chore: v4.2.4 (#15703)

* refactor: handleNewBooking #3

* fix: type error

* fix: type err

* fix: type err

* refactor: create booking factor

* chore: refactor availusers

* chore: type err

---------

Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>

.env.appStore.example

@@ -38,6 +38,7 @@ BASECAMP3_USER_AGENT=
 DAILY_API_KEY=
 DAILY_SCALE_PLAN=''
 DAILY_WEBHOOK_SECRET=''
+DAILY_MEETING_ENDED_WEBHOOK_SECRET=''
 
 #   - GOOGLE CALENDAR/MEET/LOGIN
 # Needed to enable Google Calendar integration and Login with Google

.env.example

@@ -169,8 +169,7 @@ STRIPE_WEBHOOK_SECRET=
 STRIPE_WEBHOOK_SECRET_APPS=
 STRIPE_PRIVATE_KEY=
 STRIPE_CLIENT_ID=
-PAYMENT_FEE_FIXED=
-PAYMENT_FEE_PERCENTAGE=
+
 
 # Use for internal Public API Keys and optional
 API_KEY_PREFIX=cal_
@@ -181,6 +180,7 @@ API_KEY_PREFIX=cal_
 # allow access to the nodemailer transports from the .env file. E-mail templates are accessible within lib/emails/
 # Configures the global From: header whilst sending emails.
 EMAIL_FROM='notifications@yourselfhostedcal.com'
+EMAIL_FROM_NAME='Cal.com'
 
 # Configure SMTP settings (@see https://nodemailer.com/smtp/).
 # Configuration to receive emails locally (mailhog)
@@ -213,6 +213,10 @@ E2E_TEST_MAILHOG_ENABLED=
 
 # **********************************************************************************************************
 
+# Cloudflare Turnstile
+NEXT_PUBLIC_CLOUDFLARE_SITEKEY=
+CLOUDFLARE_TURNSTILE_SECRET=
+
 # Set the following value to true if you wish to enable Team Impersonation
 NEXT_PUBLIC_TEAM_IMPERSONATION=false
 
@@ -237,7 +241,7 @@ CSP_POLICY=
 # Vercel Edge Config
 EDGE_CONFIG=
 
-NEXT_PUBLIC_MINUTES_TO_BOOK=5 # Minutes
+NEXT_PUBLIC_MINUTES_TO_BOOK=5               # Minutes
 NEXT_PUBLIC_BOOKER_NUMBER_OF_DAYS_TO_LOAD=0 # Override the booker to only load X number of days worth of data
 
 # Control time intervals on a user's Schedule availability
@@ -296,6 +300,7 @@ E2E_TEST_CALCOM_GCAL_KEYS=
 CALCOM_CREDENTIAL_SYNC_SECRET=""
 # This is the header name that will be used to verify the webhook secret. Should be in lowercase
 CALCOM_CREDENTIAL_SYNC_HEADER_NAME="calcom-credential-sync-secret"
+# This the endpoint from which the token is fetched
 CALCOM_CREDENTIAL_SYNC_ENDPOINT=""
 # Key should match on Cal.com and your application
 # must be 24 bytes for AES256 encryption algorithm
@@ -344,5 +349,17 @@ SENTRY_DISABLE_SERVER_WEBPACK_PLUGIN=1
 # api v2
 NEXT_PUBLIC_API_V2_URL="http://localhost:5555/api/v2"
 
+# Tasker features
+TASKER_ENABLE_WEBHOOKS=0
+TASKER_ENABLE_EMAILS=0
+
 # Ratelimiting via unkey
-UNKEY_ROOT_KEY=
+UNKEY_ROOT_KEY=
+
+
+# Used for Cal.ai Enterprise Voice AI Agents
+# https://retellai.com
+RETELL_AI_KEY=
+
+# Used to disallow emails as being added as guests on bookings
+BLACKLISTED_GUEST_EMAILS=

.eslintignore

@@ -1,6 +1,9 @@
 node_modules
+apps/api/v2/dist
+packages/platform/**/dist/*
 **/**/node_modules
 **/**/.next
 **/**/public
 packages/prisma/zod
 apps/web/public/embed
+packages/ui/components/icon/dynamicIconImports.tsx

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,29 +2,18 @@
 
 <!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. -->
 
-Fixes # (issue)
+- Fixes #XXXX (GitHub issue number)
+- Fixes CAL-XXXX (Linear issue number - should be visible at the bottom of the GitHub issue description)
 
 <!-- Please provide a loom video for visual changes to speed up reviews
  Loom Video: https://www.loom.com/
 -->
 
-## Requirement/Documentation
+## Mandatory Tasks (DO NOT REMOVE)
 
-<!-- Please provide all documents that are important to understand the reason of that PR. -->
-
-- If there is a requirement document, please, share it here.
-- If there is a UI/UX design document, please, share it here.
-
-## Type of change
-
-<!-- Please delete bullets that are not relevant. -->
-
-- Bug fix (non-breaking change which fixes an issue)
-- Chore (refactoring code, technical debt, workflow improvements)
-- New feature (non-breaking change which adds functionality)
-- Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- Tests (Unit/Integration/E2E or any other test)
-- This change requires a documentation update
+- [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
+- [ ] I have added a Docs issue [here](https://github.com/calcom/docs/issues/new) if this PR makes changes that would require a [documentation change](https://docs.cal.com). If N/A, write N/A here and check the checkbox.
+- [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.
 
 ## How should this be tested?
 
@@ -35,10 +24,6 @@ Fixes # (issue)
 - What is expected (happy path) to have (input and output)?
 - Any other important info that could help to test that PR
 
-## Mandatory Tasks
-
-- [ ] Make sure you have self-reviewed the code. A decent size PR without self-review might be rejected.
-
 ## Checklist
 
 <!-- Remove bullet points below that don't apply to you -->
@@ -46,7 +31,4 @@ Fixes # (issue)
 - I haven't read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
 - My code doesn't follow the style guidelines of this project
 - I haven't commented my code, particularly in hard-to-understand areas
-- I haven't checked if my PR needs changes to the documentation
 - I haven't checked if my changes generate no new warnings
-- I haven't added tests that prove my fix is effective or that my feature works
-- I haven't checked if new and existing unit tests pass locally with my changes

.github/actions/cache-build/action.yml

@@ -8,22 +8,26 @@ runs:
   using: "composite"
   steps:
     - name: Cache production build
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       id: cache-build
       env:
+        # WARN: Don't touch this cache key. Currently github.sha refers to the latest commit in main
+        # and not the branch that's attempting to merge to main, which causes CI errors when merged
+        # to main.
+        # TODO: Fix this problem if intending to modify this cache key.
         cache-name: prod-build
         key-1: ${{ inputs.node_version }}-${{ hashFiles('yarn.lock') }}
         key-2: ${{ hashFiles('apps/**/**.[jt]s', 'apps/**/**.[jt]sx', 'packages/**/**.[jt]s', 'packages/**/**.[jt]sx', '!**/node_modules') }}
         key-3: ${{ github.event.pull_request.number || github.ref }}
-        # Ensures production-build.yml will always be fresh
         key-4: ${{ github.sha }}
+        key-5: ${{ github.event.pull_request.head.sha }}
       with:
         path: |
           ${{ github.workspace }}/apps/web/.next
           ${{ github.workspace }}/apps/web/public/embed
           **/.turbo/**
           **/dist/**
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+        key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}-${{ env.key-5 }}
     - run: |
         export NODE_OPTIONS="--max_old_space_size=8192"
         yarn build

.github/actions/cache-db/action.yml

@@ -3,7 +3,7 @@ description: "Cache or restore if necessary"
 inputs:
   DATABASE_URL:
     required: false
-    default: "postgresql://postgres:@localhost:5432/calendso"
+    default: "postgresql://postgres:postgres@localhost:5432/calendso"
   path:
     required: false
     default: "backups/backup.sql"
@@ -12,11 +12,12 @@ runs:
   steps:
     - name: Cache database
       id: cache-db
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       env:
         cache-name: cache-db
         key-1: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
         key-2: ${{ github.event.pull_request.number || github.ref }}
+        key-3: ${{ github.event.pull_request.head.sha }}
         DATABASE_URL: ${{ inputs.DATABASE_URL }}
         DATABASE_DIRECT_URL: ${{ inputs.DATABASE_URL }}
         E2E_TEST_CALCOM_QA_EMAIL: ${{ inputs.E2E_TEST_CALCOM_QA_EMAIL }}
@@ -24,7 +25,7 @@ runs:
         E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ inputs.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
       with:
         path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ inputs.path }}-${{ env.key-1 }}-${{ env.key-2 }}
+        key: ${{ runner.os }}-${{ env.cache-name }}-${{ inputs.path }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}
     - run: echo ${{ env.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }} && yarn db-seed
       if: steps.cache-db.outputs.cache-hit != 'true'
       shell: bash

.github/actions/dangerous-git-checkout/action.yml

@@ -4,7 +4,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 2

.github/actions/yarn-install/action.yml

@@ -20,7 +20,7 @@ runs:
   using: "composite"
   steps:
     - name: Use Node ${{ inputs.node_version }}
-      uses: buildjet/setup-node@v3
+      uses: buildjet/setup-node@v4
       with:
         node-version: ${{ inputs.node_version }}
     - name: Expose yarn config as "$GITHUB_OUTPUT"
@@ -32,7 +32,7 @@ runs:
     # Yarn rotates the downloaded cache archives, @see https://github.com/actions/setup-node/issues/325
     # Yarn cache is also reusable between arch and os.
     - name: Restore yarn cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       id: yarn-download-cache
       with:
         path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
@@ -43,7 +43,7 @@ runs:
     # Invalidated on yarn.lock changes
     - name: Restore node_modules
       id: yarn-nm-cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       with:
         path: "**/node_modules/"
         key: ${{ runner.os }}-yarn-nm-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
@@ -51,7 +51,7 @@ runs:
     # Invalidated on yarn.lock changes
     - name: Restore yarn install state
       id: yarn-install-state-cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       with:
         path: .yarn/ci-cache/
         key: ${{ runner.os }}-yarn-install-state-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}

.github/actions/yarn-playwright-install/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - name: Cache playwright binaries
       id: playwright-cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       with:
         path: |
           ~/Library/Caches/ms-playwright

.github/labeler.yml

@@ -1,6 +1,10 @@
 "❗️ migrations":
-  - packages/prisma/migrations/**/migration.sql
+- changed-files:
+  - any-glob-to-any-file:
+    - packages/prisma/migrations/**/migration.sql
 
 "❗️ .env changes":
-  - .env.example
-  - .env.appStore.example
+- changed-files:
+  - any-glob-to-any-file:
+    - .env.example
+    - .env.appStore.example

.github/workflows/all-checks.yml

@@ -0,0 +1,85 @@
+name: All checks
+
+on:
+  merge_group:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  type-check:
+    name: Type check
+    uses: ./.github/workflows/check-types.yml
+    secrets: inherit
+
+  lint:
+    name: Linters
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+
+  unit-test:
+    name: Tests
+    uses: ./.github/workflows/unit-tests.yml
+    secrets: inherit
+
+  build-api-v1:
+    name: Production builds
+    uses: ./.github/workflows/api-v1-production-build.yml
+    secrets: inherit
+
+  build-api-v2:
+    name: Production builds
+    uses: ./.github/workflows/api-v2-production-build.yml
+    secrets: inherit
+
+  build:
+    name: Production builds
+    uses: ./.github/workflows/production-build-without-database.yml
+    secrets: inherit
+
+  integration-test:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/integration-tests.yml
+    secrets: inherit
+
+  e2e:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e.yml
+    secrets: inherit
+
+  e2e-app-store:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e-app-store.yml
+    secrets: inherit
+
+  e2e-embed:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e-embed.yml
+    secrets: inherit
+
+  e2e-embed-react:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e-embed-react.yml
+    secrets: inherit
+
+  analyze:
+    name: Analyze Build
+    needs: [build]
+    uses: ./.github/workflows/nextjs-bundle-analysis.yml
+    secrets: inherit
+
+  required:
+    needs: [lint, type-check, unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
+    if: always()
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    steps:
+      - name: fail if conditional jobs failed
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')
+        run: exit 1

