routers/viewer/eventTypes/heavy/duplicate.handler.ts b/packages/trpc/server/routers/viewer/eventTypes/heavy/duplicate.handler.ts
index 25f01b0ac4..6782449c34 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/heavy/duplicate.handler.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/heavy/duplicate.handler.ts
@@ -39,8 +39,16 @@ export const duplicateHandler = async ({ ctx, input }: DuplicateOptions) => {
           },
         },
         hosts: true,
-        team: true,
-        webhooks: true,
+        team: {
+          select: {
+            id: true,
+          },
+        },
+        webhooks: {
+          select: {
+            id: true,
+          },
+        },
         hashedLink: true,
         destinationCalendar: true,
         calVideoSettings: {
diff --git a/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts b/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts
index eaec37ccd7..6d9b95d4ff 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts
@@ -608,11 +608,9 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => {
       break;
     }
   }
-  console.log("multiplePrivateLinks", multiplePrivateLinks);
   // Handle multiple private links using the service
   const privateLinksRepo = HashedLinkRepository.create();
   const connectedLinks = await privateLinksRepo.findLinksByEventTypeId(input.id);
-  console.log("connectedLinks", connectedLinks);
   const connectedMultiplePrivateLinks = connectedLinks.map((link) => link.link);
 
   const privateLinksService = new HashedLinkService();
@@ -724,9 +722,8 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => {
     });
   }
 
-  const updatedValues = Object.entries(data).reduce((acc, [key, value]) => {
+  const updatedValues = Object.entries(data).reduce<Record<string, unknown>>((acc, [key, value]) => {
     if (value !== undefined) {
-      // @ts-expect-error Element implicitly has any type
       acc[key] = value;
     }
     return acc;