Day.js requires the 'utc' plugin to be loaded before the 'timezone'
plugin to correctly apply timezone offsets during formatting.
This fixes an issue where the Bookings Dashboard displayed UTC time
but labeled it with the user's timezone.
Fixes#28193
Co-authored-by: Harshith Kumar <mharshithkumar6@gmail.com>
Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com>
The deleteDomain function had a 'return false' statement after
'return isDomainDeleted && isDnsRecordDeleted' which could never
be reached.
Co-authored-by: Harshith Kumar <mharshithkumar6@gmail.com>
PostgreSQL 18+ stores data in /var/lib/postgresql/18/main instead of
/var/lib/postgresql/data. The volume mount needs to be at /var/lib/postgresql
to capture the new directory structure.
Fixes#28281
The 'should render the /teams page' test was failing because PR #27650
introduced a showHeader flag that hides the 'Teams' heading for users
without teams. Other tests in the file were updated to create users
with hasTeam: true, but this test was missed.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: use path.sep in redirect-apps template exclusion for Windows compatibility
* fix: normalize backslashes instead of using path.sep
---------
Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com>
* feat: add booking attendees endpoint to API v2
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* feat: add rate limiting to booking attendees endpoint
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* refactor: simplify attendees output to id, bookingId, name, email, timeZone
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* test: add E2E tests for booking attendees endpoint
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* chore: update bookings repository
* fixup: add pbac guards and update service logic
* chore: update openapi spec
* test: add rate limiting E2E test for booking attendees endpoint
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fix: tests
* fix: return 404 instead of 403 for non-existent booking in BookingPbacGuard
The BookingPbacGuard was returning 403 (Forbidden) for non-existent bookings
because doesUserIdHaveAccessToBooking returns false when a booking doesn't
exist, which the guard treated as an access denial.
Added an explicit booking existence check in the guard before the access
check, so non-existent bookings now correctly return 404 (Not Found) as
documented in the PR description.
Updated the E2E test to expect 404 for non-existent booking UIDs.
Issue identified by cubic.
Co-Authored-By: unknown <>
* fixup
* fix: return 404 instead of 403 for non-existent booking in attendees endpoint
BookingPbacGuard now checks booking existence before the access check,
returning 404 (Not Found) instead of 403 (Forbidden) for non-existent
booking UIDs. Updated the E2E test assertion and description to match.
Issue identified by cubic (confidence 9/10).
Co-Authored-By: unknown <>
* chore: implement PR feedback
* chore: update tests
* fixup
* chore: update endpoint decsription
* feat: endpoint to retrieve specific attendee
* chore: update e2e tests
* chore: implement cubic feedback
* fix: update test to expect 403 for non-existent booking UID (BookingPbacGuard behavior)
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fix: merge conflicts
* feat: endpoint to get attendees
* chore: update findByUidIncludeEventTypeAttendeesAndUser method
* chore: implement PR feedback
* fix: e2e tests
* chore: update e2e tests
* fixup fixup
* fix: remove phoneNumber assertion since it's optional and not provided in test
* chore: implement PR feedback
* fix: keep the same output shape for get attendees and get attendee endpoint
* chore: update openapi spec
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: bot_apk <apk@cognition.ai>
* fix: trigger lingo.dev by removing duplicate value
* under progress
* wow this worked
* migrate schema
* fix types
* fix import for google login
* Add onboarding tests for Azure (Microsoft sign up)
* add comments back
* fix failing test
* fix: update Outlook login configuration and improve type safety in authentication adapter
- Set OUTLOOK_LOGIN_ENABLED to false in .env.example
- Refactor getServerSideProps to directly use samlTenantID and samlProductID
- Update linkAccount method in next-auth-custom-adapter for better type handling
- Remove redundant comment in next-auth-options related to Azure AD email verification
* remove log
* remove debug log from signin callback in next-auth options
* fixup
* chore: standardize naming
* chore: add primary calendar for outlook, verify email and auto link org for outlook
* chore: helper fns
* chore: implement cubic feedback
* cleanup
* chore: implement cubic feedback again
* WIP design#
* feat: login design
* fix: map identity provider names correctly
* 32px of mt
* fix: login UI
* fix: type check
* fix: fix type check again
* chore: update OAuth login tests
* fixup
* fix: bad import
* chore: update tests
* fixup
* fix: locales test
* chore: implement PR feedback and fix minor issues
* fix: revert token spreading change
* fix: merge conflicts
* chore: revert signup view changes
* fixup: bring back reverted changes because of merge conflicts
* fix: disable email input when microsoft sign in is in progress
* chore: implement cubic feedback
* cleanup: unused variables
* fix: address Cubic AI review feedback (confidence >= 9/10)
- Remove userId (PII) from log payloads in updateProfilePhotoMicrosoft.ts
- Replace text selectors with data-testid in locale.e2e.ts and oauth-provider.e2e.ts
- Restore callbackUrl redirect parameter in signup link in login-view.tsx
- Add data-testid='login-subtitle' to login page subtitle element
Co-Authored-By: unknown <>
* fix: use empty alt for decorative icon images in login view
MicrosoftIcon and GoogleIcon are decorative (adjacent to text labels),
so they should have empty alt attributes per accessibility best practices.
Co-Authored-By: unknown <>
* chore: implement cubic feedback
* cleanup
* fixup
* chore: implement PR feedback
* chore: implement feedback
* fix: address PR review feedback - type safety and centralize constants
- Replace non-null assertions (!) with proper null checks for OUTLOOK_CLIENT_ID/SECRET
- Replace `as any` casting with `Record<string, unknown>` for OAuth profile claims
- Remove non-null assertion on account.access_token by adding conditional check
- Centralize Outlook env constants in @calcom/lib/constants alongside MICROSOFT_CALENDAR_SCOPES
- Add explanatory comment for getNextAuthProviderName usage in get.handler.ts
Co-Authored-By: unknown <>
* Revert "fix: address PR review feedback - type safety and centralize constants"
This reverts commit 91ace141e6a28a23deea5897f7f9d6ad80319d84.