.github/workflows/api-v1-production-build.yml

@@ -1,4 +1,4 @@
-name: Production Build
+name: Production Builds
 
 on:
   workflow_call:
@@ -18,7 +18,10 @@ env:
   GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
   NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
   NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
   NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
   NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
   NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
   NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
@@ -33,27 +36,55 @@ env:
   SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
   TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
-  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
 
 jobs:
   build:
-    name: Build
+    name: Build API v1
     runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 30
     services:
       postgres:
-        image: postgres:13.13
+        image: postgres:13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
         env:
           POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
-      - uses: ./.github/actions/cache-build
+      - name: Cache API v1 production build
+        uses: buildjet/cache@v4
+        id: cache-api-v1-build
+        env:
+          cache-name: api-v1-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('apps/api/v1/**.[jt]s', 'apps/api/v1/**.[jt]sx', '!**/node_modules') }}
+          key-3: ${{ github.event.pull_request.number || github.ref }}
+          # Ensures production-build.yml will always be fresh
+          key-4: ${{ github.sha }}
+        with:
+          path: |
+            ${{ github.workspace }}/apps/api/v1/.next
+            **/.turbo/**
+            **/dist/**
+          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+      - run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          if [ ${{ steps.cache-api-v1-build.outputs.cache-hit }} == 'true' ]; then
+            echo "Cache hit for API v1 build. Skipping build."
+          else
+            yarn turbo run build --filter=@calcom/api...
+          fi
+        shell: bash

.github/workflows/api-v2-production-build.yml

@@ -0,0 +1,60 @@
+name: Production Build
+
+on:
+  workflow_call:
+
+env:
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+
+jobs:
+  build:
+    name: Build API v2
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    timeout-minutes: 30
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - name: Cache API v2 production build
+        uses: buildjet/cache@v4
+        id: cache-api-v2-build
+        env:
+          cache-name: api-v2-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('apps/api/v2/**.[jt]s', 'apps/api/v2/**.[jt]sx', '!**/node_modules') }}
+          key-3: ${{ github.event.pull_request.number || github.ref }}
+          # Ensures production-build.yml will always be fresh
+          key-4: ${{ github.sha }}
+        with:
+          path: |
+            **/dist/**
+          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+      - run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          if [ ${{ steps.cache-api-v2-build.outputs.cache-hit }} == 'true' ]; then
+            echo "Cache hit for API v2 build. Skipping build."
+          else
+            yarn workspace @calcom/api-v2 run generate-schemas
+            rm -rf apps/api/v2/node_modules
+            yarn install
+            yarn workspace @calcom/api-v2 run build
+          fi
+        shell: bash

.github/workflows/cache-clean.yml

@@ -6,10 +6,10 @@ on:
 
 jobs:
   cleanup:
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Cleanup
         run: |
@@ -21,7 +21,7 @@ jobs:
           echo "Fetching list of cache key"
           cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 )
 
-          ## Setting this to not fail the workflow while deleting cache keys. 
+          ## Setting this to not fail the workflow while deleting cache keys.
           set +e
           echo "Deleting caches..."
           for cacheKey in $cacheKeysForPR

.github/workflows/check-if-ui-has-changed.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }} # So we can test on forks
           fetch-depth: 0

.github/workflows/check-types.yml

@@ -7,7 +7,7 @@ jobs:
   check-types:
     runs-on: buildjet-4vcpu-ubuntu-2204
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - name: Show info

.github/workflows/cron-changeTimeZone.yml

@@ -0,0 +1,24 @@
+name: Cron - changeTimeZone
+
+on:
+  # "Scheduled workflows run on the latest commit on the default or base branch."
+  # — https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#schedule
+  schedule:
+    # Runs "At every full hour." (see https://crontab.guru)
+    - cron:  "0 * * * *"
+
+jobs:
+  cron-scheduleEmailReminders:
+    env:
+      APP_URL: ${{ secrets.APP_URL }}
+      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: cURL request
+        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+        run: |
+          curl ${{ secrets.APP_URL }}/api/cron/changeTimeZone \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            -sSf

.github/workflows/cron-monthlyDigestEmail.yml

@@ -18,9 +18,9 @@ jobs:
         run: |
           LAST_DAY=$(date -d tomorrow +%d)
           if [ "$LAST_DAY" == "01" ]; then
-            echo "::set-output name=is_last_day::true"
+            echo "is_last_day=true" >> "$GITHUB_OUTPUT"
           else
-            echo "::set-output name=is_last_day::false"
+            echo "is_last_day=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: cURL request

.github/workflows/crowdin.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.GH_ACCESS_TOKEN }}
 

.github/workflows/delete-buildjet-cache.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - uses: buildjet/cache-delete@v1
         with:
           cache_key: ${{ inputs.cache_key }}

.github/workflows/e2e-app-store.yml

@@ -1,22 +1,63 @@
-name: E2E App-Store Apps Tests
+name: E2E App Store Tests
 on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
+  EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
+  EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
+  EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 jobs:
   e2e-app-store:
     timeout-minutes: 20
-    name: E2E App Store (${{ matrix.shard }}/${{ strategy.job-total }})
+    name: E2E App Store
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:13.13
+        image: postgres:13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
         env:
           POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
         ports:
           - 5432:5432
       mailhog:
@@ -29,16 +70,13 @@ jobs:
           - 1025:1025
     strategy:
       fail-fast: false
-      matrix:
-        ## There aren't many tests for AppStore. So, just start with 2 shards. Increase if needed.
-        shard: [1, 2]
 
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
@@ -52,42 +90,10 @@ jobs:
           E2E_TEST_CALCOM_GCAL_KEYS: ${{ secrets.E2E_TEST_CALCOM_GCAL_KEYS }}
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:app-store --shard=${{ matrix.shard }}/${{ strategy.job-total }}
-        env:
-          ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
-          CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
-          DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-          DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
-          DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
-          E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
-          E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
-          E2E_TEST_CALCOM_QA_EMAIL: ${{ secrets.E2E_TEST_CALCOM_QA_EMAIL }}
-          E2E_TEST_CALCOM_QA_PASSWORD: ${{ secrets.E2E_TEST_CALCOM_QA_PASSWORD }}
-          E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ secrets.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
-          E2E_TEST_CALCOM_GCAL_KEYS: ${{ secrets.E2E_TEST_CALCOM_GCAL_KEYS }}
-          E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
-          GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
-          GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
-          NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
-          NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
-          NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
-          NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
-          NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
-          NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
-          PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
-          PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
-          SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
-          SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
-          STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
-          STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
-          STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
-          SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
-          SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
-          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+        run: yarn e2e:app-store
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: app-store-results-${{ matrix.shard }}_${{ strategy.job-total }}
+          name: app-store-results
           path: test-results

.github/workflows/e2e-embed-react.yml

@@ -3,34 +3,72 @@ on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
+  EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
+  EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
+  EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 jobs:
   e2e-embed:
     timeout-minutes: 20
-    name: E2E Embed React (${{ matrix.shard }}/${{ strategy.job-total }})
+    name: E2E Embed React
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:13.13
+        image: postgres:13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
         env:
           POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
         ports:
           - 5432:5432
     strategy:
       fail-fast: false
-      matrix:
-        ## There aren't many tests for embed-react. So, just start with 2 shards. Increase if needed.
-        shard: [1, 2]
 
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
@@ -38,38 +76,11 @@ jobs:
       - uses: ./.github/actions/cache-build
       - name: Run Tests
         run: |
-          yarn e2e:embed-react --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+          yarn e2e:embed-react
           yarn workspace @calcom/embed-react packaged:tests
-        env:
-          ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
-          CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
-          DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-          DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
-          DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
-          E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
-          E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
-          GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
-          GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
-          NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
-          NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
-          NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
-          NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
-          NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
-          NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
-          PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
-          PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
-          SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
-          SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
-          STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
-          STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
-          STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
-          SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
-          SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
-          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: embed-react-results-${{ matrix.shard }}_${{ strategy.job-total }}
+          name: embed-react-results
           path: test-results

.github/workflows/e2e-embed.yml

@@ -3,20 +3,61 @@ on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
+  EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
+  EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
+  EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 jobs:
   e2e-embed:
     timeout-minutes: 20
-    name: E2E Embed Core (${{ matrix.shard }}/${{ strategy.job-total }})
+    name: E2E Embed Core
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:13.13
+        image: postgres:13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
         env:
           POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
         ports:
           - 5432:5432
       mailhog:
@@ -29,54 +70,23 @@ jobs:
           - 1025:1025
     strategy:
       fail-fast: false
-      matrix:
-        ## There aren't many tests for embed-core. So, just start with 2 shards. Increase if needed.
-        shard: [1, 2]
 
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:embed --shard=${{ matrix.shard }}/${{ strategy.job-total }}
-        env:
-          ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
-          CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
-          DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-          DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
-          DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
-          E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
-          E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
-          E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
-          GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
-          GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
-          NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
-          NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
-          NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
-          NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
-          NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
-          NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
-          PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
-          PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
-          SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
-          SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
-          STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
-          STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
-          STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
-          SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
-          SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
-          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+        run: yarn e2e:embed
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: embed-core-results-${{ matrix.shard }}_${{ strategy.job-total }}
+          name: embed-core-results
           path: test-results

.github/workflows/e2e.yml

@@ -1,22 +1,63 @@
-name: E2E tests
+name: E2E
 on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
+  EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
+  EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
+  EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 jobs:
   e2e:
     timeout-minutes: 20
-    name: E2E tests (${{ matrix.shard }}/${{ strategy.job-total }})
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    name: E2E (${{ matrix.shard }}/${{ strategy.job-total }})
+    runs-on: buildjet-8vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:13.13
+        image: postgres:13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
         env:
           POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
         ports:
           - 5432:5432
       mailhog:
@@ -30,13 +71,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4, 5]
+        shard: [1, 2, 3, 4]
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
@@ -44,38 +85,6 @@ jobs:
       - uses: ./.github/actions/cache-build
       - name: Run Tests
         run: yarn e2e --shard=${{ matrix.shard }}/${{ strategy.job-total }}
-        env:
-          ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
-          CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
-          DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-          DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
-          DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
-          E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
-          E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
-          E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
-          GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
-          EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
-          EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
-          EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
-          EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
-          GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
-          NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
-          NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
-          NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
-          NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
-          NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
-          NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
-          PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
-          PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
-          SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
-          SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
-          STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
-          STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
-          STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
-          SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
-          SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
-          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/integration-tests.yml

@@ -0,0 +1,90 @@
+name: Integration
+on:
+  workflow_call:
+env:
+  NODE_OPTIONS: --max-old-space-size=4096
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
+  EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
+  EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
+  EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+jobs:
+  integration:
+    timeout-minutes: 20
+    name: Integration
+    runs-on: buildjet-8vcpu-ubuntu-2204
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+      mailhog:
+        image: mailhog/mailhog:v1.0.1
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        ports:
+          - 8025:8025
+          - 1025:1025
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - uses: ./.github/actions/cache-db
+      - name: Run Tests
+        run: yarn test -- --integrationTestsOnly
+      # TODO: Generate test results so we can upload them
+      # - name: Upload Test Results
+      #   if: ${{ always() }}
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: test-results
+      #     path: test-results

