* feat: add keyboard shortcuts and tooltips to booking slideover buttons
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: remove duplicate useBookingLocation import and fix import ordering
- Removed duplicate import of useBookingLocation from non-existent
@calcom/web/modules/bookings/hooks/useBookingLocation path
- Fixed import ordering to satisfy biome organizeImports rules
- Removed unnecessary code comment
- Original feature by @PeerRich via Devin AI
Co-Authored-By: unknown <>
* use same style arrows for both button and remove bydefault focus from them
* fix join button tooltip hover
* fix: disable keyboard shortcuts when overlays/dialogs are open on BookingDetailsSheet
Co-Authored-By: unknown <>
* fix: use focus-based detection instead of selector-based overlay detection for keyboard shortcuts
Co-Authored-By: unknown <>
* fix: allow keyboard shortcuts when focus is on sheet ancestors
Co-Authored-By: unknown <>
* fix: use capture phase for keyboard handler to prevent Enter from activating focused buttons
Co-Authored-By: unknown <>
* fix: allow shortcuts when focus is on page elements outside any Radix portal
Co-Authored-By: unknown <>
* fix: handle calendar event clicks in onInteractOutside to prevent sheet close/reopen
Co-Authored-By: unknown <>
* fix: stop arrow key propagation to prevent Radix dropdown from opening during booking navigation
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: always stop arrow key propagation when sheet is active, even at first/last booking
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: extract keyboard handler into testable utility with tests
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: resolve type errors in keyboard handler config and test mocks
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* test: add e2e tests for booking sheet keyboard shortcuts
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: replace text= locators with data-testid selectors in e2e tests
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* made 3 fixes: Fix 1 — Stabilize handleNext/handlePrevious/handleClose with useCallback
In BookingDetailsSheet.tsx, all three handler functions were plain arrow functions recreated on every render, causing the useEffect to tear down and re-attach the document keydown listener unnecessarily. Wrapped all three in useCallback with proper dependency arrays (the Zustand store functions they call).
Fix 2 — data-booking-list-item verified (no change needed)
Confirmed that data-booking-list-item is rendered on BookingListItem.tsx and data-booking-calendar-event is rendered on Event.tsx. The onInteractOutside handler in the final merged state correctly checks both selectors. No code change required.
Fix 3 — Removed dead code from JoinMeetingButton
Reverted JoinMeetingButton back to a plain function component:
Removed forwardRef wrapping (no caller passes a ref)
Removed showTooltip prop (unused — tooltip is handled by the parent BookingDetailsSheet)
Removed ref prop from the inner Button
Removed unused Tod forwardRef imports
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
Co-authored-by: eunjae@cal.com <hey@eunjae.dev>
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
* feat: add duplicate functionality for managed event types
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add disclaimer and redirect for managed event type duplication
- Add info alert disclaimer in duplicate modal for managed event types
- Pass schedulingType to duplicate dialog via query params
- Redirect to assignment tab after duplicating managed event types
- Add translation key for managed event type duplicate disclaimer
Co-Authored-By: peer@cal.com <peer@cal.com>
* test: add tests for managed event type duplication
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: replace PrismaMock unit test with Prisma integration test for duplicate handler (#27973)
* refactor: replace PrismaMock unit test with Prisma integration test for duplicate handler
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* fix: re-throw TRPCErrors in duplicate handler catch block and assert specific error codes in tests
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Hariom Balhara <1780212+hariombalhara@users.noreply.github.com>
Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com>
* feat(companion): add upcoming bookings widget for iOS and Android
- Add iOS widget using @bacons/apple-targets with SwiftUI
- Add Android widget using react-native-android-widget
- Configure App Groups for iOS data sharing between app and widget
- Create widget sync hook to update widget data when bookings change
- Widget displays up to 5 upcoming bookings with title, time, and attendee
- Widget refreshes every 15 minutes and when app goes to background
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix(companion): refactor useWidgetSync to avoid React Compiler limitation
Move conditional logic outside of try/catch block to fix React Compiler
error: 'Support value blocks (conditional, logical, optional chaining,
etc) within a try/catch statement'
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix(companion): fix widget data sync issues
- Fix Swift widget to read data as JSON string (format used by react-native-shared-group-preferences)
- Add fallback to read as raw Data for compatibility
- Fix query key mismatch by checking multiple common filter combinations
- Ensure widget finds cached bookings regardless of which filter the app used
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix(companion): use ExtensionStorage from @bacons/apple-targets for widget data
- Replace react-native-shared-group-preferences with ExtensionStorage
- ExtensionStorage properly stores data in iOS App Groups
- Add ExtensionStorage.reloadWidget() call to trigger widget refresh
- This ensures the widget picks up new data immediately
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat(companion): add upcoming bookings widget for ios - all shapes (#27564)
* ios working widget
* fix(companion): remove sensitive data logging from widget storage
Remove console.log statements that were logging full widgetData payload
and formatted widget bookings containing attendee names and booking
details. This addresses security concerns identified by Cubic AI review
(confidence 9/10).
