* chore: dedupe yarn.lock to remove duplicate package versions
- Consolidated 762 duplicate package versions
- Reduced yarn.lock from 51,211 lines (1.7MB) to 44,471 lines (1.5MB)
- Removed 7,071 lines (~200KB) of redundant dependency entries
- Major packages deduplicated include: resolve, semver, type-fest, commander, glob, lru-cache, dotenv, @babel/* packages, typescript, tslib, postcss, and many more
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: resolve type errors in managed event types and react-select components
- Add Zod-compatible versions of allManagedEventTypeProps and unlockedManagedEventTypeProps
that only include scalar fields (excludes Prisma relation fields)
- Update handleChildrenEventTypes.ts and queries.ts to use the new Zod-compatible props
- Fix react-select CSS type errors in Select.tsx files by using Object.assign
instead of spread operator to avoid TypeScript type inference issues
- Fix lint warning in updateNewTeamMemberEventTypes by using if statement
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: derive eventType parameter type from actual query result
Use Awaited<ReturnType<typeof getEventTypesToAddNewMembers>>[number] to ensure
type safety at call sites, avoiding Prisma type namespace mismatches.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: disable turbo cache for @calcom/trpc#build to prevent stale type errors
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: correct field names in API v1 validation schemas
- Remove timeZone from booking schema (field doesn't exist on Booking model)
- Remove bookingId from destination-calendar schema (field doesn't exist, only booking relation)
- Change avatar to avatarUrl in user schema (correct field name)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: use Object.assign for react-select styles to fix TypeScript spread type errors
The spread operator causes TypeScript to compute an incompatible type with
CSSObjectWithLabel due to the accentColor property. Using Object.assign
preserves the correct type inference.
Fixed files:
- FormEdit.tsx
- DestinationCalendarSelector.tsx (features and platform)
- TimezoneSelect.tsx
- ApiKeyDialogForm.tsx
- Select.tsx (features/form)
- WebhookForm.tsx
Also fixed pre-existing lint warnings:
- Constant truthiness in label assignment
- Unused variant parameter
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove extra fields from allManagedEventTypePropsForZod to match original behavior
The Zod-compatible version should only include scalar fields that were in the
original allManagedEventTypeProps. Removed instantMeetingScheduleId, profileId,
rrSegmentQueryValue, and assignRRMembersUsingSegment which were incorrectly
added and caused test failures by including extra fields in Prisma update payloads.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove access to fields not in Zod schema
- Remove unnecessary destructuring of profileId and instantMeetingScheduleId
from managedEventTypeValues in handleChildrenEventTypes.ts (these fields
are already sourced from other variables)
- Set rrSegmentQueryValue to undefined directly in queries.ts instead of
accessing it from managedEventTypeValues (not applicable for managed children)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add name property to mock credentials and revert turbo cache change
- Add name property to MockCredential type and factory function in
InstallAppButtonChild.test.tsx to match expected credentials type
- Revert turbo cache disable for @calcom/trpc#build (per review comment)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: revert API v1 validation changes and restore eslint comment
- Revert API v1 validation changes (booking.ts, destination-calendar.ts,
user.ts) since API v1 is deprecated and these could be breaking changes
- Restore eslint-disable comment for @typescript-eslint/no-empty-function
in Select.tsx that was accidentally removed
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add inputs to @calcom/trpc#build to properly invalidate cache
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: properly fix API v1 validation schemas for stricter zod 3.25.76
The yarn dedupe upgraded zod from 3.22.4 to 3.25.76, which has stricter
.pick() typing that now properly rejects picking non-existent fields.
Changes:
- user.ts: Pick avatarUrl (actual Prisma field) and extend with avatar
for API v1 backward compatibility
- booking.ts: Remove timeZone from pick (not a field on Booking model,
only exists in nested attendees/user objects)
- destination-calendar.ts: Remove bookingId from pick (not a field on
DestinationCalendar model)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove turbo.json inputs for @calcom/trpc#build to use cached artifacts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: use robust selector for react-select option in routing forms E2E test
The previous selector used .nth(1) which assumed the email text appeared
exactly twice in the DOM in a specific order. This broke when react-select
was upgraded from 5.7.2 to 5.8.0 via yarn dedupe.