.github/workflows/labeler.yml

@@ -12,18 +12,16 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v4
+      - uses: actions/labeler@v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
-          # https://github.com/actions/labeler/issues/442#issuecomment-1297359481
-          sync-labels: ""
   team-labels:
     permissions:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: equitybee/team-label-action@main
         with:
           repo-token: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN }}
@@ -39,7 +37,7 @@ jobs:
 
     steps:
       - name: Apply labels from linked issue to PR
-        uses: actions/github-script@v5
+        uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/lint.yml

@@ -6,7 +6,7 @@ jobs:
     runs-on: buildjet-4vcpu-ubuntu-2204
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - name: Run Linting with Reports

.github/workflows/nextjs-bundle-analysis.yml

@@ -7,18 +7,49 @@ on:
     branches:
       - main
 
+env:
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
+  EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
+  EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
+  EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+
 jobs:
-  build:
-    name: Production build
-    if: ${{ github.event_name == 'push' }}
-    uses: ./.github/workflows/production-build.yml
-    secrets: inherit
   analyze:
-    needs: build
     if: always()
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-build

.github/workflows/pr-review.yml

@@ -0,0 +1,17 @@
+name: PR Reviewed
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  label-pr:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Label PR as ready for E2E
+        if: github.event.review.state == 'approved'
+        uses: actions-ecosystem/action-add-labels@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          labels: 'ready-for-e2e'

.github/workflows/pr.yml

@@ -2,9 +2,10 @@ name: PR Update
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
     branches:
       - main
-  merge_group:
+      - gh-actions-test-branch
   workflow_dispatch:
 
 concurrency:
@@ -14,94 +15,163 @@ concurrency:
 jobs:
   changes:
     name: Detect changes
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: buildjet-2vcpu-ubuntu-2204
     permissions:
       pull-requests: read
     outputs:
       has-files-requiring-all-checks: ${{ steps.filter.outputs.has-files-requiring-all-checks }}
+      commit-sha: ${{ steps.get_sha.outputs.commit-sha }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
-      - uses: dorny/paths-filter@v2
+      - uses: dorny/paths-filter@v3
         id: filter
         with:
           filters: |
             has-files-requiring-all-checks:
               - "!(**.md|.github/CODEOWNERS)"
+      - name: Get Latest Commit SHA
+        id: get_sha
+        run: |
+          echo "commit-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
+  check-label:
+    needs: [changes]
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    name: Check for E2E label
+    outputs:
+      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' && (github.event.action != 'labeled' || (github.event.action == 'labeled' && github.event.label.name == 'ready-for-e2e')) }}
+    steps:
+      - name: Check if PR exists with ready-for-e2e label for this SHA
+        id: check-if-pr-has-label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let labels = [];
+
+            if (context.payload.pull_request) {
+              labels = context.payload.pull_request.labels;
+            } else {
+              try {
+                const sha = '${{ needs.changes.outputs.commit-sha }}';
+                console.log('sha', sha);
+                const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  commit_sha: sha
+                });
+
+                if (prs.length === 0) {
+                  core.setOutput('run-e2e', false);
+                  console.log(`No pull requests found for commit SHA ${sha}`);
+                  return;
+                }
+
+                const pr = prs[0];
+                console.log(`PR number: ${pr.number}`);
+                console.log(`PR title: ${pr.title}`);
+                console.log(`PR state: ${pr.state}`);
+                console.log(`PR URL: ${pr.html_url}`);
+
+                labels = pr.labels;
+              }
+              catch (e) {
+                core.setOutput('run-e2e', false);
+                console.log(e);
+              }
+            }
+
+            const labelFound = labels.map(l => l.name).includes('ready-for-e2e');
+            console.log('Found the label?', labelFound);
+            core.setOutput('run-e2e', labelFound);
+
   type-check:
     name: Type check
-    needs: [changes]
+    needs: [changes, check-label]
     if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/check-types.yml
     secrets: inherit
 
-  test:
-    name: Unit tests
-    needs: [changes]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    uses: ./.github/workflows/unit-tests.yml
-    secrets: inherit
-
   lint:
     name: Linters
-    needs: [changes]
+    needs: [changes, check-label]
     if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/lint.yml
     secrets: inherit
 
-  build:
-    name: Production build
-    needs: [changes]
+  unit-test:
+    name: Tests
+    needs: [changes, check-label]
     if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    uses: ./.github/workflows/production-build.yml
+    uses: ./.github/workflows/unit-tests.yml
     secrets: inherit
 
-  build-without-database:
-    name: Production build (without database)
-    needs: [changes]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+  build-api-v1:
+    name: Production builds
+    needs: [changes, check-label]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/api-v1-production-build.yml
+    secrets: inherit
+
+  build-api-v2:
+    name: Production builds
+    needs: [changes, check-label]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/api-v2-production-build.yml
+    secrets: inherit
+
+  build:
+    name: Production builds
+    needs: [changes, check-label]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/production-build-without-database.yml
     secrets: inherit
 
-  e2e:
-    name: E2E tests
-    needs: [changes, lint, build]
+  integration-test:
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
     if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/integration-tests.yml
+    secrets: inherit
+
+  e2e:
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e.yml
     secrets: inherit
 
   e2e-app-store:
-    name: E2E App Store tests
-    needs: [changes, lint, build]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-app-store.yml
     secrets: inherit
 
   e2e-embed:
-    name: E2E embeds tests
-    needs: [changes, lint, build]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed.yml
     secrets: inherit
 
   e2e-embed-react:
-    name: E2E React embeds tests
-    needs: [changes, lint, build]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
   analyze:
     name: Analyze Build
-    needs: [changes, build]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [build]
     uses: ./.github/workflows/nextjs-bundle-analysis.yml
     secrets: inherit
 
   required:
-    needs: [changes, lint, type-check, test, build, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
+    needs: [changes, lint, type-check, unit-test, integration-test, check-label, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
     if: always()
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
       - name: fail if conditional jobs failed
         if: needs.changes.outputs.has-files-requiring-all-checks == 'true' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled'))

.github/workflows/pre-release.yml

@@ -14,9 +14,9 @@ jobs:
       embed: ${{ steps.filter.outputs.embed }}
       embed-react: ${{ steps.filter.outputs.embed-react }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
-      - uses: dorny/paths-filter@v2
+      - uses: dorny/paths-filter@v3
         id: filter
         with:
           filters: |
@@ -39,8 +39,8 @@ jobs:
     secrets: inherit
 
   build:
-    name: Production build
-    uses: ./.github/workflows/production-build.yml
+    name: Production builds
+    uses: ./.github/workflows/production-build-without-database.yml
     secrets: inherit
 
   e2e:
@@ -67,15 +67,10 @@ jobs:
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
-  build-without-database:
-    name: Production build (without database)
-    uses: ./.github/workflows/production-build-without-database.yml
-    secrets: inherit
-
   required:
-    needs: [e2e, e2e-app-store, e2e-embed, e2e-embed-react, build-without-database]
+    needs: [changes, lint, build, e2e, e2e-app-store, e2e-embed, e2e-embed-react]
     if: always()
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
       - name: fail if conditional jobs failed
         if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')

.github/workflows/production-build-without-database.yml

@@ -1,11 +1,11 @@
-name: Production Build (without database)
-
+name: Production Builds
 on:
   workflow_call:
 
 env:
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
   DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
@@ -30,14 +30,17 @@ env:
   TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
   NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+
 
 jobs:
   build:
-    name: Build
-    runs-on: ubuntu-latest
+    name: Web App
+    runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-build

.github/workflows/release-docker.yaml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: "Determine tag"
         run: 'echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV'

.github/workflows/release.yml

@@ -9,7 +9,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: main # Always checkout main even for tagged releases
           fetch-depth: 0

.github/workflows/semantic-pull-requests.yml

@@ -37,12 +37,3 @@ jobs:
             ```
             ${{ steps.lint_pr_title.outputs.error_message }}
             ```
-
-      # Delete a previous comment when the issue has been resolved
-      - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          header: pr-title-lint-error
-          message: |
-            Thank you for following the naming conventions! 🙏 Feel free to join our [discord](https://go.cal.com/discord) and post your PR link.           
-

.github/workflows/submodule-sync.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: recursive
           token: ${{ secrets.GH_ACCESS_TOKEN }}

.github/workflows/unit-tests.yml

@@ -1,4 +1,4 @@
-name: Unit tests
+name: Unit
 on:
   workflow_call:
   workflow_run:
@@ -6,10 +6,11 @@ on:
     types: [completed]
 jobs:
   test:
+    name: Unit
     timeout-minutes: 20
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       # Should be an 8GB machine as per https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners

.github/workflows/yarn-install.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install

.prettierignore

@@ -17,3 +17,4 @@ packages/prisma/zod
 packages/prisma/enums
 apps/web/public/embed
 apps/api/v2/swagger/documentation.json
+packages/ui/components/icon/dynamicIconImports.tsx

CONTRIBUTING.md

@@ -13,8 +13,6 @@ Contributions are what makes the open source community such an amazing place to
     - Issues from non-core members automatically receive the `🚨 needs approval` label.
     - We greatly value new feature ideas. To ensure consistency in the product's direction, they undergo review and approval.
 
-
-
 ## Priorities
 
 <table>
@@ -101,7 +99,7 @@ To develop locally:
 
    - Duplicate `.env.example` to `.env`.
    - Use `openssl rand -base64 32` to generate a key and add it under `NEXTAUTH_SECRET` in the `.env` file.
-   - Use `openssl rand -base64 24` to generate a key and add it under `CALENDSO_ENCRYPTION_KEY` in the `.env` file.
+   - Use `openssl rand -base64 32` to generate a key and add it under `CALENDSO_ENCRYPTION_KEY` in the `.env` file.
 
 6. Setup Node
    If your Node version does not meet the project's requirements as instructed by the docs, "nvm" (Node Version Manager) allows using Node at the version required by the project:
@@ -178,11 +176,15 @@ If you get errors, be sure to fix them before committing.
 Do not commit your `yarn.lock` unless you've made changes to the `package.json`. If you've already committed `yarn.lock` unintentionally, follow these steps to undo:
 
 If your last commit has the `yarn.lock` file alongside other files and you only wish to uncommit the `yarn.lock`:
+
    ```bash
    git checkout HEAD~1 yarn.lock
    git commit -m "Revert yarn.lock changes"
    ```
+
+_NB_: You may have to bypass the pre-commit hook with by appending `--no-verify` to the git commit
 If you've pushed the commit with the `yarn.lock`:
+
    1. Correct the commit locally using the above method.
    2. Carefully force push:
 
@@ -194,26 +196,35 @@ If `yarn.lock` was committed a while ago and there have been several commits sin
 
 1. **Checkout a Previous Version**:
    - Find the commit hash before the `yarn.lock` was unintentionally committed. You can do this by viewing the Git log:
+
      ```bash
      git log yarn.lock
      ```
+
    - Once you have identified the commit hash, use it to checkout the previous version of `yarn.lock`:
+
      ```bash
      git checkout <commit_hash> yarn.lock
      ```
 
 2. **Commit the Reverted Version**:
    - After checking out the previous version of the `yarn.lock`, commit this change:
+
      ```bash
      git commit -m "Revert yarn.lock to its state before unintended changes"
      ```
 
 3. **Proceed with Caution**:
    - If you need to push this change, first pull the latest changes from your remote branch to ensure you're not overwriting other recent changes:
+
      ```bash
      git pull origin <your-branch-name>
      ```
+
    - Then push the updated branch:
+
      ```bash
      git push origin <your-branch-name>
      ```
+
+Lastly, make sure to keep the branches updated (e.g. click the `Update branch` button on GitHub PR).

