* refactor: migrate TeamEventTypeForm to use PBAC instead of isTeamAdminOrOwner
- Replace isTeamAdminOrOwner prop with permissions.canCreateEventType
- Move permission checks to server-side using PermissionCheckService
- Use eventType.create permission string as specified in PBAC guide
- Update all parent components: CreateEventTypeDialog, event-types-view, CreateEventTypePlatformWrapper
- Follow existing PBAC patterns from event-types-listing-view.tsx
- Maintain backward compatibility with role-based fallback
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: implement proper server-side PBAC permission checks
- Add eventType.create permission checks to TRPC teams.get handler
- Add PBAC permission checks to platform /organizations/{orgId}/teams/me endpoint
- Update all three components to use server-side permission data instead of client-side async calls
- Add canCreateEventTypes property to platform team types
- Maintain backward compatibility with role-based fallbacks
- Remove unused imports and variables
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: update client components to use server-side PBAC permission data
- Update event-types-view.tsx to use team.canCreateEventTypes from server
- Update CreateEventTypeDialog.tsx to use team.canCreateEventTypes with fallback
- Update CreateEventTypePlatformWrapper.tsx to use team.canCreateEventTypes with fallback
- Remove hardcoded permission values and role-based checks
- Maintain backward compatibility with existing role-based logic as fallback
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* apply correct PBAC for event type creation
* revert unexpected changes
* clean up
* address feedback
* fix type error
* clean up
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: replace isTeamAdminOrOwner with PBAC team.listMembers permission
- Add canListMembers prop to BookingsProps interface
- Implement server-side permission check using PermissionCheckService
- Handle organization vs team context as specified
- Use ADMIN/OWNER fallback roles for backward compatibility
- Replace user?.isTeamAdminOrOwner check in bookings column filter
- Fix React Hook dependency arrays for ESLint compliance
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: wrap canListMembers in permissions object and simplify server logic
- Wrap canListMembers in permissions object for future extensibility
- Simplify server-side logic to only use getTeamIdsWithPermission
- Remove unused imports (prisma, MembershipRole)
- Address user feedback on PR #24006
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* docs: add comment explaining canListMembers UI logic
- Clarify that teamIdsWithPermission.length > 0 check is for UI purposes
- Actual accurate filtering happens server-side for filter values
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: add e2e test for member filter visibility
- Verify that users with the MEMBER role cannot see the member filter
- Test creates team with ADMIN and MEMBER users
- Confirms UI correctly reflects PBAC permissions
- Address user feedback on PR #24006
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: correct e2e test team member creation pattern
- Replace invalid teamId property with hasTeam and teammates pattern
- Fix TypeScript error in booking-filters.e2e.ts
- Resolve CI type check failure
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix e2e test
* remove booking.read permission from member
* add guide
* update
* resource scope
* fix markdown
* update usage
* update guide
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
* feat: add availability and ooo permissions to PBAC registry
- Add Availability and OutOfOffice resources to Resource enum
- Add CRUD permissions for both resources with empty scope arrays
- Create migration to seed admin_role with all CRUD permissions
- Create migration to seed member_role with read-only permissions
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: add i18n entries for availability and ooo permissions
- Add pbac_resource_availability and pbac_resource_out_of_office resource names
- Add description entries for all CRUD operations on both resources
- Follow existing PBAC i18n pattern for consistency
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add fallbackRoles parameter to getTeamIdsWithPermissions method
- Add fallbackRoles parameter to method signature in interface and implementation
- Implement second query for teams without PBAC where user has fallback roles
- Combine and deduplicate results from both PBAC-enabled and fallback role teams
- Supports fallback to role-based permissions when PBAC is disabled
- Fix linting issue in getUserMemberships method by replacing include with select
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix usages
* revert some change
* fix unit tests
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: adds user plan info in `useHasPaidPlan` for intercom
* add to support api route
* Update constants.ts
* sql migration to backfill plans and create/change plans on upgrade/downgrade/create of teams and orgs
* fix: breaking unit tests
* test: add comprehensive tests for billing plan service and team/org flows
- Add unit tests for BillingPlanService.getUserPlanByMemberships() covering all plan determination scenarios
- Add tests for team creation handler verifying TEAMS vs ORGANIZATIONS plan assignment
- Add tests for hasTeamPlan handler integration with BillingPlanService
- Add tests for MembershipRepository.findAllMembershipsByUserIdForBilling() data fetching
- Add tests for InternalTeamBilling upgrade/downgrade flows with proper mocking
- All tests follow existing vitest patterns with proper Prisma and service mocking
- Covers both self-serve and platform billing scenarios with comprehensive edge cases
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* Revert "test: add comprehensive tests for billing plan service and team/org flows"
This reverts commit 58e511f15caf8757c3ec45f6d026caf96ee1a75e.
* fix: make `BillingPlanService` instantiable and use `TeamRepository`
* Revert "fix: make `BillingPlanService` instantiable and use `TeamRepository`"
This reverts commit ae1ff8f15b725566b828864a217d8d0e308b520f.
