chore: release v5.4.20

fix: CalDAV credential verification between multiple instances (#22331 )
Co-authored-by: zomars@cal.com <zomars@me.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-07-15 00:37:37 +00:00 · 2025-07-15 01:32:52 +01:00 · 2025-07-14 16:58:19 -07:00 · 2025-07-14 22:49:25 +00:00 · 2025-07-14 20:39:07 +00:00 · 2025-07-14 16:30:11 +00:00
46 changed files with 4102 additions and 297 deletions
@@ -23,6 +23,7 @@
 /packages/lib/getUserAvailability.ts @calcom/Foundation
 /packages/lib/server/getLuckyUser.ts @calcom/Foundation
 /packages/lib/slots.ts @calcom/Foundation
+/packages/platform/atoms/**/*WebWrapper.tsx @calcom/Consumer
 /packages/platform/**/* @calcom/Platform @calcom/Foundation
 /packages/prisma/**/* @calcom/DBA
 /packages/trpc/server/routers/viewer/bookings/confirm.handler.ts @calcom/Foundation
@@ -26,7 +26,7 @@ jobs:
  e2e:
    timeout-minutes: 20
    name: E2E API v2
-    runs-on: buildjet-8vcpu-ubuntu-2204
+    runs-on: buildjet-16vcpu-ubuntu-2204
    services:
      postgres:
        image: postgres:13
@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"
@@ -222,6 +222,13 @@ async function handler(req: NextApiRequest) {
  };
  if (isSystemWideAdmin) userId = req.body.userId || userId;

+  if (req.body.eventTypeId !== undefined && typeof req.body.eventTypeId !== "number") {
+    throw new HttpError({
+      statusCode: 400,
+      message: "Bad request, eventTypeId must be a number",
+    });
+  }
+
  if (isOrganizationOwnerOrAdmin) {
    const accessibleUsersIds = await getAccessibleUsers({
      adminUserId: userId,
@@ -25,6 +25,44 @@ vi.mock("@calcom/lib/server/i18n", () => {
  };
 });

+describe("POST /api/bookings - eventTypeId validation", () => {
+  test("String eventTypeId should return 400", async () => {
+    const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+      method: "POST",
+      body: {
+        eventTypeId: "invalid-string",
+      },
+    });
+
+    await handler(req, res);
+
+    expect(res._getStatusCode()).toBe(400);
+    expect(JSON.parse(res._getData())).toEqual(
+      expect.objectContaining({
+        message: "Bad request, eventTypeId must be a number",
+      })
+    );
+  });
+
+  test("Number eventTypeId should not trigger validation error", async () => {
+    const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+      method: "POST",
+      body: {
+        eventTypeId: 123,
+      },
+    });
+
+    await handler(req, res);
+
+    const statusCode = res._getStatusCode();
+    const responseData = JSON.parse(res._getData());
+
+    if (statusCode === 400) {
+      expect(responseData.message).not.toBe("Bad request, eventTypeId must be a number");
+    }
+  });
+});
+
 describe.skipIf(true)("POST /api/bookings", () => {
  describe("Errors", () => {
    test("Missing required data", async () => {
@@ -38,7 +38,7 @@
    "@axiomhq/winston": "^1.2.0",
    "@calcom/platform-constants": "*",
    "@calcom/platform-enums": "*",
-    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.257",
+    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.258",
    "@calcom/platform-types": "*",
    "@calcom/platform-utils": "*",
    "@calcom/prisma": "*",
@@ -1,6 +1,7 @@
 import { bootstrap } from "@/app";
 import { AppModule } from "@/app.module";
 import { CreateIcsFeedOutput, CreateIcsFeedOutputResponseDto } from "@/ee/calendars/input/create-ics.output";
+import { ConnectedCalendarsData } from "@/ee/calendars/outputs/connected-calendars.output";
 import { DeletedCalendarCredentialsOutputResponseDto } from "@/ee/calendars/outputs/delete-calendar-credentials.output";
 import { CalendarsService } from "@/ee/calendars/services/calendars.service";
 import { HttpExceptionFilter } from "@/filters/http-exception.filter";
@@ -30,7 +31,7 @@ import {
  GOOGLE_CALENDAR_ID,
 } from "@calcom/platform-constants";
 import { OFFICE_365_CALENDAR_ID, OFFICE_365_CALENDAR_TYPE } from "@calcom/platform-constants";
-import { ICS_CALENDAR } from "@calcom/platform-constants/apps";
+import { ICS_CALENDAR, ICS_CALENDAR_TYPE } from "@calcom/platform-constants/apps";
 import { IcsFeedCalendarService } from "@calcom/platform-libraries/app-store";

 const CLIENT_REDIRECT_URI = "http://localhost:5555";
@@ -247,6 +248,35 @@ describe("Platform Calendars Endpoints", () => {
      .expect(200);
  });

+  it(`/GET/v2/calendars with access token`, async () => {
+    const response = await request(app.getHttpServer())
+      .get(`/v2/calendars`)
+      .set("Authorization", `Bearer ${accessTokenSecret}`)
+      .set("Origin", CLIENT_REDIRECT_URI)
+      .expect(200);
+
+    const data: ConnectedCalendarsData = response.body.data;
+    expect(data.connectedCalendars).toBeDefined();
+    expect(data.connectedCalendars).toHaveLength(3);
+
+    const googleConnectedCalendar = data.connectedCalendars.find(
+      (calendar) => calendar.integration.type === GOOGLE_CALENDAR_TYPE
+    );
+    const office365ConnectedCalendar = data.connectedCalendars.find(
+      (calendar) => calendar.integration.type === OFFICE_365_CALENDAR_TYPE
+    );
+    const icsConnectedCalendar = data.connectedCalendars.find(
+      (calendar) => calendar.integration.type === ICS_CALENDAR_TYPE
+    );
+
+    expect(googleConnectedCalendar).toBeDefined();
+    expect(office365ConnectedCalendar).toBeDefined();
+    expect(icsConnectedCalendar).toBeDefined();
+
+    expect(data.destinationCalendar).toBeDefined();
+    expect(data.destinationCalendar.integration).toEqual(GOOGLE_CALENDAR_TYPE);
+  });
+
  it.skip(`/POST/v2/calendars/${OFFICE_365_CALENDAR}/disconnect: it should respond with a 201 returning back the user deleted calendar credentials`, async () => {
    const body = {
      id: 10,
@@ -0,0 +1,29 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { IsOptional, IsString } from "class-validator";
+
+import { SkipTakePagination } from "@calcom/platform-types";
+
+export class GetManagedOrganizationsInput_2024_08_13 extends SkipTakePagination {
+  @IsOptional()
+  @IsString()
+  @ApiProperty({ example: "organization-slug", description: "The slug of the managed organization" })
+  slug?: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty({
+    example: "metadata-key",
+    description:
+      "The key of the metadata - it is case sensitive so provide exactly as stored. If you provide it then you must also provide metadataValue",
+  })
+  metadataKey?: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty({
+    example: "metadata-value",
+    description:
+      "The value of the metadata - it is case sensitive so provide exactly as stored. If you provide it then you must also provide metadataKey",
+  })
+  metadataValue?: string;
+}
@@ -1,3 +1,4 @@
+import { GetManagedOrganizationsInput_2024_08_13 } from "@/modules/organizations/organizations/inputs/get-managed-organizations.input";
 import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { Injectable } from "@nestjs/common";
@@ -24,6 +25,17 @@ export class ManagedOrganizationsRepository {
    });
  }

+  async getManagedOrganizationBySlug(managerOrganizationId: number, managedOrganizationSlug: string) {
+    return this.dbRead.prisma.managedOrganization.findFirst({
+      where: {
+        managerOrganizationId,
+        managedOrganization: {
+          slug: managedOrganizationSlug,
+        },
+      },
+    });
+  }
+
  async getByManagerManagedIds(managerOrganizationId: number, managedOrganizationId: number) {
    return this.dbRead.prisma.managedOrganization.findUnique({
      where: {
@@ -35,11 +47,26 @@ export class ManagedOrganizationsRepository {
    });
  }

-  async getByManagerOrganizationIdPaginated(managerOrganizationId: number, pagination: SkipTakePagination) {
-    const { skip, take } = pagination;
+  async getByManagerOrganizationIdPaginated(
+    managerOrganizationId: number,
+    query: GetManagedOrganizationsInput_2024_08_13
+  ) {
+    const { skip, take, slug, metadataKey, metadataValue } = query;
+
+    const managedOrganizationFilter: Prisma.TeamWhereInput = {
+      slug,
+    };
+
+    if (metadataKey && metadataValue) {
+      managedOrganizationFilter.metadata = {
+        path: [metadataKey],
+        equals: metadataValue,
+      };
+    }

    const where: Prisma.ManagedOrganizationWhereInput = {
      managerOrganizationId,
+      managedOrganization: managedOrganizationFilter,
    };

    const [totalItems, linkRows] = await this.dbRead.prisma.$transaction([
@@ -66,6 +66,7 @@ describe("Organizations Organizations Endpoints", () => {

  let managerOrg: Team;
  let managedOrg: ManagedOrganizationWithApiKeyOutput;
+  let managedOrg2: ManagedOrganizationWithApiKeyOutput;
  const managerOrgAdminEmail = `organizations-organizations-admin-${randomString()}@api.com`;
  let managerOrgAdmin: User;
  let managerOrgAdminApiKey: string;
@@ -159,27 +160,36 @@ describe("Organizations Organizations Endpoints", () => {
      .expect(400);
  });

+  const suffix = randomString(5);
+  const metadataKey = "first-org-metadata-key";
+  const metadataValue = "first-org-metadata-value";
+  const createManagedOrganizationBody: CreateOrganizationInput = {
+    name: `org ${suffix}`,
+    slug: `org-${suffix}`,
+    metadata: { [metadataKey]: metadataValue },
+  };
+
+  const suffix2 = randomString(5);
+  const createManagedOrganizationBodySecond: CreateOrganizationInput = {
+    name: `org2 ${suffix2}`,
+    slug: `org2-${suffix2}`,
+    metadata: { key: "value" },
+  };
+
  it("should create managed organization", async () => {
-    const suffix = randomString();
-
-    const body: CreateOrganizationInput = {
-      name: `organizations organizations org ${suffix}`,
-      metadata: { key: "value" },
-    };
-
    return request(app.getHttpServer())
      .post(`/v2/organizations/${managerOrg.id}/organizations`)
      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
-      .send(body)
+      .send(createManagedOrganizationBody)
      .expect(201)
      .then(async (response) => {
        const responseBody: ApiSuccessResponse<ManagedOrganizationWithApiKeyOutput> = response.body;
        expect(responseBody.status).toEqual(SUCCESS_STATUS);
        managedOrg = responseBody.data;
        expect(managedOrg?.id).toBeDefined();
-        expect(managedOrg?.name).toEqual(body.name);
-        expect(managedOrg?.slug).toEqual(slugify(body.name));
-        expect(managedOrg?.metadata).toEqual(body.metadata);
+        expect(managedOrg?.name).toEqual(createManagedOrganizationBody.name);
+        expect(managedOrg?.slug).toEqual(createManagedOrganizationBody.slug);
+        expect(managedOrg?.metadata).toEqual(createManagedOrganizationBody.metadata);
        expect(managedOrg?.apiKey).toBeDefined();

        // note(Lauris): check that managed organization is correctly setup in database
@@ -284,6 +294,36 @@ describe("Organizations Organizations Endpoints", () => {
      });
  });