Co-Authored-By: unknown <>
* dark mode
* new look
* fix deeplink
* fix biome lint
* fix(companion): remove booking titles from console logs to avoid PII exposure
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* lock the versions and dev mode logging
* remove dynamic imports
* feat(companion): upcoming bookings widget android (#27689)
* companion-upcoming-bookings-widget-android
* fix(companion): remove stale relative countdowns and fix past-time clamping in Android widget
- Remove relative countdown text (In 15m, In 1h, Now) that becomes stale
due to Android widget 30+ min update interval (Cubic violation 2)
- Remove Math.max(0, minutes) clamping that caused ended meetings to
display as 'Now' indefinitely (Cubic violation 1)
- Simplify accent color logic to use startTimeISO directly
- Keep absolute time display (date + startTime) which remains accurate
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
Co-authored-by: Volnei Munhoz <volnei@cal.com>
* refactor: simplify link-as-an-app template to config.json only
- Remove api/, components/, index.ts, package.json from link-as-an-app template
- Add externalLink field to AppMetaSchema for external URL configuration
- Update API handler to dynamically create handlers for external link apps
- External link apps no longer create credentials (just redirect to URL)
- Update CLI to handle externalLinkUrl field for link-as-an-app template
- CLI now skips package.json update for apps without package.json
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: simplify external link handler to bypass credential creation
External link apps now directly return the redirect URL without going
through the AppDeclarativeHandler type, avoiding type conflicts with
the createCredential return type requirement.
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: migrate 24 external link apps to simplified structure
Migrated the following apps to use config.json with externalLink field
instead of api/add.ts handlers:
- amie, autocheckin, baa-for-hipaa, bolna, chatbase, clic, cron, deel
- elevenlabs, fonio-ai, framer, granola, greetmate-ai, lindy, millis-ai
- monobot, n8n, pipedream, raycast, retell-ai, synthflow, telli, vimcal
- wordpress
Each app now only contains: config.json, DESCRIPTION.md, static/
Removed: api/, components/, index.ts, package.json
Co-Authored-By: peer@cal.com <peer@cal.com>
* nit
* Fix merge conflict issue
* refactor: generate REDIRECT_APPS dynamically during app-store build
- Add logic to build.ts to detect apps with externalLink field
- Generate redirect-apps.generated.ts with list of redirect app slugs
- Update redirectApps.ts to import from generated file
- Revert [...]args].ts to original state (Flow 1 is preferred)
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: cast REDIRECT_APPS to readonly string[] for includes check
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Fix error with React
* Take exteral link URL as input
* deleted bun.lockb
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
* refactor(companion): split calcom.ts into modular service files
Split the monolithic 1692-line calcom.ts file into focused modules:
- auth.ts: Authentication configuration and token management
- bookings.ts: Booking CRUD operations and actions
- conferencing.ts: Conferencing options
- event-types.ts: Event type CRUD operations
- private-links.ts: Private link management for event types
- request.ts: Core HTTP request functionality
- schedules.ts: Schedule CRUD operations
- user.ts: User profile management
- utils.ts: JSON parsing and payload sanitization utilities
- webhooks.ts: Webhook management (global and event type specific)
- index.ts: Re-exports all functions and maintains backward compatibility
This improves code organization, maintainability, and makes it easier
to understand and modify specific functionality.
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix(companion): avoid logging sensitive booking response data
Replace logging of full responseText (which may contain PII like attendee
emails and names) with responseLength for safer debugging.
Addresses Cubic AI review feedback (confidence 9/10).