* revert to runtime calculations. review fixes
* remove uneccessary changes and logs
* review fixes
* review fixes
* fix: type check
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: use kysely types instead of prisma types in atoms
* fixup! chore: use kysely types instead of prisma types in atoms
* fixup! Merge branch 'main' into reduce-atoms-bundle-size-prisma-types
* fix: check if team is platform or not when sending billingPortalUrl
* update team repository
* fix: pass teamId explicitely for platform team
* fix: coderabbit feedback
* fix: merge conflicts
* fix: merge conflicts
* fix: make sure we pass in the correct subsciption id
* fix: implement PR feedback
- Replace prismaMock. mocks with BookingRepository.getTotalBookingDuration mocks
- Update return values from [{ totalMinutes: X }] to X to match repository method signature
- Follow existing repository mocking pattern used in other test files
- All tests pass with the new mocking approach
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: replace isTeamAdminOrOwner with PBAC permissions
- Remove isTeamAdminOrOwner from team-members-view.tsx, rely on server-side permissions
- Replace role checks in addMembersToEventTypes.handler.ts with eventType.update permission
- Follow PBAC refactoring guide patterns for consistent permission checking
- Fix TypeScript any type usage and unused variable warnings
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* use enum
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add BillingCacheService with 1-hour TTL for team subscription data
- Create BillingCacheService following CalendarsCacheService pattern
- Use teamId-based cache keys with 1-hour TTL (3,600,000 ms)
- Integrate caching into getBillingData method in BillingService
- Add cache invalidation to all webhook handlers:
- handleStripeSubscriptionDeleted
- handleStripePaymentSuccess
- handleStripePaymentFailed
- handleStripePaymentPastDue
- handleStripeCheckoutEvents
- Add cache invalidation to cancelTeamSubscription method
- Add RedisModule import to billing module
- Add BillingCacheService to billing module providers
- Add findTeamByPlatformBillingId method to OrganizationsRepository for cache invalidation
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: implement BillingServiceCachingProxy pattern
- Extract IBillingService interface with all public methods
- Create BillingServiceCachingProxy that implements caching logic
- Remove all caching logic from original BillingService
- Simplify cache invalidation using billing.id = team.id
- Update module to use proxy with proper dependency injection
- Update controller to inject proxy interface
- Remove unused BillingService import from controller
This follows the proxy pattern requested in PR feedback, separating
caching concerns from core billing logic for better maintainability.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* chore: add e2e for billing check
* chore: eslint rule for blocking importing features from appstore, lib, prisma (#23832)
* eslint rule
* improve
* fix
* improve msg
* chore: fix any types set by devin
* fix: add mising expect in test
* refactor: move cache methods into BillingServiceCachingProxy
- Remove BillingCacheService abstraction as suggested by @keithwillcode
- Move cache methods directly into proxy as private methods
- Update proxy to inject RedisService directly
- Move BillingData type to interface for better type safety
- Remove BillingCacheService from module providers
- Delete unused billing-cache.service.ts file
This simplifies the architecture by removing unnecessary abstraction
and follows standard caching proxy patterns.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: test and legacy starter
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: morgan@cal.com <morgan@cal.com>
Co-authored-by: Benny Joo <sldisek783@gmail.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* refactor: implement PBAC for team member listing
- Replace membership-based team filtering with getTeamIdsWithPermission
- Use team.listMembers permission for access control
- Maintain fallback to original logic when PBAC fails
- Add comprehensive PBAC refactoring guide for future use
Fixes team fetching logic to use Permission-Based Access Control
while preserving existing functionality and privacy checks.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* docs: move PBAC refactoring guide to packages/features/pbac/
Move the PBAC refactoring guide to the appropriate location within
the PBAC feature package for better organization and discoverability.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: remove unnecessary try-catch wrapper
The getTeamIdsWithPermission method already handles all errors internally
and returns an empty array instead of throwing exceptions, making the
try-catch wrapper redundant. Simplified to use direct fallback logic
based on empty array return.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: simplify PBAC implementation
- Remove flawed fallback logic that assumed empty array meant PBAC failure
- Use direct string 'team.listMembers' instead of PermissionMapper
- Remove unused imports (PermissionMapper, Resource, CustomAction)
- Empty array from getTeamIdsWithPermission is legitimate (no permissions)
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* docs: simplify PBAC refactoring guide
- Reduce from 260 to 87 lines by removing bloated content
- Focus on core pattern: direct permission strings, no fallback logic
- Align with actual PR implementation
- Remove verbose theoretical sections and complex patterns
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Fallback to org admin
* Prevent accidental privilege escalation as code changes in the future
* When org admin, we don't actually need to do the db query
* Use findMany and Map to drill down permission adjustments
* Exclude .MEMBER from overriding role, we likely don't want to demote
* refactor logic
* Add tests for services/factories + removeHandler
* fix type check
---------
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Sean Brydon <sean@cal.com>
* feat: add createdAt and updatedAt fields to EventType model
- Add timestamp fields to EventType schema with backward compatibility
- Update all EventType select statements across API v1, v2, and tRPC
- Update platform API output types to include timestamp fields
- Generate migration for existing database records
- Fix test files to handle new timestamp fields properly
The timestamp fields are added as optional (DateTime?) to ensure backward
compatibility - existing EventType records will have null values for these
fields, while new records will automatically get timestamps.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: remove @default(now()) from EventType createdAt to prevent existing records from getting current timestamp
- Remove @default(now()) from createdAt field in schema to ensure backward compatibility
- Create migration that only drops DEFAULT constraint without updating existing records
- Existing EventType records will keep null timestamps
- New records will get timestamps via application logic
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* feat: add createdAt and updatedAt timestamps to all EventType creation locations
- Update all seed scripts to set timestamps for new EventType records
- Ensure consistency across all EventType creation patterns
- Maintain backward compatibility with nullable timestamp fields
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* feat: add timestamps to remaining EventType creation locations in test files
- Update integration test files to include createdAt and updatedAt
- Ensure consistency across all EventType creation patterns
- Complete comprehensive update of all EventType creation locations
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* add migration
* few left
* feat: implement Prisma extension for automatic EventType timestamps
- Create eventTypeTimestampsExtension to automatically set createdAt and updatedAt
- Handle both eventType.create and eventType.createMany operations
- Revert all manual timestamp setting from application code
- Extension only sets timestamps if not already provided
- Maintains backward compatibility - existing records keep null timestamps
- New records get automatic timestamps via Prisma extension
- Follows existing Cal.com extension patterns and architecture
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* feat: remove hardcoded timestamp settings from test files
- Remove manual createdAt/updatedAt settings from routing forms controller test
- Remove manual timestamp settings from event types repository fixture
- Prisma extension now handles timestamps automatically for all EventType operations
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* update
* Update event-type.output.ts
* fix test
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* fix: skip select field validation for existing responses during reschedule
- Modify hasRequiredBookingFieldsResponses to detect reschedule context
- Skip validation for select, multiselect, checkbox, and radio fields during reschedule to preserve existing responses
- Fixes validation error when rescheduling bookings with select field responses that may no longer match current field options
Resolves issue where reschedule operations fail with 'Value Travel, Adventure & Wildlife is not valid for type select for field Niche-project' error
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: skip frontend validation for existing select field responses during reschedule
- Revert backend changes in bookings.service.ts as the issue is frontend-only
- Add reschedule detection in getBookingResponsesSchema.ts preprocess function
- Skip option validation for select, radio, multiselect, and checkbox fields during reschedule
- Preserves existing booking responses that may no longer match current field options
- Fixes error 'Value Travel, Adventure & Wildlife is not valid for type select for field Niche-project' during slot selection