+  it("should not create managed organization if slug already exists", async () => {
+    const response = await request(app.getHttpServer())
+      .post(`/v2/organizations/${managerOrg.id}/organizations`)
+      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
+      .send(createManagedOrganizationBody)
+      .expect(409);
+
+    expect(response.body.error.message).toBe(
+      `Organization with slug '${createManagedOrganizationBody.slug}' already exists. Please, either provide a different slug or change name so that the automatically generated slug is different.`
+    );
+  });
+
+  it("should create second managed organization", async () => {
+    return request(app.getHttpServer())
+      .post(`/v2/organizations/${managerOrg.id}/organizations`)
+      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
+      .send(createManagedOrganizationBodySecond)
+      .expect(201)
+      .then(async (response) => {
+        const responseBody: ApiSuccessResponse<ManagedOrganizationWithApiKeyOutput> = response.body;
+        expect(responseBody.status).toEqual(SUCCESS_STATUS);
+        managedOrg2 = responseBody.data;
+        expect(managedOrg2?.id).toBeDefined();
+        expect(managedOrg2?.name).toEqual(createManagedOrganizationBodySecond.name);
+        expect(managedOrg2?.slug).toEqual(createManagedOrganizationBodySecond.slug);
+        expect(managedOrg2?.metadata).toEqual(createManagedOrganizationBodySecond.metadata);
+        expect(managedOrg2?.apiKey).toBeDefined();
+      });
+  });
+
  it("should get managed organization", async () => {
    return request(app.getHttpServer())
      .get(`/v2/organizations/${managerOrg.id}/organizations/${managedOrg.id}`)
@@ -304,12 +344,69 @@ describe("Organizations Organizations Endpoints", () => {
      .get(`/v2/organizations/${managerOrg.id}/organizations`)
      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
      .expect(200)
+      .then(async (response) => {
+        const responseBody: GetManagedOrganizationsOutput = response.body;
+        expect(responseBody.status).toEqual(SUCCESS_STATUS);
+        const responseManagedOrgs = responseBody.data;
+        expect(responseManagedOrgs?.length).toEqual(2);
+        const responseManagedOrg = responseManagedOrgs.find((org) => org.id === managedOrg.id);
+        expect(responseManagedOrg?.id).toBeDefined();
+        expect(responseManagedOrg?.name).toEqual(managedOrg.name);
+        expect(responseManagedOrg?.metadata).toEqual(managedOrg.metadata);
+
+        const responseManagedOrg2 = responseManagedOrgs.find((org) => org.id === managedOrg2.id);
+        expect(responseManagedOrg2?.id).toBeDefined();
+        expect(responseManagedOrg2?.name).toEqual(managedOrg2.name);
+        expect(responseManagedOrg2?.metadata).toEqual(managedOrg2.metadata);
+
+        expect(responseBody.pagination).toBeDefined();
+        expect(responseBody.pagination.totalItems).toEqual(2);
+        expect(responseBody.pagination.remainingItems).toEqual(0);
+        expect(responseBody.pagination.returnedItems).toEqual(2);
+        expect(responseBody.pagination.itemsPerPage).toEqual(250);
+        expect(responseBody.pagination.currentPage).toEqual(1);
+        expect(responseBody.pagination.totalPages).toEqual(1);
+      });
+  });
+
+  it("should get managed organization by slug", async () => {
+    return request(app.getHttpServer())
+      .get(`/v2/organizations/${managerOrg.id}/organizations?slug=${managedOrg.slug}`)
+      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
+      .expect(200)
      .then(async (response) => {
        const responseBody: GetManagedOrganizationsOutput = response.body;
        expect(responseBody.status).toEqual(SUCCESS_STATUS);
        const responseManagedOrgs = responseBody.data;
        expect(responseManagedOrgs?.length).toEqual(1);
-        const responseManagedOrg = responseManagedOrgs[0];
+        const responseManagedOrg = responseManagedOrgs.find((org) => org.id === managedOrg.id);
+        expect(responseManagedOrg?.id).toBeDefined();
+        expect(responseManagedOrg?.name).toEqual(managedOrg.name);
+        expect(responseManagedOrg?.metadata).toEqual(managedOrg.metadata);
+
+        expect(responseBody.pagination).toBeDefined();
+        expect(responseBody.pagination.totalItems).toEqual(1);
+        expect(responseBody.pagination.remainingItems).toEqual(0);
+        expect(responseBody.pagination.returnedItems).toEqual(1);
+        expect(responseBody.pagination.itemsPerPage).toEqual(250);
+        expect(responseBody.pagination.currentPage).toEqual(1);
+        expect(responseBody.pagination.totalPages).toEqual(1);
+      });
+  });
+
+  it("should get managed organization by metadata key", async () => {
+    return request(app.getHttpServer())
+      .get(
+        `/v2/organizations/${managerOrg.id}/organizations?metadataKey=${metadataKey}&metadataValue=${metadataValue}`
+      )
+      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
+      .expect(200)
+      .then(async (response) => {
+        const responseBody: GetManagedOrganizationsOutput = response.body;
+        expect(responseBody.status).toEqual(SUCCESS_STATUS);
+        const responseManagedOrgs = responseBody.data;
+        expect(responseManagedOrgs?.length).toEqual(1);
+        const responseManagedOrg = responseManagedOrgs.find((org) => org.id === managedOrg.id);
        expect(responseManagedOrg?.id).toBeDefined();
        expect(responseManagedOrg?.name).toEqual(managedOrg.name);
        expect(responseManagedOrg?.metadata).toEqual(managedOrg.metadata);
@@ -465,7 +562,40 @@ describe("Organizations Organizations Endpoints", () => {
      });
  });

-  it("should delete managed organization ", async () => {
+  it("should delete managed organization", async () => {
+    return request(app.getHttpServer())
+      .delete(`/v2/organizations/${managerOrg.id}/organizations/${managedOrg2.id}`)
+      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
+      .expect(200)
+      .then(async (response) => {
+        const responseBody: ApiSuccessResponse<ManagedOrganizationWithApiKeyOutput> = response.body;
+        expect(responseBody.status).toEqual(SUCCESS_STATUS);
+        const responseManagedOrg = responseBody.data;
+        expect(responseManagedOrg?.id).toBeDefined();
+        expect(responseManagedOrg?.id).toEqual(managedOrg2.id);
+        expect(responseManagedOrg?.name).toEqual(managedOrg2.name);
+
+        const managedOrgInDb =
+          await managedOrganizationsRepositoryFixture.getOrganizationWithManagedOrganizations(managedOrg2.id);
+        expect(managedOrgInDb).toEqual(null);
+
+        const billings = await platformBillingRepositoryFixture.getByCustomerSubscriptionIds(
+          managerOrgBilling.customerId,
+          managerOrgBilling.subscriptionId!
+        );
+        expect(billings).toBeDefined();
+        // note(Lauris): manager billing is left and other managed org
+        expect(billings?.length).toEqual(2);
+
+        const managerOrgInDb =
+          await managedOrganizationsRepositoryFixture.getOrganizationWithManagedOrganizations(managerOrg.id);
+        expect(managerOrgInDb).toBeDefined();
+        expect(managerOrgInDb?.id).toEqual(managerOrg.id);
+        expect(managerOrgInDb?.managedOrganizations?.length).toEqual(1);
+      });
+  });
+
+  it("should delete managed organization", async () => {
    return request(app.getHttpServer())
      .delete(`/v2/organizations/${managerOrg.id}/organizations/${managedOrg.id}`)
      .set("Authorization", `Bearer ${managerOrgAdminApiKey}`)
@@ -11,6 +11,7 @@ import { IsOrgGuard } from "@/modules/auth/guards/organizations/is-org.guard";
 import { RolesGuard } from "@/modules/auth/guards/roles/roles.guard";
 import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { CreateOrganizationInput } from "@/modules/organizations/organizations/inputs/create-managed-organization.input";
+import { GetManagedOrganizationsInput_2024_08_13 } from "@/modules/organizations/organizations/inputs/get-managed-organizations.input";
 import { UpdateOrganizationInput } from "@/modules/organizations/organizations/inputs/update-managed-organization.input";
 import { CreateManagedOrganizationOutput } from "@/modules/organizations/organizations/outputs/create-managed-organization.output";
 import { GetManagedOrganizationOutput } from "@/modules/organizations/organizations/outputs/get-managed-organization.output";
@@ -102,10 +103,10 @@ export class OrganizationsOrganizationsController {
  })
  async getOrganizations(
    @Param("orgId", ParseIntPipe) managerOrganizationId: number,
-    @Query() queryPagination: SkipTakePagination
+    @Query() query: GetManagedOrganizationsInput_2024_08_13
  ): Promise<GetManagedOrganizationsOutput> {
    const { organizations, pagination: responsePagination } =
-      await this.managedOrganizationsService.getManagedOrganizations(managerOrganizationId, queryPagination);
+      await this.managedOrganizationsService.getManagedOrganizations(managerOrganizationId, query);
    return {
      status: SUCCESS_STATUS,
      data: organizations,
@@ -5,11 +5,12 @@ import { ManagedOrganizationsBillingService } from "@/modules/billing/services/m
 import { OrganizationsRepository } from "@/modules/organizations/index/organizations.repository";
 import { OrganizationsMembershipService } from "@/modules/organizations/memberships/services/organizations-membership.service";
 import { CreateOrganizationInput } from "@/modules/organizations/organizations/inputs/create-managed-organization.input";
+import { GetManagedOrganizationsInput_2024_08_13 } from "@/modules/organizations/organizations/inputs/get-managed-organizations.input";
 import { UpdateOrganizationInput } from "@/modules/organizations/organizations/inputs/update-managed-organization.input";
 import { ManagedOrganizationsRepository } from "@/modules/organizations/organizations/managed-organizations.repository";
 import { ManagedOrganizationsOutputService } from "@/modules/organizations/organizations/services/managed-organizations-output.service";
 import { ProfilesRepository } from "@/modules/profiles/profiles.repository";
-import { ForbiddenException, Injectable, NotFoundException } from "@nestjs/common";
+import { ConflictException, ForbiddenException, Injectable, NotFoundException } from "@nestjs/common";

 import { slugify } from "@calcom/platform-libraries";
 import { SkipTakePagination } from "@calcom/platform-types";
@@ -44,6 +45,18 @@ export class ManagedOrganizationsService {
      organizationData.slug = slugify(organizationData.name);
    }

+    const existingManagedOrganization =
+      await this.managedOrganizationsRepository.getManagedOrganizationBySlug(
+        managerOrganizationId,
+        organizationData.slug
+      );
+
+    if (existingManagedOrganization) {
+      throw new ConflictException(
+        `Organization with slug '${organizationData.slug}' already exists. Please, either provide a different slug or change name so that the automatically generated slug is different.`
+      );
+    }
+
    const organization = await this.managedOrganizationsRepository.createManagedOrganization(
      managerOrganizationId,
      {
@@ -101,11 +114,14 @@ export class ManagedOrganizationsService {
    return this.managedOrganizationsOutputService.getOutputManagedOrganization(organization);
  }

-  async getManagedOrganizations(managerOrganizationId: number, pagination: SkipTakePagination) {
+  async getManagedOrganizations(
+    managerOrganizationId: number,
+    query: GetManagedOrganizationsInput_2024_08_13
+  ) {
    const { items: managedOrganizations, totalItems } =
      await this.managedOrganizationsRepository.getByManagerOrganizationIdPaginated(
        managerOrganizationId,
-        pagination
+        query
      );

    return {
@@ -113,7 +129,7 @@ export class ManagedOrganizationsService {
        this.managedOrganizationsOutputService.getOutputManagedOrganization(managedOrganization)
      ),
      pagination: getPagination({
-        ...pagination,
+        ...query,
        totalCount: totalItems,
      }),
    };
@@ -93,7 +93,7 @@ export class OrganizationTeamWorkflowsController {

  @Patch("/:workflowId")
  @UseGuards(IsWorkflowInTeam)
-  @ApiOperation({ summary: "Update workflow" })
+  @ApiOperation({ summary: "Update organization team workflow" })
  @Roles("TEAM_ADMIN")
  @PlatformPlan("SCALE")
  async updateWorkflow(
@@ -1,4 +1,4 @@
-import { ApiProperty, ApiPropertyOptional, getSchemaPath } from "@nestjs/swagger";
+import { ApiExtraModels, ApiProperty, ApiPropertyOptional, getSchemaPath } from "@nestjs/swagger";
 import { Type } from "class-transformer";
 import {
  IsBoolean,
@@ -74,6 +74,24 @@ export type TriggerDtoType =
  | OnCancelTriggerDto
  | OnAfterCalVideoGuestsNoShowTriggerDto
  | OnAfterCalVideoHostsNoShowTriggerDto;
+
+@ApiExtraModels(
+  OnBeforeEventTriggerDto,
+  OnAfterEventTriggerDto,
+  OnCancelTriggerDto,
+  OnCreationTriggerDto,
+  OnRescheduleTriggerDto,
+  OnAfterCalVideoGuestsNoShowTriggerDto,
+  OnAfterCalVideoHostsNoShowTriggerDto,
+  WorkflowEmailAddressStepDto,
+  WorkflowEmailAttendeeStepDto,
+  WorkflowEmailHostStepDto,
+  WorkflowPhoneWhatsAppAttendeeStepDto,
+  WorkflowPhoneWhatsAppNumberStepDto,
+  WorkflowPhoneNumberStepDto,
+  WorkflowPhoneAttendeeStepDto,
+  BaseWorkflowTriggerDto
+)
 export class CreateWorkflowDto {
  @ApiProperty({ description: "Name of the workflow", example: "Platform Test Workflow" })
  @IsString()
@@ -86,17 +104,15 @@ export class CreateWorkflowDto {

  @ApiProperty({
    description: "Trigger configuration for the workflow",
-    items: {
-      oneOf: [
-        { $ref: getSchemaPath(OnBeforeEventTriggerDto) },
-        { $ref: getSchemaPath(OnAfterEventTriggerDto) },
-        { $ref: getSchemaPath(OnCancelTriggerDto) },
-        { $ref: getSchemaPath(OnCreationTriggerDto) },
-        { $ref: getSchemaPath(OnRescheduleTriggerDto) },
-        { $ref: getSchemaPath(OnAfterCalVideoGuestsNoShowTriggerDto) },
-        { $ref: getSchemaPath(OnAfterCalVideoHostsNoShowTriggerDto) },
-      ],
-    },
+    oneOf: [
+      { $ref: getSchemaPath(OnBeforeEventTriggerDto) },
+      { $ref: getSchemaPath(OnAfterEventTriggerDto) },
+      { $ref: getSchemaPath(OnCancelTriggerDto) },
+      { $ref: getSchemaPath(OnCreationTriggerDto) },
+      { $ref: getSchemaPath(OnRescheduleTriggerDto) },
+      { $ref: getSchemaPath(OnAfterCalVideoGuestsNoShowTriggerDto) },
+      { $ref: getSchemaPath(OnAfterCalVideoHostsNoShowTriggerDto) },
+    ],
  })
  @ValidateNested()
  @Type(() => BaseWorkflowTriggerDto, {
@@ -124,17 +140,16 @@ export class CreateWorkflowDto {