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(companion): add app store rating prompts for iOS and Android
- Add useAppStoreRating hook with generalized requestRating(trigger) function
- Add RatingTrigger const for extensible trigger types (EVENT_TYPE_SAVED, BOOKING_CONFIRMED, BOOKING_REJECTED)
- Integrate rating prompt into useCreateEventType and useUpdateEventType hooks
- Integrate rating prompt into useConfirmBooking and useDeclineBooking hooks
- Add expo-store-review package dependency
- Rating prompts only show once per trigger type (tracked via AsyncStorage)
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix(companion): correct expo-store-review version to 9.0.10
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: move organization members page from /settings/organizations/members to /members
- Create new /members route under main-nav with same functionality
- Add permanent redirect from /settings/organizations/members to /members
- Include loading skeleton and server actions for the new route
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: Deduplicate organization members page logic (#27168)
* refactor(web): extract shared org members data fetching logic
- Extract data fetching, coaching, and permission logic into [getOrgMembersPageData.ts](cci:7://file:///Users/dhairyashilshinde/work/cal.com/apps/web/modules/members/getOrgMembersPageData.ts:0:0-0:0)
- Deduplicate logic between [/members](cci:7://file:///Users/dhairyashilshinde/work/cal.com/apps/web/app/%28use-page-wrapper%29/%28main-nav%29/members:0:0-0:0) and pages
- Reduce page component size and improve maintainability
* safe guard for org id null
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
* feat: add Cloudflare URL Scanner integration for malicious URL detection
- Add MALICIOUS_URL_IN_WORKFLOW to LockReason enum
- Add URL_SCANNING_ENABLED constant for feature flag
- Create urlScanner.ts utility for Cloudflare Radar URL Scanner API
- Create scanWorkflowUrls task for async URL scanning with polling
- Integrate URL scanning into scanWorkflowBody task
- Add URL scanning for event type redirect URLs
- Lock user accounts when malicious URLs are detected
- Fix pre-existing lint issues (parseInt radix, optional chaining)
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address biome lint warnings and TypeScript iterator errors
- Wrap iterators with Array.from() to fix TS2802 errors
- Add biome-ignore comments for process.env usage
- Extract helper functions to reduce function length
- Move exports to end of file per useExportsLast rule
- Remove problematic imports that cause TypeScript errors
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address cubic-dev-ai review comments for URL scanning
- Fix P0: Re-fetch workflow steps before scheduling notifications to use actual verifiedAt values from database instead of overriding with new Date()
- Fix P1: Mark workflow step as verified in submitWorkflowStepForUrlScanning when URL scanning is disabled or no URLs found
- Fix P1: Add whitelistWorkflows parameter to submitUrlForUrlScanning for consistency
- Fix P2: Preserve URL context in error results in urlScanner.ts scanUrls function
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: add select clause to Prisma query for workflow steps
Address cubic-dev-ai P2 comment: Use select to fetch only the required
fields (id, action, sendTo, emailSubject, reminderBody, template, sender,
verifiedAt) instead of fetching all columns from workflowStep table.
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: add select clause to Prisma query in scanWorkflowBody.ts
Address cubic-dev-ai P2 review comment: Use select to fetch only the
required fields (id, action, sendTo, emailSubject, reminderBody,
template, sender, verifiedAt) instead of fetching all columns.
Co-Authored-By: peer@cal.com <peer@cal.com>
* test: add unit tests for URL scanning functionality
- Add tests for urlScanner.ts (extractUrlsFromHtml, isUrlScanningEnabled)
- Add tests for scanWorkflowUrls.ts (happy/unhappy paths for URL scanning task)
- Add tests for scanWorkflowBody.ts (happy/unhappy paths for workflow body scanning)
Tests cover:
- URL extraction from HTML content
- URL normalization and deduplication
- Handling of malicious URLs and user locking
- Fail-open behavior for API errors
- Whitelisted user handling
- Iffy spam detection integration
Co-Authored-By: peer@cal.com <peer@cal.com>
* test: remove incomplete test that provides no value
Removed the 'should mark all steps as verified when neither Iffy nor URL scanning is enabled' test as it used vi.doMock() which doesn't work after module import, had no assertions, and gave false confidence in test coverage.
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: use Cloudflare bulk scanning endpoint to reduce API quota usage
- Added submitUrlsForBulkScanning function that uses /urlscanner/v2/bulk endpoint
- Updated scanUrls to use bulk submission instead of individual URL submissions
- Bulk endpoint accepts up to 100 URLs per request, batching is handled automatically
- Reduces API quota usage as suggested by keithwillcode
Co-Authored-By: peer@cal.com <peer@cal.com>
* Update packages/features/tasker/tasks/scanWorkflowUrls.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix: address cubic-dev-ai review comments
- P1: Sanitize URLs before logging to prevent exposing sensitive query parameters
- P2: Extract handleUrlScanningForStep helper function to reduce code duplication
- P2: Use vi.stubGlobal for fetch mock in tests for proper cleanup
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address volnei review comments on PR #26387
- Move vi.unstubAllGlobals() to afterEach hook in iffyScanBody tests
- Restore updateMany optimization when URL scanning is disabled
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Volnei Munhoz <volnei@cal.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* feat: add OAuth client developer settings page with approval workflow
- Add new developer OAuth page at /settings/developer/oAuth for users to submit OAuth client requests
- Transform admin OAuth page into management dashboard for reviewing/approving submissions
- Add OAuthClientApprovalStatus enum (PENDING, APPROVED, REJECTED) to track submission status
- Add userId and createdAt fields to OAuthClient model for tracking submissions
- Create email notifications for admin (new submission) and user (approval)
- Add sidebar navigation link in developer section below API keys
- Add comprehensive translations for new UI strings
- Create OAuthClientRepository for data access following repository pattern
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: re-export generateSecret for backward compatibility
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: make logo mandatory and list items clickable for OAuth clients
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: add missing translation keys and remove client secret from details dialog
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address cubic AI reviewer comments
- Remove duplicate 'there' JSON key in common.json
- Add select clause to findByUserId to avoid exposing clientSecret
- Add @@index([userId]) to OAuthClient model for query performance
- Update migration to include the index
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address PR review comments - fix indentation and use useCopy hook
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: change react-dom/server import to fix Turbopack compatibility
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* Revert "fix: change react-dom/server import to fix Turbopack compatibility"
This reverts commit c3e0b709c2d88fd221143cb4ce9cd25bb8c94277.