The new approach waits for the react-select listbox to appear and clicks
the option within it, which is more robust against DOM structure changes.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Move InvalidAppCredentialBannerProps to packages/features/users/types/invalidAppCredentials.ts
- Add WorkflowListType to packages/features/ee/workflows/lib/types.ts
- Update server file imports to use new type locations
- Update React component imports to re-export from new locations
This fixes circular dependencies where server files were importing from React
component modules that import from @calcom/trpc, creating:
server -> component -> @calcom/trpc -> react -> server (circular)
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(auth): validate IdP authority before SAML account linking
Adds verification that SAML IdP is authoritative for the email domain
before allowing account conversion
* fix(auth): deny by default on missing SAML tenant + optimize membership query
- Block account conversion when tenant is missing (deny by default)
- Replace JOIN + ILIKE with two indexed lookups for O(1) performance
* refactor(auth): apply data minimization to security logs
* test
* update
* Refactor create-event-type.input.ts for slug handling
Removed unused import and transformation for slug.
* Remove slugify transformation from slug field
Removed slugify transformation from slug property.
* Remove slugify transformation from slug field
Removed slugify transformation from slug property.
* perf(googlecalendar): batch freebusy calls by delegation credential
- Group selectedCalendars by delegationCredentialId before making API calls
- Make one batched freebusy query per delegation credential group
- Reduces total API calls while respecting credential boundaries
- Maintains existing caching behavior per group
- Updated both getAvailability and getAvailabilityWithTimeZones methods
- Added groupCalendarsByDelegationCredential helper method
- Handles edge case when no calendars provided but fallbackToPrimary is true
- Fixed linting issue: replaced hasOwnProperty with 'in' operator
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test(googlecalendar): add test for delegation credential batching
- Verify calendars are grouped by delegationCredentialId
- Ensure exactly 3 API calls made for 3 delegation credential groups
- Confirm all busy times from different groups are properly returned
- Fix type-safety issues by replacing 'as any' with proper type constraints
- Fix ESLint warnings: unused variables and any types in mock functions
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix(googlecalendar): ensure fallback logic works with empty calendar groups
- Handle empty calendar groups by ensuring at least one iteration
- Add test for chunking groups larger than 50 calendars
- Verify all delegation credential batching logic works correctly
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix remaining type errors from merge conflict resolution
- Changed getCacheOrFetchAvailability to getFreeBusyData in getAvailabilityWithTimeZones
- Removed orphaned merge conflict marker in test file
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: reset test file to original PR version and update method name
- Reset CalendarService.test.ts to original PR version (0e9eb9e97a)
- Updated getCacheOrFetchAvailability to getFreeBusyData to match main branch
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: reset test file to main branch version
The original PR's test file had tests for caching features that have been
removed from main. Reset to main's version to fix type errors.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test(googlecalendar): add tests for delegation credential batching logic
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Revamp devin's implementation
* Remove comsoles.log
* fix(tests): update delegation credential batching tests to match reimplementation
- Remove tests for private methods that no longer exist (groupCalendarsByDelegationCredential, chunkArray)
- Update getAvailability test to verify calendar fetching without expecting multiple API calls per delegation credential
- Keep existing tests for fallback to primary calendar and non-google calendar handling
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Remove dead code