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: extend reschedule validation skip to handle multiemail fields like guests
- Add reschedule-aware logic to multiemail validation in getBookingResponsesSchema.ts
- Skip validation for existing multiemail responses during reschedule to avoid type mismatch errors
- Fixes 'Value is not valid for type text for field guests' error during slot selection
- Complements existing fix for select/radio field validation during reschedule
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: disable guests field inputs for seated events
- Disable type SelectField for guests field in seated events
- Disable identifier InputField for guests field in seated events
- Add validation to prevent saving guests field changes for seated events
- Pass seatsEnabled prop from EventAdvancedTab to FormBuilder
- Use condition: seatsEnabled && formFieldType === 'multiemail' && fieldForm.getValues('name') === 'guests'
- Fix linting warnings: remove unused variable and add missing dependency
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Update getBookingResponsesSchema.ts
* Update FormBuilder.tsx
* Update FormBuilder.tsx
* update
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: added block display to .cal-embed
* fixed the iframe color-scheme to unset and bg transparent
* removed forced CSS
* changes reverted from iframe
* Add comments and remove background transparent as it is still not needed
---------
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
* fix: always check team.parentID even if no membership
* refactor permission handling in create event type handler
* remove hasMembership
---------
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* manage billing section
* wip billing credits
* WIP
* WIP
* Download expense log
* credit worth
* skeleton fixes
* add org tip
* add teams tip
* restore service
* type check
* type check
* fix types
* additional credits
* fix progress bar
* add dashed prop
* match new designs
* hide area with no monthly credits
* fix i18n
* show current balance label
* Update apps/web/modules/settings/billing/billing-view.tsx
Co-authored-by: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com>
* spacing + monthly credits not showing additional
* Remove additional credits from monthly calculations
* feat: replace add members redirect with invite modal in billing settings
- Replace Button href with onClick handler to open MemberInvitationModal
- Add MemberInvitationModalWithoutMembers import and state management
- Maintain existing team/org context support
- Follow established modal usage patterns from other components
- Fix lint error by using undefined instead of empty arrow function
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* Remove redudant vars from method
* fix type check
---------
Co-authored-by: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add ISO timestamp columns to booking CSV exports
- Add createdAt_iso, startTime_iso, endTime_iso columns to getCsvData() method
- Use .toISOString() format for new columns: 2025-09-09T13:03:55+02:00
- Keep existing timestamp columns unchanged to avoid breaking changes
- Addresses user request for parseable timestamp format in CSV downloads
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: add ISO timestamp columns to routing CSV exports
- Add ISO format columns for createdAt, bookingCreatedAt, bookingStartTime, bookingEndTime
- Preserve original timestamp format to avoid breaking changes
- Complete implementation for both /insights and /insights/routing pages
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: replace ISO columns with timezone-aware date/time columns
- Replace _iso columns with separate _date and _time columns
- Use user timezone for proper date/time conversion
- Add timezone parameter to CSV export methods
- Maintain backward compatibility with original timestamp format
- Date format: YYYY-MM-DD, Time format: HH:mm:ss
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: resolve TypeScript type compatibility issues
- Fix WhereForTeamOrAllTeams type compatibility in routing-events.ts
- Restructure conditional object creation to ensure required properties
- Clean up merge conflict remnants from previous rebase
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* clean up
* fix: use user profile timezone for CSV exports instead of browser timezone
- Modified rawData endpoint to use ctx.user.timeZone instead of input.timeZone
- Removed timeZone field from bookingRepositoryBaseInputSchema
- Updated useInsightsBookingParameters to remove timeZone property
- Fixed RecentNoShowGuestsChart to use useDataTable for timezone access
- Resolves timezone discrepancy where CSV exports showed incorrect time values
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* Revert "fix: use user profile timezone for CSV exports instead of browser timezone"
This reverts commit 6356657bd0c503f41349c8d1463bb4dd427b1a2c.
* default columns are formatted as iso
* address feedback
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: make orgId optional for user and team scopes in InsightsRoutingBaseService
- User scope authorization only checks formUserId and formTeamId IS NULL
- Team scope now supports standalone teams without organizations
- Add validation logic to return NOTHING_CONDITION if team belongs to org but no orgId provided
- Add comprehensive test coverage for null/undefined orgId scenarios in both scopes
- Aligns schema with actual usage patterns and supports teams without organizations
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: extend orgId optional support to InsightsBookingBaseService
- Make orgId optional for user and team scopes in InsightsBookingBaseService
- Update InsightsBookingServicePublicOptions type to allow orgId: number | null
- Add validation logic for team scope to handle missing orgId
- Add comprehensive test coverage for null/undefined orgId scenarios
- Fix type casting issues in test file
- Maintains backward compatibility while supporting teams without organizations
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: correct authorization logic for optional orgId in team scope
- Skip isOwnerOrAdmin check for team scope when orgId is null (standalone teams)
- Maintain security for org scope and team scope with orgId
- Fixes integration test failures for null orgId test cases
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: use != null instead of !== undefined for orgId checks
- Properly handle both null and undefined orgId values in authorization logic
- Fix integration test failures where null orgId was incorrectly triggering isOwnerOrAdmin check
- Ensure team scope with null orgId skips ownership validation for standalone teams
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: always validate team membership for team scope
- Remove orgId condition from isOwnerOrAdmin check for team scope
- Ensure both standalone teams and org-based teams require ownership validation
- Maintain orgId validation logic in buildTeamAuthorizationCondition methods
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: use nullish() for orgId schema validation
- Change from .optional() to .nullish() to allow both null and undefined
- Fixes schema validation when tests pass orgId: null
- Resolves authorization logic returning NOTHING_CONDITION for valid cases
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: replace isOwnerOrAdmin with PBAC checkPermission in insights services
- Replace isOwnerOrAdmin method in InsightsBookingBaseService with checkPermission from PermissionCheckService
- Replace isOwnerOrAdmin method in InsightsRoutingBaseService with checkPermission from PermissionCheckService
- Use permission 'insights.read' with fallback roles MembershipRole.OWNER and MembershipRole.ADMIN
- Maintain same method signature and behavior while leveraging PBAC system
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* clean up types
* add comment
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Add mounted state to ensure component renders after hydration
- Fix hydration mismatch between server and client rendering
- Ensure ConfigureStepCard renders properly on initial load in production
Fixes the issue where GTM analytics app configuration form appears blank
on step 3 until page refresh.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Fix route pattern from **/api/trpc/viewer.slots.getSchedule** to **/api/trpc/slots/getSchedule**
- Remove permissive assertions that allowed tests to pass with 0 API calls
- Tests now properly fail when duplicate getSchedule calls are detected
- Addresses issue where E2E tests weren't catching duplicate API calls on main branch
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
* chore: Skip static file copy if not required
* feat: Replace MD5 hash checks with Turborepo caching for static file copying
- Add copy-app-store-static Turborepo task with proper inputs/outputs
- Remove manual MD5 hash calculation logic that was causing performance issues
- Update package.json scripts to use Turborepo task
- Addresses Keith's feedback about using Turborepo cache instead of manual checks
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: Add copy-app-store-static script to package.json for Turborepo task execution
- Add missing script definition in apps/web/package.json
- Enables Turborepo to properly execute the static file copying task
- Fixes 'No tasks were executed' issue by providing the command to run
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: Remove skipped jobs from required check failure condition
- Allow conditional E2E jobs to be skipped without failing the required check
- Maintain failure detection for actual job failures and cancellations
- Apply fix consistently to both pr.yml and all-checks.yml workflows
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* Revert "fix: Remove skipped jobs from required check failure condition"
This reverts commit 429f0506d009eaae7fa88be6db077681d5124f2a.
