* add owner email to admin oauth view
* fix type error
* fix oauth flow with sign up
* improve e2e tests
* fix: use dynamic user email in OAuth client e2e test
The test 'editing redirect uri of an approved client triggers reapproval'
creates a new user and assigns the OAuth client to that user, but was
incorrectly expecting 'admin@example.com' as the owner email. Changed to
use user.email to correctly validate the owner email matches the created
user.
Addresses Cubic AI review feedback (confidence: 9/10)
Co-Authored-By: unknown <>
---------
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: apply biome formatting to Phase 1 packages
Packages formatted:
- packages/app-store-cli
- packages/config
- packages/dayjs
- packages/debugging
- packages/embeds/embed-react
- packages/embeds/embed-snippet
- packages/kysely
- packages/platform/constants
- packages/platform/utils
- packages/testing
- packages/tsconfig
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: restore non-null assertions in embed-snippet to fix type error
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: remove ESM import from CommonJS config file
Biome incorrectly added 'import process from node:process' to a CommonJS
file that uses require(). This breaks Jest which expects CommonJS syntax.
The process global is already available in Node.js without explicit import.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: exclude packages/embeds from Phase 1 formatting
Per user request, reverting all biome formatting changes in packages/embeds
to handle separately.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: restore const enum for BookingLocations
Biome changed 'const enum' to 'enum' which is a semantic change.
Reverting to keep the PR purely formatting-only.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: refactor UI to use coss + coupons UI
* fix: use TRPCError and remove sensitive logging in createCoupon handler
- Replace plain Error with TRPCError for consistent tRPC error handling
- Use INTERNAL_SERVER_ERROR for missing env configuration
- Use UNAUTHORIZED for permission denied errors
- Use BAD_REQUEST for API failure errors
- Remove console.warn that logged username (sensitive info)
Co-Authored-By: unknown <>
* feat: add copy button and fix 0 on % off
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* wip
* fix: claue reveiew commentsd
* add seed test
* fix: seed test plus subscriptin undefined in webhook
* chore: udpate triggr
* Integration test + HWM seed script
* add feature flag for hmw
* Remove redudant docs
* feat: add hwm-seating feature flag for high water mark billing
- Add new hwm-seating feature flag to control HWM billing logic
- Update HighWaterMarkService to use hwm-seating flag
- Update SeatChangeTrackingService to use hwm-seating flag
- Update BillingPeriodService to use hwm-seating flag
- Add flag to migration SQL
- Enable flag in seed script and integration test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: add hwm-seating to useFlags and fix test mocks
- Add hwm-seating to useFlags.ts initial data
- Add shouldApplyHighWaterMark mock to TeamBillingService tests
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix test
* feat: move to invoice paid subscription
* fix: transactions for transiants updates + reusable util
* fix: address Cubic AI review feedback for HWM billing
- Fix dotenv import hoisting in seed-hwm-test.ts by using side-effect import
- Remove logging of sensitive information (password/emails) in seed script
- Fix incorrect newHighWaterMark return value when update is not performed
Co-Authored-By: unknown <>
* add additional unit tests
* improve DI
* fix migration + restore package.json trigger update
* feat:move to featurerepo+update tests
* fix mocks
* fix DI calls
* revert faeturerepo to featuresrepository
* fix: pass featureRepository to BillingPeriodService and HighWaterMarkService
- Fix TeamBillingService.ts: pass featureRepository to BillingPeriodService constructor
- Fix _invoice.upcoming.ts: pass featureRepository to HighWaterMarkService constructor
- Fix hwm-webhook-utils.ts: pass featureRepository to HighWaterMarkService constructor
These services require featureRepository for feature flag checks but production
call sites were missing this required dependency, causing runtime errors.