* chore: implement feedback
* chore: cleanup
* chore: implement feedback
* fix: merge conflicts
* fix: revert formatting-only changes in packages/lib/constants.ts
Co-Authored-By: unknown <>
* fix: revert IdentityProvider enum location change in schema.prisma
Co-Authored-By: unknown <>
* chore: implement more PR feedback
* fix: restore database-derived profileId from determineProfile in OAuth JWT
The profileId regression was identified by Cubic AI (confidence 9/10).
Previously, determineProfile's returned id was used to set profileId in the
JWT via 'profileResult.id ?? token.profileId ?? null'. A recent refactor
changed this to 'token.profileId ?? null', which drops the database-derived
profile ID. On first OAuth login (or when profile switcher is disabled),
token.profileId is likely null, so profileId would incorrectly be set to
null even though determineProfile returned a valid profile with an id.
This commit restores the correct priority chain:
visitorProfileId ?? token.profileId ?? null
Co-Authored-By: bot_apk <apk@cognition.ai>
* refactor: revert pure formatting and import reordering changes
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fix: normalize determineProfile return type to use consistent 'id' field
The determineProfile function returned a union type where one branch used
'id' and the other used 'profileId'. This caused TS2339 when destructuring
'id' from the result. Normalize the token.upId branch to also return 'id'
(mapped from token.profileId) so the return type is consistent.
Co-Authored-By: bot_apk <apk@cognition.ai>
* chore: add tests
* reveret: profileId changes should be in a separate PR
* fix: avoid logging entire existingUser object in OAuth JWT callback
Revert to logging only { userId, upId } instead of the full existingUser
object, which contains PII (email, name, identity provider details).
This restores the previous safe logging pattern.
Co-Authored-By: bot_apk <apk@cognition.ai>
* chore: remove profileId related tests
---------
Co-authored-by: amrit <iamamrit27@gmail.com>
Co-authored-by: Devanshu Sharma <devanshusharma658@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Sean Brydon <sean@cal.com>
Co-authored-by: bot_apk <apk@cognition.ai>
* chore: pull coss ui
* refactor: migrate webhooks page to coss/ui components
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* refactor: migrate CreateNewWebhookButton to coss/ui Menu components
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* refactor: adjust CreateNewWebhookButton variant and align based on context
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* feat(coss-ui): add list-item components and refactor WebhookListItem to use them
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* refactor(webhooks): match prototype – remove docs link, flatten list, show user in item
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* update css vars
* refactor(webhooks): migrate WebhookForm.tsx to coss-ui components
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix(webhooks): add FormProvider for useFormContext in child components
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* restore prev form
* swap form components
* mc
* use coss button everywhere
* fix ts errors
* refactor(webhooks): replace SettingsHeaderWithBackButton with coss-ui CardFrame in edit/new views
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* refactor(webhooks): split into two CardFrames with Card/CardPanel
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* refactor(webhooks): wrap WebhookTestDisclosure in Card/CardPanel
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* refactor(webhooks): migrate WebhookTestDisclosure to coss-ui CardFrame
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* mc
* mc
* refactor(webhooks): update skeletons to use coss-ui CardFrame pattern
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* mc
* refactor(webhooks): improve new webhook skeleton to match actual UI layout
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* imrpove form skeleton
* optimise card header
* refactor: improve base ui react-hook-form compatibility
* update string
* use coss ui alert dialog
* use coss toast
* feat(webhooks): add user filter to webhooks list
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix(webhooks): resolve lint warnings in filter component
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* refactor(webhooks): filter after new button, icon+badge only
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* improve switch
* remove unneeded toast
* refactor(webhooks): enhance WebhooksFilter component with anchor reference
* mc
* fix(webhooks): update Switch component to use checked prop instead of defaultChecked
* fix(webhooks): prevent Suspense boundary error on webhook edit save
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix(webhooks): add optimistic state for Switch toggle in WebhookListItem
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix(webhooks): disable switch during pending mutation to prevent rapid-toggle race
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix(webhooks): guard toggle with isPending check instead of disabled prop
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix toggle
* mc
* mc
* fix(webhooks): navigate before revalidation to prevent Suspense re-suspension
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* mc
* fix(webhooks): use render prop for Cancel button navigation
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix(webhooks): simplify Cancel button with explicit conditional rendering
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* fix(webhooks): sort list by id to prevent resorting on toggle
Co-Authored-By: pasquale@cal.com <pasquale@cal.com>
* mc
* mc
* show filter only if user is >1
* refactor(webhooks): move ListItem components to shared directory
* feat: reintroduce avatars
* remove unneeded translations
* remove unneeded useMemo
* add clickable +n badge
* mc
* mc
* add tooltips and docs link
* animated tooltips
* refactor(WebhookForm): replace hardcoded text with translation keys for better localization
* refactor(WebhookListItem): manage active state with useEffect and improve toggle error handling
* mc
* update toast position + re-pull coss ui components
* refactor: rename onEditWebhook to onEditWebhookAction to prevent warnings
* feat: enhance WebhookListItem with edit link and mobile support
* mc
* remove unneded component
* refactor: simplify webhook toggle logic in WebhookListItem component
* fix: update edit link logic in WebhookListItem and add editHref to webhooks-view
* wip
* feat: implement webhook version selection in WebhookForm
* update list item
* fix issue with delete button perrmission
* sort webhooks by ID in WebhooksList component
* mc
* refactor: enhance Webhook components with improved header and skeleton loading logic
* refactor: rename files for clarity
* display the edit button
* re-pull coss ui components
* fix ts error
* refactor: simplify permission checks in WebhookListItem component
* improve skeletons
* fix ts errors
* rename onEditWebhook
* fix: update SheetContent variant in ActiveUserBreakdown component
* fix e2e
* feat: add data-testid attribute to confirmation button in DeleteWebhookDialog
* remove unnecessary file
* refactor: allow passing the aria-label attribute to the button that removes a chip
* refactor: rename onEditWebhook to onEditWebhookAction to prevent warnings
* refactor: add webhook version select to event-type dialog and extract shared WebhookVersionCTA component
Co-Authored-By: pasquale@cal.com <pasqualevitiello@gmail.com>
* fix: restore toast notification on webhook toggle in event-types tab
Co-Authored-By: pasquale@cal.com <pasqualevitiello@gmail.com>
* implement the coss ui dialog
* refactor(webhooks): use shared WebhookListItem in event type tab and coss-ui Dialog
* remove unneeded lastItem prop
* re-pull coss ui components
* Merge remote-tracking branch 'origin/main' into style/improve-webhooks
Co-Authored-By: unknown <>
* refactor: extract AppHeader component and move page title outside CardFrame
Co-Authored-By: unknown <>
* refactor: show user header for every webhook group and remove CardFrame wrapper
Co-Authored-By: unknown <>
* fix: wrap each user webhook group in CardFrame with CardFrameHeader
Co-Authored-By: unknown <>
* fix: add dashed border to Empty state matching coss prototype
Co-Authored-By: unknown <>
* mc
* fix: only show New button in header when webhooks exist
Co-Authored-By: unknown <>
* refactor: move page title/description/back button out of CardFrame on new/edit webhook pages
Co-Authored-By: unknown <>
* refactor: render webhook form header outside flex-col gap wrapper
Co-Authored-By: unknown <>
* refactor: move header outside div wrapper in webhook form skeleton
Co-Authored-By: unknown <>
* mc
* skeleton improvements
* refactor: move AppHeader component to @coss/ui/shared/app-header
Co-Authored-By: unknown <>
* fix the webhook dialog on event-types settings
* make the webhook clickable for event types
* remove hardcoded string
---------
Co-authored-by: pasqualevitiello <pasqualevitiello@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: pasquale@cal.com <pasquale@cal.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
The recent upgrade to PostgreSQL 18 in CI (commit 27515d4) caused the
Setup Database job to fail because the runner's host pg_dump (v16) refuses
to dump a Postgres 18 server.