  @ApiProperty({
    description: "Steps to execute as part of the workflow",
-    items: {
-      oneOf: [
-        { $ref: getSchemaPath(WorkflowEmailAddressStepDto) },
-        { $ref: getSchemaPath(WorkflowEmailAttendeeStepDto) },
-        { $ref: getSchemaPath(WorkflowEmailHostStepDto) },
-        { $ref: getSchemaPath(WorkflowPhoneWhatsAppAttendeeStepDto) },
-        { $ref: getSchemaPath(WorkflowPhoneWhatsAppNumberStepDto) },
-        { $ref: getSchemaPath(WorkflowPhoneNumberStepDto) },
-        { $ref: getSchemaPath(WorkflowPhoneAttendeeStepDto) },
-      ],
-    },
+    oneOf: [
+      { $ref: getSchemaPath(WorkflowEmailAddressStepDto) },
+      { $ref: getSchemaPath(WorkflowEmailAttendeeStepDto) },
+      { $ref: getSchemaPath(WorkflowEmailHostStepDto) },
+      { $ref: getSchemaPath(WorkflowPhoneWhatsAppAttendeeStepDto) },
+      { $ref: getSchemaPath(WorkflowPhoneWhatsAppNumberStepDto) },
+      { $ref: getSchemaPath(WorkflowPhoneNumberStepDto) },
+      { $ref: getSchemaPath(WorkflowPhoneAttendeeStepDto) },
+    ],
+    type: "array",
  })
  @ValidateNested({ each: true })
  @ArrayMinSize(1, { message: "Your workflow must contain at least one step." })
@@ -1,4 +1,4 @@
-import { ApiProperty, ApiPropertyOptional, getSchemaPath } from "@nestjs/swagger";
+import { ApiExtraModels, ApiProperty, ApiPropertyOptional, getSchemaPath } from "@nestjs/swagger";
 import { Type } from "class-transformer";
 import { IsNumber, IsString, IsOptional, ValidateNested, ArrayMinSize } from "class-validator";

@@ -113,6 +113,23 @@ export class UpdateWhatsAppAttendeePhoneWorkflowStepDto extends WorkflowPhoneWha
  id?: number;
 }

+@ApiExtraModels(
+  OnBeforeEventTriggerDto,
+  OnAfterEventTriggerDto,
+  OnCancelTriggerDto,
+  OnCreationTriggerDto,
+  OnRescheduleTriggerDto,
+  OnAfterCalVideoGuestsNoShowTriggerDto,
+  OnAfterCalVideoHostsNoShowTriggerDto,
+  UpdateEmailAddressWorkflowStepDto,
+  UpdateEmailAttendeeWorkflowStepDto,
+  UpdateEmailHostWorkflowStepDto,
+  UpdatePhoneAttendeeWorkflowStepDto,
+  UpdatePhoneWhatsAppNumberWorkflowStepDto,
+  UpdateWhatsAppAttendeePhoneWorkflowStepDto,
+  UpdatePhoneNumberWorkflowStepDto,
+  BaseWorkflowTriggerDto
+)
 export class UpdateWorkflowDto {
  @ApiPropertyOptional({ description: "Name of the workflow", example: "Platform Test Workflow" })
  @IsString()
@@ -128,6 +145,20 @@ export class UpdateWorkflowDto {
  @IsOptional()
  activation?: WorkflowActivationDto;

+  @ApiPropertyOptional({
+    description: "Trigger configuration for the workflow",
+    oneOf: [
+      { $ref: getSchemaPath(OnBeforeEventTriggerDto) },
+      { $ref: getSchemaPath(OnAfterEventTriggerDto) },
+      { $ref: getSchemaPath(OnCancelTriggerDto) },
+      { $ref: getSchemaPath(OnCreationTriggerDto) },
+      { $ref: getSchemaPath(OnRescheduleTriggerDto) },
+      { $ref: getSchemaPath(OnAfterCalVideoGuestsNoShowTriggerDto) },
+      { $ref: getSchemaPath(OnAfterCalVideoHostsNoShowTriggerDto) },
+    ],
+  })
+  @IsOptional()
+  @ValidateNested()
  @Type(() => BaseWorkflowTriggerDto, {
    discriminator: {
      property: "type",
@@ -142,7 +173,7 @@ export class UpdateWorkflowDto {
      ],
    },
  })
-  trigger!:
+  trigger?:
    | OnAfterEventTriggerDto
    | OnBeforeEventTriggerDto
    | OnCreationTriggerDto
@@ -150,19 +181,19 @@ export class UpdateWorkflowDto {
    | OnCancelTriggerDto
    | OnAfterCalVideoGuestsNoShowTriggerDto
    | OnAfterCalVideoHostsNoShowTriggerDto;
+
  @ApiPropertyOptional({
    description: "Steps to execute as part of the workflow",
-    items: {
-      oneOf: [
-        { $ref: getSchemaPath(UpdateEmailAddressWorkflowStepDto) },
-        { $ref: getSchemaPath(UpdateEmailAttendeeWorkflowStepDto) },
-        { $ref: getSchemaPath(UpdateEmailHostWorkflowStepDto) },
-        { $ref: getSchemaPath(UpdatePhoneAttendeeWorkflowStepDto) },
-        { $ref: getSchemaPath(UpdatePhoneWhatsAppNumberWorkflowStepDto) },
-        { $ref: getSchemaPath(UpdateWhatsAppAttendeePhoneWorkflowStepDto) },
-        { $ref: getSchemaPath(UpdatePhoneNumberWorkflowStepDto) },
-      ],
-    },
+    oneOf: [
+      { $ref: getSchemaPath(UpdateEmailAddressWorkflowStepDto) },
+      { $ref: getSchemaPath(UpdateEmailAttendeeWorkflowStepDto) },
+      { $ref: getSchemaPath(UpdateEmailHostWorkflowStepDto) },
+      { $ref: getSchemaPath(UpdatePhoneAttendeeWorkflowStepDto) },
+      { $ref: getSchemaPath(UpdatePhoneWhatsAppNumberWorkflowStepDto) },
+      { $ref: getSchemaPath(UpdateWhatsAppAttendeePhoneWorkflowStepDto) },
+      { $ref: getSchemaPath(UpdatePhoneNumberWorkflowStepDto) },
+    ],
+    type: "array",
  })
  @ValidateNested({ each: true })
  @ArrayMinSize(1, { message: "Your workflow must contain at least one step." })
@@ -35,4 +35,5 @@ process.env = {
  VAPID_PRIVATE_KEY: "6cJtkASCar5sZWguIAW7OjvyixpBw9p8zL8WDDwk9Jk",
  CALENDSO_ENCRYPTION_KEY: "22gfxhWUlcKliUeXcu8xNah2+HP/29ZX",
  INTEGRATION_TEST_MODE: "true",
+  e2e: "true",
 };
@@ -3,11 +3,15 @@ import type { PageProps, ReadonlyHeaders, ReadonlyRequestCookies } from "app/_ty
 import { _generateMetadata, getTranslate } from "app/_utils";
 import { unstable_cache } from "next/cache";
 import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";

+import { checkAdminOrOwner } from "@calcom/features/auth/lib/checkAdminOrOwner";
+import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
 import { AvailabilitySliderTable } from "@calcom/features/timezone-buddy/components/AvailabilitySliderTable";
 import { OrganizationRepository } from "@calcom/lib/server/repository/organization";
 import { availabilityRouter } from "@calcom/trpc/server/routers/viewer/availability/_router";
-import { meRouter } from "@calcom/trpc/server/routers/viewer/me/_router";
+
+import { buildLegacyRequest } from "@lib/buildLegacyCtx";

 import { AvailabilityList, AvailabilityCTA } from "~/availability/availability-view";

@@ -23,15 +27,6 @@ export const generateMetadata = async () => {
  );
 };

-const getCachedMe = unstable_cache(
-  async (headers: ReadonlyHeaders, cookies: ReadonlyRequestCookies) => {
-    const meCaller = await createRouterCaller(meRouter, await getTRPCContext(headers, cookies));
-    return await meCaller.get();
-  },
-  ["viewer.me.get"],
-  { revalidate: 3600 } // Cache for 1 hour
-);
-
 const getCachedAvailabilities = unstable_cache(
  async (headers: ReadonlyHeaders, cookies: ReadonlyRequestCookies) => {
    const availabilityCaller = await createRouterCaller(
@@ -49,11 +44,12 @@ const Page = async ({ searchParams: _searchParams }: PageProps) => {
  const t = await getTranslate();
  const _headers = await headers();
  const _cookies = await cookies();
+  const session = await getServerSession({ req: buildLegacyRequest(_headers, _cookies) });
+  if (!session?.user?.id) {
+    return redirect("/auth/login");
+  }

-  const [me, cachedAvailabilities] = await Promise.all([
-    getCachedMe(_headers, _cookies),
-    getCachedAvailabilities(_headers, _cookies),
-  ]);
+  const cachedAvailabilities = await getCachedAvailabilities(_headers, _cookies);

  // Transform the data to ensure startTime, endTime, and date are Date objects
  // This is because the data is cached and as a result the data is converted to a string
@@ -70,13 +66,14 @@ const Page = async ({ searchParams: _searchParams }: PageProps) => {
    })),
  };

-  const organizationId = me.organization?.id ?? me.profiles[0]?.organizationId;
+  const organizationId = session?.user?.profile?.organizationId ?? session?.user.org?.id;
  const isOrgPrivate = organizationId
    ? await OrganizationRepository.checkIfPrivate({
        orgId: organizationId,
      })
    : false;
-  const canViewTeamAvailability = me.organization?.isOrgAdmin || !isOrgPrivate;
+  const isOrgAdminOrOwner = checkAdminOrOwner(session?.user?.org?.role);
+  const canViewTeamAvailability = isOrgAdminOrOwner || !isOrgPrivate;

  return (
    <ShellMainAppDir
@@ -91,9 +88,9 @@ const Page = async ({ searchParams: _searchParams }: PageProps) => {
        />
      }>
      {searchParams?.type === "team" && canViewTeamAvailability ? (
-        <AvailabilitySliderTable userTimeFormat={me?.timeFormat ?? null} isOrg={!!organizationId} />
+        <AvailabilitySliderTable isOrg={!!organizationId} />
      ) : (
-        <AvailabilityList availabilities={availabilities ?? { schedules: [] }} me={me} />
+        <AvailabilityList availabilities={availabilities ?? { schedules: [] }} />
      )}
    </ShellMainAppDir>
  );
@@ -9,9 +9,8 @@ import { redirect } from "next/navigation";
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
 import { getTeamsFiltersFromQuery } from "@calcom/features/filters/lib/getTeamsFiltersFromQuery";
 import { eventTypesRouter } from "@calcom/trpc/server/routers/viewer/eventTypes/_router";
-import { meRouter } from "@calcom/trpc/server/routers/viewer/me/_router";

-import { buildLegacyCtx } from "@lib/buildLegacyCtx";
+import { buildLegacyRequest } from "@lib/buildLegacyCtx";

 import EventTypes, { EventTypesCTA } from "~/event-types/views/event-types-listing-view";

@@ -24,15 +23,6 @@ export const generateMetadata = async () =>
    "/event-types"
  );

-const getCachedMe = unstable_cache(
-  async (headers: ReadonlyHeaders, cookies: ReadonlyRequestCookies) => {
-    const meCaller = await createRouterCaller(meRouter, await getTRPCContext(headers, cookies));
-    return await meCaller.get();
-  },
-  ["viewer.me.get"],
-  { revalidate: 3600 } // seconds
-);
-
 const getCachedEventGroups = unstable_cache(
  async (
    headers: ReadonlyHeaders,
@@ -53,30 +43,26 @@ const getCachedEventGroups = unstable_cache(
  { revalidate: 3600 } // seconds
 );

-const Page = async ({ params, searchParams }: PageProps) => {
+const Page = async ({ searchParams }: PageProps) => {
  const _searchParams = await searchParams;
  const _headers = await headers();
  const _cookies = await cookies();
-  const context = buildLegacyCtx(_headers, _cookies, await params, _searchParams);
-  const session = await getServerSession({ req: context.req });