README.md

@@ -24,7 +24,7 @@
 
 <p align="center">
    <a href="https://go.cal.com/discord"><img src="https://img.shields.io/badge/Discord-go.cal.com%2Fdiscord-%234A154B" alt="Join Cal.com Discord"></a>
-   <a href="https://producthunt.com/posts/calendso"><img src="https://img.shields.io/badge/Product%20Hunt-%231%20Product%20of%20the%20Month-%23DA552E" alt="Product Hunt"></a>
+   <a href="https://www.producthunt.com/products/cal-com"><img src="https://img.shields.io/badge/Product%20Hunt-%231%20Product%20of%20the%20Month-%23DA552E" alt="Product Hunt"></a>
    <a href="https://status.cal.com"><img height="20px" src="https://betteruptime.com/status-badges/v1/monitor/a9kf.svg" alt="Uptime"></a>
    <a href="https://github.com/calcom/cal.com/stargazers"><img src="https://img.shields.io/github/stars/calcom/cal.com" alt="Github Stars"></a>
    <a href="https://news.ycombinator.com/item?id=34507672"><img src="https://img.shields.io/badge/Hacker%20News-%231-%23FF6600" alt="Hacker News"></a>
@@ -33,7 +33,7 @@
    <a href="https://cal.com/pricing"><img src="https://img.shields.io/badge/Pricing-Free-brightgreen" alt="Pricing"></a>
    <a href="https://jitsu.com?utm_source=github/calcom/cal.com"><img src="https://img.shields.io/badge/Metrics_tracked_by-JITSU-AA00FF?logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA4AAAAOCAYAAAAfSC3RAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAACKSURBVHgBrZDRCYAwDEQv6gCOoKO4hOCXI9QVnEZwiY5iF5GaVClaBNtioCSUvCR3tMJaxIfZgW4AGUoEPVwgPZoS0Dmgg3NBVDFNbMIsmYCak3J1jDk9iCQvsKJvkzr71N81Gj6vDT/LU2P6RhY63jcafk3YJEbgeZpiFyc/5HJKv8Ef273NSfABGbQfUZhnOSAAAAAASUVORK5CYII=" alt="Jitsu Tracked"></a>
    <img src="https://api.checklyhq.com/v1/badges/checks/5e048048-1b51-47ba-9209-60607507622e?responseTime=true" alt="Checkly Availability" />
-   <a href="https://hub.docker.com/r/calendso/calendso"><img src="https://img.shields.io/docker/pulls/calendso/calendso"></a>
+   <a href="https://hub.docker.com/r/calcom/cal.com"><img src="https://img.shields.io/docker/pulls/calcom/cal.com"></a>
    <a href="https://twitch.tv/calcomtv"><img src="https://img.shields.io/twitch/status/calcomtv?style=flat"></a>
    <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+label:%22%F0%9F%99%8B%F0%9F%8F%BB%E2%80%8D%E2%99%82%EF%B8%8Fhelp+wanted%22"><img src="https://img.shields.io/badge/Help%20Wanted-Contribute-blue"></a>
    <a href="https://cal.com/figma"><img src="https://img.shields.io/badge/Figma-Design%20System-blueviolet"></a>
@@ -113,7 +113,7 @@ To get a local copy up and running, please follow these simple steps.
 Here is what you need to be able to run Cal.com.
 
 - Node.js (Version: >=18.x)
-- PostgreSQL
+- PostgreSQL (Version: >=13.x)
 - Yarn _(recommended)_
 
 > If you want to enable any of the available integrations, you may want to obtain additional credentials for each one. More details on this can be found below under the [integrations section](#integrations).
@@ -210,7 +210,7 @@ echo 'NEXT_PUBLIC_DEBUG=1' >> .env
       ![image](https://user-images.githubusercontent.com/39329182/236612291-51d87f69-6dc1-4a23-bf4d-1ca1754e0a35.png)
 
    5. Now extract all the info and add it to your DATABASE_URL. The url would look something like this
-      `postgresql://postgres:postgres@localhost:5432/Your-DB-Name`.
+      `postgresql://postgres:postgres@localhost:5432/Your-DB-Name`. The port is configurable and does not have to be 5432.
 
    </details>
 

__checks__/organization.spec.ts

@@ -56,7 +56,7 @@ test.describe("Org", () => {
       ];
       const response = await page.goto(`http://i.cal.com/${users[0].username}+${users[1].username}`);
       expect(response?.status()).toBe(200);
-      expect(await page.locator('[data-testid="event-title"]').textContent()).toBe("Dynamic");
+      expect(await page.locator('[data-testid="event-title"]').textContent()).toBe("Group Meeting");
 
       expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(users[0].name);
       expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(users[1].name);

apps/api/v1/.env.example

@@ -4,3 +4,4 @@ NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
 
 # Get it in console.cal.com
 CALCOM_LICENSE_KEY="" 
+NEXT_PUBLIC_API_V2_ROOT_URL=http://localhost:5555

apps/api/v1/instrumentation.ts

@@ -0,0 +1,15 @@
+import * as Sentry from "@sentry/nextjs";
+
+export function register() {
+  if (process.env.NEXT_RUNTIME === "nodejs") {
+    Sentry.init({
+      dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    });
+  }
+
+  if (process.env.NEXT_RUNTIME === "edge") {
+    Sentry.init({
+      dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    });
+  }
+}

apps/api/v1/lib/helpers/checkIsInMaintenanceMode.ts

@@ -0,0 +1,23 @@
+import { get } from "@vercel/edge-config";
+import type { NextMiddleware } from "next-api-middleware";
+
+const safeGet = async <T = unknown>(key: string): Promise<T | undefined> => {
+  try {
+    return get<T>(key);
+  } catch (error) {
+    // Don't crash if EDGE_CONFIG env var is missing
+  }
+};
+
+export const config = { matcher: "/:path*" };
+
+export const checkIsInMaintenanceMode: NextMiddleware = async (req, res, next) => {
+  const isInMaintenanceMode = await safeGet<boolean>("isInMaintenanceMode");
+  if (isInMaintenanceMode) {
+    return res
+      .status(503)
+      .json({ message: "API is currently under maintenance. Please try again at a later time." });
+  }
+
+  await next();
+};

apps/api/v1/lib/helpers/rateLimitApiKey.test.ts

@@ -0,0 +1,90 @@
+import type { Request, Response } from "express";
+import type { NextApiResponse, NextApiRequest } from "next";
+import { createMocks } from "node-mocks-http";
+import { describe, it, expect, vi } from "vitest";
+
+import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
+
+import { rateLimitApiKey } from "~/lib/helpers/rateLimitApiKey";
+
+type CustomNextApiRequest = NextApiRequest & Request;
+type CustomNextApiResponse = NextApiResponse & Response;
+
+vi.mock("@calcom/lib/checkRateLimitAndThrowError", () => ({
+  checkRateLimitAndThrowError: vi.fn(),
+}));
+
+describe("rateLimitApiKey middleware", () => {
+  it("should return 401 if no apiKey is provided", async () => {
+    const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+      method: "GET",
+      query: {},
+    });
+
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res._getStatusCode()).toBe(401);
+    expect(res._getJSONData()).toEqual({ message: "No apiKey provided" });
+  });
+
+  it("should call checkRateLimitAndThrowError with correct parameters", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+    });
+
+    (checkRateLimitAndThrowError as any).mockResolvedValueOnce({
+      limit: 100,
+      remaining: 99,
+      reset: Date.now(),
+    });
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(checkRateLimitAndThrowError).toHaveBeenCalledWith({
+      identifier: "test-key",
+      rateLimitingType: "api",
+      onRateLimiterResponse: expect.any(Function),
+    });
+  });
+
+  it("should set rate limit headers correctly", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+    });
+
+    const rateLimiterResponse = {
+      limit: 100,
+      remaining: 99,
+      reset: Date.now(),
+    };
+
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(({ onRateLimiterResponse }) => {
+      onRateLimiterResponse(rateLimiterResponse);
+    });
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res.getHeader("X-RateLimit-Limit")).toBe(rateLimiterResponse.limit);
+    expect(res.getHeader("X-RateLimit-Remaining")).toBe(rateLimiterResponse.remaining);
+    expect(res.getHeader("X-RateLimit-Reset")).toBe(rateLimiterResponse.reset);
+  });
+
+  it("should return 429 if rate limit is exceeded", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+    });
+
+    (checkRateLimitAndThrowError as any).mockRejectedValue(new Error("Rate limit exceeded"));
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res._getStatusCode()).toBe(429);
+    expect(res._getJSONData()).toEqual({ message: "Rate limit exceeded" });
+  });
+});

apps/api/v1/lib/helpers/rateLimitApiKey.ts

@@ -1,21 +1,24 @@
 import type { NextMiddleware } from "next-api-middleware";
 
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
-import { API_KEY_RATE_LIMIT } from "@calcom/lib/rateLimit";
 
 export const rateLimitApiKey: NextMiddleware = async (req, res, next) => {
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
 
   // TODO: Add a way to add trusted api keys
-  await checkRateLimitAndThrowError({
-    identifier: req.query.apiKey as string,
-    rateLimitingType: "api",
-    onRateLimiterResponse: (response) => {
-      res.setHeader("X-RateLimit-Limit", API_KEY_RATE_LIMIT);
-      res.setHeader("X-RateLimit-Remaining", response.remaining);
-      res.setHeader("X-RateLimit-Reset", response.reset);
-    },
-  });
+  try {
+    await checkRateLimitAndThrowError({
+      identifier: req.query.apiKey as string,
+      rateLimitingType: "api",
+      onRateLimiterResponse: (response) => {
+        res.setHeader("X-RateLimit-Limit", response.limit);
+        res.setHeader("X-RateLimit-Remaining", response.remaining);
+        res.setHeader("X-RateLimit-Reset", response.reset);
+      },
+    });
+  } catch (error) {
+    res.status(429).json({ message: "Rate limit exceeded" });
+  }
 
   await next();
 };

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -6,6 +6,7 @@ import { IS_PRODUCTION } from "@calcom/lib/constants";
 import prisma from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";
+import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 
 // Used to check if the apiKey is not expired, could be extracted if reused. but not for now.
 export const dateNotInPast = function (date: Date) {
@@ -36,7 +37,10 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   if (!apiKey.userId) return res.status(404).json({ error: "No user found for this apiKey" });
   // save the user id in the request for later use
   req.userId = apiKey.userId;
-  // save the isAdmin boolean here for later use
-  req.isAdmin = await isAdminGuard(req);
+  const { isAdmin, scope } = await isAdminGuard(req);
+
+  req.isSystemWideAdmin = isAdmin && scope === ScopeOfAdmin.SystemWide;
+  req.isOrganizationOwnerOrAdmin = isAdmin && scope === ScopeOfAdmin.OrgOwnerOrAdmin;
+
   await next();
 };

apps/api/v1/lib/helpers/verifyCredentialSyncEnabled.ts

@@ -3,9 +3,9 @@ import type { NextMiddleware } from "next-api-middleware";
 import { APP_CREDENTIAL_SHARING_ENABLED } from "@calcom/lib/constants";
 
 export const verifyCredentialSyncEnabled: NextMiddleware = async (req, res, next) => {
-  const { isAdmin } = req;
+  const { isSystemWideAdmin } = req;
 
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     return res.status(403).json({ error: "Only admin API keys can access credential syncing endpoints" });
   }
 

apps/api/v1/lib/helpers/withMiddleware.ts

@@ -2,6 +2,7 @@ import { label } from "next-api-middleware";
 
 import { addRequestId } from "./addRequestid";
 import { captureErrors } from "./captureErrors";
+import { checkIsInMaintenanceMode } from "./checkIsInMaintenanceMode";
 import { extendRequest } from "./extendRequest";
 import {
   HTTP_POST,
@@ -24,6 +25,7 @@ const middleware = {
   HTTP_POST,
   HTTP_DELETE,
   addRequestId,
+  checkIsInMaintenanceMode,
   verifyApiKey,
   rateLimitApiKey,
   extendRequest,
@@ -36,6 +38,7 @@ type Middleware = keyof typeof middleware;
 
 const middlewareOrder = [
   // The order here, determines the order of execution
+  "checkIsInMaintenanceMode",
   "extendRequest",
   "captureErrors",
   "verifyApiKey",

apps/api/v1/lib/utils/extractUserIdsFromQuery.ts

@@ -4,9 +4,9 @@ import { HttpError } from "@calcom/lib/http-error";
 
 import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/queryUserId";
 