Replace tj-actions/pg-dump and tj-actions/pg-restore with docker run
commands using the postgres:18 image, ensuring the client version always
matches the server. This aligns with the fix already applied in the
internal cal repo.
* fix: add phone mask overrides for Argentina and Finland to prevent digit truncation
Co-Authored-By: susan <susan@cal.com>
* refactor: extract CUSTOM_PHONE_MASKS to shared module to avoid duplication
Address review feedback from cubic-dev-ai: extract CUSTOM_PHONE_MASKS
into a shared phone-masks.ts module so both PhoneInput.tsx and the test
file import from the same source of truth instead of duplicating the
masks. Also fix non-null assertion lint warning in the test file.
Original PR by devin-ai-integration[bot].
Co-Authored-By: bot_apk <apk@cognition.ai>
* fix: move custom message to expect() for toBeGreaterThanOrEqual type compatibility
toBeGreaterThanOrEqual only accepts 1 argument. Move the custom error
message to the expect() call instead.
Co-Authored-By: bot_apk <apk@cognition.ai>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: susan <susan@cal.com>
Co-authored-by: bot_apk <apk@cognition.ai>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* fix: admin wizard crash and prisma enum generator path resolution
1. Fix TypeError in WizardForm when license step is skipped:
- defaultStep was set to 3 (APPS) but only 2 steps existed when
hasValidLicense=true, causing steps[2] to be undefined
- Removed redundant double onNext() call in AdminUser onSuccess
- Extracted hasLicenseStep variable for clarity
2. Fix prisma enum generator not being directory-safe:
- Created run-enum-generator.js wrapper resolved by Prisma relative
to schema directory, so npx prisma commands work from any directory
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: use bin entry for prisma enum generator path resolution
Changed provider from './run-enum-generator.js' (which Prisma doesn't
resolve relative to schema dir) to 'prisma-enum-generator' bin registered
in package.json. This ensures the generator is found via PATH regardless
of CWD.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* chore: Also add new bin to the lockfile
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: susan <susan@cal.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
- Add await to unawaited bookingSeatsRepositoryFixture.create calls
- Clean up leftover selected slots before seated and variable length tests
- Add deleteAllByUserId method to SelectedSlotRepositoryFixture
The flakiness was caused by reserved slots from earlier tests leaking
into subsequent test groups. The availability calculation fetches all
unexpired reserved slots by userId (not eventTypeId), so non-seat
reserved slots from regular event type tests appeared as busy times
when computing slots for seated and variable length event types.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
* fix: strip avatar and profile from children payload in managed event type updates
When assigning users to managed event types with ~85+ users, the request
body exceeds the 1MB server limit. The root cause is that the full
ChildrenEventType objects (including avatar, profile, username, membership)
are sent in the update payload, even though the server schema (childSchema)
only needs owner.{id, name, email, eventTypeSlugs} and hidden.
Avatar data can be particularly large when stored as base64 data URLs.
With 85 users each having ~10KB+ avatars, the payload easily exceeds 1MB.
This fix strips the children array down to only server-required fields
before sending the mutation, while keeping the full data in form state
for UI display purposes.
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* refactor: extract stripChildrenForPayload into shared utility instead of duplicating in test
Addresses Cubic AI review feedback: the test file was duplicating the
stripping logic instead of importing it from production code.