+  const session = await getServerSession({ req: buildLegacyRequest(_headers, _cookies) });
  if (!session?.user?.id) {
-    redirect("/auth/login");
+    return redirect("/auth/login");
  }

  const t = await getTranslate();
  const filters = getTeamsFiltersFromQuery(_searchParams);
-  const [me, userEventGroupsData] = await Promise.all([
-    getCachedMe(_headers, _cookies),
-    getCachedEventGroups(_headers, _cookies, filters),
-  ]);
+  const userEventGroupsData = await getCachedEventGroups(_headers, _cookies, filters);

  return (
    <ShellMainAppDir
      heading={t("event_types_page_title")}
      subtitle={t("event_types_page_subtitle")}
      CTA={<EventTypesCTA userEventGroupsData={userEventGroupsData} />}>
-      <EventTypes userEventGroupsData={userEventGroupsData} user={me} />
+      <EventTypes userEventGroupsData={userEventGroupsData} user={session.user} />
    </ShellMainAppDir>
  );
 };
@@ -92,7 +92,8 @@ const getTabs = (orgBranding: OrganizationBranding | null) => {
          ? [
              {
                name: "members",
-                href: `/settings/organizations/${orgBranding.slug}/members`,
+                href: "https://app.cal.com/settings/organizations/i/members",
+                isExternalLink: true,
              },
            ]
          : []),
@@ -400,12 +401,6 @@ const TeamListCollapsible = () => {
                    textClassNames="px-3 text-emphasis font-medium text-sm"
                    disableChevron
                  />
-                  <VerticalTabItem
-                    name={t("event_types_page_title")}
-                    href={`/event-types?teamId=${team.id}`}
-                    textClassNames="px-3 text-emphasis font-medium text-sm"
-                    disableChevron
-                  />
                  {(checkAdminOrOwner(team.role) ||
                    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
                    // @ts-ignore this exists wtf?
@@ -15,19 +15,20 @@ import { useLocale } from "@calcom/lib/hooks/useLocale";
 import { HttpError } from "@calcom/lib/http-error";
 import type { RouterOutputs } from "@calcom/trpc/react";
 import { trpc } from "@calcom/trpc/react";
+import useMeQuery from "@calcom/trpc/react/hooks/useMeQuery";
 import { EmptyScreen } from "@calcom/ui/components/empty-screen";
 import { ToggleGroup } from "@calcom/ui/components/form";
 import { showToast } from "@calcom/ui/components/toast";

 type AvailabilityListProps = {
-  me: RouterOutputs["viewer"]["me"]["get"];
  availabilities: RouterOutputs["viewer"]["availability"]["list"];
 };
-export function AvailabilityList({ availabilities, me }: AvailabilityListProps) {
+export function AvailabilityList({ availabilities }: AvailabilityListProps) {
  const { t } = useLocale();
  const [bulkUpdateModal, setBulkUpdateModal] = useState(false);
  const utils = trpc.useUtils();
  const router = useRouter();
+  const { data: user } = useMeQuery();

  const deleteMutation = trpc.viewer.availability.schedule.delete.useMutation({
    onMutate: async ({ scheduleId }) => {
@@ -141,9 +142,9 @@ export function AvailabilityList({ availabilities, me }: AvailabilityListProps)
              {availabilities.schedules.map((schedule) => (
                <ScheduleListItem
                  displayOptions={{
-                    hour12: me?.timeFormat ? me.timeFormat === 12 : undefined,
-                    timeZone: me?.timeZone,
-                    weekStart: me?.weekStart || "Sunday",
+                    hour12: user?.timeFormat ? user.timeFormat === 12 : undefined,
+                    timeZone: user?.timeZone,
+                    weekStart: user?.weekStart || "Sunday",
                  }}
                  key={schedule.id}
                  schedule={schedule}
@@ -558,6 +558,14 @@ export default function Success(props: PageProps) {
                            <div className="col-span-2 mb-6 last:mb-0">{cancellationReason}</div>
                          </>
                        )}
+                        {isCancelled && bookingInfo?.cancelledBy && (
+                          <>
+                            <div className="font-medium">{t("cancelled_by")}</div>
+                            <div className="col-span-2 mb-6 last:mb-0">
+                              <p className="break-words">{bookingInfo?.cancelledBy}</p>
+                            </div>
+                          </>
+                        )}
                        {previousBooking && (
                          <>
                            <div className="font-medium">{t("rescheduled_by")}</div>
@@ -928,7 +928,10 @@ const InfiniteScrollMain = ({

 type Props = {
  userEventGroupsData: GetUserEventGroupsResponse;
-  user: RouterOutputs["viewer"]["me"]["get"];
+  user: {
+    id: number;
+    completedOnboarding?: boolean;
+  } | null;
 };