* fix: use email service pattern for OAuth client notifications
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: add try-catch around email sending to handle Turbopack react-dom/server issue
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* Revert "fix: add try-catch around email sending to handle Turbopack react-dom/server issue"
This reverts commit fc9d47cd773505ebc5ee2696718aad4a8a98be77.
* fix: improve OAuth client UI with skeleton loaders and smaller dialog styling
- Replace 'Loading...' text with proper skeleton loaders in both developer and admin OAuth client views
- Make client_id and copy button smaller in dialogs using size='sm' and text-sm styling
- Add 'client_id' translation key to common.json for proper i18n
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: improve skeleton loader to match actual OAuth client list structure
- Remove divide-y from container and use conditional border-b on rows
- Match the exact structure from oauth-clients-view.tsx L126-160
- Use proper spacing for text elements (mt-1 instead of space-y-2)
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix skeleton
* rename the selected oauth client dialog
* fix: address PR feedback - admin auth, dropdown styling, sidebar label
- Add defense-in-depth admin authorization check in updateClientStatus handler
- Fix broken dropdown menu by using DropdownItem with StartIcon prop
- Fix sidebar menu label from 'oAuth' to 'oauth_clients' to match developer view
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update common.json
* feat: show client secret in approval email for confidential OAuth clients
- Add regenerateSecret method to OAuthClientRepository
- Regenerate secret when admin approves a PENDING confidential client
- Include client secret in approval notification email
- Add one-time warning message about storing the secret securely
- Only regenerate on first approval (not re-approvals)
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: add Website URL field, fix logo styling, show client secret after approval
- Add Website URL field to OAuth client forms (admin and developer views)
- Fix Upload Logo section styling by wrapping in Label div with proper gap
- Display client secret in dialog after admin approves a confidential OAuth client
- Add websiteUrl field to Prisma schema with migration
- Update tRPC handlers and repository to support websiteUrl
- Add translation keys for new UI elements
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: move clientSecret variable declaration outside if block for proper scoping
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: dont expose client secret in emails
* refactor: dont regenerate secret upon status change
* refactor: reuse existing hash function
* refactor: rename admin/oAuth to admin/oauth page
* refactor: deduplicate oauth repositories
* refactor: remove withGlobalPrisma from oauth repository
* refactor: developer oauth page
* refactor: oauth status by default accepted
* refactor: request oauth status when creating
* refactor ux
* fix: address Cubic AI code review feedback
- Add purpose field to plain text email body for accessibility
- Convert NewOAuthClientButton to inline JSX to avoid React anti-pattern
- Trigger re-approval when redirectUri changes for security
- Add e.preventDefault() for Space key to prevent page scroll
- Change default approvalStatus to PENDING for defense-in-depth
- Use oauth_clients translation key for consistency
- Add meaningful alt text to Avatar for accessibility
- Remove onClick from DialogClose to prevent double-run close effects
- Return NOT_FOUND for non-owner delete to prevent resource enumeration
Co-Authored-By: unknown <>
* common.json file
* refactor: delete all prisma migrations
* refactor: have just 1 prisma migration
* revert: some devin changes
* fix: typecheck
* test: owner OAuth crud
* test: admin OAuth approval / rejection
* fix: address Cubic AI review feedback (confidence 9/10 issues)
- schema.prisma: Remove @default("") from purpose field to make it required
- schema.prisma: Use UTC-aware timezone expression for createdAt default
- OAuthClientFormFields.tsx: Localize redirect URI placeholder using t()
- common.json: Add redirect_uri_placeholder translation key
Co-Authored-By: unknown <>
* cubic changes
* refactor: dont log sensitive info and rethrow error
* cubic feedback
* refactor: make oauth client purpose optional
* refactor: admin/oauth not allowed if not logged in
* refactor: admin view skeleton
* refactor: rename state
* refactor: get rid of redundant mapping
* refactor: remove redundant handler
* refactor: remove redundant handler
* refactor: re-usable new oauth client button
* refactor: dialogs
* refactor: modals
* refactor: handler names, dialog, skeleton
* fix: purpose being null
* refactor: rename handler and delete old oauth admin page
* fix: purpose in submission
* refactor: handler names
* refactor: rename
* refactor: update handler
* refactor: rename approvalStatus -> status
* refactor: simplify modal
* refactor: name
* dont require repproval if redirectUri changes
* fix: remove integration sync index creation
* refactor: require re-approval if redirectUri updated
* fix: flaky e2e test
* fix: flaky e2e test
* fix: flaky e2e test
* fix: remove duplicate common.json keys
* refactor: replace team@cal.com with SUPPORT_MAIL_ADDRESS
* refactor: generate client secret on handler level
* fix: authorization code only available to approved clients
* refactor: cubic review dont display exclamation
* refactor: cubic review website_url in common json
* fix: dont default in ui to approved status
* refactor: optiona logo in schema create handler
* fix: tests
* fix: tests
* fix: /authorize redirect if client not approved or show error
* test: authorize page with invalid client id