Addresses Cubic AI review feedback on PR #27559
Co-Authored-By: unknown <>
* fix import
* update feature repo usage to features
* remove test thats mocking the wrong stuff
* revert RegularBookingService changes
* remove hide branding
* remove change in redudant file
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add delete confirmation dialog to webhook list items
* adds appname for translation key used in alert
* extract delete wehook dialog into separate component
* add e2e test
* chore update e2e locator
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com>
Co-authored-by: Romit <romitgabani@icloud.com>
- Changed checkIfSuccessfullyConfiguredInWorkspace to throw detailed errors instead of returning boolean
- Updated testDelegationCredentialSetup in Google Calendar and Office365 Calendar services to throw specific errors
- Updated assertWorkspaceConfigured to let errors propagate naturally
- Updated Calendar interface type to reflect Promise<void> return type
- Updated CalendarCacheWrapper and CalendarTelemetryWrapper to match new interface
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(analytics): handle null/undefined tracking IDs in embed endpoint
PR 26976 introduced strict validation for analytics app schemas,
but this broke the embed endpoint when apps are installed with
null tracking IDs (apps enabled but not yet configured)
Changes:
- Add nullishToEmpty preprocessor to convert null/undefined to ""
- Update all analytics schemas to handle null gracefully
- Change GTM to allowEmpty: true for consistency
- Fix createPrefixedIdSchema to not add prefix to empty strings
- Add tests for null handling
* fix(analytics): add optional() to schemas for type compatibility
The preprocess schemas output string type but BookerEvent has
trackingId?: string | undefined. Adding .optional() makes the
types compatible while preserving null → "" conversion at runtime
* refactor: use z.union+transform for proper type inference
Replace z.preprocess() with z.union([string, null, undefined]).transform()
pattern. This ensures TypeScript correctly infers:
- Input: string | null | undefined
- Output: string (always)
Remove .optional() from tracking ID fields to output string, not string | undefined
* fix(analytics): make trackingId optional in metapixel and plausible schemas
Address Cubic AI review feedback (confidence 9/10) to keep trackingId
optional in the schema to avoid breaking existing payloads that omit
the field entirely. The union with null/undefined handles the value
transformation, but the property itself must be optional to allow
payloads without the key.
Co-Authored-By: unknown <>
* fix: restore .optional() for missing tracking fields
* fix: revert safeUrlSchema to maintain databuddy type compat
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* se organizer default app
* nit
* Add tests: packages/features/bookings/lib/handleNewBooking/getBookingData.test.ts
Generated by Paragon from proposal for PR #27620
* Replace n x m array functions with maps
* feat: add attributeIds filter to findManyByOrgMembershipIds
Allow filtering attribute-to-user assignments by specific attribute IDs.
This enables querying only the attributes needed for a routing rule
instead of fetching all attributes for all team members.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: extract attribute IDs from routing rules and filter queries
Add extractAttributeIdsFromQueryValue helper to parse routing rules
and identify which attributes are referenced. Pass these IDs through
getAttributesAssignmentData to _queryAllData to only fetch the
attribute assignments that are actually needed for evaluation.
For a team with 785 members and 14 attributes, if a routing rule
only references 2-3 attributes, this reduces the query from ~3500
rows to ~500 rows.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: use attribute filtering in findTeamMembersMatchingAttributeLogic
Extract attribute IDs from the routing rules (main + fallback) and
pass them to getAttributesForLogic to only fetch necessary data.
This completes the optimization to reduce database load when
evaluating routing rules that only reference a subset of attributes.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: filter attributes query by attribute IDs
Also filter the attributes query (not just attributeToUser assignments)
by the attribute IDs referenced in routing rules.
For a routing rule that references 2 out of 14 attributes with 6524
total options, this reduces:
- Attributes fetched: 14 → 2
- Options fetched: 6524 → ~930 (proportional reduction)
- Fewer regex replacements in replaceAttributeOptionIdsWithOptionLabel
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add comprehensive test coverage for attribute routing query optimization
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Revert "Replace n x m array functions with maps"
This reverts commit 312eeb03bd1aba19760f093c798861a23b5fc66f.