 export const EventTypesCTA = ({ userEventGroupsData }: Omit<Props, "user">) => {
@@ -1,6 +1,6 @@
 {
  "name": "@calcom/web",
-  "version": "5.4.19",
+  "version": "5.4.20",
  "private": true,
  "scripts": {
    "analyze": "ANALYZE=true next build",
@@ -75,6 +75,7 @@
  "you_can_view_booking_details_with_this_url": "You can view the booking details from this url {{url}} and add the event to your calendar",
  "no_options_available": "No options available",
  "cancellation_reason": "Reason for cancellation (optional)",
+  "cancelled_by":"Cancelled By",
  "cancellation_reason_host": "Reason for cancellation",
  "cancellation_reason_placeholder": "Why are you cancelling?",
  "notify_attendee_cancellation_reason_warning": "Cancellation reason will be shared with guests",
@@ -3361,5 +3362,6 @@
  "license_validation_failed": "Failed to validate license key",
  "license_key_saved": "License key saved successfully",
  "timezone_mismatch_tooltip": "You are viewing the report based on your profile timezone ({{userTimezone}}), while your browser is set to timezone ({{browserTimezone}})",
+  "event_type_no_hosts": "No hosts are assigned to event type",
  "ADD_NEW_STRINGS_ABOVE_THIS_LINE_TO_PREVENT_MERGE_CONFLICTS": "↑↑↑↑↑↑↑↑↑↑↑↑↑ Add your new strings above here ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑"
 }
@@ -60,7 +60,7 @@ use the `<CreateEventType />` component while passing `teamId={teamId}` to it to
 ```js
 import { CreateEventType } from "@calcom/atoms";

-export default function TeamEventType(teamId: number) {l
+export default function TeamEventType(teamId: number) {
  return (
    <>
      <CreateEventType
@@ -279,4 +279,4 @@ The payments tab lets you accept payments for your events. At the moment we only

 Once you connect your Stripe account, you can set a custom price along with the currency and payment option; which will determine when to charge your customers.

-<img src="/images/StripeConnected.png" alt="Payments tab with stripe connected" />
+<img src="/images/StripeConnected.png" alt="Payments tab with stripe connected" />
@@ -96,6 +96,7 @@ export async function getServerSession(options: {
      email: user.email,
      emailVerified: user.emailVerified,
      email_verified: user.emailVerified !== null,
+      completedOnboarding: user.completedOnboarding,
      role: user.role,
      image: getUserAvatarUrl({
        avatarUrl: user.avatarUrl,
@@ -19,6 +19,7 @@ const getUserBooking = async (uid: string) => {
      status: true,
      metadata: true,
      cancellationReason: true,
+      cancelledBy: true,
      responses: true,
      rejectionReason: true,
      userPrimaryEmail: true,
@@ -20,6 +20,7 @@ import {
  enrichHostsWithDelegationCredentials,
  enrichUserWithDelegationCredentialsIncludeServiceAccountKey,
 } from "@calcom/lib/delegationCredential/server";
+import { ErrorCode } from "@calcom/lib/errorCodes";
 import { getEventName } from "@calcom/lib/event";
 import { IdempotencyKeyService } from "@calcom/lib/idempotencyKey/idempotencyKeyService";
 import { isPrismaObjOrUndefined } from "@calcom/lib/isPrismaObj";
@@ -99,6 +100,10 @@ export const roundRobinReassignment = async ({
        createdAt: new Date(0), // use earliest possible date as fallback
      }));

+  if (eventType.hosts.length === 0) {
+    throw new Error(ErrorCode.EventTypeNoHosts);
+  }
+
  const roundRobinHosts = eventType.hosts.filter((host) => !host.isFixed);

  const originalOrganizer = booking.user;
@@ -104,9 +104,10 @@ export default function RequiresConfirmationController({
              LockedIcon={requiresConfirmationLockedProps.LockedIcon}
              onCheckedChange={(val) => {
                formMethods.setValue("requiresConfirmation", val, { shouldDirty: true });
-                // If we uncheck requires confirmation, we also uncheck the "will block slot" checkbox
+                // If we uncheck requires confirmation, we also uncheck these checkboxes
                if (!val) {
                  formMethods.setValue("requiresConfirmationWillBlockSlot", false, { shouldDirty: true });
+                  formMethods.setValue("requiresConfirmationForFreeEmail", false, { shouldDirty: true });
                }
                onRequiresConfirmation(val);
              }}>
@@ -1,4 +1,4 @@
-import { Fragment, useCallback, useEffect, useMemo, useRef, useState } from "react";
+import React, { Fragment, useCallback, useEffect, useMemo, useRef, useState } from "react";
 import type {
  ArrayPath,
  Control,
@@ -10,7 +10,7 @@ import type {
  UseFieldArrayRemove,
 } from "react-hook-form";
 import { Controller, useFieldArray, useFormContext } from "react-hook-form";
-import type { GroupBase, Props } from "react-select";
+import { createFilter, type GroupBase, type Props } from "react-select";

 import type { scheduleClassNames } from "@calcom/atoms/availability/types";
 import type { ConfigType } from "@calcom/dayjs";
@@ -20,6 +20,7 @@ import { useLocale } from "@calcom/lib/hooks/useLocale";
 import { weekdayNames } from "@calcom/lib/weekday";
 import useMeQuery from "@calcom/trpc/react/hooks/useMeQuery";
 import type { TimeRange } from "@calcom/types/schedule";
+
 import cn from "@calcom/ui/classNames";
 import { Button } from "@calcom/ui/components/button";
 import { Dropdown, DropdownMenuContent, DropdownMenuTrigger } from "@calcom/ui/components/dropdown";
@@ -396,9 +397,36 @@ const LazySelect = ({
    filter({ current: value });
  }, [filter, value]);

+  const [inputValue, setInputValue] = React.useState("");
+  const defaultFilter = React.useMemo(() => createFilter(), []);
+  const filteredOptions = React.useMemo(() => {
+    const regex = /^(\d{1,2})(a|p|am|pm)$/i;
+    const match = inputValue.replaceAll(" ", "").match(regex);
+    if (!match) {
+      return options.filter((option) =>
+        defaultFilter({ ...option, data: option.label, value: option.label }, inputValue)
+      );
+    }
+
+    const [, numberPart, periodPart] = match;
+    const periodLower = periodPart.toLowerCase();
+    const scoredOptions = options
+      .filter((option) => option.label && option.label.toLowerCase().includes(periodLower))
+      .map((option) => {
+        const labelLower = option.label.toLowerCase();
+        const index = labelLower.indexOf(numberPart);
+        const score = index >= 0 ? index + labelLower.length : Infinity;
+        return { score, option };
+      })
+      .sort((a, b) => a.score - b.score);
+
+    const maxScore = scoredOptions[0]?.score;
+    return scoredOptions.filter((item) => item.score === maxScore).map((item) => item.option);
+  }, [inputValue, options, defaultFilter]);
+
  return (
    <Select
-      options={options}
+      options={filteredOptions}
      onMenuOpen={() => {
        if (min) filter({ offset: min });
        if (max) filter({ limit: max });
@@ -408,6 +436,8 @@ const LazySelect = ({
      value={options.find((option) => option.value === dayjs(value).toDate().valueOf())}
      onMenuClose={() => filter({ current: value })}
      components={{ DropdownIndicator: () => null, IndicatorSeparator: () => null }}
+      onInputChange={setInputValue}
+      filterOption={() => true}
      {...props}
    />
  );
@@ -67,7 +67,7 @@ function UpgradeTeamTip() {
  );
 }

-export function AvailabilitySliderTable(props: { userTimeFormat: number | null; isOrg: boolean }) {
+export function AvailabilitySliderTable(props: { isOrg: boolean }) {
  return (
    <DataTableProvider>
      <AvailabilitySliderTableContent {...props} />
@@ -75,7 +75,7 @@ export function AvailabilitySliderTable(props: { userTimeFormat: number | null;
  );
 }

-function AvailabilitySliderTableContent(props: { userTimeFormat: number | null; isOrg: boolean }) {
+function AvailabilitySliderTableContent(props: { isOrg: boolean }) {
  const tableContainerRef = useRef<HTMLDivElement>(null);
  const [browsingDate, setBrowsingDate] = useState(dayjs());
  const [editSheetOpen, setEditSheetOpen] = useState(false);
@@ -0,0 +1,452 @@
+import type { DestinationCalendar } from "@prisma/client";
+import { describe, expect, it, vi, beforeEach } from "vitest";
+
+import { symmetricDecrypt } from "@calcom/lib/crypto";
+import type { CredentialForCalendarService } from "@calcom/types/Credential";
+
+import EventManager from "./EventManager";
+
+vi.mock("@calcom/lib/crypto", () => ({
+  symmetricDecrypt: vi.fn(),
+}));
+
+const mockedSymmetricDecrypt = vi.mocked(symmetricDecrypt);
+
+function buildCalDAVCredential(data: {
+  id: number;
+  key: string;
+  userId?: number;
+}): CredentialForCalendarService {
+  return {
+    id: data.id,
+    type: "caldav_calendar",
+    key: data.key,
+    userId: data.userId || 1,
+    user: { email: "test@example.com" },
+    teamId: null,
+    appId: "caldav-calendar",
+    invalid: false,
+    delegatedTo: null,
+    delegationCredentialId: null,
+  };
+}
+
+function buildDestinationCalendar(data: {
+  id: number;
+  integration: string;
+  externalId: string | null;
+}): DestinationCalendar {
+  return {
+    id: data.id,
+    integration: data.integration,
+    externalId: data.externalId || "",
+    userId: 1,
+    eventTypeId: null,
+    credentialId: null,
+    primaryEmail: null,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    delegationCredentialId: null,
+    domainWideDelegationCredentialId: null,
+  };
+}
+
+describe("EventManager CalDAV credential validation", () => {
+  let eventManager: EventManager;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    eventManager = new EventManager({
+      credentials: [],
+      destinationCalendar: null,
+    });
+  });
+
+  describe("extractServerUrlFromCredential", () => {
+    it("should extract server URL from valid CalDAV credential", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "https://caldav.example.com/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).extractServerUrlFromCredential(credential);
+      expect(result).toBe("https://caldav.example.com");
+      expect(mockedSymmetricDecrypt).toHaveBeenCalledWith(
+        "encrypted_key",
+        process.env.CALENDSO_ENCRYPTION_KEY || ""
+      );
+    });
+
+    it("should return null for non-CalDAV credential", () => {
+      const credential = {
+        ...buildCalDAVCredential({ id: 1, key: "encrypted_key" }),
+        type: "google_calendar",
+      } as CredentialForCalendarService;
+
+      const result = (eventManager as any).extractServerUrlFromCredential(credential);
+      expect(result).toBeNull();
+      expect(mockedSymmetricDecrypt).not.toHaveBeenCalled();
+    });
+
+    it("should return null when decryption fails", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "invalid_key",
+      });
+
+      mockedSymmetricDecrypt.mockImplementation(() => {
+        throw new Error("Decryption failed");
+      });
+
+      const result = (eventManager as any).extractServerUrlFromCredential(credential);
+      expect(result).toBeNull();
+    });
+
+    it("should return null when decrypted data has no URL", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+        })
+      );
+
+      const result = (eventManager as any).extractServerUrlFromCredential(credential);
+      expect(result).toBeNull();
+    });
+
+    it("should return null when URL is invalid", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "invalid-url",
+        })
+      );
+
+      const result = (eventManager as any).extractServerUrlFromCredential(credential);
+      expect(result).toBeNull();
+    });
+
+    it("should handle URLs with different ports", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "https://caldav.example.com:8443/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).extractServerUrlFromCredential(credential);
+      expect(result).toBe("https://caldav.example.com:8443");
+    });
+
+    it("should handle HTTP URLs", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "http://caldav.internal.com/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).extractServerUrlFromCredential(credential);
+      expect(result).toBe("http://caldav.internal.com");
+    });
+  });
+
+  describe("extractServerUrlFromDestination", () => {
+    it("should extract server URL from CalDAV destination calendar", () => {
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://caldav.example.com/dav/calendars/user/calendar1/",
+      });
+
+      const result = (eventManager as any).extractServerUrlFromDestination(destination);
+      expect(result).toBe("https://caldav.example.com");
+    });
+
+    it("should return null for non-CalDAV destination", () => {
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "google_calendar",
+        externalId: "calendar@gmail.com",
+      });
+
+      const result = (eventManager as any).extractServerUrlFromDestination(destination);
+      expect(result).toBeNull();
+    });
+
+    it("should return null when externalId is null", () => {
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: null,
+      });
+
+      const result = (eventManager as any).extractServerUrlFromDestination(destination);
+      expect(result).toBeNull();
+    });
+
+    it("should return null when externalId is invalid URL", () => {
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "invalid-url",
+      });
+
+      const result = (eventManager as any).extractServerUrlFromDestination(destination);
+      expect(result).toBeNull();
+    });
+
+    it("should handle URLs with different ports", () => {
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://caldav.example.com:8443/dav/calendars/user/calendar1/",
+      });
+
+      const result = (eventManager as any).extractServerUrlFromDestination(destination);
+      expect(result).toBe("https://caldav.example.com:8443");
+    });
+
+    it("should handle HTTP URLs", () => {
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "http://caldav.internal.com/dav/calendars/user/calendar1/",
+      });
+
+      const result = (eventManager as any).extractServerUrlFromDestination(destination);
+      expect(result).toBe("http://caldav.internal.com");
+    });
+  });
+
+  describe("credentialMatchesDestination", () => {
+    it("should return true for matching CalDAV server URLs", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://caldav.example.com/dav/calendars/user/calendar1/",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "https://caldav.example.com/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(true);
+    });
+
+    it("should return false for non-matching CalDAV server URLs", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://different.example.com/dav/calendars/user/calendar1/",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "https://caldav.example.com/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(false);
+    });
+
+    it("should return true for non-CalDAV credentials", () => {
+      const credential = {
+        ...buildCalDAVCredential({ id: 1, key: "encrypted_key" }),
+        type: "google_calendar",
+      } as CredentialForCalendarService;
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "google_calendar",
+        externalId: "calendar@gmail.com",
+      });
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(true);
+      expect(symmetricDecrypt).not.toHaveBeenCalled();
+    });
+
+    it("should return true when credential is CalDAV but destination is not", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "google_calendar",
+        externalId: "calendar@gmail.com",
+      });
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(true);
+      expect(symmetricDecrypt).not.toHaveBeenCalled();
+    });
+
+    it("should return false when credential URL extraction fails", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "invalid_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://caldav.example.com/dav/calendars/user/calendar1/",
+      });
+
+      mockedSymmetricDecrypt.mockImplementation(() => {
+        throw new Error("Decryption failed");
+      });
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(false);
+    });
+
+    it("should return false when destination URL extraction fails", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "invalid-url",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "https://caldav.example.com/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(false);
+    });
+
+    it("should handle URLs with different paths but same server", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://caldav.example.com/different/path/calendar1/",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "https://caldav.example.com/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(true);
+    });
+
+    it("should handle URLs with different ports as non-matching", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://caldav.example.com:8443/dav/calendars/user/calendar1/",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "https://caldav.example.com:9443/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(false);
+    });
+
+    it("should handle HTTP vs HTTPS as non-matching", () => {
+      const credential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_key",
+      });
+
+      const destination = buildDestinationCalendar({
+        id: 1,
+        integration: "caldav_calendar",
+        externalId: "https://caldav.example.com/dav/calendars/user/calendar1/",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "http://caldav.example.com/dav/calendars/user/",
+        })
+      );
+