* refactor: dont allow refreshing tokens unless approved client
* fix: flaky e2e test
* fix: flaky e2e test
* fix: flaky e2e test
* fix: flaky e2e test
* fix: flaky e2e test
* fix: flaky e2e test
* chore: warn that pending client is not usable
* fix: approve and reject buttons
* fix: /authorize show error if client not approved
* refactor: info message about editing oauth client and status
* change info alert to warning
* try to fix ci test
* debug: failing e2e test
* fix: improve session propagation in oauth-client-admin E2E test
- Add navigateToAdminOAuthPage helper that waits for listClients API call
- If the API call doesn't arrive (session issue), reload page to force session refresh
- This fixes the CI flakiness where admin page wasn't loading due to session not having ADMIN role
Co-Authored-By: lauris@cal.com <lauris@cal.com>
* fix: register waitForResponse before navigating in E2E test
- Register the listClients waitForResponse promise BEFORE page.goto()
- This ensures the response isn't missed during page load
- Also register the promise before reload in the catch block
Co-Authored-By: lauris@cal.com <lauris@cal.com>
* fix: rename oAuth folder to oauth for case-sensitive filesystems
The admin OAuth page route was at /settings/admin/oAuth (capital A) but the
code references /settings/admin/oauth (lowercase). This caused 404 errors
on case-sensitive filesystems (Linux).
Also improved the E2E test navigation helper to retry with delays if the
admin page doesn't load immediately, handling session propagation timing.
Co-Authored-By: lauris@cal.com <lauris@cal.com>
* test style
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: eunjae@cal.com <hey@eunjae.dev>
Co-authored-by: Lauris Skraucis <lauris.skraucis@gmail.com>
Co-authored-by: supalarry <laurisskraucis@gmail.com>
Co-authored-by: cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: lauris@cal.com <lauris@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* chore: remove Mintlify AI chat from CMD+K widget
- Remove MintlifyChat component and related state from Kbar.tsx
- Delete packages/features/mintlify-chat directory (MintlifyChat.tsx, util.ts)
- Delete apps/web/app/api/mintlify-chat API routes and tests
- Delete packages/lib/server/mintlifyChatValidation.ts
- Remove Mintlify-related env vars from .env.example and turbo.json
- Refactor Kbar.tsx to fix lint issues (explicit types, exports at end)
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: use ReactNode import instead of JSX from react
The JSX type is not exported from 'react' module. Use the global
JSX.Element type (available in React projects) and import ReactNode
for the children prop type.
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add all event-types and upcoming bookings to KBar
- Increase event types limit from 10 to 100 to show more event types
- Add useUpcomingBookingsAction hook to fetch and display upcoming bookings
- Bookings show title, date, and time in KBar search results
- Navigate to booking details page when selecting a booking
Co-Authored-By: peer@cal.com <peer@cal.com>
* Revert "feat: add all event-types and upcoming bookings to KBar"
This reverts commit 69d03397e3820e45e7207eb55b38117d269eae5e.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Exclude 'link' toolbar item from Editor for all workflow actions (not just SMS)
- Add replaceCloakedLinksInHtml utility to sanitize HTML and replace cloaked links with visible URLs
- Apply sanitization to email content before sending in all workflow email paths
This ensures recipients can see the actual destination of URLs, helping them identify potentially malicious links.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Remove 'as any' type assertion in LoginScreen.tsx, use Platform.OS check
- Fix malformed className string in LogoutButton.tsx (extra quotes)
- Remove @ts-ignore comments in Tooltip.tsx with proper web-specific types
- Replace 'any' type with Schedule type in AvailabilityTab.tsx
- Replace 'any' type with 'string' for SF Symbol icons in EventTypeListItem.ios.tsx
- Remove console.log error handling in SvgImage.tsx
- Extract duplicated formatDuration function to use shared utility from formatters.ts
- Extract repeated inline styles to sectionDividerStyle constant in AvailabilityTab.tsx
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
* feat: add environment-based favicons (prod vs dev)
- Add cal-prod.png (dark/gray) favicon for production environments
- Add cal-dev.png (red) favicon for development/localhost environments
- Update FAVICON_16 and FAVICON_32 constants to switch based on IS_PRODUCTION
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add higher resolution icons for all icon types (apple-touch, android-chrome, mstile)
- Add 180x180 apple-touch-icon for prod and dev
- Add 150x150 mstile icons for prod and dev
- Add 192x192 and 256x256 android-chrome icons for prod and dev
- Update all icon constants to use IS_PRODUCTION switching
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: simplify favicon to single new design
- Remove environment-based favicon switching
- Update all icon files with new Cal favicon design
- Remove dev/prod icon variants
- Update constants to use static icon paths
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add favicon.ico with new Cal favicon design
Co-Authored-By: peer@cal.com <peer@cal.com>
* chore: update favicon icons with final design
Co-Authored-By: peer@cal.com <peer@cal.com>
* chore: update favicon icons with final design v3
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add data region dropdown to signup page
Add a dropdown to the signup page that allows users to select their data region (United States or European Union). When a region is selected, the user is navigated to the appropriate domain (app.cal.com or app.cal.eu).