-export function extractUserIdsFromQuery({ isAdmin, query }: NextApiRequest) {
+export function extractUserIdsFromQuery({ isSystemWideAdmin, query }: NextApiRequest) {
   /** Guard: Only admins can query other users */
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     throw new HttpError({ statusCode: 401, message: "ADMIN required" });
   }
   const { userId: userIdOrUserIds } = schemaQuerySingleOrMultipleUserIds.parse(query);

apps/api/v1/lib/utils/isAdmin.ts

@@ -1,10 +1,37 @@
 import type { NextApiRequest } from "next";
 
 import prisma from "@calcom/prisma";
-import { UserPermissionRole } from "@calcom/prisma/enums";
+import { UserPermissionRole, MembershipRole } from "@calcom/prisma/enums";
+
+import { ScopeOfAdmin } from "./scopeOfAdmin";
 
 export const isAdminGuard = async (req: NextApiRequest) => {
   const { userId } = req;
-  const user = await prisma.user.findUnique({ where: { id: userId } });
-  return user?.role === UserPermissionRole.ADMIN;
+  const user = await prisma.user.findUnique({ where: { id: userId }, select: { role: true } });
+  if (!user) return { isAdmin: false, scope: null };
+
+  const { role: userRole } = user;
+  if (userRole === UserPermissionRole.ADMIN) return { isAdmin: true, scope: ScopeOfAdmin.SystemWide };
+
+  const orgOwnerOrAdminMemberships = await prisma.membership.findMany({
+    where: {
+      userId: userId,
+      accepted: true,
+      team: {
+        isOrganization: true,
+      },
+      OR: [{ role: MembershipRole.OWNER }, { role: MembershipRole.ADMIN }],
+    },
+    select: {
+      team: {
+        select: {
+          id: true,
+          isOrganization: true,
+        },
+      },
+    },
+  });
+  if (!orgOwnerOrAdminMemberships.length) return { isAdmin: false, scope: null };
+
+  return { isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin };
 };

apps/api/v1/lib/utils/retrieveScopedAccessibleUsers.ts

@@ -0,0 +1,92 @@
+import prisma from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/enums";
+
+type AccessibleUsersType = {
+  memberUserIds: number[];
+  adminUserId: number;
+};
+
+const getAllOrganizationMemberships = async (
+  memberships: {
+    userId: number;
+    role: MembershipRole;
+    teamId: number;
+  }[],
+  orgId: number
+) => {
+  return memberships.reduce<number[]>((acc, membership) => {
+    if (membership.teamId === orgId) {
+      acc.push(membership.userId);
+    }
+    return acc;
+  }, []);
+};
+
+const getAllAdminMemberships = async (userId: number) => {
+  return await prisma.membership.findMany({
+    where: {
+      userId: userId,
+      accepted: true,
+      OR: [{ role: MembershipRole.OWNER }, { role: MembershipRole.ADMIN }],
+    },
+    select: {
+      team: {
+        select: {
+          id: true,
+          isOrganization: true,
+        },
+      },
+    },
+  });
+};
+
+const getAllOrganizationMembers = async (organizationId: number) => {
+  return await prisma.membership.findMany({
+    where: {
+      teamId: organizationId,
+      accepted: true,
+    },
+    select: {
+      userId: true,
+    },
+  });
+};
+
+export const getAccessibleUsers = async ({
+  memberUserIds,
+  adminUserId,
+}: AccessibleUsersType): Promise<number[]> => {
+  const memberships = await prisma.membership.findMany({
+    where: {
+      team: {
+        isOrganization: true,
+      },
+      accepted: true,
+      OR: [
+        { userId: { in: memberUserIds } },
+        { userId: adminUserId, role: { in: [MembershipRole.OWNER, MembershipRole.ADMIN] } },
+      ],
+    },
+    select: {
+      userId: true,
+      role: true,
+      teamId: true,
+    },
+  });
+
+  const orgId = memberships.find((membership) => membership.userId === adminUserId)?.teamId;
+  if (!orgId) return [];
+
+  const allAccessibleMemberUserIds = await getAllOrganizationMemberships(memberships, orgId);
+  const accessibleUserIds = allAccessibleMemberUserIds.filter((userId) => userId !== adminUserId);
+  return accessibleUserIds;
+};
+
+export const retrieveOrgScopedAccessibleUsers = async ({ adminId }: { adminId: number }) => {
+  const adminMemberships = await getAllAdminMemberships(adminId);
+  const organizationId = adminMemberships.find((membership) => membership.team.isOrganization)?.team.id;
+  if (!organizationId) return [];
+
+  const allMemberships = await getAllOrganizationMembers(organizationId);
+  return allMemberships.map((membership) => membership.userId);
+};

apps/api/v1/lib/utils/scopeOfAdmin.ts

@@ -0,0 +1,4 @@
+export const ScopeOfAdmin = {
+  SystemWide: "SystemWide",
+  OrgOwnerOrAdmin: "OrgOwnerOrAdmin",
+} as const;

apps/api/v1/lib/validations/booking.ts

@@ -21,6 +21,8 @@ export const schemaBookingCreateBodyParams = extendedBookingCreateBody.merge(sch
 export const schemaBookingGetParams = z.object({
   dateFrom: iso8601.optional(),
   dateTo: iso8601.optional(),
+  order: z.enum(["asc", "desc"]).default("asc"),
+  sortBy: z.enum(["createdAt", "updatedAt"]).optional(),
 });
 
 const schemaBookingEditParams = z
@@ -55,7 +57,7 @@ export const schemaBookingReadPublic = Booking.extend({
       timeZone: true,
       locale: true,
     })
-    .optional(),
+    .nullish(),
   payment: z
     .array(
       _PaymentModel.pick({
@@ -82,4 +84,5 @@ export const schemaBookingReadPublic = Booking.extend({
   metadata: true,
   status: true,
   responses: true,
+  fromReschedule: true,
 });

apps/api/v1/lib/validations/shared/queryIdTransformParseInt.ts

@@ -14,3 +14,7 @@ export const withValidQueryIdTransformParseInt = withValidation({
   type: "Zod",
   mode: "query",
 });
+
+export const getTranscriptFromRecordingId = schemaQueryIdParseInt.extend({
+  recordingId: z.string(),
+});

apps/api/v1/lib/validations/team.ts

@@ -6,6 +6,9 @@ export const schemaTeamBaseBodyParams = Team.omit({ id: true, createdAt: true })
   hideBranding: true,
   metadata: true,
   pendingPayment: true,
+  isOrganization: true,
+  isPlatform: true,
+  smsLockState: true,
 });
 
 const schemaTeamRequiredParams = z.object({

apps/api/v1/lib/validations/user.ts

@@ -82,7 +82,6 @@ export const schemaUserBaseBodyParams = User.pick({
   brandColor: true,
   darkBrandColor: true,
   allowDynamicBooking: true,
-  away: true,
   role: true,
   // @note: disallowing avatar changes via API for now. We can add it later if needed. User should upload image via UI.
   // avatar: true,
@@ -171,7 +170,6 @@ export const schemaUserReadPublic = User.pick({
   brandColor: true,
   darkBrandColor: true,
   allowDynamicBooking: true,
-  away: true,
   createdDate: true,
   verified: true,
   invitedTo: true,

apps/api/v1/next.config.js

@@ -2,7 +2,12 @@ const { withAxiom } = require("next-axiom");
 const { withSentryConfig } = require("@sentry/nextjs");
 
 const plugins = [withAxiom];
+
+/** @type {import("next").NextConfig} */
 const nextConfig = {
+  experimental: {
+    instrumentationHook: true,
+  },
   transpilePackages: [
     "@calcom/app-store",
     "@calcom/core",
@@ -47,6 +52,22 @@ const nextConfig = {
           source: "/v:version/:rest*",
           destination: "/api/v:version/:rest*",
         },
+        {
+          source: "/api/v2",
+          destination: `${process.env.NEXT_PUBLIC_API_V2_ROOT_URL}/health`,
+        },
+        {
+          source: "/api/v2/health",
+          destination: `${process.env.NEXT_PUBLIC_API_V2_ROOT_URL}/health`,
+        },
+        {
+          source: "/api/v2/docs/:path*",
+          destination: `${process.env.NEXT_PUBLIC_API_V2_ROOT_URL}/docs/:path*`,
+        },
+        {
+          source: "/api/v2/:path*",
+          destination: `${process.env.NEXT_PUBLIC_API_V2_ROOT_URL}/api/v2/:path*`,
+        },
         // This redirects requests to api/v*/ to /api/ passing version as a query parameter.
         {
           source: "/api/v:version/:rest*",
@@ -71,12 +92,12 @@ const nextConfig = {
 };
 
 if (!!process.env.NEXT_PUBLIC_SENTRY_DSN) {
-  nextConfig["sentry"] = {
-    autoInstrumentServerFunctions: true,
-    hideSourceMaps: true,
-  };
-
-  plugins.push(withSentryConfig);
+  plugins.push((nextConfig) =>
+    withSentryConfig(nextConfig, {
+      autoInstrumentServerFunctions: true,
+      hideSourceMaps: true,
+    })
+  );
 }
 
 module.exports = () => plugins.reduce((acc, next) => next(acc), nextConfig);

apps/api/v1/next.d.ts

@@ -11,7 +11,8 @@ export declare module "next" {
     method: string;
     // session: { user: { id: number } };
     // query: Partial<{ [key: string]: string | string[] }>;
-    isAdmin: boolean;
+    isSystemWideAdmin: boolean;
+    isOrganizationOwnerOrAdmin: boolean;
     pagination: { take: number; skip: number };
   }
 }

apps/api/v1/package.json

@@ -30,7 +30,7 @@
     "@calcom/lib": "*",
     "@calcom/prisma": "*",
     "@calcom/trpc": "*",
-    "@sentry/nextjs": "^7.73.0",
+    "@sentry/nextjs": "^8.8.0",
     "bcryptjs": "^2.4.3",
     "memory-cache": "^0.2.0",
     "next": "^13.5.4",

apps/api/v1/pages/api/api-keys/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdAsString } from "~/lib/validations/shared/queryIdString";
 
 export async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdAsString.parse(req.query);
   // Admin can check any api key
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Check if user can access the api key
   const apiKey = await prisma.apiKey.findFirst({
     where: { id, userId },

apps/api/v1/pages/api/api-keys/_get.ts

@@ -16,8 +16,8 @@ type CustomNextApiRequest = NextApiRequest & {
 function handleAdminRequests(req: CustomNextApiRequest) {
   // To match type safety with runtime
   if (!hasReqArgs(req)) throw Error("Missing req.args");
-  const { userId, isAdmin } = req;
-  if (isAdmin && req.query.userId) {
+  const { userId, isSystemWideAdmin } = req;
+  if (isSystemWideAdmin && req.query.userId) {
     const query = schemaQuerySingleOrMultipleUserIds.parse(req.query);
     const userIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
     req.args.where = { userId: { in: userIds } };
@@ -30,8 +30,8 @@ function hasReqArgs(req: CustomNextApiRequest): req is Ensure<CustomNextApiReque
 }
 
 async function getHandler(req: CustomNextApiRequest) {
-  const { userId, isAdmin } = req;
-  req.args = isAdmin ? {} : { where: { userId } };
+  const { userId, isSystemWideAdmin } = req;
+  req.args = isSystemWideAdmin ? {} : { where: { userId } };
   // Proof of concept: allowing mutation in exchange of composability
   handleAdminRequests(req);
   const data = await prisma.apiKey.findMany(req.args);

apps/api/v1/pages/api/api-keys/_post.ts

@@ -10,7 +10,7 @@ import prisma from "@calcom/prisma";
 import { apiKeyCreateBodySchema, apiKeyPublicSchema } from "~/lib/validations/api-key";
 