- Extracted stripChildrenForPayload() into childrenEventType.ts
- Updated useEventTypeForm.ts to import and use the shared function
- Updated test file to import from production code instead of defining its own copy
Co-Authored-By: bot_apk <apk@cognition.ai>
* fix: remove unused @ts-expect-error directive in useEventTypeForm
Co-Authored-By: bot_apk <apk@cognition.ai>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: bot_apk <apk@cognition.ai>
* feat: calendar cache and sync - wip
* Add env.example
* refactor on CalendarCacheEventService
* remove test console.log
* Fix type checks errors
* chore: remove pt comment
* add route.ts
* chore: fix tests
* Improve cache impl
* chore: update recurring event id
* chore: small improvements
* calendar cache improvements
* Fix remove dynamic imports
* Add cleanup stale cache
* Fix tests
* add event update
* type fixes
* feat: add comprehensive tests for new calendar subscription API routes
- Add tests for /api/cron/calendar-subscriptions-cleanup route (9 tests)
- Add tests for /api/cron/calendar-subscriptions route (10 tests)
- Add tests for /api/webhooks/calendar-subscription/[provider] route (11 tests)
- Add missing feature flags for calendar-subscription-cache and calendar-subscription-sync
- All 30 tests pass with comprehensive coverage of authentication, feature flags, error handling, and service instantiation
Tests cover:
- Authentication scenarios (API key validation, Bearer tokens, query parameters)
- Feature flag combinations (cache/sync enabled/disabled states)
- Success and error handling (including non-Error exceptions)
- Service instantiation with proper dependency injection
- Provider validation for webhook endpoints
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* feat: add comprehensive tests for calendar subscription services, repositories, and adapters
- Add unit tests for CalendarSubscriptionService with subscription, webhook, and event processing
- Add unit tests for CalendarCacheEventService with cache operations and cleanup
- Add unit tests for CalendarSyncService with Cal.com event filtering and booking operations
- Add unit tests for CalendarCacheEventRepository with CRUD operations
- Add unit tests for SelectedCalendarRepository with calendar selection management
- Add unit tests for GoogleCalendarSubscriptionAdapter with subscription and event fetching
- Add unit tests for Office365CalendarSubscriptionAdapter with placeholder implementation
- Add unit tests for AdaptersFactory with provider management and adapter creation
- Fix lint issues by removing explicit 'any' type casting and unused variables
- All tests follow Cal.com conventions using Vitest framework with proper mocking
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: improve calendar-subscriptions-cleanup test performance by adding missing mocks
- Add comprehensive mocks for defaultResponderForAppDir, logger, performance monitoring, and Sentry
- Fix slow test execution (933ms -> <100ms) caused by missing dependency mocks
- Ensure consistent test performance across different environments
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Fix tests
* Fix tests
* type fix
* Fix coderabbit comments
* Fix types
* Fix test
* Update apps/web/app/api/cron/calendar-subscriptions/route.ts
Co-authored-by: Alex van Andel <me@alexvanandel.com>
* Fixes by first review
* feat: add database migrations for calendar cache and sync fields
- Add CalendarCacheEventStatus enum with confirmed, tentative, cancelled values
- Add new fields to SelectedCalendar: channelId, channelKind, channelResourceId, channelResourceUri, channelExpiration, syncSubscribedAt, syncToken, syncedAt, syncErrorAt, syncErrorCount
- Create CalendarCacheEvent table with foreign key to SelectedCalendar
- Add necessary indexes and constraints for performance and data integrity
Fixes database schema issues causing e2e test failures with 'column does not exist' errors.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* only google-calendar for now
* docs: add Calendar Cache and Sync feature documentation
- Add comprehensive feature overview and motivation
- Document feature flags with SQL examples
- Include SQL examples for enabling features for users and teams
- Reference technical documentation files
Addresses PR #23876 documentation requirements
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* docs: update calendar subscription README with comprehensive documentation
- Undo incorrect changes to main README.md
- Update packages/features/calendar-subscription/README.md with:
- Feature overview and motivation
- Environment variables section
- Complete feature flags documentation with SQL examples
- SQL examples for enabling features for users and teams
- Detailed architecture documentation
Addresses PR #23876 documentation requirements
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix docs
* Fix test to available calendars
* Fix test to available calendars
* add migration and sync boilerplate
* fix typo
* remove double log
* sync boilerplate
* remove console.log
* only subscribe for google calendar
* adjust for 3 months fetch
* only subscribe for teams that have feature enabled
* adjust tests
* chore: safe increment error count
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* calendar sync
* test: add comprehensive tests for CalendarSyncService
- Add comprehensive test coverage for CalendarSyncService methods
- Test handleEvents, cancelBooking, and rescheduleBooking functionality
- Cover edge cases like missing UIDs, malformed UIDs, and error handling
- Fix dynamic import usage in CalendarSyncService to use .default
- Remove invalid properties from handleNewBooking call to fix type errors
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add skipCalendarSyncTaskCreation flag to handleCancelBooking to prevent infinite loops
- Add skipCalendarSyncTaskCreation field to bookingCancelSchema in zod-utils.ts
- Update handleCancelBooking to skip EventManager.cancelEvent when flag is true
- Update CalendarSyncService.cancelBooking to pass skipCalendarSyncTaskCreation: true
- Update CalendarSyncService.rescheduleBooking to pass skipCalendarSyncTaskCreation: true
- Update tests to verify the flags are passed correctly
This prevents infinite loops when calendar events are cancelled/rescheduled from
external calendars (Google/Office365) which trigger webhooks to Cal.com, which
would otherwise try to update the external calendar again.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: rename flag to skipCalendarSyncTaskCancellation and use static imports
- Rename skipCalendarSyncTaskCreation to skipCalendarSyncTaskCancellation in handleCancelBooking
- Convert dynamic imports to static imports in CalendarSyncService
- Update tests to use vi.hoisted for proper mock hoisting with static imports
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* feat: add error handling and static import for handleNewBooking
- Create index.ts entry point for handleNewBooking directory
- Add try-catch error handling to cancelBooking and rescheduleBooking
- Log errors but don't block calendar sync operations
- Update tests to verify errors are caught and logged, not thrown
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: use RegularBookingService directly and fix safeStringify usage
- Remove handleNewBooking/index.ts and call getRegularBookingService().createBooking() directly in CalendarSyncService
- Fix safeStringify usage: apply to error itself, not wrapper object
- Update tests to mock getRegularBookingService instead of handleNewBooking
Addresses PR comments from Volnei and Cubic-dev-ai
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: restore handleNewBooking/index.ts and fix bookingData structure for calendar sync
- Restore handleNewBooking/index.ts as entry point for static imports
- Fix CalendarSyncService.rescheduleBooking to use correct bookingData structure
with required fields (eventTypeId, start, end, timeZone, language, metadata)
- Use rescheduleUid to indicate this is a reschedule operation
- Fix safeStringify usage in error logging (wrap only the error, not the whole object)
- Update tests to match new bookingData structure
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: address PR comments - use RegularBookingService directly, remove unnecessary flags, fix booking reference update
- Remove handleNewBooking/index.ts wrapper and use getRegularBookingService().createBooking() directly in CalendarSyncService
- Remove allRemainingBookings and cancelSubsequentBookings flags from cancelBooking (only cancel the specific booking, not the entire series)
- Move bookingReference update outside skipCalendarSyncTaskCancellation block for data consistency
- Update tests to match new implementation
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* chore: remove unnecessary comment from zod-utils.ts
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* feat: add Sentry metrics telemetry and fix null assertions in CalendarSyncService
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: use dynamic import for getRegularBookingService to avoid RAQB import in server context
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: use dynamic import for findTeamMembersMatchingAttributeLogic to avoid RAQB import in server context
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* improve booking update
* add more tests and edge cases
* fix: add required actionSource and Sentry mocks to calendar sync
Add actionSource: "SYSTEM" to handleCancelBooking call after it became
required, and mock @sentry/nextjs in test files.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix: hide branding for teams
* fix: remove unused organizationId and username fields from profiles select
Addresses Cubic AI review feedback (confidence 9/10) to select only
the profile fields that are actually used. The organizationId and
username fields were fetched but never referenced in this function.
