feat: remove unused x-cal-timezone header and middleware matcher (#22398)

* feat: remove unused x-cal-timezone header and middleware matcher

- Remove x-cal-timezone header setting from middleware.ts
- Remove x-cal-timezone header setting from createNextApiHandler.ts
- Remove /api/trpc/:path* from middleware matcher
- Eliminates ~50M edge requests per month for unused functionality
- All timezone handling uses browser detection and localStorage instead

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>

* update POST_METHODS_ALLOWED_API_ROUTES

* test: remove api/trpc POST validation test

- Remove test for /api/trpc/book/event POST requests since /api/trpc/:path* was removed from middleware matcher
- Keep test for /api/auth/signup which is still processed by middleware

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: hbjORbj <sldisek783@gmail.com>

apps/web/middleware.test.ts

@@ -18,10 +18,6 @@ describe("Middleware - POST requests restriction", () => {
     const req1 = createRequest("/api/auth/signup", "POST");
     const res1 = checkPostMethod(req1);
     expect(res1).toBeNull();
-
-    const req2 = createRequest("/api/trpc/book/event", "POST");
-    const res2 = checkPostMethod(req2);
-    expect(res2).toBeNull();
   });
 
   it("should block POST requests to not-allowed app routes", async () => {

apps/web/middleware.ts

@@ -15,7 +15,7 @@ const safeGet = async <T = any>(key: string): Promise<T | undefined> => {
   }
 };
 
-export const POST_METHODS_ALLOWED_API_ROUTES = ["/api/auth/signup", "/api/trpc/"];
+export const POST_METHODS_ALLOWED_API_ROUTES = ["/api/auth/signup"];
 export function checkPostMethod(req: NextRequest) {
   const pathname = req.nextUrl.pathname;
   if (!POST_METHODS_ALLOWED_API_ROUTES.some((route) => pathname.startsWith(route)) && req.method === "POST") {
@@ -69,10 +69,6 @@ const middleware = async (req: NextRequest): Promise<NextResponse<unknown>> => {
     return responseWithHeaders({ url, res: routingFormRewriteResponse, req });
   }
 
-  if (url.pathname.startsWith("/api/trpc/")) {
-    requestHeaders.set("x-cal-timezone", req.headers.get("x-vercel-ip-timezone") ?? "");
-  }
-
   if (url.pathname.startsWith("/api/auth/signup")) {
     const isSignupDisabled = await safeGet<boolean>("isSignupDisabled");
     // If is in maintenance mode, point the url pathname to the maintenance page
@@ -178,7 +174,6 @@ export const config = {
     "/:path*/embed",
     // API routes
     "/api/auth/signup",
-    "/api/trpc/:path*",
   ],
 };
 

packages/trpc/server/createNextApiHandler.ts

@@ -1,5 +1,3 @@
-import { z } from "zod";
-
 import type { AnyRouter } from "@trpc/server";
 import { createNextApiHandler as _createNextApiHandler } from "@trpc/server/adapters/next";
 
@@ -43,9 +41,6 @@ export function createNextApiHandler(router: AnyRouter, isPublic = false, namesp
         headers: {},
       };
 
-      const timezone = z.string().safeParse(ctx.req?.headers["x-vercel-ip-timezone"]);
-      if (timezone.success) defaultHeaders.headers["x-cal-timezone"] = timezone.data;
-
       // We need all these conditions to be true to set cache headers
       if (!(isPublic && allOk && isQuery)) return defaultHeaders;