+      const result = (eventManager as any).credentialMatchesDestination(credential, destination);
+      expect(result).toBe(false);
+    });
+  });
+});
@@ -12,6 +12,7 @@ import getApps from "@calcom/app-store/utils";
 import { FeaturesRepository } from "@calcom/features/flags/features.repository";
 import { getUid } from "@calcom/lib/CalEventParser";
 import CRMScheduler from "@calcom/lib/crmManager/tasker/crmScheduler";
+import { symmetricDecrypt } from "@calcom/lib/crypto";
 import logger from "@calcom/lib/logger";
 import {
  getPiiFreeDestinationCalendar,
@@ -40,6 +41,8 @@ import { isDelegationCredential } from "./delegationCredential/clientAndServer";
 import { createMeeting, updateMeeting, deleteMeeting } from "./videoClient";

 const log = logger.getSubLogger({ prefix: ["EventManager"] });
+const CALENDSO_ENCRYPTION_KEY = process.env.CALENDSO_ENCRYPTION_KEY || "";
+const CALDAV_CALENDAR_TYPE = "caldav_calendar";
 export const isDedicatedIntegration = (location: string): boolean => {
  return location !== MeetLocationType && location.includes("integrations:");
 };
@@ -172,6 +175,82 @@ export default class EventManager {
    this.appOptions = eventTypeAppMetadata;
  }

+  private extractServerUrlFromCredential(credential: CredentialForCalendarService): string | null {
+    try {
+      if (credential.type !== CALDAV_CALENDAR_TYPE) {
+        return null;
+      }
+
+      const decryptedData = JSON.parse(symmetricDecrypt(credential.key as string, CALENDSO_ENCRYPTION_KEY));
+
+      if (!decryptedData.url) {
+        return null;
+      }
+
+      const url = new URL(decryptedData.url);
+      return `${url.protocol}//${url.host}`;
+    } catch (error) {
+      log.warn("Failed to extract server URL from CalDAV credential", {
+        credentialId: credential.id,
+        error: error instanceof Error ? error.message : "Unknown error",
+      });
+      return null;
+    }
+  }
+
+  private extractServerUrlFromDestination(destination: DestinationCalendar): string | null {
+    try {
+      if (destination.integration !== CALDAV_CALENDAR_TYPE || !destination.externalId) {
+        return null;
+      }
+
+      const url = new URL(destination.externalId);
+      return `${url.protocol}//${url.host}`;
+    } catch (error) {
+      log.warn("Failed to extract server URL from destination calendar", {
+        destinationId: destination.id,
+        externalId: destination.externalId,
+        error: error instanceof Error ? error.message : "Unknown error",
+      });
+      return null;
+    }
+  }
+
+  private credentialMatchesDestination(
+    credential: CredentialForCalendarService,
+    destination: DestinationCalendar
+  ): boolean {
+    if (credential.type !== CALDAV_CALENDAR_TYPE || destination.integration !== CALDAV_CALENDAR_TYPE) {
+      return true;
+    }
+
+    const credentialServerUrl = this.extractServerUrlFromCredential(credential);
+    const destinationServerUrl = this.extractServerUrlFromDestination(destination);
+
+    if (!credentialServerUrl || !destinationServerUrl) {
+      log.warn("Could not extract server URLs for CalDAV credential validation", {
+        credentialId: credential.id,
+        destinationId: destination.id,
+        credentialServerUrl,
+        destinationServerUrl,
+      });
+      return false;
+    }
+
+    const matches = credentialServerUrl === destinationServerUrl;
+
+    if (!matches) {
+      log.warn("CalDAV credential server URL does not match destination calendar server URL", {
+        credentialId: credential.id,
+        destinationId: destination.id,
+        credentialServerUrl,
+        destinationServerUrl,
+      });
+    }
+
+    return matches;
+  }
+
  /**
   * Takes a CalendarEvent and creates all necessary integration entries for it.
   * When a video integration is chosen as the event's location, a video integration
@@ -774,18 +853,33 @@ export default class EventManager {
            }
          }
        } else {
-          const destinationCalendarCredentials = this.calendarCredentials.filter(
-            (c) => c.type === destination.integration
-          );
+          const destinationCalendarCredentials = this.calendarCredentials.filter((c) => {
+            if (c.type !== destination.integration) return false;
+
+            if (c.type === CALDAV_CALENDAR_TYPE) {
+              return this.credentialMatchesDestination(c, destination);
+            }
+
+            return true;
+          });
          // It might not be the first connected calendar as it seems that the order is not guaranteed to be ascending of credentialId.
          const firstCalendarCredential = destinationCalendarCredentials[0] as
            | (typeof destinationCalendarCredentials)[number]
            | undefined;

          if (!firstCalendarCredential) {
-            log.warn(
-              "No other credentials found of the same type as the destination calendar. Falling back to first connected calendar"
-            );
+            if (destination.integration === CALDAV_CALENDAR_TYPE) {
+              log.warn(
+                "No CalDAV credentials found with matching server URL for destination calendar. This prevents credential leakage.",
+                safeStringify({
+                  destination: getPiiFreeDestinationCalendar(destination),
+                })
+              );
+            } else {
+              log.warn(
+                "No other credentials found of the same type as the destination calendar. Falling back to first connected calendar"
+              );
+            }
            await fallbackToFirstCalendarInTheList();
          } else {
            log.warn(
@@ -23,4 +23,5 @@ export enum ErrorCode {
  BookerLimitExceededReschedule = "booker_limit_exceeded_error_reschedule",
  BookingNotAllowedByRestrictionSchedule = "booking_not_allowed_by_restriction_schedule_error",
  RestrictionScheduleNotFound = "restriction_schedule_not_found_error",
+  EventTypeNoHosts = "event_type_no_hosts",
 }
@@ -7,7 +7,17 @@ import logger from "@calcom/lib/logger";
 import type { EventBusyDate } from "@calcom/types/Calendar";
 import type { CredentialForCalendarService, CredentialPayload } from "@calcom/types/Credential";

-import getCalendarsEvents, { getCalendarsEventsWithTimezones } from "./getCalendarsEvents";
+import { symmetricDecrypt } from "./crypto";
+import getCalendarsEvents, {
+  getCalendarsEventsWithTimezones,
+  filterSelectedCalendarsForCredential,
+} from "./getCalendarsEvents";
+
+vi.mock("./crypto", () => ({
+  symmetricDecrypt: vi.fn(),
+}));
+
+const mockedSymmetricDecrypt = vi.mocked(symmetricDecrypt);

 function buildDelegationCredential(credential: CredentialPayload): CredentialForCalendarService {
  return {
@@ -49,6 +59,12 @@ function buildSelectedCalendar(credential: {
    delegationCredentialId: null,
    domainWideDelegationCredentialId: null,
    error: null,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    lastErrorAt: null,
+    watchAttempts: 0,
+    unwatchAttempts: 0,
+    maxAttempts: 3,
    ...credential,
  };
 }
@@ -73,6 +89,8 @@ describe("getCalendarsEvents", () => {
      teamId: null,
      appId: "exampleApp",
      invalid: false,
+      delegationCredentialId: null,
+      user: null,
    };
  });

@@ -324,6 +342,7 @@ describe("getCalendarsEventsWithTimezones", () => {
      user: null,
      appId: "exampleApp",
      invalid: false,
+      delegationCredentialId: null,
    };
  });

@@ -471,3 +490,214 @@ describe("getCalendarsEventsWithTimezones", () => {
    });
  });
 });
+
+// CalDAV Credential Leak Prevention Tests
+describe("CalDAV credential leak prevention", () => {
+  function buildCalDAVCredential(data: {
+    id: number;
+    key: string;
+    userId?: number;
+  }): CredentialForCalendarService {
+    return {
+      id: data.id,
+      type: "caldav_calendar",
+      key: data.key,
+      userId: data.userId || 1,
+      user: { email: "test@example.com" },
+      teamId: null,
+      appId: "caldav-calendar",
+      invalid: false,
+      delegatedTo: null,
+      delegationCredentialId: null,
+    };
+  }
+
+  function buildCalDAVSelectedCalendar(data: {
+    id: string;
+    externalId: string;
+    credentialId?: number;
+  }): SelectedCalendar {
+    return {
+      id: data.id,
+      userId: 1,
+      integration: "caldav_calendar",
+      externalId: data.externalId,
+      credentialId: data.credentialId || null,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+      googleChannelId: null,
+      googleChannelKind: null,
+      googleChannelResourceId: null,
+      googleChannelResourceUri: null,
+      googleChannelExpiration: null,
+      delegationCredentialId: null,
+      domainWideDelegationCredentialId: null,
+      error: null,
+      lastErrorAt: null,
+      watchAttempts: 0,
+      unwatchAttempts: 0,
+      maxAttempts: 3,
+      eventTypeId: null,
+    };
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe("filterSelectedCalendarsForCredential", () => {
+    it("prevents CalDAV credential leak by matching server URLs", () => {
+      // Setup: Two CalDAV servers with different URLs
+      const serverACredential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_server_a_key",
+      });
+
+      const serverBCredential = buildCalDAVCredential({
+        id: 2,
+        key: "encrypted_server_b_key",
+      });
+
+      // Mock encrypted credential data for different servers
+      mockedSymmetricDecrypt
+        .mockReturnValueOnce(
+          JSON.stringify({
+            username: "user_a",
+            password: "pass_a",
+            url: "https://server-a.example.com/dav/calendars/user/",
+          })
+        )
+        .mockReturnValueOnce(
+          JSON.stringify({
+            username: "user_b",
+            password: "pass_b",
+            url: "https://server-b.example.com/dav/calendars/user/",
+          })
+        );
+
+      // Selected calendars from both servers
+      const selectedCalendars = [
+        buildCalDAVSelectedCalendar({
+          id: "cal_1",
+          externalId: "https://server-a.example.com/dav/calendars/user/calendar1/",
+          credentialId: 1,
+        }),
+        buildCalDAVSelectedCalendar({
+          id: "cal_2",
+          externalId: "https://server-b.example.com/dav/calendars/user/calendar2/",
+          credentialId: 2,
+        }),
+      ];
+
+      // Test Server A credential - should only return Server A calendars
+      const serverACalendars = filterSelectedCalendarsForCredential(selectedCalendars, serverACredential);
+      expect(serverACalendars).toHaveLength(1);
+      expect(serverACalendars[0].externalId).toBe(
+        "https://server-a.example.com/dav/calendars/user/calendar1/"
+      );
+
+      // Test Server B credential - should only return Server B calendars
+      const serverBCalendars = filterSelectedCalendarsForCredential(selectedCalendars, serverBCredential);
+      expect(serverBCalendars).toHaveLength(1);
+      expect(serverBCalendars[0].externalId).toBe(
+        "https://server-b.example.com/dav/calendars/user/calendar2/"
+      );
+    });
+
+    it("demonstrates the credential leak that existed before the fix", () => {
+      // This test shows what WOULD happen with naive filtering (integration type only)
+      const serverACredential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_server_a_key",
+      });
+
+      const selectedCalendars = [
+        buildCalDAVSelectedCalendar({
+          id: "cal_1",
+          externalId: "https://server-a.example.com/dav/calendars/user/calendar1/",
+          credentialId: 1,
+        }),
+        buildCalDAVSelectedCalendar({
+          id: "cal_2",
+          externalId: "https://server-b.example.com/dav/calendars/user/calendar2/",
+          credentialId: 2,
+        }),
+      ];
+
+      // Legacy filtering (type-only) would return ALL CalDAV calendars
+      const legacyFiltering = selectedCalendars.filter((sc) => sc.integration === "caldav_calendar");
+      expect(legacyFiltering).toHaveLength(2); // This demonstrates the leak - both calendars returned
+
+      // Our new filtering prevents this
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user_a",
+          password: "pass_a",
+          url: "https://server-a.example.com/dav/calendars/user/",
+        })
+      );
+
+      const secureFiltering = filterSelectedCalendarsForCredential(selectedCalendars, serverACredential);
+      expect(secureFiltering).toHaveLength(1); // Only calendars from matching server
+      expect(secureFiltering[0].externalId).toContain("server-a.example.com");
+    });
+
+    it("handles non-CalDAV calendars normally", () => {
+      const googleCredential: CredentialForCalendarService = {
+        id: 1,
+        type: "google_calendar",
+        key: "google_key",
+        userId: 1,
+        user: { email: "test@example.com" },
+        teamId: null,
+        appId: "google-calendar",
+        invalid: false,
+        delegatedTo: null,
+        delegationCredentialId: null,
+      };
+
+      const selectedCalendars = [
+        buildCalDAVSelectedCalendar({
+          id: "cal_1",
+          externalId: "https://server-a.example.com/dav/calendars/user/calendar1/",
+        }),
+        {
+          ...buildCalDAVSelectedCalendar({
+            id: "cal_2",
+            externalId: "primary",
+          }),
+          integration: "google_calendar",
+        },
+      ];
+
+      const googleCalendars = filterSelectedCalendarsForCredential(selectedCalendars, googleCredential);
+      expect(googleCalendars).toHaveLength(1);
+      expect(googleCalendars[0].integration).toBe("google_calendar");
+    });
+
+    it("handles invalid CalDAV credential URLs gracefully", () => {
+      const invalidCredential = buildCalDAVCredential({
+        id: 1,
+        key: "encrypted_invalid_key",
+      });
+
+      mockedSymmetricDecrypt.mockReturnValue(
+        JSON.stringify({
+          username: "user",
+          password: "pass",
+          url: "invalid-url-format",
+        })
+      );
+
+      const selectedCalendars = [
+        buildCalDAVSelectedCalendar({
+          id: "cal_1",
+          externalId: "https://server-a.example.com/dav/calendars/user/calendar1/",
+        }),
+      ];
+
+      const result = filterSelectedCalendarsForCredential(selectedCalendars, invalidCredential);
+      expect(result).toHaveLength(0); // Should return empty array for safety
+    });
+  });
+});
@@ -7,7 +7,11 @@ import { performance } from "@calcom/lib/server/perfObserver";
 import type { EventBusyDate, SelectedCalendar } from "@calcom/types/Calendar";
 import type { CredentialForCalendarService } from "@calcom/types/Credential";

+import { symmetricDecrypt } from "./crypto";
+
 const log = logger.getSubLogger({ prefix: ["getCalendarsEvents"] });
+
+const CALENDSO_ENCRYPTION_KEY = process.env.CALENDSO_ENCRYPTION_KEY || "";
 // only for Google Calendar for now
 export const getCalendarsEventsWithTimezones = async (
  withCredentials: CredentialForCalendarService[],
@@ -35,15 +39,16 @@ export const getCalendarsEventsWithTimezones = async (
    if (!c) return [];
    /** We rely on the index so we can match credentials with calendars */
    const { type } = calendarCredentials[i];
+    const credential = calendarToCredentialMap.get(c);
    /** We just pass the calendars that matched the credential type,
     * TODO: Migrate credential type or appId
     */
-    const passedSelectedCalendars = selectedCalendars
-      .filter((sc) => sc.integration === type)
-      // Needed to ensure cache keys are consistent
-      .sort((a, b) => (a.externalId < b.externalId ? -1 : a.externalId > b.externalId ? 1 : 0));
-
-    const credential = calendarToCredentialMap.get(c);
+    const passedSelectedCalendars = credential
+      ? filterSelectedCalendarsForCredential(selectedCalendars, credential)
+      : selectedCalendars
+          .filter((sc) => sc.integration === type)
+          // Needed to ensure cache keys are consistent
+          .sort((a, b) => (a.externalId < b.externalId ? -1 : a.externalId > b.externalId ? 1 : 0));
    const isADelegationCredential = credential && isDelegationCredential({ credentialId: credential.id });
    // We want to fallback to primary calendar when no selectedCalendars are passed
    // Default behaviour for Google Calendar is to use all available calendars, which isn't good default.
@@ -103,15 +108,17 @@ const getCalendarsEvents = async (
    if (!calendarService) return [];
    /** We rely on the index so we can match credentials with calendars */
    const { type, appId } = calendarCredentials[i];
+    const credential = calendarToCredentialMap.get(calendarService);
    /** We just pass the calendars that matched the credential type,
     * TODO: Migrate credential type or appId
     */
    // Important to have them unique so that
-    const passedSelectedCalendars = selectedCalendars
-      .filter((sc) => sc.integration === type)
-      // Needed to ensure cache keys are consistent
-      .sort((a, b) => (a.externalId < b.externalId ? -1 : a.externalId > b.externalId ? 1 : 0));
-    const credential = calendarToCredentialMap.get(calendarService);
+    const passedSelectedCalendars = credential
+      ? filterSelectedCalendarsForCredential(selectedCalendars, credential)
+      : selectedCalendars
+          .filter((sc) => sc.integration === type)
+          // Needed to ensure cache keys are consistent
+          .sort((a, b) => (a.externalId < b.externalId ? -1 : a.externalId > b.externalId ? 1 : 0));