Co-Authored-By: unknown <>
* fix: unit tests
* fix: add prisma named export to test mock
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* Add tests: packages/features/profile/lib/hideBranding.test.ts
Generated by Paragon from proposal for PR #27643
* chore: implement cubic feedback
* fix: merge conflicts
* fix: unit tests
* fixup
* refactor: implement DI pattern for event type service
* fix: atoms build
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: workflow auto translation
* tests: add unit tests
* refactor: tests and workflow
* fix: type err
* fix: type err
* fix: remove redundant index on WorkflowStepTranslation
The @@index on [workflowStepId, field, targetLocale] duplicates the @@unique
constraint on the same columns. A unique index already provides efficient
lookups, so the separate @@index adds storage overhead and write latency
without benefit.
Addresses Cubic AI review feedback (confidence 9/10).
Co-Authored-By: unknown <>
* fix: correct locale mapping when translation API returns null
Map translations with their corresponding locales before filtering to
preserve correct locale-to-translation associations. Previously, filtering
out null translations would reindex the array, causing incorrect locale
mappings when any translation in the batch failed.
Also fixes pre-existing lint warnings:
- Move exports to end of file
- Add explicit return type to processTranslations
- Replace ternary with if-else for upsertMany selection
Co-Authored-By: udit@cal.com <udit222001@gmail.com>
* fix: address review feedback for workflow auto-translation
- Add change detection before creating translation tasks
- Rename userLocale to sourceLocale in task props for clarity
- Show source language in UI with new translation key
- Extract SUPPORTED_LOCALES to shared translationConstants.ts
- Fix locale mapping bug in translateEventTypeData.ts
- Add WhatsApp translation support
- Abstract translation lookup into shared translationLookup.ts helper
- Restore if-else readability for SCANNING_WORKFLOW_STEPS
Co-authored-by: Udit Takkar <udit.takkar@cal.com>
Co-Authored-By: unknown <>
* fix: update test to use sourceLocale instead of userLocale
Co-Authored-By: unknown <>
* refactor: feedback
* fix: handle first time
* fix: tests
* fix: tests
* fix: address Cubic AI review feedback (confidence 9/10 issues)
- WhatsApp translation: Apply variable substitution using getSMSMessageWithVariables
and clear contentSid when using translated body to ensure Twilio uses the
translated text instead of the original template
- update.handler.ts: Change sourceLocale assignment from ?? to || for consistency
with tasker payload behavior (line 481)
- ITranslationService.ts: Rename methods from plural to singular naming:
- getWorkflowStepTranslations -> getWorkflowStepTranslation
- getEventTypeTranslations -> getEventTypeTranslation
Updated all call sites and tests accordingly
Co-Authored-By: unknown <>
* fix: address Cubic AI review feedback (confidence 9/10+ issues)
- Fix getSMSMessageWithVariables to handle WHATSAPP_ATTENDEE action for
locale and timezone (confidence 9/10)
- Remove WhatsApp translation feature that set contentSid to undefined
since Twilio ignores body parameter for WhatsApp and requires
pre-approved Message Templates (confidence 10/10)
Co-Authored-By: unknown <>
* fix: translatio
* Add tests: packages/features/eventTypeTranslation/repositories/EventTypeTranslationRepository.test.ts
Generated by Paragon from proposal for PR #27087
* Add tests: packages/features/tasker/tasks/translateWorkflowStepData.test.ts
Generated by Paragon from proposal for PR #27087
* chore: nit
* chore: verfied atg
* fix: set sourceLocale for new steps, add shouldDirty to checkbox, remove spec docs
- Set sourceLocale fallback in addedSteps mapping to fix stale detection mismatch
- Add { shouldDirty: true } to autoTranslateEnabled checkbox onChange
- Remove specs/workflow-translation/ directory (planning docs, not for repo)
Co-authored-by: Udit Takkar <udit.07.takkar@gmail.com>
Co-Authored-By: unknown <>
* chore: add specs back
* fix: type error
* fix: type error
* fix: type err
* fix: tests
* refactor: feedback
* fix: type err
* refactor
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Udit Takkar <udit.takkar@cal.com>
Co-authored-by: Udit Takkar <udit.07.takkar@gmail.com>
* perf: improve getTotalBookingDuration query
* perf: improve getTotalBookingDuration query
* test: add unit tests for getTotalBookingDurationForUsers and yearly duration pre-fetching
Co-Authored-By: udit@cal.com <udit222001@gmail.com>
* fix: integration tests
* fix: update tests
* fix: use vi.stubEnv instead of direct process.env modification for test isolation
Replace direct deletion of process.env variables with vi.stubEnv() to ensure
automatic restoration after tests, preventing flaky tests and side effects
in parallel execution.