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { neverExpires, userId: bodyUserId, ...input } = apiKeyCreateBodySchema.parse(req.body);
   const [hashedKey, apiKey] = generateUniqueAPIKey();
   const args: Prisma.ApiKeyCreateArgs = {
@@ -24,9 +24,10 @@ async function postHandler(req: NextApiRequest) {
     },
   };
 
-  if (!isAdmin && bodyUserId) throw new HttpError({ statusCode: 403, message: `ADMIN required for userId` });
+  if (!isSystemWideAdmin && bodyUserId)
+    throw new HttpError({ statusCode: 403, message: `ADMIN required for userId` });
 
-  if (isAdmin && bodyUserId) {
+  if (isSystemWideAdmin && bodyUserId) {
     const where: Prisma.UserWhereInput = { id: bodyUserId };
     await prisma.user.findFirstOrThrow({ where });
     args.data.userId = bodyUserId;

apps/api/v1/pages/api/attendees/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const query = schemaQueryIdParseInt.parse(req.query);
   // @note: Here we make sure to only return attendee's of the user's own bookings if the user is not an admin.
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Find all user bookings, including attendees
   const attendee = await prisma.attendee.findFirst({
     where: { id: query.id, booking: { userId } },

apps/api/v1/pages/api/attendees/[id]/_patch.ts

@@ -63,8 +63,8 @@ export async function patchHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: z.infer<typeof schemaAttendeeEditBodyParams>) {
-  const { isAdmin } = req;
-  if (isAdmin) return;
+  const { isSystemWideAdmin } = req;
+  if (isSystemWideAdmin) return;
   const { userId } = req;
   const { bookingId } = body;
   if (bookingId) {

apps/api/v1/pages/api/attendees/_get.ts

@@ -31,8 +31,8 @@ import { schemaAttendeeReadPublic } from "~/lib/validations/attendee";
  *         description: No attendees were found
  */
 async function handler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  const args: Prisma.AttendeeFindManyArgs = isAdmin ? {} : { where: { booking: { userId } } };
+  const { userId, isSystemWideAdmin } = req;
+  const args: Prisma.AttendeeFindManyArgs = isSystemWideAdmin ? {} : { where: { booking: { userId } } };
   const data = await prisma.attendee.findMany(args);
   const attendees = data.map((attendee) => schemaAttendeeReadPublic.parse(attendee));
   if (!attendees) throw new HttpError({ statusCode: 404, message: "No attendees were found" });

apps/api/v1/pages/api/attendees/_post.ts

@@ -52,10 +52,10 @@ import { schemaAttendeeCreateBodyParams, schemaAttendeeReadPublic } from "~/lib/
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const body = schemaAttendeeCreateBodyParams.parse(req.body);
 
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     const userBooking = await prisma.booking.findFirst({
       where: { userId, id: body.bookingId },
       select: { id: true },

apps/api/v1/pages/api/availabilities/[id]/_auth-middleware.ts

@@ -5,10 +5,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin, query } = req;
+  const { userId, isSystemWideAdmin, query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   /** Admins can skip the ownership verification */
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   /**
    * There's a caveat here. If the availability exists but the user doesn't own it,
    * the user will see a 404 error which may or not be the desired behavior.

apps/api/v1/pages/api/availabilities/_post.ts

@@ -86,8 +86,8 @@ async function postHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  if (isAdmin) return;
+  const { userId, isSystemWideAdmin } = req;
+  if (isSystemWideAdmin) return;
   const data = schemaAvailabilityCreateBodyParams.parse(req.body);
   const schedule = await prisma.schedule.findFirst({
     where: { userId, id: data.scheduleId },

apps/api/v1/pages/api/availability/_get.ts

@@ -189,7 +189,7 @@ const availabilitySchema = z
   );
 
 async function handler(req: NextApiRequest) {
-  const { isAdmin, userId: reqUserId } = req;
+  const { isSystemWideAdmin, userId: reqUserId } = req;
   const { username, userId, eventTypeId, dateTo, dateFrom, teamId } = availabilitySchema.parse(req.query);
   if (!teamId)
     return getUserAvailability({
@@ -224,7 +224,7 @@ async function handler(req: NextApiRequest) {
   const isUserAdminOrOwner =
     memberRoles[reqUserId] == MembershipRole.ADMIN ||
     memberRoles[reqUserId] == MembershipRole.OWNER ||
-    isAdmin;
+    isSystemWideAdmin;
   if (!isUserAdminOrOwner) throw new HttpError({ statusCode: 403, message: "Forbidden" });
   const availabilities = members.map(async (user) => {
     return {

apps/api/v1/pages/api/booking-references/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
   // Here we make sure to only return references of the user's own bookings if the user is not an admin.
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Find all references where the user has bookings
   const bookingReference = await prisma.bookingReference.findFirst({
     where: { id, booking: { userId } },

apps/api/v1/pages/api/booking-references/[id]/_patch.ts

@@ -60,12 +60,12 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Authorization information is missing or invalid.
  */
 export async function patchHandler(req: NextApiRequest) {
-  const { query, body, isAdmin, userId } = req;
+  const { query, body, isSystemWideAdmin, userId } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const data = schemaBookingEditBodyParams.parse(body);
   /* If user tries to update bookingId, we run extra checks */
   if (data.bookingId) {
-    const args: Prisma.BookingFindFirstOrThrowArgs = isAdmin
+    const args: Prisma.BookingFindFirstOrThrowArgs = isSystemWideAdmin
       ? /* If admin, we only check that the booking exists */
         { where: { id: data.bookingId } }
       : /* For non-admins we make sure the booking belongs to the user */

apps/api/v1/pages/api/booking-references/_get.ts

@@ -30,8 +30,10 @@ import { schemaBookingReferenceReadPublic } from "~/lib/validations/booking-refe
  *         description: No booking references were found
  */
 async function getHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  const args: Prisma.BookingReferenceFindManyArgs = isAdmin ? {} : { where: { booking: { userId } } };
+  const { userId, isSystemWideAdmin } = req;
+  const args: Prisma.BookingReferenceFindManyArgs = isSystemWideAdmin
+    ? {}
+    : { where: { booking: { userId } } };
   const data = await prisma.bookingReference.findMany(args);
   return { booking_references: data.map((br) => schemaBookingReferenceReadPublic.parse(br)) };
 }

apps/api/v1/pages/api/booking-references/_post.ts

@@ -62,9 +62,9 @@ import {
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const body = schemaBookingCreateBodyParams.parse(req.body);
-  const args: Prisma.BookingFindFirstOrThrowArgs = isAdmin
+  const args: Prisma.BookingFindFirstOrThrowArgs = isSystemWideAdmin
     ? /* If admin, we only check that the booking exists */
       { where: { id: body.bookingId } }
     : /* For non-admins we make sure the booking belongs to the user */

apps/api/v1/pages/api/bookings/[id]/_auth-middleware.ts

@@ -3,15 +3,33 @@ import type { NextApiRequest } from "next";
 import { HttpError } from "@calcom/lib/http-error";
 import prisma from "@calcom/prisma";
 
+import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin, query } = req;
-  if (isAdmin) {
+  const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin, query } = req;
+  if (isSystemWideAdmin) {
     return;
   }
 
   const { id } = schemaQueryIdParseInt.parse(query);
+  if (isOrganizationOwnerOrAdmin) {
+    const booking = await prisma.booking.findUnique({
+      where: { id },
+      select: { userId: true },
+    });
+    if (booking) {
+      const bookingUserId = booking.userId;
+      if (bookingUserId) {
+        const accessibleUsersIds = await getAccessibleUsers({
+          adminUserId: userId,
+          memberUserIds: [bookingUserId],
+        });
+        if (accessibleUsersIds.length > 0) return;
+      }
+    }
+  }
+
   const userWithBookingsAndTeamIds = await prisma.user.findUnique({
     where: { id: userId },
     include: {
@@ -43,7 +61,7 @@ async function authMiddleware(req: NextApiRequest) {
     });
 
     if (!teamBookings) {
-      throw new HttpError({ statusCode: 401, message: "You are not authorized" });
+      throw new HttpError({ statusCode: 403, message: "You are not authorized" });
     }
   }
 }

apps/api/v1/pages/api/bookings/[id]/_patch.ts

@@ -5,6 +5,7 @@ import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
 
+import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
 import { schemaBookingEditBodyParams, schemaBookingReadPublic } from "~/lib/validations/booking";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
@@ -109,14 +110,27 @@ export async function patchHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: z.infer<typeof schemaBookingEditBodyParams>) {
-  const { isAdmin } = req;
-  if (body.userId && !isAdmin) {
+  const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin } = req;
+  if (body.userId && !isSystemWideAdmin && !isOrganizationOwnerOrAdmin) {
     // Organizer has to be a cal user and we can't allow a booking to be transfered to some other cal user's name
     throw new HttpError({
       statusCode: 403,
       message: "Only admin can change the organizer of a booking",
     });
   }
+
+  if (body.userId && isOrganizationOwnerOrAdmin) {
+    const accessibleUsersIds = await getAccessibleUsers({
+      adminUserId: userId,
+      memberUserIds: [body.userId],
+    });
+    if (accessibleUsersIds.length === 0) {
+      throw new HttpError({
+        statusCode: 403,
+        message: "Only admin can change the organizer of a booking",
+      });
+    }
+  }
 }
 
 export default defaultResponder(patchHandler);

apps/api/v1/pages/api/bookings/[id]/recordings/_get.ts

@@ -0,0 +1,99 @@
+import type { NextApiRequest } from "next";
+
+import { getRecordingsOfCalVideoByRoomName } from "@calcom/core/videoClient";
+import { getDownloadLinkOfCalVideoByRecordingId } from "@calcom/core/videoClient";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
+import type { RecordingItemSchema } from "@calcom/prisma/zod-utils";
+import type { PartialReference } from "@calcom/types/EventManager";
+
+import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
+
+/**
+ * @swagger
+ * /bookings/{id}/recordings:
+ *   get:
+ *     summary: Find all Cal video recordings of that booking
+ *     operationId: getRecordingsByBookingId
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         schema:
+ *           type: integer
+ *         required: true
+ *         description: ID of the booking for which recordings need to be fetched. Recording download link is only valid for 12 hours and you would have to fetch the recordings again to get new download link
+ *       - in: query
+ *         name: apiKey
+ *         required: true
+ *         schema:
+ *           type: string
+ *         description: Your API key
+ *     tags:
+ *     - bookings
+ *     responses:
+ *       200:
+ *         description: OK
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: "#/components/schemas/ArrayOfRecordings"
+ *             examples:
+ *               recordings:
+ *                 value:
+ *                   - id: "ad90a2e7-154f-49ff-a815-5da1db7bf899"
+ *                     room_name: "0n22w24AQ5ZFOtEKX2gX"
+ *                     start_ts: 1716215386
+ *                     status: "finished"
+ *                     max_participants: 1
+ *                     duration: 11
+ *                     share_token: "x94YK-69Gnh7"
+ *                     download_link: "https://daily-meeting-recordings..."
+ *       401:
+ *         description: Authorization information is missing or invalid.
+ *       404:
+ *         description: Booking was not found
+ */
+
+export async function getHandler(req: NextApiRequest) {
+  const { query } = req;
+  const { id } = schemaQueryIdParseInt.parse(query);
+
+  const booking = await prisma.booking.findUnique({
+    where: { id },
+    include: { references: true },
+  });
+
+  if (!booking)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking found with booking id ${id}`,
+    });
+
+  const roomName =
+    booking?.references?.find((reference: PartialReference) => reference.type === "daily_video")?.meetingId ??
+    undefined;
+
+  if (!roomName)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Cal Video reference found with booking id ${booking.id}`,
+    });
+
+  const recordings = await getRecordingsOfCalVideoByRoomName(roomName);
+
+  if (!recordings || !("data" in recordings)) return [];
+
+  const recordingWithDownloadLink = recordings.data.map((recording: RecordingItemSchema) => {
+    return getDownloadLinkOfCalVideoByRecordingId(recording.id)
+      .then((res) => ({
+        ...recording,
+        download_link: res?.download_link,
+      }))
+      .catch((err) => ({ ...recording, download_link: null, error: err.message }));
+  });
+  const res = await Promise.all(recordingWithDownloadLink);
+  return res;
+}
+
+export default defaultResponder(getHandler);