* Only write new logs
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* feat: add Webhook resource to PBAC system with permission enforcement
- Add Webhook resource to PBAC permission registry with CRUD actions
- Implement PBAC permission checks in webhook handlers (create, edit, delete)
- Add webhook permission translations to common.json
- Use PermissionCheckService with fallback roles [ADMIN, OWNER] for team webhooks
- Maintain backward compatibility when PBAC is disabled
- Follow same pattern as workflow PBAC implementation from PR #22845
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: implement PBAC permission filtering in webhook list handler
- Add PermissionCheckService to filter team webhooks by webhook.read permission
- Only show webhooks from teams where user has proper permissions
- Maintain backward compatibility with fallback to all team memberships
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* add migration for default roles
* new forUserMethod
* update webhook repository
* fix UI showing/hiding webhooks for webhoo.create teams
* WIP pbac procedure migratoin + tests
* add more roles to get fallback
* permissions in cmponents instead of readOnly
* passPermissions to list item
* push instant events logic
* Git merge
* wip teamId accessable refactor
* fix delete handler
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: allow to choose dateTarget for /insights (startTime by default)
* feat: add timestamp selector for insights date filtering
- Add TimestampFilter component with Start Time/Created At options
- Extend useInsightsBookingParameters hook with timestamp selection
- Update all insight components to use dateTarget parameter
- Add i18n translations for new UI strings
- Position selector next to DateRangeFilter as requested
Addresses user request to add select box next to date range filter
allowing users to choose between startTime (default) and createdAt
for displaying booking metrics on the Insights page.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: rename TimestampFilter to DateTargetSelector with nuqs URL state
- Rename TimestampFilter component to DateTargetSelector
- Implement nuqs hook in InsightsPageContent for URL state management
- Update useInsightsBookingParameters to return dateTarget from URL state
- Add dateTarget field to insightsRoutingServiceInputSchema and related types
- Simplify individual insight components to use insightsBookingParams directly
- Remove manual timestampTarget destructuring from all components
- Update all tRPC routing service calls to include dateTarget parameter
- All TypeScript checks now pass successfully
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update styles
* fix inconsistency
* feat: replace Select with Command component and rename filter ID
- Replace Select with Command + Popover for compact width and wider dropdown
- Add descriptive option labels with translations
- Change filter ID from 'createdAt' to 'timestamp' across all components
- Maintain URL state management with nuqs
- Fix ESLint warning for missing dependency in useEffect
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: revert routing components to use createdAt filter ID
- Keep timestamp filter ID change scoped only to main insights page
- Routing components should continue using createdAt as filter ID
- Only insights-view.tsx and related booking hooks use timestamp
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update styles
* fix trpc router
* refactor timestamp column for insights booking service
* fix
* update text
* rename and clean up
* fix endDate in DateRangeFilter
* fix type errors
* fix startTime filter and type errors
* provide default date range
* add completed to getMembersStatsWithCount
* add unit tests
* fix type error
* address feedback
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: resolve JSON parsing error in Stripe subscription endpoint
- Fix 'Unexpected end of JSON input' error during premium username upgrade
- Replace res.status(404).end() with proper JSON response
- Add descriptive error message for missing userId or intentUsername parameters
- Ensure consistent JSON response format across all error paths
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: add proper session handling to Stripe subscription endpoint
- Import getServerSession from @calcom/features/auth/lib/getServerSession
- Use getServerSession({ req }) to properly populate user session
- Fix session validation that was causing 'Unexpected end of JSON input' error
- Ensure subscription endpoint handles sessions consistently with other Cal.com API endpoints
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Wrap ConfigureStepCard content with NoSSR component
- Prevents blank step 3 configuration page in production
- Fixes hydration mismatch between server and client rendering
- Ensures analytics apps (GTM, Fathom, GA4) installation works properly
- Uses Cal.com's established NoSSR pattern for client-side only rendering
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: Past booking redirect
* fix: rename ENV_PAST_BOOKING_RESCHEDULE_CHANGE to ENV_PAST_BOOKING_RESCHEDULE_CHANGE_TEAM_IDS for clarity
- Renamed environment variable to better reflect that it contains comma-separated team IDs
- Updated all references in constants.ts, implementation file, tests, and turbo.json
- Addresses PR comment feedback about misleading variable name
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix members page crash with pbac feature flag
* invite member to org backend
* update org permissions
* feat: org profile update settings
* org general page
* remove redudant me call
* privacy page
* add attributes to pbac
* dync + sso on organization permissions
* add tests for resource-permission util
* pass permissions to attributes\
* restore invite members
* update org update and attribute backends
* fix type errors
* fix orgId
* fix types attempt two
* fix types attempt two
* fix type error
* show/hide team event types based on eventType.read permission
* fix dupe string in i18n
* fix tests
* fix team-dsync
* update session to use profile
* use profile metadata to get orgRolew
* fix dsync
* fix typing
* Event type create pbac check
* fix the readonly permission check. WIP
* refactor getUserEventTypes
* fix test
* add generate util for update
* update router to use new generator function for pbac procedures
* update transform utils
* fix members being able to update on UI
* fix allSettled
* fix fallback permissions
* fix permission logic
* fix compare memebrship type error
* fix unit test error
* fix manage test error
* fix nested permissions
* filter based on canView permission in getUserEventGroups
* Update packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.test.ts
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix tests
* fix tests
* feat: Adding workflow permission checks inside of eventTypes (#23038)
* add permission checks for workflows
* wip getall active workflows
* check eventType.update permission on activiating workflow on event type
* pass permissions to context and use context in client
* remove local parsePermissionString and use registery
* Use new scoped function
* default scope to orgs
* use object values for workflow permissions
* fix type errors
* Fix permission traversal + fix all state caluclation
* fix eventType group to use permissions.canRead
* fix: update failing PBAC unit tests and resolve ESLint warnings
- Fix getUserEventGroups test: MEMBER role should not have update permissions in fallback scenario
- Fix EventTypeGroupFilter test: add missing canRead property to mock permissions map
- Replace 'as any' type assertions with proper 'as unknown as' type assertions to resolve ESLint warnings
Both tests now pass and align with PBAC permission model where MEMBER role has read-only access to event types.