* improve documentation
* docs: add README explaining Google Calendar availability batching feature
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* docs: translate README to English
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* docs: move README to calendar-batch package with comprehensive documentation
- Remove README from googlecalendar lib (wrong location)
- Add comprehensive README to packages/features/calendar-batch/
- Document CalendarBatchService and CalendarBatchWrapper
- Explain how getCalendar() integrates with batching
- Include architecture, data model, and performance considerations
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: address cubic-dev-ai review comments
- Remove misleading comment from getCalendar.ts cache block
- Fix typo 'optmization' -> 'optimization' in comment
- Add comprehensive tests for CalendarBatchWrapper batching behavior
- Test separate calls for calendars without delegationCredentialId
- Test batching calendars with same delegationCredentialId
- Test chunking into groups of 50 for API limits
- Test mixed calendars handling
- Test fallbackToPrimary with empty array
- Test result flattening from batched calls
- Test pass-through methods delegation
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add shouldServeCache param to CalendarBatchWrapper and verify batching call count
- Fix CalendarBatchWrapper.getAvailability signature to match Calendar interface (add shouldServeCache param)
- Update CalendarBatchWrapper tests to pass shouldServeCache parameter
- Add integration test in CalendarService.test.ts that verifies CalendarBatchWrapper makes separate API calls for different delegationCredentialIds (call count assertion)
- This fixes the getCalendarsEvents test failures caused by signature mismatch
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Improve CalendarBatchImplementation
* test: add shouldServeCache forwarding and order-independent batching verification tests
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test: make CalendarBatchWrapper tests order-independent
Refactored tests to avoid relying on Promise.all execution order:
- 'should make separate calls for calendars without delegationCredentialId'
now uses set comparison instead of toHaveBeenNthCalledWith
- 'should batch calendars with the same delegationCredentialId together'
now finds calls by delegation credential instead of call order
This addresses Sean's review comment about potential flakiness due to
Promise.all not guaranteeing execution order of parallel promises.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Remove hardcoded ID
* test: add comprehensive tests for resolveCalendarServeStrategy
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* feat: use Promise.allSettled for partial failure handling in CalendarBatchWrapper
- Changed Promise.all to Promise.allSettled in getAvailability and getAvailabilityWithTimeZones
- Returns partial results when some batches fail instead of failing entirely
- Logs warnings for failed batches with error details
- Added tests for partial failure scenarios
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* test: add comprehensive tests for getAvailabilityWithTimeZones
- Added batching behavior tests (separate calls, batching by delegationCredentialId, chunking)
- Added partial failure handling tests (partial results, all fail, no throw)
- Added edge case test for underlying calendar not implementing the method
- Total: 24 tests now covering both getAvailability and getAvailabilityWithTimeZones
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add required serviceAccountKey fields to delegatedTo mock objects
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add missing client_id and private_key to serviceAccountKey mock
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: keith@cal.com <keithwillcode@gmail.com>
* fix: split confirm-emails e2e test to authenticate as booking owner
The test was flaky because it authenticated as an admin user (authEmail)
but created bookings for different users (emailsEnabledSetup.user and
emailsDisabledSetup.user). When confirming/declining bookings, the
ApiAuthGuard + BookingUidGuard rejected requests with 401 because the
authenticated user wasn't the booking owner.