apps/api/v1/pages/api/bookings/[id]/recordings/index.ts

@@ -0,0 +1,16 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+
+import authMiddleware from "../_auth-middleware";
+
+export default withMiddleware()(
+  defaultResponder(async (req: NextApiRequest, res: NextApiResponse) => {
+    await authMiddleware(req);
+    return defaultHandler({
+      GET: import("./_get"),
+    })(req, res);
+  })
+);

apps/api/v1/pages/api/bookings/[id]/transcripts/[recordingId]/_get.ts

@@ -0,0 +1,94 @@
+import type { NextApiRequest } from "next";
+
+import {
+  getTranscriptsAccessLinkFromRecordingId,
+  checkIfRoomNameMatchesInRecording,
+} from "@calcom/core/videoClient";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
+import type { PartialReference } from "@calcom/types/EventManager";
+
+import { getTranscriptFromRecordingId } from "~/lib/validations/shared/queryIdTransformParseInt";
+
+/**
+ * @swagger
+ * /bookings/{id}/transcripts/{recordingId}:
+ *   get:
+ *     summary: Find all Cal video transcripts of that recording
+ *     operationId: getTranscriptsByRecordingId
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         schema:
+ *           type: integer
+ *         required: true
+ *         description: ID of the booking for which transcripts need to be fetched.
+ *       - in: path
+ *         name: recordingId
+ *         schema:
+ *           type: string
+ *         required: true
+ *         description: ID of the recording(daily.co recording id) for which transcripts need to be fetched.
+ *       - in: query
+ *         name: apiKey
+ *         required: true
+ *         schema:
+ *           type: string
+ *         description: Your API key
+ *     tags:
+ *     - bookings
+ *     responses:
+ *       200:
+ *         description: OK
+ *         content:
+ *           application/json:
+ *       401:
+ *         description: Authorization information is missing or invalid.
+ *       404:
+ *         description: Booking was not found
+ */
+
+export async function getHandler(req: NextApiRequest) {
+  const { query } = req;
+  const { id, recordingId } = getTranscriptFromRecordingId.parse(query);
+
+  await checkIfRecordingBelongsToBooking(id, recordingId);
+
+  const transcriptsAccessLinks = await getTranscriptsAccessLinkFromRecordingId(recordingId);
+
+  return transcriptsAccessLinks;
+}
+
+const checkIfRecordingBelongsToBooking = async (bookingId: number, recordingId: string) => {
+  const booking = await prisma.booking.findUnique({
+    where: { id: bookingId },
+    include: { references: true },
+  });
+
+  if (!booking)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking found with booking id ${bookingId}`,
+    });
+
+  const roomName =
+    booking?.references?.find((reference: PartialReference) => reference.type === "daily_video")?.meetingId ??
+    undefined;
+
+  if (!roomName)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking Reference with Daily Video found with booking id ${bookingId}`,
+    });
+
+  const canUserAccessRecordingId = await checkIfRoomNameMatchesInRecording(roomName, recordingId);
+  if (!canUserAccessRecordingId) {
+    throw new HttpError({
+      statusCode: 403,
+      message: `This Recording Id ${recordingId} does not belong to booking ${bookingId}`,
+    });
+  }
+};
+
+export default defaultResponder(getHandler);

apps/api/v1/pages/api/bookings/[id]/transcripts/[recordingId]/index.ts

@@ -0,0 +1,16 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+
+import authMiddleware from "../../_auth-middleware";
+
+export default withMiddleware()(
+  defaultResponder(async (req: NextApiRequest, res: NextApiResponse) => {
+    await authMiddleware(req);
+    return defaultHandler({
+      GET: import("./_get"),
+    })(req, res);
+  })
+);

apps/api/v1/pages/api/bookings/[id]/transcripts/_get.ts

@@ -0,0 +1,73 @@
+import type { NextApiRequest } from "next";
+
+import { getAllTranscriptsAccessLinkFromRoomName } from "@calcom/core/videoClient";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
+import type { PartialReference } from "@calcom/types/EventManager";
+
+import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
+
+/**
+ * @swagger
+ * /bookings/{id}/transcripts:
+ *   get:
+ *     summary: Find all Cal video transcripts of that booking
+ *     operationId: getTranscriptsByBookingId
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         schema:
+ *           type: integer
+ *         required: true
+ *         description: ID of the booking for which recordings need to be fetched.
+ *       - in: query
+ *         name: apiKey
+ *         required: true
+ *         schema:
+ *           type: string
+ *         description: Your API key
+ *     tags:
+ *     - bookings
+ *     responses:
+ *       200:
+ *         description: OK
+ *         content:
+ *           application/json:
+ *       401:
+ *         description: Authorization information is missing or invalid.
+ *       404:
+ *         description: Booking was not found
+ */
+
+export async function getHandler(req: NextApiRequest) {
+  const { query } = req;
+  const { id } = schemaQueryIdParseInt.parse(query);
+
+  const booking = await prisma.booking.findUnique({
+    where: { id },
+    include: { references: true },
+  });
+
+  if (!booking)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking found with booking id ${id}`,
+    });
+
+  const roomName =
+    booking?.references?.find((reference: PartialReference) => reference.type === "daily_video")?.meetingId ??
+    undefined;
+
+  if (!roomName)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Cal Video reference found with booking id ${booking.id}`,
+    });
+
+  const transcripts = await getAllTranscriptsAccessLinkFromRoomName(roomName);
+
+  return transcripts;
+}
+
+export default defaultResponder(getHandler);

apps/api/v1/pages/api/bookings/[id]/transcripts/index.ts

@@ -0,0 +1,16 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+
+import authMiddleware from "../_auth-middleware";
+
+export default withMiddleware()(
+  defaultResponder(async (req: NextApiRequest, res: NextApiResponse) => {
+    await authMiddleware(req);
+    return defaultHandler({
+      GET: import("./_get"),
+    })(req, res);
+  })
+);

apps/api/v1/pages/api/bookings/_get.ts

@@ -5,6 +5,11 @@ import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
 
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+import {
+  getAccessibleUsers,
+  retrieveOrgScopedAccessibleUsers,
+} from "~/lib/utils/retrieveScopedAccessibleUsers";
 import { schemaBookingGetParams, schemaBookingReadPublic } from "~/lib/validations/booking";
 import { schemaQuerySingleOrMultipleAttendeeEmails } from "~/lib/validations/shared/queryAttendeeEmail";
 import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/queryUserId";
@@ -46,6 +51,18 @@ import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/que
  *                type: string
  *                format: email
  *              example: [john.doe@example.com, jane.doe@example.com]
+ *        - in: query
+ *          name: order
+ *          required: false
+ *          schema:
+ *          type: string
+ *          enum: [asc, desc]
+ *       - in: query
+ *         name: sortBy
+ *         required: false
+ *         schema:
+ *          type: string
+ *          enum: [createdAt, updatedAt]
  *     operationId: listBookings
  *     tags:
  *     - bookings
@@ -108,7 +125,11 @@ import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/que
  *       404:
  *         description: No bookings were found
  */
-
+type GetAdminArgsType = {
+  adminDidQueryUserIds?: boolean;
+  requestedUserIds: number[];
+  userId: number;
+};
 /**
  * Constructs the WHERE clause for Prisma booking findMany operation.
  *
@@ -161,12 +182,20 @@ function buildWhereClause(
   };
 }
 
-async function handler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-
-  const { dateFrom, dateTo } = schemaBookingGetParams.parse(req.query);
+export async function handler(req: NextApiRequest) {
+  const {
+    userId,
+    isSystemWideAdmin,
+    isOrganizationOwnerOrAdmin,
+    pagination: { take, skip },
+  } = req;
+  const { dateFrom, dateTo, order, sortBy } = schemaBookingGetParams.parse(req.query);
 
   const args: Prisma.BookingFindManyArgs = {};
+  if (req.query.take && req.query.page) {
+    args.take = take;
+    args.skip = skip;
+  }
   args.include = {
     attendees: true,
     user: true,
@@ -182,19 +211,32 @@ async function handler(req: NextApiRequest) {
   const filterByAttendeeEmails = attendeeEmails.length > 0;
 
   /** Only admins can query other users */
-  if (isAdmin) {
-    if (req.query.userId) {
+  if (isSystemWideAdmin) {
+    if (req.query.userId || filterByAttendeeEmails) {
       const query = schemaQuerySingleOrMultipleUserIds.parse(req.query);
-      const userIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
-      const users = await prisma.user.findMany({
-        where: { id: { in: userIds } },
-        select: { email: true },
-      });
-      const userEmails = users.map((u) => u.email);
-      args.where = buildWhereClause(userId, attendeeEmails, userIds, userEmails);
-    } else if (filterByAttendeeEmails) {
-      args.where = buildWhereClause(null, attendeeEmails, [], []);
+      const requestedUserIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
+
+      const systemWideAdminArgs = {
+        adminDidQueryUserIds: !!req.query.userId,
+        requestedUserIds,
+        userId,
+      };
+      const { userId: argUserId, userIds, userEmails } = await handleSystemWideAdminArgs(systemWideAdminArgs);
+      args.where = buildWhereClause(argUserId, attendeeEmails, userIds, userEmails);
     }
+  } else if (isOrganizationOwnerOrAdmin) {
+    let requestedUserIds = [userId];
+    if (req.query.userId || filterByAttendeeEmails) {
+      const query = schemaQuerySingleOrMultipleUserIds.parse(req.query);
+      requestedUserIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
+    }
+    const orgWideAdminArgs = {
+      adminDidQueryUserIds: !!req.query.userId,
+      requestedUserIds,
+      userId,
+    };
+    const { userId: argUserId, userIds, userEmails } = await handleOrgWideAdminArgs(orgWideAdminArgs);
+    args.where = buildWhereClause(argUserId, attendeeEmails, userIds, userEmails);
   } else {
     const user = await prisma.user.findUnique({
       where: { id: userId },
@@ -203,7 +245,7 @@ async function handler(req: NextApiRequest) {
       },
     });
     if (!user) {
-      throw new HttpError({ message: "User not found", statusCode: 500 });
+      throw new HttpError({ message: "User not found", statusCode: 404 });
     }
     args.where = buildWhereClause(userId, attendeeEmails, [], []);
   }
@@ -221,8 +263,69 @@ async function handler(req: NextApiRequest) {
     };
   }
 
+  if (sortBy === "updatedAt") {
+    args.orderBy = {
+      updatedAt: order,
+    };
+  }
+
+  if (sortBy === "createdAt") {
+    args.orderBy = {
+      createdAt: order,
+    };
+  }
+
   const data = await prisma.booking.findMany(args);
   return { bookings: data.map((booking) => schemaBookingReadPublic.parse(booking)) };
 }
 