- Add SelectField component to signup page below the description text
- Detect current domain and set appropriate default value
- Navigate to correct domain when selection changes
- Add translation strings for data_region, united_states, and european_union
Co-Authored-By: peer@cal.com <peer@cal.com>
* added localhost
* fix: improve data region dropdown - SSR hydration, query params, and self-hosted protection (#25463)
* fix/remove-eu-us-dropdown-from-self-hosted-signup
* fix: remove localhost bypass and fix SSR hydration for data region dropdown
- Remove localhost bypass from IS_CALCOM check to prevent self-hosted instances from seeing Cal.com-specific dropdown
- Fix SSR hydration mismatch by using WEBAPP_URL instead of window.location for region detection
- Fix hostname replacement to preserve query parameters by modifying hostname directly instead of entire URL string
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
* feat: companion expo and chrome
* fix: api-v2-fetch-bookings (#25023)
* migrated to app expo router
* feat(companion): added availability screen and fix event type fetch (#25025)
* fix(companion): add host check in bookings (#25036)
* using liquid glass bottom nav experimental
* added action sheet
* added icons to event type tabs
* added action bar for event-type details
* long press for edit event types
* added limits
* added more limits
* added more limits
* added username to event types
* feat(companion): config to set and show all the available meeting options a user has stalled (#25081)
* feat: Add tailwind support using nativewind. (#25028)
* init nativewind
* replace styles with tailwind classes
* changes
* feat(companion): all locations options, icons, and apply nativewind to remaining files (#25143)
* feat: all locations options and icons and apply nativwind to reamaining files
* icon bug fix
* cal video icon
* other location frontend
* other location api
* address cubics comment about correctly detects SVGs
* feat(companion): edit availability (#25149)
* feat: companion-edit-availability
* date override and use correct config for patch api endpoint
* Android Alert supports a maximum of 3 buttons
* feat: companion-ui-release-1 (#25150)
* feat(companion): Add event type & schedule creation flows with API expansion (#25187)
* feat(companion): event schedule creation and apis
* profile section
* limits, advanced, recurring tab
* Clean Folder Structure
* addressed cubics comments
* fix cubiics comments
* replaced text with cal.com svg logo
* added correct more button for event-types
* added copy link button
* added extension popup
* added chrome extension sidebar
* achieved liquid glass buttons
* nit
* more progress
* fixed ios bug, added icon
* added cal icon to gmail
* nit
* nit
* added dialog for one-off meeting
* added one-time dialog
* feat(companion): gmail plugin (#25327)
* Update Cal.com Companion to version 1.7.0 with enhanced background and content scripts. The background script now handles fetching event types from the Cal.com API and improved error handling. The content script has been updated to manage sidebar visibility and respond to messages more effectively. Removed deprecated dev background script and updated manifest permissions for better functionality.