Issue identified by Cubic AI (confidence: 9/10)
Co-Authored-By: unknown <>
* chore: add log
* refactor: imports
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add no users found fallback action for routing forms
- Add NoUsersFoundFallbackActionType enum with CustomPageMessage and ExternalRedirectUrl options
- Add noUsersFoundFallbackAction field to zodNonRouterRoute schema
- Add NoUsersFoundFallback UI component in RouteBuilder for configuring fallback action
- Update handleResponse to return noUsersFoundFallbackAction when no team members match
- Add i18n translation keys for new UI strings
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: change fallback to use same action options as main route
- Replace noUsersFoundFallbackAction with fallbackAction that has same structure as main action
- Add action dropdown and input fields to fallback attributes query builder section
- Support Event redirect, External URL, and Custom page options in fallback
- Remove separate NoUsersFoundFallback toggle component
- Update handleResponse to return fallbackAction
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: ensure fallbackAction type is always defined in onChange handlers
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add guards for route.fallbackAction in onChange handlers
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: only return fallbackAction when no users are found
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: restructure fallback section to mirror main route structure
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: ensure backwards compatibility for existing routes with fallbackAttributesQueryValue
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: initialize fallbackAction with main event type for backwards compatibility
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: include fallbackAction in getRoutesToSave to persist changes
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: use fallbackAction in getRoutedUrl when no team members found
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: use i18n for fallback label and add tests for fallback action
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: do not trigger fallback action when CRM contact owner is found
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: prioritize fallbackAction over fallbackAttributesQueryValue
When a route has a fallbackAction configured, skip the
fallbackAttributesQueryValue to ensure the fallbackAction is triggered
when no team members are found. This maintains backwards compatibility
by only using fallbackAttributesQueryValue when fallbackAction is not set.
Also treats teamMemberIdsMatchingAttributeLogic being null (routing couldn't
run, e.g., missing orgId) the same as an empty array for the purpose of
triggering the fallbackAction.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract RouteActionSelector shared component for action selection UI
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add i18n string for default custom page message
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat: add webhook trigger when routing form fallback route is hit
- Add ROUTING_FORM_FALLBACK_HIT to WebhookTriggerEvents enum in Prisma schema
- Add new trigger to routing-forms webhook triggers in constants
- Add translation string for the new webhook trigger
- Implement triggerFallbackWebhook function in formSubmissionUtils.ts
- Call webhook trigger from handleResponse.ts when fallback action is used
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: remove webhook object from error log to avoid exposing secrets
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* revert: remove webhook trigger changes (to be moved to separate PR)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat: add webhook trigger when routing form fallback route is hit
- Add ROUTING_FORM_FALLBACK_HIT to WebhookTriggerEvents enum in Prisma schema
- Add new trigger to routing-forms webhook triggers in constants
- Add translation string for the new webhook trigger
- Implement triggerFallbackWebhook function in formSubmissionUtils.ts
- Call webhook trigger from handleResponse.ts when fallback action is used
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: remove webhook object from error log to avoid exposing secrets
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add ROUTING_FORM_FALLBACK_HIT to PayloadBuilderFactory trigger mapping
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* style: apply biome formatting fixes
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: restore removed comments in RouteBuilder
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* chore: add prisma migration for ROUTING_FORM_FALLBACK_HIT enum value
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add ROUTING_FORM_FALLBACK_HIT to FormTriggerEvents type union
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* test: add test coverage for triggerFallbackWebhook function
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: consolidate fallback webhook firing with form submission webhooks
Move ROUTING_FORM_FALLBACK_HIT webhooks into the same Promise.all() batch
as FORM_SUBMITTED / FORM_SUBMITTED_NO_EVENT, eliminating redundant
getWebhooks/getWebhookTargetEntity/getOrgIdFromMemberOrTeamId calls.
- Add fallbackAction parameter to _onFormSubmission and onSubmissionOfFormResponse
- Remove triggerFallbackWebhook function and all its usages/imports
- Move getFallbackAction() earlier in handleResponse.ts and pass result through
- Update all tests to verify batched webhook behavior
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Add UI option for trigger
* feat: persist fallbackAction on queued form responses
When a routing form response is queued, the fallbackAction determined
during routing is now stored on the QueuedFormResponse record. When
the queued response is later converted to a real FormResponse, the
stored fallbackAction is passed to onSubmissionOfFormResponse so the
ROUTING_FORM_FALLBACK_HIT webhook fires correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add coverage for fallbackAction in queued form response flow
Verify that fallbackAction is persisted when queuing and passed through
to onSubmissionOfFormResponse when the queued response is converted.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Replace request.url with WEBAPP_URL from @calcom/lib/constants as the base URL
for NextResponse.redirect() in booking confirmation API routes. Behind a reverse
proxy, request.url resolves to http://localhost:3000 instead of the public domain.
Fixes#20358
Co-Authored-By: unknown <>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* SMS reminders not trigger
* addressed devin review
* Add tests: packages/features/ee/workflows/lib/service/scheduleLazySMSWorkflow.test.ts
Generated by Paragon from proposal for PR #27942
* Add tests: packages/features/ee/workflows/lib/reminders/reminderScheduler.smsLazy.test.ts
Generated by Paragon from proposal for PR #27942
* Add tests: packages/features/tasker/tasks/sendWorkflowSMS.test.ts
Generated by Paragon from proposal for PR #27942
* Add tests: packages/features/ee/workflows/lib/reminders/smsReminderManager.test.ts
Generated by Paragon from proposal for PR #27942
* Delete packages/features/ee/workflows/lib/reminders/reminderScheduler.smsLazy.test.ts
* fix: update sendWorkflowSMS tests to match refactored implementation
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: use smsReminderNumber fallback for attendee phone in SMS workflows
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* revert: keep only scheduleSMSReminders.ts changes, revert all other files
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: restore reminderScheduler.ts and smsReminderManager.ts to original branch state
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: use smsReminderNumber fallback for attendee phone in WhatsApp reminders
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Add strategyName property to ISeatBillingStrategy interface and all implementations
- Log which strategy handled the invoice.upcoming webhook (not just whether it applied)
- Always log strategy result (not just when applied=true) for better observability
- Rename highWaterMarkApplied to strategyApplied since applied covers multiple strategies
Co-Authored-By: unknown <>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(caldav): use consistent UIDs and inject VTIMEZONE in iCalendar output
Two remaining CalDAV interop issues from #9485:
1. UID consistency: use the booking's canonical UID (event.uid) instead
of always generating a new random UUID. CalDAV servers use UID as the
event identifier — different UIDs cause duplicate calendar entries.
2. VTIMEZONE injection: the ics library generates UTC times with no
VTIMEZONE block. CalDAV servers like Fastmail read this as UTC and
send scheduling emails with wrong times. Per RFC 5545 §3.6.5,
DTSTART with TZID requires a matching VTIMEZONE component. We now
build a proper VTIMEZONE using binary-searched DST transitions for
the event's year, handling Northern/Southern hemisphere correctly.