The fix splits the test into two separate describe blocks, each with its
own app instance that authenticates as the actual booking owner. This
ensures the authenticated user always matches the booking owner.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: add unauthenticated app for attendee reschedule test
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: use real API key authentication instead of withApiAuth mock
- Replace withApiAuth mock with real API key authentication using ApiKeysRepositoryFixture
- This avoids Passport strategy registration conflicts between test suites
- For attendee reschedule test, use unauthenticated request (no auth header) since endpoint uses OptionalApiAuthGuard
- Remove separate unauthenticatedApp instance as it's no longer needed
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix flakes
* update
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Use previous header for android
* use activity instead of ternary statements
* update layout to use header buttons in availability screen
* fix styles and add context menu
* add set as default action
---------
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
Booking confirmation pages contain PII (names, emails, phone numbers)
and should not be indexed by search engines
- Add robots noindex to /booking/[uid]/page.tsx
- Add robots noindex to /booking/[uid]/embed/page.tsx
Follows same pattern as not-found.tsx
- Add list-event-types.mdx with Quick start, Props, Demo video, and Combining with EventTypeSettings sections
- Add list_event_types_light.png screenshot
- Update mint.json navigation to include new page
* feat: add environment-based favicons (prod vs dev)
- Add cal-prod.png (dark/gray) favicon for production environments
- Add cal-dev.png (red) favicon for development/localhost environments
- Update FAVICON_16 and FAVICON_32 constants to switch based on IS_PRODUCTION
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add higher resolution icons for all icon types (apple-touch, android-chrome, mstile)
- Add 180x180 apple-touch-icon for prod and dev
- Add 150x150 mstile icons for prod and dev
- Add 192x192 and 256x256 android-chrome icons for prod and dev
- Update all icon constants to use IS_PRODUCTION switching
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: simplify favicon to single new design
- Remove environment-based favicon switching
- Update all icon files with new Cal favicon design
- Remove dev/prod icon variants
- Update constants to use static icon paths
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add favicon.ico with new Cal favicon design
Co-Authored-By: peer@cal.com <peer@cal.com>
* chore: update favicon icons with final design
Co-Authored-By: peer@cal.com <peer@cal.com>
* chore: update favicon icons with final design v3
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add name property to delegation credentials for type compatibility
The MultiDisconnectIntegration component expects credentials with user.name property,
but delegation credentials only had user.email. This caused a type mismatch when
spreading both credential types together in appCredentialsByType handler.
Added name: null to the delegation credentials user object to ensure type compatibility.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update getUserDisplayName to check value instead of just property existence
The narrowing logic was causing TypeScript to infer 'never' type because
after adding name property to delegation credentials, the 'name in user'
check always passes. Now we check if name has a truthy value before using it.
Also fixed lint warning by using optional chaining for onSuccess callback.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add explicit return type and typeof checks to getUserDisplayName
The function now has an explicit return type of string | null and uses
typeof checks to ensure proper type narrowing. This prevents TypeScript
from inferring a wider return type that includes {} when the user object
has properties with non-string types.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test: update delegation credential test to include name property
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: flaky E2E tests and refactor
* fix
* fix: week limit tests to use same week for pre-booking and UI booking
The week limit tests were failing because the pre-booking was created in
week 1 but the UI booking was done in week 2. Since weekly limits are
per-week, the pre-booking didn't count toward the limit in week 2.
Fixed by keeping both bookings in the same week:
- Pre-booking on Monday (satisfies daily limit, counts toward weekly)
- UI booking on Tuesday (same week, hits weekly limit of 2)
This ensures the weekly limit is properly tested and all remaining
weekdays in the week get blocked after hitting the limit.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(companion): separate dev and prod build scripts to prevent localhost in production
- Add ext:build-dev and ext:build-prod scripts with clear separation
- Add BUILD_FOR_STORE flag to force production URL in store builds
- Add visual build indicators (store / dev) for clarity
- Prevent EXPO_PUBLIC_COMPANION_DEV_URL from leaking into production builds
* update commands to work for ci
* update version
---------
Co-authored-by: Volnei Munhoz <volnei@cal.com>
- Add CalComPageStatus handling in NotFound and ErrorPage components using useLayoutEffect
- Remove redundant pageStatus logic from PageWrapperAppDir.tsx since App Router error/notFound pages set status themselves
- Refactor embed-iframe.ts: split checkPageStatusAndHandleError into hasPageError() and handlePageError()
- Add page status checks before firing linkReady to catch errors set after initialization
- Ensures linkFailed event fires correctly for all error status codes in embed scenarios
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(booking-audit): extract core audit system changes from PR 25125
This PR extracts core audit infrastructure changes without integration changes:
1. New action services introduced:
- SeatBookedAuditActionService
- SeatRescheduledAuditActionService
2. Simplification of ActionService interface:
- Streamlined IAuditActionService interface
- Reduced TypeScript burden with cleaner type definitions
3. ActionSource support:
- Added BookingAuditSource enum (API_V1, API_V2, WEBAPP, WEBHOOK, UNKNOWN)
- Added source and operationId fields to BookingAudit model
4. New AuditAction types:
- SEAT_BOOKED
- SEAT_RESCHEDULED
- APP actor type
5. New BookingAuditAccessService:
- Permission-based access control for audit logs
- Added readTeamAuditLogs and readOrgAuditLogs permissions
6. Fixes in the logs viewer flow:
- Enhanced BookingAuditViewerService with improved filtering
- Local AttendeeRepository for actor enrichment
Changes are contained within packages/features/booking-audit with minimal
outside changes (permission registry only).