* chore: update companion .gitignore to exclude build outputs and env files
* feat: insert Cal.com event link directly at cursor position in Gmail compose
- Add insertTextAtCursor function to insert booking link where user is typing
- Automatically positions cursor after inserted link for seamless typing
- Fallback to clipboard copy if compose field not found
- Improved UX: no need to manually paste the link
* feat(companion): improve notification UI and add event types caching
- Update notification to Cal.com brand style (black bg, check icon, smooth fade)
- Change notification text to 'Link inserted' for subtlety
- Move notification to bottom-right position (matching Cal.com toasts)
- Add event types caching (5min duration) to reduce API calls
- Cache automatically refreshes on page reload
- Fix TypeScript error with composeBody.focus() type assertion
* Notification toast border
* conditional description
* conditional description
* feat(companion): Enhance UI with action buttons, tooltips, and Gmail extension improvements (#25353)
* feat: companion-and-gmail-ui-upgrade
* feat: companion-and-gmail-ui-upgrade
* feat: companion-and-gmail-ui-upgrade
* feat: companion-and-gmail-ui-upgrade
* feat(companion): one-off links (#25355)
* added one off prototype
* resolve merge conflicts
---------
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
* fixed sidebar iframe
* fix: enable pointer events on sidebar while maintaining click-through on transparent area
- Added pointerEvents: 'auto' to sidebar View component in _layout.tsx
- Changed iframe width from 100% to 400px to match sidebar width
- Changed iframe pointerEvents from 'none' to 'auto' to enable clicking
- This allows sidebar items to be clickable while transparent area remains click-through
* feat(companion): center all modals on full screen in browser extension (#25380)
* fix: companion-full-width-iframe
* center the popups on extension view
* feat(companion): center all modals on full screen in browser extension
- Created FullScreenModal component that expands iframe to full width
- Updated content script to handle instant iframe expansion/collapse
- Converted 17 modals across 6 files to use FullScreenModal
- All modals now appear centered on full browser viewport
- Removed animations for instant modal appearance
- Mobile app behavior remains unchanged
Files updated:
- companion/components/FullScreenModal.tsx (new)
- companion/extension/entrypoints/content.ts
- companion/app/(tabs)/event-types.tsx (5 modals)
- companion/app/(tabs)/bookings.tsx (2 modals)
- companion/app/(tabs)/availability.tsx (3 modals)
- companion/app/booking-detail.tsx (2 modals)
- companion/app/availability-detail.tsx (4 modals)
- companion/components/Header.tsx (1 modal)
* security(companion): validate postMessage origin in content script
Add origin and source validation to postMessage listener to prevent
malicious scripts on host pages from manipulating the companion iframe.
- Verify event.source matches iframe.contentWindow
- Verify event.origin matches iframe origin (localhost:8081)
- Reject all unauthorized messages before processing
This prevents external scripts from:
- Forcing full-screen overlays
- Intercepting pointer events
- Manipulating the companion UI
* fix(companion): center 'Add new event type' modal on full screen
Replace KeyboardAvoidingView with TouchableOpacity pattern in the
create event type modal to ensure it appears centered on the full
screen like all other modals.
This was the last remaining modal that wasn't properly centered.
* fix(companion): resolve modal transition timing issue
Fixed the 'Add new event type' modal not centering properly by:
- Added 100ms delay when transitioning between modals
- Prevents conflicting expand/collapse messages
- Removed redundant postMessage calls from modal handlers
- Added max-height constraint to modal content
- Cleaned up debug console logs
The issue was that when clicking 'New Event Type' from the 'New' menu,
both modals were transitioning simultaneously, causing the create modal
to collapse immediately. The delay ensures proper sequencing.
All 17 modals now work correctly and appear centered on full screen.
* added working date range
* removed all of one-off event code
* nit
* feat(companion): Suggest `Cal.com` links and Embed using Gemini Ai in Gmail (#25406)
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
* add companion build on CI
* feat: oauth companion (#25526)
* first implemenation of oauth
* fix logout for web
* revert app name
* remove isUsingOAuth
* clean up log out button
* remove logs
* clean up authcontext
* simplify code generation
* code clean up
* clean up oauthService.ts
* oauth browser extension
* add redirect uri to .env.example
* remove api key support
* clean up _layout file
* add identity
* fix + clean up
* improvements to oauth flow
* code clean up
* remove comments
* clean up comments
* add log out dialog
* add confirm modal
---------
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
---------
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
Co-authored-by: Abhijeet Singh <asingh9829@gmail.com>
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com>
Co-authored-by: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
* feat: remove OAuth clients link from settings navigation
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: resolve infinite loop in sidebar close effect
Use functional state update to avoid reading sideContainerOpen in dependency array, which was causing infinite re-renders when navigating between settings pages.
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## What does this PR do?
- Fixes#25116
- Fixes [CAL-6741](https://linear.app/calcom/issue/CAL-6741/make-routing-edit-question-form-less-intrusive-on-how-it-handles-the)
https://github.com/user-attachments/assets/d78c4c62-2af5-44d8-b25c-e938cc8ddf6f
Improves the routing form field identifier auto-fill behavior to generate URL-safe identifiers from labels. Previously, the identifier field simply duplicated the label text. Now it normalizes the input to be URL-friendly.