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* add pbac to _heavy router
* Merge main
* restore versions
* Parallelizable members query
* fix nits
* fix create
* Restore lock file
* Fix import from merge artifact
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* e2e tests for apple connect atom
* update globalEnv for turbo.json
* update pages for tests
* update playwright config so we can use env variables inside tests
* update packages
* update variable names
* update playwright config
* fix: import variables from env instead of separate files
* update env variables for atoms e2e yml
* Change display mode from 'standalone' to 'minimal-ui'
this shows the refresh and back button for easier navigation ux
* Update display settings in site.webmanifest
---------
Co-authored-by: Kartik Saini <41051387+kart1ka@users.noreply.github.com>
* fix
* Update UserForm.tsx
* test: add e2e tests for admin user creation and editing
- Add test for successful user creation via /settings/admin/users/add
- Add test for successful user editing via /settings/admin/users/{id}
- Tests verify form submission, API responses, and database changes
- Follow Cal.com e2e testing patterns with admin authentication
- Use Playwright for end-to-end form interaction testing
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Update admin-users.e2e.ts
* Update admin-users.e2e.ts
* update
* tweak
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: return attendees when fetching all bookings
* refactor: v2 show hidden attendees for authenticated requests
* chore: regenerate docs
* chore: add test
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
The allowTypeImports option is only supported by @typescript-eslint/no-restricted-imports,
not the standard ESLint no-restricted-imports rule. This fixes the configuration error:
'Configuration for rule no-restricted-imports is invalid: allowTypeImports should NOT have additional properties'
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: phone number billing bug
* fix: phone number billing bug
* fix: use raw code
* fix: use zod
* chore: update test
* Remove newline.
---------
Co-authored-by: Alex van Andel <me@alexvanandel.com>
* feat: add e2e tests for insights ChartCard components
- Test that all ChartCard components render with expected titles
- Test graceful handling of TRPC call failures
- Test ChartCard rendering for organization users
- Wait for page load and TRPC calls before checking chart presence
- Use text-based selectors to find ChartCard titles in h2 elements
- Remove page.waitForTimeout() calls to comply with ESLint rules
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* clean up e2e tests
* fix titles
* still render charts if no data
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
* feat: implement generalized navigation permission system with PBAC
- Create NavigationPermissionsProvider context for server-side permission data
- Add checkNavigationPermissions utility using PermissionCheckService
- Update main navigation layout to check permissions server-side
- Enhance useShouldDisplayNavigationItem for generalized permission filtering
- Support permission mapping for insights, workflows, routing, teams, members
- Use unstable_cache for performance optimization
- Replace insights-specific logic with scalable PBAC-based system
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: correct flag check logic in useShouldDisplayNavigationItem
- Only return false when flag is explicitly false
- Allow navigation permission checks to run when flags are truthy
- Fixes bug where truthy flags would short-circuit permission checks
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: resolve linting errors in embed-core files
- Replace forbidden non-null assertion with null check in embed.ts
- Replace 'any' type with 'unknown' in embed.test.ts
- Replace non-null assertion with proper null check in EmbedElement.test.ts
- Remove unused variable declaration
These are pre-existing linting issues unrelated to navigation permissions feature.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: resolve server-client boundary issue in NavigationPermissionsProvider
- Add 'use client' directive to NavigationPermissionsProvider.ts
- Replace JSX syntax with React.createElement to fix TypeScript compilation
- Create NavigationPermissionsWrapper.tsx as client component bridge
- Update layout.tsx to use wrapper instead of provider directly
- Ensure proper separation between server-side permission checking and client-side context consumption
This fixes the architectural issue where useContext was being used in server components.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* Revert "fix: resolve linting errors in embed-core files"
This reverts commit 4f481bae576376c9f9177215f7872c8bf7132894.
* refactor: simplify NavigationPermissionsProvider approach
- Remove NavigationPermissionsWrapper.tsx (revert to simpler approach)
- Rename NavigationPermissionsProvider.ts to .tsx for JSX support
- Update layout.tsx to use NavigationPermissionsProvider directly
- Keep 'use client' directive for proper server-client boundary handling
- Maintain all navigation permission functionality with cleaner architecture
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* clean up
* return true for no team situation
* fix: prevent hidden navigation items from reappearing via stored expansion state
- Modified usePersistedExpansionState hook to accept shouldDisplay parameter
- Clear stored expansion state for items that shouldn't be displayed
- Prevent state persistence for items without permissions
- Updated both NavigationItem and MobileNavigationMoreItem components
- Use safe sessionStorage import from @calcom/lib/webstorage
Fixes bug where clicking 'Workflows' would restore 'Insights' menu visibility
even when user lacks insights permissions due to sessionStorage state restoration.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: add sessionStorage to webstorage module and export NavigationItemName type
- Added sessionStorage wrapper to @calcom/lib/webstorage with safe error handling
- Export NavigationItemName type from NavigationPermissionsProvider for proper type access
- Resolves TypeScript compilation errors in navigation permission system
These changes enable the collapsible menu state bug fix to compile properly.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: improve separation of concerns in usePersistedExpansionState hook
- Remove shouldDisplay parameter from usePersistedExpansionState hook
- Move state clearing logic for hidden items to NavigationItem component level
- Add setIsExpanded to useEffect dependency arrays to fix ESLint warnings
- Maintain bug fix functionality while improving code design
- Better separation between expansion state management and display permissions
This addresses user feedback about inappropriate coupling between concerns.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix provider
* fix unstable_cache
* refactor: move navigation permission checks to client-side with tRPC
- Replace server-side unstable_cache permission checks with client-side tRPC query
- Add getNavigationPermissions query to PBAC router
- Update NavigationPermissionsProvider to use tRPC with loading states
- Remove server-side checkNavigationPermissions function
- Improve initial page load performance by deferring permission checks
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: centralize navigation item definitions to eliminate repetition
- Create NAVIGATION_ITEMS_CONFIG as single source of truth for navigation items
- Auto-generate NAVIGATION_PERMISSION_MAP from centralized config
- Update Navigation.tsx to use centralized definitions for teams, routing, workflows, insights
- Fix import issues in NavigationPermissionsProvider.tsx
- Eliminate hardcoded repetition of navigation item properties across codebase
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* clean up
* clean up permissions
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: sort bookingUserId options alphabetically in insights routing faceted values
- Add .sort((a, b) => a.label.localeCompare(b.label)) to bookingUserId options
- Makes user dropdown more human-friendly with alphabetical ordering
- Follows existing sorting pattern used in FilterSegmentSelect.tsx
- Fix ESLint warning by replacing Table<any> with Table<unknown>
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: use generic type parameter instead of unknown in Table type
- Replace Table<unknown> with <TData>(_: Table<TData>) to fix CI type errors
- Maintains type safety while avoiding ESLint any type warning
- Allows hook to work with any table type through generic parameter
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Add `findBookingById` to `BookingRepository`
* Create `generateMetadata` to Stripe `PaymentService`
* `create` method to use `generateMetadata`
* Remove unused trpc endpoint
* Pass booking id to chargeCard method
* Use generateMetadata in chargeCard method
* Remove unused stripeAppKeys
* Add error handling if booking doesn't contain attendee
* Rename to
* Return attendees in a consistent order
---------
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
* getEnabledAppsFromCredentials
* wip
* wip
* mv more
* fix: update test mocking for PrismockClient in processPaymentRefund.test.ts
- Replace prismaMock with prismock for proper PrismockClient usage
- Update mock data structure to include required fields (id, userId, teamId, etc.)