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor(booking-audit): streamline action handling and enhance localization
- Replaced action icon retrieval with a mapping object for improved clarity and performance.
- Introduced constants for actor role labels to simplify role retrieval.
- Added new localization strings for audit log permission errors and organization requirements.
- Updated various service and repository interfaces to enhance type safety and clarity.
- Removed deprecated architecture documentation and adjusted related imports for consistency.
These changes aim to improve code maintainability and user experience in the booking audit system.
* fix(booking-audit): enhance actor role localization and operation ID tracking
- Updated actor role labels in the booking logs view to use lowercase for consistency.
- Improved localization by wrapping actor role display in a translation function.
- Added operationId field to audit logs for better correlation of actions across multiple bookings.
- Enhanced BookingAuditViewerService to include operationId in enriched audit logs.
- Updated integration tests to verify consistent operationId across related audit logs.
These changes aim to improve localization accuracy and facilitate better tracking of user actions in the booking audit system.
* feat: integrate credential repository and enhance app actor handling
- Added CredentialRepository to manage app credentials, including a method to find credentials by ID.
- Updated BookingAudit system to support app actors identified by credential ID, improving actor attribution and audit clarity.
- Introduced a new utility function to map app slugs to display names, enhancing the user experience in audit logs.
- Modified relevant interfaces and types to accommodate the new credential handling and app actor structure.
- Enhanced BookingAuditViewerService to display app names based on credentials, ensuring accurate representation in audit logs.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: allow required check to pass when E2E tests are skipped due to missing label
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* revert: remove unnecessary integration-test condition change
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* chore: trigger fresh CI run
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* all should pass to allow merge
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add enabled column to UserFeatures and TeamFeatures for tri-state semantics
- Add enabled Boolean column to UserFeatures model with default true
- Add enabled Boolean column to TeamFeatures model with default true
- Update FeaturesRepository to use tri-state semantics:
- enabled=true: feature is explicitly enabled
- enabled=false: feature is explicitly disabled (blocks inheritance)
- No row: inherit from team/org level
- Update SQL queries to check enabled=true for feature access
- Add enableFeatureForTeam method to interface and implementation
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update comments
* add integration tests
* add more test
* select enabled only
* no @default(true)
* fix types and tests
* add missing enabled
* add missing enabled
* rename enableFeatureForTeam to updateFeatureForTeam and support FeatureState
* refactor: rename updateFeatureForTeam to setTeamFeatureState
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix integration test
* fix tests
* add more tests
* add missing enabled
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* add webhook version schema
* version the code
* update version from numeric to date val
* migration
* update schema and build factory
* update string
* move version picker
* tooltip instead of infobadge
* --
* fix type
* --
* fix type
* fix type
* --
* fix messed up merge
* improvements to payloadfactory
* extract version off of DB and instead keep it in IWebhookRepository
* fix webhookform
* fix type safety and routing ambiguity
* scalable with easier factory extensions and base definition
* fix types
* --
* --
* clean up prisma/client type imports
* fix
* type fix
* type fix
* cleanup
* add tests and registry changes
* unintended file inclusion
* type-fix
* select in repo
* --
* explicit return type
* --
* fix type
* fixes
* feedback 1
* feedback 2
* use enum instead of string
* fixes
* Isolate companion build
* Fix typo
* Update .github/workflows/pr.yml
* Improve branch protection
* integration tests missing
* fix typo
* fix to only have required
* fix to only have required
* fix to only have required
* adjust to keep as before
---------
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