**Changes:**
- Converts labels to lowercase with hyphens (e.g., "What is your name?" → "what-is-your-name")
- Limits identifiers to the first 5 words (e.g., "What do you work on and how can we help?" → "what-do-you-work-on")
- Updates the Identifier label to clarify it's a URL parameter with an example
- Preserves manual identifier edits when the label changes
**Link to Devin run:** https://app.devin.ai/sessions/f569297990fe4436bab1fec89d8b71ac
**Requested by:** @PeerRich (peer@cal.com)
## Key Implementation Details
The `normalizeIdentifier` function:
- Strips special characters and replaces them with spaces
- Converts to lowercase
- Splits on whitespace and takes first 5 words
- Joins with hyphens
The auto-fill logic only updates the identifier if:
1. The identifier field is empty, OR
2. The identifier matches the normalized version of the previous label
This preserves manual edits while still providing helpful auto-fill for new fields.
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox. **N/A** - This is a UI behavior change that doesn't require documentation updates.
- [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works. **Note:** No automated tests were added for this change. Manual testing is recommended.
## How should this be tested?
**Test Cases:**
1. **Basic normalization:**
- Create a new routing form field
- Enter label: "What is your name?"
- Verify identifier auto-fills to: "what-is-your-name"
2. **5-word limit:**
- Enter label: "What do you work on and how can we help?"
- Verify identifier becomes: "what-do-you-work-on"
3. **Special characters:**
- Enter label: "Email (required)!"
- Verify identifier becomes: "email-required"
4. **Manual edit preservation:**
- Enter label: "Test Field"
- Manually change identifier to: "custom-id"
- Change label to: "New Test Field"
- Verify identifier stays: "custom-id" (not auto-updated)
5. **Updated label text:**
- Verify the Identifier field label shows: "Identifier (URL Parameter, i.e.: &what-is-your-name=john-doe)"
**Environment:**
- No special environment variables needed
- Test in the routing forms builder at `/apps/routing-forms/[formId]`
## Important Review Points
⚠️ **No automated tests**: The normalization function and auto-fill behavior lack test coverage. Consider adding unit tests for edge cases.
🔍 **Auto-fill logic**: The identifier only auto-updates if it's empty or matches the previous normalized label. This preserves manual edits but may be surprising to users in some scenarios.
🌍 **Unicode handling**: Non-ASCII characters are replaced with spaces. This may not be ideal for international users with non-English labels.
## Checklist
- [x] I have read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
- [x] My code follows the style guidelines of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have checked if my changes generate no new warnings
* early UI refresher of workflows using v3 designs. needs tons of testing, might have broken
* Delete .claude/settings.local.json
* fix: bunch of design fixes, merge conflict fixes
* fix: e2e and type-check
* fix: await button click
* review fixes
* code rabbit fixes
* fix styles in variables dropdown
* fix text truncate
* fix: unit tests
* fix: unit tests
* chore: add missing i18n
* review fixes
* review fixes
* fix testing info message
* move timeSectionText up
* fix which team does this apply to info message
* disable set up agent button with read only
* fix: cal.ai breaking on mobile screen
---------
Co-authored-by: Amit Sharma <74371312+Amit91848@users.noreply.github.com>
Co-authored-by: Udit Takkar <udit222001@gmail.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
* feat: replace window.todesktop with official @todesktop/client-core package
- Import platform from @todesktop/client-core in _document.tsx
- Pass isDesktopApp result via window.calIsDesktopApp to stringified function
- Update applyToDesktopClass to use passed-in value instead of window.todesktop
- Maintains existing architecture while using official package API
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: move ToDesktop detection to client-side to resolve SSR issue
- Remove server-side call to platform.todesktop.isDesktopApp() which always returns false
- Move detection logic to client-side stringified script using same logic as official package
- Maintain client-side detection while ensuring proper functionality in ToDesktop environment
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: use official platform.todesktop.isDesktopApp() function
- Import platform from @todesktop/client-core in _document.tsx
- Call platform.todesktop.isDesktopApp() directly in stringified script
- Replace duplicated logic with official package function call
- Maintain client-side detection while using official API
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: properly use official platform.todesktop.isDesktopApp() function
- Call platform.todesktop.isDesktopApp() outside stringified context
- Pass result as template variable to avoid SSR issues
- Now actually uses the official @todesktop/client-core package
- Eliminates duplicated detection logic as requested
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: add SSR safety guards around platform.todesktop.isDesktopApp() call
- Wrap platform.todesktop.isDesktopApp() in try/catch to prevent SSR crashes
- Return false as fallback if library touches browser globals during SSR
- Addresses keithwillcode's comment about SSR safety concerns
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Add applyToDesktopClass function to detect window.todesktop
- Conditionally add 'todesktop' class to html element when ToDesktop environment is detected
- Follow existing pattern used by applyTheme function for client-side script injection
- Enable desktop-specific CSS styling that already exists in globals.css
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