- Create app and credential records separately to handle PrismockClient limitations
- Replace 'as any' type casting with vi.mocked() for proper type safety
- Adjust test expectations to match PrismockClient's actual return structure
- Add proper cleanup in beforeEach hook for both credential and app records
Fixes failing unit tests after migration from packages/lib to packages/features/bookings/lib/payment
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* publish platform libraries
* fix import
* bump version
* fix apiv2
* publish platform-libraries
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* mv PaymentPage to web
* mv 2 more components to web
* refactor
* update imports
* mv
* revert
* fix
* fix
* update
* migrate relevant test too
* move setup components to web from appstore
* move wipemycalother
* mv
* fix typechecks
* mv more routing forms components
* fix
* fix
* fix
* fix: resolve type errors in SingleForm.tsx after migration
- Updated SingleFormComponentProps type to include enriched form properties
- Added proper typing for user, team, nonOrgUsername, nonOrgTeamslug, userOrigin, teamOrigin
- Fixes type errors that occurred after migrating SingleForm.tsx from packages/app-store/routing-forms/components/
- Resolves both SingleForm.tsx and TestForm.tsx type errors
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* delete
* refactors
* fix
* fix
* fix
* remove usage of trpc client from OmniInstallAppButton.tsx
* fix test
* import only type
* fix test
* remove trpc package from appstore package.json
* remove remaining trpc usage
* update test
* fix type checks
* fix errors
* fix
* make it error
* nit
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: managed event types inherit team hideBranding setting
- Add getParentTeamForBranding helper to query parent team data
- Update shouldHideBrandingForEvent to use parent team when eventType.team is null
- Ensures CTA 'create your own booking link with Cal' respects team branding settings
- Follows existing pattern used by eventType.team?.id ?? eventType.parent?.teamId
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* chore: update yarn.lock dependencies
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Get parent event type team branding
* Use data from getEventTypeFromDB
* Undo yarn.lock changes
* Undo yarn.lock changes from latest main
* Address code commit
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* export const CalendarServiceMap
* fix: resolve linting issues in video and calendar adapter fixes
- Remove unused isCalendarService function
- Fix any type usage in getCalendar
- Add eslint-disable for necessary app-store imports in videoClient
- Maintain architectural separation while fixing core functionality
* revert
---------
Co-authored-by: unknown <adhabal2002@gmail.com>
* refactor: remove circular dependency between prisma and app-store packages
- Replace EventTypeAppMetadataSchema with z.record(z.any()).optional() pattern
- Remove appDataSchemas import from packages/prisma/zod-utils.ts
- Add null checks in consuming packages for flexible validation
- Fix test file that no longer needs @ts-expect-error directive
This breaks the circular dependency while maintaining all functionality
by moving strict validation to the business logic layer where operations
actually happen, following existing patterns in the codebase.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: remove EventTypeAppMetadataSchema exports from prisma package
- Remove EventTypeAppMetadataSchema and eventTypeAppMetadataOptionalSchema exports from prisma/zod-utils.ts
- Update all importing files to use local z.record(z.any()).optional() schemas
- Replace type annotations with Record<string, any> where appropriate
- Maintain validation functionality while breaking circular dependency
- All TypeScript compilation now passes without errors
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: complete removal of EventTypeAppMetadataSchema from remaining files
- Update handleSeats/createNewSeat.ts to use local schema
- Update payment handlers to use local schemas
- Update eventTypes update handler to use local schema
- All files now define their own validation instead of importing from prisma
- Circular dependency completely eliminated
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: resolve TypeScript compilation errors
- Remove duplicate z import from handleConfirmation.ts
- Remove duplicate appDataSchemas import from update.handler.ts
- Fix index signature errors in handlePayment.ts by using appData variable consistently
- All type checks now pass successfully
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add type casting for appSlug in eventTypeService
- Cast appSlug as keyof typeof apps to resolve index signature error
- Maintains type safety while allowing dynamic property access
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix
* remove
* make zod-utils.ts in app-store
* update imports
* fix
* fix
* fix
* revert unrelated change
* update imports
* fix
* fix
* revert
* fix
* fix
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: hbjORbj <sldisek783@gmail.com>
* chore: Upgrade prisma to 6.7.0
* Build fixes
* type fixes
Signed-off-by: Omar López <zomars@me.com>
* Update schema.prisma
* Patching
* Revert "Update schema.prisma"
This reverts commit 47d8618bf89ef4d007b30084df766f17281e21a1.
* Revert "Patching"
This reverts commit a1d2e3040e71690a44d4324db95d73b4d68c6adb.