* fix: re-establish extractAttributeIdsFromQueryValue mock after resetAllMocks
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: optimize myStats tRPC call to only trigger when Intercom is enabled
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: fetch myStats on-demand when Intercom session is created, not upfront
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: remove unnecessary comments
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: skip platform billing for non-platform-managed users in 2024-08-13 API
- Add isPlatformManaged check in billBooking() to skip billing for regular users
- Add isPlatformManaged check in billRescheduledBooking() to skip billing for regular users
- Add isPlatformManagedUserBooking check in cancelBooking() to skip billing cancellation for regular users
- Add E2E tests to verify billing behavior for both regular and platform-managed users
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: reuse booking data for isPlatformManaged instead of fetching user
- Capture isPlatformManagedUserBooking from raw booking data returned by regularBookingService.createBooking() and recurringBookingService.createBooking()
- Pass the flag through the output booking objects
- Update billBooking() and billRescheduledBooking() to use the flag instead of fetching user from database
- Matches the pattern used in 2024-04-15 controller
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: skip platform billing in booking service for non platform
* fix: use double negation for boolean type safety in isPlatformManagedUserBooking
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: ensure default calendars
* test: add E2E tests for delegation credential controller and update tasker config
- Add E2E tests to verify ensureDefaultCalendars is called when enabling delegation credentials
- Update calendars tasker config to use medium-1x machine for retry on OOM
- Set minimum retry backoff to 60 seconds (1 minute between retries)
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: update tasker config to use small-2x machine with outOfMemory retry on medium-1x
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: update E2E tests to properly spy on service instance and use valid workspace platform slug
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* ci: add CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY to E2E API v2 workflow
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: add encryption key to E2E test file for delegation credentials
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* revert: remove CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY from workflow (moved to test file)
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: move encryption key to setEnvVars.ts for E2E tests
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use valid format for service account encryption key
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: encrypt service account key in E2E test for delegation credentials
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: mock updateDelegationCredentialEnabled to bypass Google API call in E2E tests
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: get service from app.get() after initialization for proper spy setup in E2E tests
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use jest.mock() to mock toggleDelegationCredentialEnabled and bypass Google API calls in E2E tests
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use Service.prototype pattern for spying on ensureDefaultCalendars in E2E tests
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: move spy setup to beforeAll before app.init() for proper NestJS interception
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(api-v2): add GET /v2/bookings/by-seat/{seatUid} endpoint
- Add new endpoint to retrieve a booking by its seat reference UID
- Add getByReferenceUidIncludeBookingWithAttendeesAndUserAndEvent method to BookingSeatRepository
- Add getBookingBySeatUid method to BookingsService
- Add e2e tests for the new endpoint
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use Object.prototype.hasOwnProperty.call for ES compatibility in e2e tests
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use select instead of include in BookingSeatRepository for security and performance
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: add teamId and userId to eventType select for access check
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: return seatUid attendee when not admin and seatsShowAttendees is false
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use select for eventType in repository and fetch full eventType for access check
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* users not joining org/team
* fix: address Cubic AI review feedback for E2E tests
- Replace waitForURL with expect(page).toHaveURL() for fail-fast URL checks
- Replace Prisma include with select to fetch only needed fields
Both issues had confidence score 9/10 from Cubic AI review.
Co-Authored-By: unknown <>
* fix: add select to Prisma query in getServerSideProps
Address Cubic AI review feedback - use select to fetch only the id field
instead of retrieving all user columns, following project guidelines to
avoid over-fetching and exposing sensitive data.
Co-Authored-By: unknown <>
* refactor: remove comments from newly added E2E tests
Clean up the E2E tests by removing unnecessary comments as requested.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: avatar URL breaking for team/orgs in booker embed
* fix: api v2 breaking because of type mismatch
* fix: atoms build
* chore: implement PR feedback
The checkout step deletes the review-context.json file that was extracted
from the artifact. The 'Post comment with Devin session link' step was
trying to read this file after checkout, causing ENOENT errors.
Fixed by using the PR number from the extract-prompt step output instead
of reading the deleted file.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add GitHub workflows to sync agents/ to Devin Knowledge
- Add parse-to-devin-knowledge.ts to convert agents/ markdown to Devin Knowledge JSON
- Add validate-format.ts to validate rules have frontmatter and knowledge-base sections start with 'When...'