    const isADelegationCredential = credential && isDelegationCredential({ credentialId: credential.id });
    // We want to fallback to primary calendar when no selectedCalendars are passed
    // Default behaviour for Google Calendar is to use all available calendars, which isn't good default.
@@ -179,3 +186,90 @@ const getCalendarsEvents = async (
 };

 export default getCalendarsEvents;
+
+/**
+ * Extract server URL from CalDAV calendar externalId
+ */
+function getServerUrlFromCalendarExternalId(externalId: string): string | null {
+  try {
+    const url = new URL(externalId);
+    return `${url.protocol}//${url.host}`;
+  } catch (error) {
+    return null;
+  }
+}
+
+/**
+ * Extract server URL from CalDAV credential
+ */
+function getServerUrlFromCredential(credential: CredentialForCalendarService): string | null {
+  try {
+    if (credential.type !== "caldav_calendar") {
+      return null;
+    }
+
+    const decryptedData = JSON.parse(symmetricDecrypt(credential.key as string, CALENDSO_ENCRYPTION_KEY));
+
+    if (!decryptedData.url) {
+      return null;
+    }
+
+    const url = new URL(decryptedData.url);
+    return `${url.protocol}//${url.host}`;
+  } catch (error) {
+    return null;
+  }
+}
+
+/**
+ * Filter selected calendars for the specific credential, handling CalDAV server URL matching
+ */
+export function filterSelectedCalendarsForCredential(
+  selectedCalendars: SelectedCalendar[],
+  credential: CredentialForCalendarService
+): SelectedCalendar[] {
+  const { type } = credential;
+
+  // For all other calendar types, use the existing logic
+  if (type !== "caldav_calendar") {
+    return selectedCalendars.filter((sc) => sc.integration === type);
+  }
+
+  const credentialServerUrl = getServerUrlFromCredential(credential);
+
+  if (!credentialServerUrl) {
+    log.warn("Could not extract server URL from CalDAV credential", {
+      credentialId: credential.id,
+    });
+    return [];
+  }
+
+  return selectedCalendars.filter((sc) => {
+    if (sc.integration !== type) {
+      return false;
+    }
+
+    const calendarServerUrl = getServerUrlFromCalendarExternalId(sc.externalId);
+
+    if (!calendarServerUrl) {
+      log.warn("Could not extract server URL from calendar externalId", {
+        externalId: sc.externalId,
+        integration: sc.integration,
+      });
+      return false;
+    }
+
+    const matches = credentialServerUrl === calendarServerUrl;
+
+    if (!matches) {
+      log.debug("CalDAV calendar server URL does not match credential server URL", {
+        credentialId: credential.id,
+        credentialServerUrl,
+        calendarServerUrl,
+        calendarExternalId: sc.externalId,
+      });
+    }
+
+    return matches;
+  });
+}
@@ -8,6 +8,7 @@ import type { DestinationCalendar, SelectedCalendar, User } from "@calcom/prisma
 import { AppCategories } from "@calcom/prisma/enums";
 import { credentialForCalendarServiceSelect } from "@calcom/prisma/selects/credential";

+import { DestinationCalendarRepository } from "./server/repository/destinationCalendar";
 import { EventTypeRepository } from "./server/repository/eventType";
 import { SelectedCalendarRepository } from "./server/repository/selectedCalendar";

@@ -134,20 +135,18 @@ async function handleNoDestinationCalendar({
    }
  }

-  user.destinationCalendar = await prisma.destinationCalendar.create({
-    data: {
-      userId: user.id,
-      integration,
-      externalId,
-      primaryEmail,
-      ...(!isDelegationCredential({ credentialId })
-        ? {
-            credentialId,
-          }
-        : {
-            delegationCredentialId,
-          }),
-    },
+  user.destinationCalendar = await DestinationCalendarRepository.createIfNotExistsForUser({
+    userId: user.id,
+    integration,
+    externalId,
+    primaryEmail,
+    ...(!isDelegationCredential({ credentialId })
+      ? {
+          credentialId,
+        }
+      : {
+          delegationCredentialId,
+        }),
  });

  return {
@@ -111,6 +111,7 @@ function getStatusCode(cause: Error | ErrorWithCode): number {
    case ErrorCode.BookingNotAllowedByRestrictionSchedule:
    case ErrorCode.BookerLimitExceeded:
    case ErrorCode.BookerLimitExceededReschedule:
+    case ErrorCode.EventTypeNoHosts:
      return 400;
    // 409 Conflict
    case ErrorCode.NoAvailableUsersFound:
@@ -14,6 +14,18 @@ export class DestinationCalendarRepository {
    });
  }

+  static async createIfNotExistsForUser(
+    data: { userId: number } & Prisma.DestinationCalendarUncheckedCreateInput
+  ) {
+    const conflictingCalendar = await DestinationCalendarRepository.findConflictingForUser(data);
+    if (conflictingCalendar) {
+      return conflictingCalendar;
+    }
+    return await prisma.destinationCalendar.create({
+      data,
+    });
+  }
+
  static async getByUserId(userId: number) {
    return await prisma.destinationCalendar.findFirst({
      where: {
@@ -36,6 +48,21 @@ export class DestinationCalendarRepository {
    });
  }

+  private static async findConflictingForUser(data: {
+    userId: number;
+    integration: string;
+    externalId: string;
+  }) {
+    return await DestinationCalendarRepository.find({
+      where: {
+        userId: data.userId,
+        integration: data.integration,
+        externalId: data.externalId,
+        eventTypeId: null,
+      },
+    });
+  }
+
  static async upsert({
    where,
    update,
@@ -50,7 +50,7 @@ export class NameDefaultFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if URL contains query parameter `&name=bob`,\
-      the name field will be prefilled with this value and disabled.",
+      the name field will be prefilled with this value and disabled. In case of Booker atom need to pass 'name' to defaultFormValues prop with the desired value e.g. `defaultFormValues={{name: 'bob'}}`. See guide https://cal.com/docs/platform/guides/booking-fields",
  })
  disableOnPrefill?: boolean;
 }
@@ -96,7 +96,7 @@ export class SplitNameDefaultFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if URL contains query parameter `&firstName=bob&lastName=jones`,\
-      the first name and last name fields will be prefilled with this value and disabled. In case of Booker atom need to pass firstName and lastName to defaultFormValues prop or pass name prop but as a string containing name and surname.",
+      the first name and last name fields will be prefilled with this value and disabled. In case of Booker atom need to pass 'firstName' and 'lastName' to defaultFormValues prop e.g. `defaultFormValues={{firstName: 'bob', lastName: 'doe'}}` or pass 'name' prop but as a string containing name and surname e.g. `defaultFormValues={{name: 'bob doe'}}`.  See guide https://cal.com/docs/platform/guides/booking-fields",
  })
  disableOnPrefill?: boolean;
 }
@@ -144,7 +144,7 @@ export class EmailDefaultFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if URL contains query parameter `&email=bob@gmail.com`,\
-      the email field will be prefilled with this value and disabled.",
+      the email field will be prefilled with this value and disabled. In case of Booker atom need to pass 'email' to defaultFormValues prop with the desired value e.g. `defaultFormValues={{email: 'bob@gmail.com'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;
 }
@@ -184,7 +184,7 @@ export class TitleDefaultFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if URL contains query parameter `&title=journey`,\
-      the title field will be prefilled with this value and disabled.",
+      the title field will be prefilled with this value and disabled. In case of Booker atom need to pass 'title' to defaultFormValues prop with the desired value e.g. `defaultFormValues={{title: 'very important meeting'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;
 }
@@ -239,7 +239,7 @@ export class NotesDefaultFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if URL contains query parameter `&notes=journey`,\
-      the notes field will be prefilled with this value and disabled.",
+      the notes field will be prefilled with this value and disabled. In case of Booker atom need to pass 'notes' to defaultFormValues prop with the desired value e.g. `defaultFormValues={{notes: 'bring notebook and paper'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;
 }
@@ -279,7 +279,7 @@ export class GuestsDefaultFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if URL contains query parameter `&guests=bob@cal.com`,\
-      the guests field will be prefilled with this value and disabled.",
+      the guests field will be prefilled with this value and disabled. In case of Booker atom need to pass 'guests' to defaultFormValues prop with the desired value e.g. `defaultFormValues={{guests: ['bob@gmail.com', 'alice@gmail.com']}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;
 }
@@ -322,7 +322,7 @@ export class RescheduleReasonDefaultFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if URL contains query parameter `&rescheduleReason=travel`,\
-      the rescheduleReason field will be prefilled with this value and disabled.",
+      the rescheduleReason field will be prefilled with this value and disabled. In case of Booker atom need to pass 'rescheduleReason' to defaultFormValues prop with the desired value e.g. `defaultFormValues={{rescheduleReason: 'bob'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;
 }
@@ -360,7 +360,7 @@ export class PhoneFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if the slug is `phone` and the URL contains query parameter `&phone=1234567890`,\
-      the phone field will be prefilled with this value and disabled.",
+      the phone field will be prefilled with this value and disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value e.g. `defaultFormValues={{phone: '+37122222222'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -407,7 +407,7 @@ export class AddressFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if the slug is `address` and the URL contains query parameter `&address=1234 Main St, London`,\
-      the address field will be prefilled with this value and disabled.",
+      the address field will be prefilled with this value and disabled.  In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value e.g. `defaultFormValues={{address: 'mainstreat 10, new york'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -453,8 +453,8 @@ export class TextFieldInput_2024_06_14 {
    type: Boolean,
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
-      For example, if the slug is `who-referred-you` and the URL contains query parameter `&who-referred-you=bob`,\
-      the text field will be prefilled with this value and disabled.",
+      For example, if the slug is `friend` and the URL contains query parameter `&friend=bob`,\
+      the text field will be prefilled with this value and disabled.  In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value e.g. `defaultFormValues={{friend: 'bob'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -500,7 +500,8 @@ export class UrlFieldInput_2024_06_14 {
    type: Boolean,
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
-      For example, if the slug is `video-url` and the URL contains query parameter `&video-url=https://youtube.com/abc`the url field will be prefilled with this value and disabled.",
+      For example, if the slug is `videourl` and the URL contains query parameter `&videourl=https://youtube.com/abc`the url field will be prefilled with this value and disabled. \
+      In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{videourl: 'https://caltube.com/123'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -546,8 +547,8 @@ export class NumberFieldInput_2024_06_14 {
    type: Boolean,
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
-      For example, if the slug is `calories-per-day` and the URL contains query parameter `&calories-per-day=3000`,\
-      the number field will be prefilled with this value and disabled.",
+      For example, if the slug is `calories` and the URL contains query parameter `&calories=3000`,\
+      the number field will be prefilled with this value and disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{calories: 3000}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -593,8 +594,8 @@ export class TextAreaFieldInput_2024_06_14 {
    type: Boolean,
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
-      For example, if the slug is `dear-diary` and the URL contains query parameter `&dear-diary=Today I shipped a feature`,\
-      the text area will be prefilled with this value and disabled.",
+      For example, if the slug is `reflection` and the URL contains query parameter `&reflection=Today I shipped a feature`,\
+      the text area will be prefilled with this value and disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{reflection: 'Today i shipped a feature'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -645,7 +646,7 @@ export class SelectFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if the slug is `language` and options of this select field are ['english', 'italian'] and the URL contains query parameter `&language=italian`,\
-      the 'italian' will be selected and the select field will be disabled.",
+      the 'italian' will be selected and the select field will be disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{language: 'italian'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -689,8 +690,8 @@ export class MultiSelectFieldInput_2024_06_14 {
    type: Boolean,
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
-      For example, if the slug is `consultants` and the URL contains query parameter `&consultants=en&language=it`,\
-      the 'en' and 'it' will be selected and the select field will be disabled.",
+      For example, if the slug is `language` and the URL contains query parameter `&language=en&language=it`,\
+      the 'en' and 'it' will be selected and the select field will be disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{language: ['en', 'it']}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -737,7 +738,7 @@ export class MultiEmailFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if the slug is `consultants` and the URL contains query parameter `&consultants=alice@gmail.com&consultants=bob@gmail.com`,\
-      the these emails will be added and none more can be added.",
+      the these emails will be added and none more can be added. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{consultants: ['alice@gmail.com', 'bob@gmail.com']}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -781,8 +782,8 @@ export class CheckboxGroupFieldInput_2024_06_14 {
    type: Boolean,
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
-      For example, if the slug is `notify-me` and the URL contains query parameter `&notify-me=true`,\
-      the checkbox will be selected and the checkbox field will be disabled.",
+      For example, if the slug is `notify` and the URL contains query parameter `&notify=true`,\
+      the checkbox will be selected and the checkbox field will be disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{notify: true}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -827,7 +828,7 @@ export class RadioGroupFieldInput_2024_06_14 {
    description:
      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
      For example, if the slug is `language` and options of this select field are ['english', 'italian'] and the URL contains query parameter `&language=italian`,\
-      the 'italian' radio button will be selected and the select field will be disabled.",
+      the 'italian' radio button will be selected and the select field will be disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{language: 'italian'}}`. See guide https://cal.com/docs/platform/guides/booking-field",
  })
  disableOnPrefill?: boolean;

@@ -863,7 +864,13 @@ export class BooleanFieldInput_2024_06_14 {

  @IsBoolean()
  @IsOptional()
-  @DocsPropertyOptional({ type: Boolean })
+  @DocsPropertyOptional({
+    type: Boolean,
+    description:
+      "Disable this booking field if the URL contains query parameter with key equal to the slug and prefill it with the provided value.\
+      For example, if the slug is `notify` and the URL contains query parameter `&notify=true`,\
+      the checkbox will be selected and the checkbox field will be disabled. In case of Booker atom need to pass slug you used for this booking field to defaultFormValues prop with the desired value  e.g. `defaultFormValues={{notify: true}}`. See guide https://cal.com/docs/platform/guides/booking-field",
+  })
  disableOnPrefill?: boolean;

  @IsBoolean()
@@ -20,6 +20,7 @@ declare module "next-auth" {
    id: PrismaUser["id"];
    emailVerified?: PrismaUser["emailVerified"];
    email_verified?: boolean;
+    completedOnboarding?: boolean;
    impersonatedBy?: {
      id: number;
      role: PrismaUser["role"];
@@ -74,7 +74,7 @@ export const AppListCard = (props: AppListCardProps & { highlight?: boolean }) =
            <div className="flex gap-x-2 pt-2">
              <Icon name="circle-alert" className="h-8 w-8 text-red-500 sm:h-4 sm:w-4" />
              <ListItemText component="p" className="whitespace-pre-wrap text-red-500">
-                {t("invalid_credential")}
+                {t("invalid_credential", { appName: title })}
              </ListItemText>
            </div>
          )}