* fix: use pre-transition offset for VTIMEZONE DTSTART per RFC 5545
The DTSTART in VTIMEZONE components must represent the local time
interpreted with the pre-transition offset (TZOFFSETFROM), not the
post-transition offset. For example, US Eastern spring forward DTSTART
should be 02:00 (EST), not 03:00 (EDT).
* Remove comments on UID handling in createEvent
Removed comments about UID handling for calendar events.
* Revise injectVTimezone documentation
Update injectVTimezone function documentation to clarify UTC handling.
---------
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
* fix: use import.meta.env instead of process.env in embed.ts
Using import.meta.env is Vite's native way to handle environment variables
in browser bundles. This prevents biome from auto-adding 'import process
from node:process' which breaks the embed.js in browsers.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Remove unncessar comment
* fix: migrate remaining process.env to import.meta.env in embed.ts
Complete the migration started by @hariombalhara by also converting
process.env usages at lines 1681, 1682, and 1700 to import.meta.env.
Update env.d.ts to include EMBED_PUBLIC_EMBED_FINGER_PRINT,
EMBED_PUBLIC_EMBED_VERSION, and INTEGRATION_TEST_MODE types.
This ensures no process.env references remain in embed.ts, fully
preventing Biome from auto-adding import process from node:process.
Co-Authored-By: unknown <>
* fix: add biome overrides for embed-core to prevent auto-import of node:process
Reverts import.meta.env back to process.env since API V2's tsconfig uses
module: commonjs which doesn't support import.meta. Instead, adds biome
overrides for embed-core to disable useNodejsImportProtocol, noProcessEnv,
and noProcessGlobal rules that were causing biome to auto-add
'import process from node:process' on save.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: update routing form identifier hint text with learn more link
Co-Authored-By: carina@cal.com <c.wollendorfer@me.com>
* UI improvements
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
* fix: prevent deselecting active option in ToggleGroup
Radix UI's single-type ToggleGroup allows deselection by default,
calling onValueChange("") when the active item is clicked.
Fix by converting to controlled mode with proper dual-mode support:
- Controlled (value prop): parent owns state, component just filters
empty values from onValueChange. Parent can still reject changes.
- Uncontrolled (defaultValue prop): internal useState prevents
deselection by only updating state for non-empty values.
* Update ToggleGroup.tsx
---------
Co-authored-by: Sahitya Chandra <sahityajb@gmail.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
* fix: add CSRF protection to OAuth callback via HMAC-signed nonce
The OAuth state parameter was used only for passing application data
(returnTo, teamId) with no cryptographic binding to the user session.
An attacker could authorize their own account on a provider, capture the
authorization code, and trick a logged-in user into visiting the callback
URL to link the attacker's account to the victim's Cal.com profile.
Changes:
- encodeOAuthState: generate a random nonce and HMAC-sign it with
NEXTAUTH_SECRET + userId, injecting both into the OAuth state
- decodeOAuthState: verify the HMAC on callback using timingSafeEqual;
skip verification when nonce is absent (backwards compatible with apps
that don't yet use encodeOAuthState)
- Stripe callback: replace raw state.returnTo redirect with
getSafeRedirectUrl to prevent open redirect, remove redundant
getReturnToValueFromQueryState, add missing return on access_denied
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make CSRF nonce verification mandatory with allowlist for exempt apps
Makes nonce/HMAC verification mandatory by default in decodeOAuthState,
preventing attackers from bypassing CSRF protection by omitting nonce
fields from the state parameter.
Apps not yet migrated to encodeOAuthState (stripe, basecamp3, dub,
webex, tandem) are explicitly allowlisted and pass their slug to
decodeOAuthState to skip verification.
Addresses review feedback (identified by cubic) about the conditional
check being trivially bypassable.
Co-Authored-By: unknown <>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: Add infrastructure for no-show audit integration
- Add Prisma migrations for SYSTEM source and NO_SHOW_UPDATED audit action
- Add NoShowUpdatedAuditActionService with array-based attendeesNoShow schema
- Update BookingAuditActionServiceRegistry to include NO_SHOW_UPDATED
- Update BookingAuditTaskConsumer and BookingAuditViewerService
- Add AttendeeRepository methods for no-show queries
- Update IAuditActionService interface with values array support
- Update locales with no-show audit translation keys
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Add NO_SHOW_UPDATED to BookingAuditAction and SYSTEM to ActionSource types
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Remove HOST_NO_SHOW_UPDATED and ATTENDEE_NO_SHOW_UPDATED from BookingAuditAction type to match Prisma schema
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update BookingAuditActionSchema to use NO_SHOW_UPDATED instead of HOST_NO_SHOW_UPDATED and ATTENDEE_NO_SHOW_UPDATED
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: Remove deprecated no-show audit services and unify to NoShowUpdatedAuditActionService
- Delete HostNoShowUpdatedAuditActionService and AttendeeNoShowUpdatedAuditActionService
- Update BookingAuditProducerService.interface.ts to use queueNoShowUpdatedAudit
- Update BookingAuditTaskerProducerService.ts to use queueNoShowUpdatedAudit
- Update BookingEventHandlerService.ts to use onNoShowUpdated
- Add integration tests for NoShowUpdatedAuditActionService
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Add data migration step for deprecated no-show enum values
Addresses Cubic AI review feedback (confidence 9/10): The migration now
includes an UPDATE statement to convert existing records using the
deprecated 'host_no_show_updated' or 'attendee_no_show_updated' enum
values to the new unified 'no_show_updated' value before the type cast.
This prevents migration failures if any existing data uses the old values.
Co-Authored-By: unknown <>
* fix: Use CASE expression in USING clause for enum migration
Fixes PostgreSQL error 'unsafe use of new value of enum type' by avoiding
the ADD VALUE statement and instead using a CASE expression in the ALTER
TABLE USING clause to convert deprecated enum values (host_no_show_updated,
attendee_no_show_updated) to the new unified value (no_show_updated) during
the type conversion.