* Revert schema changes
Signed-off-by: Omar López <zomars@me.com>
* WIP
Signed-off-by: Omar López <zomars@me.com>
* Update getPublicEvent.ts
* Update imports
Signed-off-by: Omar López <zomars@me.com>
* Update gitignore
Signed-off-by: Omar López <zomars@me.com>
* update remaining imports
Signed-off-by: Omar López <zomars@me.com>
* Delete .cursor/config.json
* Discard changes to packages/features/eventtypes/lib/getPublicEvent.ts
* Update _get.ts
* Update user.ts
* Update .gitignore
* update
* Update WorkflowStepContainer.tsx
* Update next-auth-custom-adapter.ts
* Update getPublicEvent.ts
* Update workflow.ts
* Update next-auth-custom-adapter.ts
* Update next-auth-options.ts
* Update bookingScenario.ts
* fix missing imports
* upgrades prismock
Signed-off-by: Omar López <zomars@me.com>
* patches prismock
Signed-off-by: Omar López <zomars@me.com>
* Update reschedule.test.ts
* Update prisma.ts
* patch prismock
Signed-off-by: Omar López <zomars@me.com>
* fix enums imports
Signed-off-by: Omar López <zomars@me.com>
* Revert "Update prisma.ts"
This reverts commit 64edcf8db54171ff4456c209d563b5d431d99619.
* Revert "patch prismock"
This reverts commit e95819113dc9d88e7130947aa120cd42710977c8.
* fix patch
* Fix test that overrun the boundary, it shouldn't test too much
* Move prisma import to changeSMSLockState
* Bring back broken test without illegal imports
* Merge with main and fix filter hosts by same round robin host
* Fixed buildDryRunBooking fn tests
* Fix and move ooo create or update handler test
* Fix packages/features/eventtypes/lib/isCurrentlyAvailable.test.ts
* Fix packages/trpc/server/routers/viewer/organizations/listMembers.handler.test.ts
* Mock @calcom/prisma
* Fix: verify-email.test.ts
* fix: Moved WebhookService test and fixed default import mock
* Fix: Added missing prisma mock, handleNewBooking uses that of course
* We're not testing createContext here
* fix: Prisma mock fix for listMembers.test.ts
* More fixes to broken testcases
* Forgot to remove borked test
* Prevent the need to mock a lot of dependencies by moving out buildBaseWhereCondition to its own file
* Temporarily skip getCalendarEvents, needs a rewrite
* Fix: turns out you can access protected in testcases
* fix further mocks
* Added packages/features/insights/server/buildBaseWhereCondition.ts, types
* Always great to have a mock and then not use it
* And one less again.
* fix: confirm.handler.test, didn't mock prisma
* fix: Address minor nit by @eunjae & fix ImpersonationProvider test
* Updated isPrismaAvailableCheck that doesn't crash on import
* fix: Get Prisma directly from the client, it usually involves the Validator and does not need 'local' inclusion
* Add zod-prisma-types without the generator enabled (commented out)
* Uncomment and see what happens
* Change method of import as imports did not work in Input Schemas
* Remove custom 'zod' booking model, it does not belong with Prisma
* Fix all other global Model imports
* Rewrite most schema includes AND remove barrel file
* Add bookingCreateBodySchema to features/bookings
* Flurry of type fixes for compatibility with new zod gen
* Refactor out the custom prisma type createEventTypeInput
* Work around nullable eventTypeLocations
* HandlePayment type fix
* More fixes, final fix remaining is CompleteEventType
* Should fix a bunch more booking related type errors
* Missed one
* Some props missing from BookingCreateBodySchema
* Fix location type in handleChildrenEventTypes
* Little bit hacky imo but it works
* Final type error \o/
* Forgot to include Prisma
* Do not include zod-utils in booker/types
* Oops, was already including Booker/types
* Fix membership type, also disallow updating createdAt/updatedAt, make part of patch/post
* Fix api v1 type errors
* Fix EventTypeDescription typings
* Remove getParserWithGeneric, use userBodySchema with UserSchema
* use centralized timeZoneSchema
* Implement feedback by @zomars
* Couple of WIP pushes
* Fix tests
* Type fixes in `handleChildrenEventTypes` test
* Try and parse metadata before use
* Change zod-prisma-types configuration for optimal performance
* Fix prisma validator error in `prisma/selects/credential`
* Disable seperate relations model, hits a bug
* Import absolute - this makes rollup work in @platform/libraries
* Attempt at removing resolutions override
* Refactor using `Prisma.validator` to `satisfies`
* Build atoms using @calcom/prisma/client
* Build atoms using @calcom/prisma/client
* fixes
* Update eventTypeSelect.ts
* Adjust `eventTypeMetaDataSchemaWithUntypedApps` from `unknown` to `record(any)`
* `EventTypeDescription` rely on `descriptionAsSafeHTML` instead of `description`
* Add `seatsPerTimeSlot` to event type public select
* Fix typing in `users-public-view` getServerSide props
* Add missing `schedulingType` to prop
* chore: bump platform libraries
* Function return type is illegal, not sure how this passed eslint (#21567)
* Merged with main
* Update updateTokenObject.ts
* Update handleResponse.ts
* Update index.ts
* Update handleChildrenEventTypes.ts
* Update booking-idempotency-key.ts
* Update WebhookService.test.ts
* Update events.test.ts
* Update queued-response.test.ts
* Update events.test.ts
* Update getRoutedUrl.test.ts
* fix: type checks
Signed-off-by: Omar López <zomars@me.com>
* fixes
Signed-off-by: Omar López <zomars@me.com>
* chore: bump platform libraries
* Update yarn.lock
* more fixes
Signed-off-by: Omar López <zomars@me.com>
* fixes
Signed-off-by: Omar López <zomars@me.com>
* biuld fixes
* chore: bump platform libraries
* Update conferencing.repository.ts
* Update conferencing.repository.ts
* Update getCalendarsEvents.test.ts
* Update vite.config.js
* chore: bump platform libraries
* Update users.ts
* Discard changes to docs/api-reference/v2/openapi.json
* Update vite.config.ts
* updated platform libraries
* Update get.handler.test.ts
* Update get.handler.test.ts
* Update schema.prisma
* Discard changes to docs/api-reference/v2/openapi.json
* Update next-auth-custom-adapter.ts
* Update team.ts
* Flurry of type fixes
* Fix majority of insight related type errors
* Type fixes for unlink of account
* Make user nullable again
* Fixed a bunch of unit tests and one type error
* Attempted mock fix
* Attempted fix for Attribute type
* Ensure default import becomes prisma, but not direct usage
* Import default as prisma in prisma.module
* Add attributeOption to attribute type
* Fix calcom/prisma mock
* Refactor Prisma client imports to @calcom/prisma/client
Updated all imports from '@prisma/client' to '@calcom/prisma/client' across tests and repository files for consistency and to use the correct Prisma client package. This change improves maintainability and ensures the correct client is referenced throughout the codebase.