@@ -2519,7 +2519,7 @@ __metadata:
    "@axiomhq/winston": ^1.2.0
    "@calcom/platform-constants": "*"
    "@calcom/platform-enums": "*"
-    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.257"
+    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.258"
    "@calcom/platform-types": "*"
    "@calcom/platform-utils": "*"
    "@calcom/prisma": "*"
@@ -3565,13 +3565,13 @@ __metadata:
  languageName: unknown
  linkType: soft

-"@calcom/platform-libraries@npm:@calcom/platform-libraries@0.0.257":
-  version: 0.0.257
-  resolution: "@calcom/platform-libraries@npm:0.0.257"
+"@calcom/platform-libraries@npm:@calcom/platform-libraries@0.0.258":
+  version: 0.0.258
+  resolution: "@calcom/platform-libraries@npm:0.0.258"
  dependencies:
    "@calcom/features": "*"
    "@calcom/lib": "*"
-  checksum: d45647591a26b6a73b6ae7602d8b8e59d87339de0e49468737437ffdd716fbd953898cd59a1eff8938326eba9ca895c28990bc91355aa55006980a2e716ddfd0
+  checksum: ca522eee904921d4a2f285ba6ed195118a6d68c76fb454d826574d1f5487e8d3d7e41915c968ad0eff6bb01730578ee414069684c7a395b0c19b910f136bffb7
  languageName: node
  linkType: hard
Author	SHA1	Message	Date
emrysal	750e6315dc	chore: release v5.4.20 Post release / release (push) Canceled after 0s Details	2025-07-15 00:37:37 +00:00
Omar LópezandDevin AI	f117b2df32	fix: CalDAV credential verification between multiple instances (#22331 ) Co-authored-by: zomars@cal.com <zomars@me.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2025-07-15 01:32:52 +01:00
Omar López	9631f083b8	Revert "feat: add race condition test for calendar-cache-serve booking flow (…" (#22507 )	2025-07-14 16:58:19 -07:00
Benny Joo	c8a52b78e1	Revert "refactor: replace i18n HTTP requests with build-time bundling (#22422 )" (#22496 ) This reverts commit `163c7ff791`.	2025-07-14 22:49:25 +00:00
Parteek malik	fe4946a269	fix: added custom filter for time select (#21717 ) * added custom filter * handling spaces	2025-07-14 20:39:07 +00:00
Anik Dhabal Babu	3de9c2bda0	fix: uncheck requires Confirmation For FreeEmail (#22486 )	2025-07-14 16:30:11 +00:00
Carina Wollendorfer Devin AI Anik Dhabal Babu	cee30c53b8	feat: remove Event Types from team settings navigation (#22472 ) - Remove VerticalTabItem for Event Types from team settings sidebar - Event Types link no longer appears in team settings navigation - Other team settings options remain unchanged and functional Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>	2025-07-14 15:51:27 +00:00
randAnik Dhabal Babu	f22b5d9daa	Fix typo "{l" in event-type causing syntax error (#22474 ) * Fix typo "{l" in event-type causing syntax error * Update event-type.mdx --------- Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>	2025-07-14 15:51:07 +00:00
Carina Wollendorfer Devin AI Anik Dhabal Babu Udit Takkar	88f8753329	feat: make Members tab open in new tab with external link icon (#22471 ) - Add isExternalLink: true to Members tab configuration - Change href to full URL https://app.cal.com/settings/organizations/i/members - VerticalTabItem component will automatically show external link icon and open in new tab Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>	2025-07-14 21:14:09 +05:30
Lauris Skraucis	fe02a97fa1	fix: increase v2 e2e instance size (#22481 )	2025-07-14 15:29:18 +00:00
Praash cubic-dev-ai[bot]Anik Dhabal Babu Kartik Saini unknown	a9172fd832	feat: added cancelled by to booking detail view (#18521 ) * feat: added cancelled by to booking detail view * fix: var naming * handled case for guest user * move cancelled by outside reason * Update bookings-single-view.tsx * Update apps/web/modules/bookings/views/bookings-single-view.tsx Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * fix --------- Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> Co-authored-by: Kartik Saini <41051387+kart1ka@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: unknown <adhabal2002@gmail.com>	2025-07-14 15:15:38 +00:00
Lauris Skraucis	96a659ae5a	feat: v2 managed orgs filters (#22420 ) * fix: don't allow managed orgs with same slug * feat: filter managed orgs by slug or metadata * test * fix: tests	2025-07-14 16:37:15 +02:00
Anik Dhabal Babu	13739dabd8	Revert "feat: Add cancelledBy input to cancellation page (#18770 )" (#22479 ) This reverts commit `2838053ba8`.	2025-07-14 13:13:27 +00:00
Ashish manhas	22acfbae28	fix(ui): interpolate appName in invalid_credential message (#22448 )	2025-07-14 10:37:48 +00:00
Lauris Skraucis	adf50b2419	docs: v2 workflows and disable on prefill booking fields (#22445 ) * wip * docs: booking fields prefilling * docs: wofklows * fix: guests docs	2025-07-14 15:16:21 +05:30
Lauris Skraucis	35022a0478	fix: get v2/calendars existing record conflict (#22286 ) * refactor: upsert destination calendar * test: v2 connected calendars * chore: bump libraries * refactor: have only createIfNotExistsForUser * refactor: exclude eventTypeId from user calendar search * chore: bump libraries	2025-07-14 08:01:43 +00:00
Harsh Thakur Anik Dhabal Babu Kartik Saini	2838053ba8	feat: Add cancelledBy input to cancellation page (#18770 ) * feat: Add cancelledBy input to cancellation page * fix: Update email verification error message * Update safe-parse.ts * fix: check attendees and booking owner email * fix: minor ui * Update CancelBooking.tsx * Update common.json --------- Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> Co-authored-by: Kartik Saini <41051387+kart1ka@users.noreply.github.com>	2025-07-14 07:14:18 +00:00
Benny Joo	66397a6626	fix: translation bundler logic (#22459 ) * fix logic in translationBundler * remove tsnode	2025-07-14 02:09:23 +00:00
Omar LópezandDevin AI	dfe997dce2	feat: add race condition test for calendar-cache-serve booking flow (#22401 ) Co-authored-by: zomars@cal.com <zomars@me.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2025-07-13 20:37:22 +05:30
Keith Williams Devin AI hbjORbj	163c7ff791	refactor: replace i18n HTTP requests with build-time bundling (#22422 ) * refactor: replace i18n HTTP requests with build-time bundling - Create translationBundler.ts for build-time translation loading - Replace HTTP fetch in loadTranslations with file system reads - Add CalComVersion cache invalidation to prevent stale translations - Fix TypeScript errors in booking page components - Eliminate 60s timeout issues by removing network dependency Resolves translation timeout issues by bundling translations at build time instead of making runtime HTTP requests to /static/locales/ endpoints. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: move i18n files back to packages/lib/server with proper imports - Move i18n.ts and translationBundler.ts back to packages/lib/server/ - Replace all relative imports with @calcom/lib/server/i18n pattern - Fix LOCALES_PATH to point to correct directory - Maintain optimized serverless-friendly translation loading Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * refactor: move locale files to packages/lib/server to eliminate circular deps - Move all locale files from apps/web/public/static/locales to packages/lib/server/locales - Create copy-locales-static.js script to copy files during build - Update all references to use new location for build-time access - Maintain public folder copying for Next.js runtime access - Update platform atoms, scripts, and config files - Fix copy script relative path issue Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: update test imports after locale refactor - Fix import paths in test files updated by pre-commit hooks - Ensure all tests use correct locale import paths Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: revert import paths from @calcom/web/lib/i18n to @calcom/lib/server/i18n - Revert all test file imports back to @calcom/lib/server/i18n as requested - Addresses GitHub comment feedback to stick with packages/lib/server location - Fixes import paths in 6 test files that were incorrectly changed Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: update vite config alias to use new locale path - Update @calcom/web/public/static/locales/en/common.json to @calcom/lib/server/locales/en/common.json - Addresses GitHub comment about updating platform atoms vite config - Maintains correct path resolution after locale files moved to packages/lib/server Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: update translationBundler path resolution for production builds - Use process.cwd() instead of __dirname for locale file path resolution - Ensures locale files can be found in both development and production environments - Fixes E2E test failures caused by missing locale files in .next/server/chunks/ Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: use relative path resolution for locale files in translationBundler - Change from process.cwd() to __dirname with relative paths - Ensures locale files can be found in both development and production environments - Fixes E2E test failures caused by incorrect path resolution in Next.js builds Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: use process.cwd() for locale path resolution in production builds - Change from __dirname to process.cwd() with relative paths - Ensures locale files can be found when bundled into Next.js server chunks - Fixes E2E test failures caused by incorrect path resolution in production environment - Follows same pattern used in getStaticProps.tsx for cross-package file access Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: use path.resolve pattern from sendVerificationRequest for locale access - Change from process.cwd() to path.resolve(process.cwd(), '..', '..', 'packages/lib/server/locales') - Follows same pattern used in sendVerificationRequest.ts for cross-environment file access - Should resolve E2E test failures by ensuring locale files can be found when bundled into Next.js server chunks - Pattern navigates up from current working directory to reach packages directory consistently Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: use dynamic monorepo root detection for locale path resolution - Replace relative path resolution with dynamic monorepo root finder - Ensures locale files can be found from any working directory (root, apps/web, apps/api/v2) - Update API v2 i18n config to use new locale path - Fixes remaining E2E test failures in API v2 and E2E (1/4) test suites Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: use require.resolve(__filename) for robust path resolution in all contexts - Replace __dirname with require.resolve(__filename) in monorepo root detection - Ensures locale files can be found when running from any working directory - Fixes E2E API v2 test failures where __dirname resolves to '.' instead of actual file path Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * Revert "fix: use require.resolve(__filename) for robust path resolution in all contexts" This reverts commit b37d8226000da8f7d5fb98b83dd0e95a53d45372. * fix: update copied locale files after translationBundler path resolution fix - Copy script updated all locale files in public directory - Ensures E2E tests have access to latest locale files - Fixes regression where all E2E tests were failing Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * feat: remove existing locale files to establish copy script as single source of truth - Delete all common.json files from apps/web/public/static/locales/ - Eliminates developer confusion about which files are authoritative - copy-locales-static.js script now clearly the only mechanism for populating public folder - packages/lib/server/locales/ remains the definitive source of truth for translations Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * add comment * refactor: simplify findMonorepoRoot by removing redundant fallback loop - Remove unnecessary second while loop using process.cwd() - The first loop from __dirname will always find the monorepo root - Add clear error message for fail-fast behavior if repo structure is corrupted - Improves code clarity and maintainability Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * feat: integrate updated translations from main branch - Restore all common.json files from main branch to apps/web/public/static/locales/ - Overwrite packages/lib/server/locales/ with up-to-date translation content - Resolve merge conflicts using Benny's safer 2-step approach - Ensure translation source of truth remains in packages/lib/server/locales/ - Complete safer conflict resolution to eliminate merge conflicts on PR #22422 Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * chore: update package.json and yarn.lock after translation integration - Update dependencies after ts-node installation for pre-commit hooks - Ensure yarn.lock reflects current dependency state - Complete translation integration process Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * feat: remove duplicate locale files from apps/web to establish single source of truth - Delete all common.json files from apps/web/public/static/locales/ - Maintain packages/lib/server/locales/ as the single source of truth for translations - copy-locales-static.js script will populate public folder during build process - Complete Benny's safer 2-step approach: restore from main, then remove duplicates - Resolve merge conflicts and eliminate developer confusion about translation file locations Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: hbjORbj <sldisek783@gmail.com>	2025-07-12 07:49:27 +00:00
Alex van AndelandhbjORbj	bd5e14b488	perf: Remove me.get call in event-types / availability (#22336 ) * perf: Event types page remove me.get call * Update ts definition listing view * fix type check * get rid of me call from availability page --------- Co-authored-by: hbjORbj <sldisek783@gmail.com>	2025-07-12 06:49:29 +00:00
Keith Williams	8cd16ee3dc	chore: Loosen Platform CODEOWNERS files (#22432 )	2025-07-12 09:20:47 +05:30
Keith WilliamsandDevin AI	57564381cb	fix: validate eventTypeId is number in API v1 bookings endpoint (#22433 ) * fix: validate eventTypeId is number in API v1 bookings endpoint - Add validation to return 400 when eventTypeId is string instead of integer - Prevents string values from reaching Prisma and causing 500 errors - Follows existing validation patterns in the codebase - Add test case to verify string eventTypeId returns 400 Bad Request Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * test: add focused test for eventTypeId validation - Create separate test file for string eventTypeId validation - Ensures validation logic is properly tested without being blocked by pre-existing issues - Addresses cubic-dev-ai bot feedback about skipped tests - Both string and number eventTypeId scenarios are tested Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: improve eventTypeId validation to only check defined values - Only validate eventTypeId when it's defined and not a number - Prevents interference with schema validation for missing/undefined values - Maintains 400 error response for string eventTypeId as required - Fixes test compatibility issues while preserving validation logic Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * test: move eventTypeId validation test outside of skipped block - Create dedicated test block for eventTypeId validation - Remove duplicate test from skipped block - Ensures validation logic is properly tested - Addresses PR feedback from keithwillcode Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * cleanup: remove duplicate eventTypeId validation test file - Remove apps/api/v1/test/lib/bookings/eventTypeId-validation.test.ts - Tests are now properly located in _post.test.ts outside skipped block - Addresses PR feedback from keithwillcode about duplicate tests Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2025-07-11 19:16:27 -03:00
devin-ai-integration[bot]joe@cal.com Joe Au-Yeung	0207109612	fix: add validation for empty hosts in round robin reassignment (#22429 ) * fix: add validation for empty hosts in round robin reassignment - Add check for empty availableUsers array before calling getLuckyUser - Throw RoundRobinHostsUnavailableForBooking error instead of 500 error - Use existing error infrastructure with 409 status code and localized message - Prevents runtime errors when no round robin hosts are available for reassignment Co-Authored-By: joe@cal.com <joe@cal.com> * fix: check eventType.hosts.length directly for empty hosts validation - Move validation to check eventType.hosts.length === 0 immediately after hosts array setup - Remove later validation after ensureAvailableUsers to catch issue earlier - Follows user feedback to check hosts array directly instead of availableUsers Co-Authored-By: joe@cal.com <joe@cal.com> * fix: update translation message for round robin hosts unavailable error - Make error message clearer about event type having no hosts - Change from 'No Round Robin hosts is available for booking' to 'No hosts are available in this event type for round robin booking' Co-Authored-By: joe@cal.com <joe@cal.com> * Change error for event type no hosts * fix: add ErrorCode.EventTypeNoHosts to switch statement for 400 status code Addresses GitHub comment from keithwillcode to ensure EventTypeNoHosts error returns proper 400 Bad Request status instead of defaulting to 500. Co-Authored-By: joe@cal.com <joe@cal.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: joe@cal.com <joe@cal.com> Co-authored-by: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>	2025-07-11 18:03:36 -03:00