Co-Authored-By: unknown <>
* fix: Replace hardcoded color with semantic text-success class
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Remove color class completely from display fields
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* feat: Add valuesWithParams support for translatable complex field values
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor(booking-audit): use discriminated union for displayFields and update consumers
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: add explicit return type to getBookingHistoryHandler to bust stale tRPC build cache
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: replace $t() nested interpolation with separate translation keys and add translationsWithParams tests
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(meta-pixel): add trackingEvent to zod schema
* fix: do not allow trackingEvent to be optional
* feat(meta-pixel): add trackingEvent selection dropdown to UI
* feat(meta-pixel): add trackingEvent to Event Type App Data
* fix(meta-pixel): implement history API hook for SPA conversion tracking
* fix(meta-pixel): check for cancel in URL and prevent Re-wrapping of pushState
* Update EventTypeAppSettingsInterface.tsx
* fix: make trackingEvent optional in zod schema to fix type-check
---------
Co-authored-by: Sahitya Chandra <sahityajb@gmail.com>
* feat: add keyboard shortcuts and tooltips to booking slideover buttons
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: remove duplicate useBookingLocation import and fix import ordering
- Removed duplicate import of useBookingLocation from non-existent
@calcom/web/modules/bookings/hooks/useBookingLocation path
- Fixed import ordering to satisfy biome organizeImports rules
- Removed unnecessary code comment
- Original feature by @PeerRich via Devin AI
Co-Authored-By: unknown <>
* use same style arrows for both button and remove bydefault focus from them
* fix join button tooltip hover
* fix: disable keyboard shortcuts when overlays/dialogs are open on BookingDetailsSheet
Co-Authored-By: unknown <>
* fix: use focus-based detection instead of selector-based overlay detection for keyboard shortcuts
Co-Authored-By: unknown <>
* fix: allow keyboard shortcuts when focus is on sheet ancestors
Co-Authored-By: unknown <>
* fix: use capture phase for keyboard handler to prevent Enter from activating focused buttons
Co-Authored-By: unknown <>
* fix: allow shortcuts when focus is on page elements outside any Radix portal
Co-Authored-By: unknown <>
* fix: handle calendar event clicks in onInteractOutside to prevent sheet close/reopen
Co-Authored-By: unknown <>
* fix: stop arrow key propagation to prevent Radix dropdown from opening during booking navigation
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: always stop arrow key propagation when sheet is active, even at first/last booking
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: extract keyboard handler into testable utility with tests
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: resolve type errors in keyboard handler config and test mocks
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* test: add e2e tests for booking sheet keyboard shortcuts
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: replace text= locators with data-testid selectors in e2e tests
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* made 3 fixes: Fix 1 — Stabilize handleNext/handlePrevious/handleClose with useCallback
In BookingDetailsSheet.tsx, all three handler functions were plain arrow functions recreated on every render, causing the useEffect to tear down and re-attach the document keydown listener unnecessarily. Wrapped all three in useCallback with proper dependency arrays (the Zustand store functions they call).
Fix 2 — data-booking-list-item verified (no change needed)
Confirmed that data-booking-list-item is rendered on BookingListItem.tsx and data-booking-calendar-event is rendered on Event.tsx. The onInteractOutside handler in the final merged state correctly checks both selectors. No code change required.
Fix 3 — Removed dead code from JoinMeetingButton
Reverted JoinMeetingButton back to a plain function component:
Removed forwardRef wrapping (no caller passes a ref)
Removed showTooltip prop (unused — tooltip is handled by the parent BookingDetailsSheet)
Removed ref prop from the inner Button
Removed unused Tod forwardRef imports
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
Co-authored-by: eunjae@cal.com <hey@eunjae.dev>
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
* init
* wiring up
* fix type
* feat: implement DI pattern for webhook producer in API v2
- Export IWebhookProducerService and getWebhookProducer from platform-libraries
- Add WEBHOOK_PRODUCER token and useFactory provider in RegularBookingModule
- Inject webhookProducer in RegularBookingService and pass to base class
This follows the composition root pattern where only the NestJS module
knows about getWebhookProducer(), and all consumers depend only on the
IWebhookProducerService interface via constructor injection.
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* test: migrate BOOKING_REQUESTED tests to new webhook architecture
- Remove failing BOOKING_REQUESTED tests from fresh-booking.test.ts (4 tests)
- Remove failing BOOKING_REQUESTED tests from reschedule.test.ts (2 tests)
- Remove failing BOOKING_REQUESTED test from collective-scheduling.test.ts (1 test)
- Replace WebhookTaskConsumer.test.ts with placeholder (constructor changed)
- Create new webhook architecture test suite:
- producer/WebhookTaskerProducerService.test.ts (14 tests)
- consumer/WebhookTaskConsumer.test.ts (8 tests)
- consumer/triggers/booking-requested.test.ts (8 tests)
The new test suite is organized by trigger type for extensibility as more
triggers are migrated to the producer/consumer pattern.
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* test: remove paid events BOOKING_REQUESTED test (moved to new architecture)
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* wrap webhook in own try-catch
* wire datafetcher
* fix
* fix v2
* fix circular dependency
* --
* merge-conflict-resolve
* mreg-conflict-resolve
* remove early return
* test: add integration tests for BOOKING_REQUESTED webhook producer invocation
Cover all 8 scenarios verifying the booking flow correctly invokes
the webhook producer for BOOKING_REQUESTED:
1. Basic confirmation → queueBookingRequestedWebhook called
2. Booker-is-organizer + confirmation → still called
3. Confirmation threshold NOT met → not called (BOOKING_CREATED instead)
4. Confirmation threshold IS met → called
5. Paid event + confirmation → called after payment succeeds
6. Reschedule + confirmation (non-organizer) → called (not BOOKING_RESCHEDULED)
7. Reschedule + confirmation (organizer) → not called (BOOKING_RESCHEDULED instead)
8. Collective scheduling + confirmation → called
Adds reusable MockWebhookProducer helper in @calcom/testing for
extendable use as more webhook triggers migrate to the new architecture.
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* fix bug
* fix conditional check
* remove unnecessary comment
* add missing expect
* remove empty test
* clean up
* tasker config
* --
* fix missing metadata
* remove faulty if else
* test: add payload content verification tests for BOOKING_REQUESTED webhook
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* remove unnecessary tests
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Hariom Balhara <1780212+hariombalhara@users.noreply.github.com>