* Undo removal of max-warnings=0 to get main to merge
* Remove unit tests for e2e fixtures, provide new prisma mock
* Mock @calcom/prisma in event manager
* Mock @calcom/prisma in event manager
* Add correct format even with --no-verify
* Mock prisma in CalendarManager
* Add mock for permission-check.service
* Better injection in PrismaApiKeyRepository imports
* More mock fixes :)
* Fix listMembers.handler.test
* Fix User import
* Appropriately adjust all types to be imported as types, there were a lot of types imported as normal deps
* Why was this a thing?
* Strictly speaking; Not using prismock anymore
* Ditched patch file for prismock
* Fix output.service.ts platform type imports, need concrete for plainToClass
* Better typing and tests for unlinkConnectedAccount.handler
* Small type fix
* Disable calendar cache tests as they are dependent on prismock
* chore: bump platform lib
* getRoutedUrl test remove of unused import
* Extract select to external const on getEventTypesFromDB
* Direct select of userSelect from selects/user
* fix type error from merging 23653
* Fixed integration tests by removing hardcoded values that were possible due to mocking, but as its now directly hitting the db no longer
* fix: vite config atoms prisma client type location
* revert: example app prisma client
* revert: example app prisma client
* bump platform libs
* fix: use class instead of type for DI of PlatformBookingsService
* update platform libs
* remove unused variable
* chore: generate prisma client for api v2
* fix: api v2 e2e
* fix: atoms e2e
* fix: atoms e2e
* fix: atoms e2e
* fix: api v2 e2e
* fix: tsconfig apiv2 enums
* publish libraries
* Simplify check for existence teamId
---------
Signed-off-by: Omar López <zomars@me.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Joe Au-Yeung <j.auyeung419@gmail.com>
Co-authored-by: supalarry <laurisskraucis@gmail.com>
Co-authored-by: cal.com <morgan@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Co-authored-by: Benny Joo <sldisek783@gmail.com>
* early UI refresher of workflows using v3 designs. needs tons of testing, might have broken
* Delete .claude/settings.local.json
* fix: bunch of design fixes, merge conflict fixes
* fix: e2e and type-check
* fix: await button click
* review fixes
* code rabbit fixes
* fix styles in variables dropdown
* fix text truncate
* fix: unit tests
* fix: unit tests
* chore: add missing i18n
* review fixes
* review fixes
* fix testing info message
* move timeSectionText up
* fix which team does this apply to info message
* disable set up agent button with read only
* fix: cal.ai breaking on mobile screen
---------
Co-authored-by: Amit Sharma <74371312+Amit91848@users.noreply.github.com>
Co-authored-by: Udit Takkar <udit222001@gmail.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
- Move permission validation from AdminLayoutAppDirClient.tsx (client) to layout.tsx (server)
- Add server-side redirect using next/navigation redirect() function
- Remove client-side useEffect permission check to eliminate flash
- Follow same pattern as organizations layout for consistent auth handling
- Users without admin role are redirected to /settings/my-account/profile before any content renders
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: correct booking count in EventTrendsChart by restructuring SQL query
- Replace JOIN-based query with CTE approach to count distinct bookings
- Separate booking stats from guest stats to prevent duplicate counting
- Preserve no-show guest functionality with LEFT JOIN
- Ensure EventTrendsChart 'Created' sum matches BookingKPICards 'events_created'
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: use positional GROUP BY references to resolve PostgreSQL error
- Replace column expressions in GROUP BY with positional references (1, 2, 3)
- Fixes PostgreSQL error 42803 caused by parameter resolution in CTE queries
- Maintains the same query logic while avoiding column reference conflicts
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* address feedback
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: v2 dont allow mixing platform teams/users with non-platform
* chore: finish main merge
* test: e2e
* refactor: simplify can add user to team logic
* refactor: fetch only needed oauth data
* refactor: cleanup
## Next.js App Directory: Authorisation Checks in Pages
This can include checking session.user exists or session.org etc.
### TL;DR:
Don’t put permission checks in layout.tsx! Always put them directly inside your page.tsx or relevant server components for every restricted route.
### Why Not to Use Layouts for Permission Checks
* Layouts don’t intercept all requests: If a user navigates directly or refreshes a protected route, layout checks might be skipped, exposing sensitive content.
* APIs and server actions bypass layouts: Sensitive operations running on the server can’t be guarded by checks in the layout.
* Risk of data leaks: Only page/server-level checks ensure that unauthorized users never get protected data.
### ✅ How To Secure Routes (The Right Way)
* Check permissions inside page.tsx or the actual server component.
* Perform all session/user/role validation before querying or rendering sensitive content.
* Redirect or return nothing to unauthorized users, before running restricted code.
### 🛠️ Example: Page-Level Permission Check
```tsx
// app/admin/page.tsx
import{redirect}from"next/navigation";
import{getUserSession}from"@/lib/auth";
exportdefaultasyncfunctionAdminPage() {
constsession=awaitgetUserSession();
if(!session||session.user.role!=="admin"){
redirect("/");// Or show an error
}
// Protected content here
return<div>Welcome,Admin!</div>;
}
```
### 🧠 Key Reminders
* Put permission guards in every restricted page.tsx.
* Never assume layouts are secure for guarding data.
* Validate users before any sensitive queries or rendering.
## Avoid using Dayjs if you don’t need to be strictly tz aware.
When doing logic like Dayjs.startOf(".."), you can instead use date-fns' `startOfMonth(dateObj)` / `endOfDay(dateObj)`;
When doing logic that depends on Browser locale, use i18n.language (prefer to deconstruct) like: `const { i18n: { language } } = useLocale();`, in combination with built-in Intl.
Note that with Date, you’re dealing with System time, so it’s not suited to everywhere (such as in the Booker, where instead we’ll likely migrate to Temporal) - but in most cases the above are suitable.
The main reason for doing so is that Dayjs uses a useful, but highly risky plugin system, which has led us to create `@calcom/dayjs` - this is heavy however, because it pre-loads ALL plugins, including locale handling. It’s a non-ideal solution to a problem that unfortunately exists due to Dayjs.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.