- Add sync-to-devin.ts to sync knowledge entries to Devin API
- Add export-devin-knowledge.sh to backup existing Devin knowledge
- Add validate-agents-format.yml workflow to validate format on PRs
- Add sync-agents-to-devin.yml workflow to sync on merge to main
- Add devin-knowledge.json to .gitignore (generated file)
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: use tsx instead of ts-node for better ESM support in CI
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* docs: add missing knowledge entries from Devin backup
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: move agents scripts to scripts/ folder
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: rename scripts to devin-knowledge-* for clarity
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: move scripts to scripts/devin/ with clearer names
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* rename DEVIN_API_TOKEN to DEVIN_API_KEY
* docs: fix usage comment script path
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: remove folder creation from sync script (API doesn't support it)
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: add -S flag to shebang for proper env execution
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* use pull_request_target
* fix: add -S flag to shebang in sync-knowledge-to-devin.ts for proper env execution
Co-Authored-By: unknown <>
* restructure workflows
* refactor: consolidate agent docs and split knowledge-base into modular rules
- Delete knowledge-base.md, migrate content to 17 new rule files
- Delete coding-standards.md (content duplicated in AGENTS.md and rules)
- Add ci- and reference- prefixes to rules/_sections.md
- Update AGENTS.md to reference new rule files
- Update agents/README.md as rules index
- Clean up parse-local-knowledge.ts (remove deleted file references)
New rule files:
- testing-playwright, testing-mocking, testing-timezone
- ci-check-failures, ci-type-check-first, ci-git-workflow
- data-prisma-migrations, data-prisma-feature-flags
- quality-error-handling, quality-imports, quality-pr-creation, quality-code-comments
- architecture-features-modules
- patterns-workflow-triggers, patterns-app-store
- reference-file-locations, reference-local-dev
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Revert "refactor: consolidate agent docs and split knowledge-base into modular rules"
This reverts commit 8251b6b214c7c01a3bfe2137c6aa9292dd72427e.
* refactor: reorganize agent docs - extract coding rules, keep domain knowledge
- Slim down knowledge-base.md (356 → 96 lines) to domain knowledge only
- Add Business rules section (managed events, orgs/teams, OAuth clients)
- Delete coding-standards.md (content moved to rules)
- Create 19 new rule files for coding guidelines:
- quality-*: PR creation, error handling, imports, comments, code review
- testing-*: playwright, mocking, timezone, incremental
- ci-*: check failures, type-check-first, git workflow
- data-prisma-*: migrations, feature flags
- patterns-*: workflow triggers, app store
- architecture-features-modules, reference-file-locations, reference-local-dev
- Update agents/README.md as rules index (43 total rules)
- Update _sections.md with CI/CD and Reference sections
- Clean up parse-local-knowledge.ts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: rename knowledge-base sections to start with "When..."
Update section headers to pass validation rules:
- "Business Rules" → "When working with managed events, organizations, or OAuth clients"
- "Product & Codebase Knowledge" → "When you need product or codebase context"
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: split knowledge-base business rules into separate sections
Split the combined "When working with managed events, organizations, or OAuth clients"
section into three distinct ## sections for better Devin triggering:
- When working with managed event types
- When working with organizations and teams
- When working with OAuth clients
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: simplify trigger description logic in parse-local-knowledge.ts
Since validate-local-knowledge.ts enforces that all section titles must start
with "When...", we can remove the manual fallback logic and just use the
title directly as the trigger description.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: simplify knowledge-base section validation
Simplify the validation to only check that section titles start with "When..."
since we've standardized on that pattern. Remove the special cases for error,
file naming, PR, and repo note sections.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add script to delete all Devin knowledge entries
Add delete-all-devin-knowledge.ts script that:
- Lists all knowledge entries before deletion
- Requires interactive confirmation (Y) to proceed
- Blocks execution in non-TTY environments (CI, piped input)
- Shows progress while deleting entries
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* docs: add API reference links to delete-all-devin-knowledge script
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: replace NOW() with CURRENT_TIMESTAMP in feature flag migration example
Co-Authored-By: unknown <>
* add -S
* docs: consolidate agent documentation and add AI setup guide
- Remove duplicated Project Structure & Tech Stack from agents/README.md
- Condense Commands section in AGENTS.md, link to agents/commands.md
- Add AI-Assisted Development section to root README.md explaining
the agents/ folder structure and symlink configuration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* docs: remove incorrect CLAUDE.md symlink claim from README
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* test: add e2e tests for team filter in bookings list
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: replace text locators with data-testid selectors in team filter tests
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: apply formatting to resolved merge conflict
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Use workflow_run pattern to enable the Cubic AI to Devin review workflow
for PRs from external forks. The pull_request_review event doesn't have
access to secrets when triggered from forks, so we split into two workflows:
1. cubic-devin-review-trigger.yml - Lightweight workflow that triggers on
pull_request_review and saves the review context as an artifact
2. cubic-devin-review.yml - Main workflow that triggers on workflow_run,
downloads the artifact, and processes it with full permissions/secrets
This follows the same pattern used by on-changes-requested.yml and re-draft.yml.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