-export default defaultResponder(handler);
+const handleSystemWideAdminArgs = async ({
+  adminDidQueryUserIds,
+  requestedUserIds,
+  userId,
+}: GetAdminArgsType) => {
+  if (adminDidQueryUserIds) {
+    const users = await prisma.user.findMany({
+      where: { id: { in: requestedUserIds } },
+      select: { email: true },
+    });
+    const userEmails = users.map((u) => u.email);
+
+    return { userId, userIds: requestedUserIds, userEmails };
+  }
+  return { userId: null, userIds: [], userEmails: [] };
+};
+
+const handleOrgWideAdminArgs = async ({
+  adminDidQueryUserIds,
+  requestedUserIds,
+  userId,
+}: GetAdminArgsType) => {
+  if (adminDidQueryUserIds) {
+    const accessibleUsersIds = await getAccessibleUsers({
+      adminUserId: userId,
+      memberUserIds: requestedUserIds,
+    });
+
+    if (!accessibleUsersIds.length) throw new HttpError({ message: "No User found", statusCode: 404 });
+    const users = await prisma.user.findMany({
+      where: { id: { in: accessibleUsersIds } },
+      select: { email: true },
+    });
+    const userEmails = users.map((u) => u.email);
+    return { userId, userIds: accessibleUsersIds, userEmails };
+  } else {
+    const accessibleUsersIds = await retrieveOrgScopedAccessibleUsers({
+      adminId: userId,
+    });
+
+    const users = await prisma.user.findMany({
+      where: { id: { in: accessibleUsersIds } },
+      select: { email: true },
+    });
+    const userEmails = users.map((u) => u.email);
+    return { userId, userIds: accessibleUsersIds, userEmails };
+  }
+};
+
+export default withMiddleware("pagination")(defaultResponder(handler));

apps/api/v1/pages/api/bookings/_post.ts

@@ -2,8 +2,12 @@ import type { NextApiRequest } from "next";
 
 import getBookingDataSchemaForApi from "@calcom/features/bookings/lib/getBookingDataSchemaForApi";
 import handleNewBooking from "@calcom/features/bookings/lib/handleNewBooking";
+import { ErrorCode } from "@calcom/lib/errorCodes";
+import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 
+import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
+
 /**
  * @swagger
  * /bookings:
@@ -204,10 +208,28 @@ import { defaultResponder } from "@calcom/lib/server";
  *         description: Authorization information is missing or invalid.
  */
 async function handler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  if (isAdmin) req.userId = req.body.userId || userId;
+  const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin } = req;
+  if (isSystemWideAdmin) req.userId = req.body.userId || userId;
 
-  return await handleNewBooking(req, getBookingDataSchemaForApi);
+  if (isOrganizationOwnerOrAdmin) {
+    const accessibleUsersIds = await getAccessibleUsers({
+      adminUserId: userId,
+      memberUserIds: [req.body.userId || userId],
+    });
+    const [requestedUserId] = accessibleUsersIds;
+    req.userId = requestedUserId || userId;
+  }
+
+  try {
+    return await handleNewBooking(req, getBookingDataSchemaForApi);
+  } catch (error: unknown) {
+    const knownError = error as Error;
+    if (knownError?.message === ErrorCode.NoAvailableUsersFound) {
+      throw new HttpError({ statusCode: 400, message: knownError.message });
+    }
+
+    throw error;
+  }
 }
 
 export default defaultResponder(handler);

apps/api/v1/pages/api/connected-calendars/_get.ts

@@ -97,9 +97,10 @@ import { schemaConnectedCalendarsReadPublic } from "~/lib/validations/connected-
  */
 
 async function getHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
 
-  if (!isAdmin && req.query.userId) throw new HttpError({ statusCode: 403, message: "ADMIN required" });
+  if (!isSystemWideAdmin && req.query.userId)
+    throw new HttpError({ statusCode: 403, message: "ADMIN required" });
 
   const userIds = req.query.userId ? extractUserIdsFromQuery(req) : [userId];
 

apps/api/v1/pages/api/credential-sync/_patch.ts

@@ -1,6 +1,6 @@
 import type { NextApiRequest } from "next";
 
-import { minimumTokenResponseSchema } from "@calcom/app-store/_utils/oauth/parseRefreshTokenResponse";
+import { OAuth2UniversalSchema } from "@calcom/app-store/_utils/oauth/universalSchema";
 import { symmetricDecrypt } from "@calcom/lib/crypto";
 import { defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
@@ -63,7 +63,7 @@ async function handler(req: NextApiRequest) {
     symmetricDecrypt(encryptedKey, process.env.CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY || "")
   );
 
-  const key = minimumTokenResponseSchema.parse(decryptedKey);
+  const key = OAuth2UniversalSchema.parse(decryptedKey);
 
   const credential = await prisma.credential.update({
     where: {

apps/api/v1/pages/api/credential-sync/_post.ts

@@ -1,7 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { getCalendar } from "@calcom/app-store/_utils/getCalendar";
-import { minimumTokenResponseSchema } from "@calcom/app-store/_utils/oauth/parseRefreshTokenResponse";
+import { OAuth2UniversalSchema } from "@calcom/app-store/_utils/oauth/universalSchema";
 import { appStoreMetadata } from "@calcom/app-store/appStoreMetaData";
 import { symmetricDecrypt } from "@calcom/lib/crypto";
 import { HttpError } from "@calcom/lib/http-error";
@@ -70,7 +70,7 @@ async function handler(req: NextApiRequest) {
     symmetricDecrypt(encryptedKey, process.env.CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY || "")
   );
 
-  const key = minimumTokenResponseSchema.parse(decryptedKey);
+  const key = OAuth2UniversalSchema.parse(decryptedKey);
 
   // Need to get app type
   const app = await prisma.app.findUnique({

apps/api/v1/pages/api/custom-inputs/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
   // Admins can just skip this check
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Check if the current user can access the event type of this input
   const eventTypeCustomInput = await prisma.eventTypeCustomInput.findFirst({
     where: { id, eventType: { userId } },

apps/api/v1/pages/api/custom-inputs/_get.ts

@@ -29,8 +29,10 @@ import { schemaEventTypeCustomInputPublic } from "~/lib/validations/event-type-c
  *         description: No eventTypeCustomInputs were found
  */
 async function getHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  const args: Prisma.EventTypeCustomInputFindManyArgs = isAdmin ? {} : { where: { eventType: { userId } } };
+  const { userId, isSystemWideAdmin } = req;
+  const args: Prisma.EventTypeCustomInputFindManyArgs = isSystemWideAdmin
+    ? {}
+    : { where: { eventType: { userId } } };
   const data = await prisma.eventTypeCustomInput.findMany(args);
   return { event_type_custom_inputs: data.map((v) => schemaEventTypeCustomInputPublic.parse(v)) };
 }

apps/api/v1/pages/api/custom-inputs/_post.ts

@@ -80,10 +80,10 @@ import {
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { eventTypeId, ...body } = schemaEventTypeCustomInputBodyParams.parse(req.body);
 
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     /* We check that the user has access to the event type he's trying to add a custom input to. */
     const eventType = await prisma.eventType.findFirst({
       where: { id: eventTypeId, userId },

apps/api/v1/pages/api/destination-calendars/[id]/_auth-middleware.ts

@@ -6,9 +6,9 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   const userEventTypes = await prisma.eventType.findMany({
     where: { userId },
     select: { id: true },

apps/api/v1/pages/api/destination-calendars/[id]/_patch.ts

@@ -83,10 +83,10 @@ type UserCredentialType = {
 };
 
 export async function patchHandler(req: NextApiRequest) {
-  const { userId, isAdmin, query, body } = req;
+  const { userId, isSystemWideAdmin, query, body } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const parsedBody = schemaDestinationCalendarEditBodyParams.parse(body);
-  const assignedUserId = isAdmin ? parsedBody.userId || userId : userId;
+  const assignedUserId = isSystemWideAdmin ? parsedBody.userId || userId : userId;
 
   validateIntegrationInput(parsedBody);
   const destinationCalendarObject: DestinationCalendarType = await getDestinationCalendar(id, prisma);

apps/api/v1/pages/api/destination-calendars/_post.ts

@@ -61,11 +61,11 @@ import {
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin, body } = req;
+  const { userId, isSystemWideAdmin, body } = req;
   const parsedBody = schemaDestinationCalendarCreateBodyParams.parse(body);
   await checkPermissions(req, userId);
 
-  const assignedUserId = isAdmin && parsedBody.userId ? parsedBody.userId : userId;
+  const assignedUserId = isSystemWideAdmin && parsedBody.userId ? parsedBody.userId : userId;
 
   /* Check if credentialId data matches the ownership and integration passed in */
   const userCredentials = await prisma.credential.findMany({
@@ -120,19 +120,20 @@ async function postHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, userId: number) {
-  const { isAdmin } = req;
+  const { isSystemWideAdmin } = req;
   const body = schemaDestinationCalendarCreateBodyParams.parse(req.body);
 
   /* Non-admin users can only create destination calendars for themselves */
-  if (!isAdmin && body.userId)
+  if (!isSystemWideAdmin && body.userId)
     throw new HttpError({
       statusCode: 401,
       message: "ADMIN required for `userId`",
     });
   /* Admin users are required to pass in a userId */
-  if (isAdmin && !body.userId) throw new HttpError({ statusCode: 400, message: "`userId` required" });
+  if (isSystemWideAdmin && !body.userId)
+    throw new HttpError({ statusCode: 400, message: "`userId` required" });
   /* User should only be able to create for their own destination calendars*/
-  if (!isAdmin && body.eventTypeId) {
+  if (!isSystemWideAdmin && body.eventTypeId) {
     const ownsEventType = await prisma.eventType.findFirst({ where: { id: body.eventTypeId, userId } });
     if (!ownsEventType) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
   }

apps/api/v1/pages/api/docs.ts

@@ -27,6 +27,37 @@ const swaggerHandler = withSwagger({
             $ref: "#/components/schemas/Booking",
           },
         },
+        ArrayOfRecordings: {
+          type: "array",
+          items: {
+            $ref: "#/components/schemas/Recording",
+          },
+        },
+        Recording: {
+          properties: {
+            id: {
+              type: "string",
+            },
+            room_name: {
+              type: "string",
+            },
+            start_ts: {
+              type: "number",
+            },
+            status: {
+              type: "string",
+            },
+            max_participants: {
+              type: "number",
+            },
+            duration: {
+              type: "number",
+            },
+            download_link: {
+              type: "string",
+            },
+          },
+        },
         Booking: {
           properties: {
             id: {
@@ -57,6 +88,11 @@ const swaggerHandler = withSwagger({
               type: "string",
               example: "Europe/London",
             },
+            fromReschedule: {
+              type: "string",
+              nullable: true,
+              format: "uuid",
+            },
             attendees: {
               type: "array",
               items: {

apps/api/v1/pages/api/event-types/[id]/_auth-middleware.ts

@@ -1,18 +0,0 @@
-import type { NextApiRequest } from "next";
-
-import { HttpError } from "@calcom/lib/http-error";
-import prisma from "@calcom/prisma";
-
-import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
-
-async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  const { id } = schemaQueryIdParseInt.parse(req.query);
-  if (isAdmin) return;
-  const eventType = await prisma.eventType.findFirst({
-    where: { id, users: { some: { id: userId } } },
-  });
-  if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });
-}
-
-export default authMiddleware;

apps/api/v1/pages/api/event-types/[id]/_delete.ts

@@ -46,9 +46,9 @@ export async function deleteHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   /** Only event type owners can delete it */
   const eventType = await prisma.eventType.findFirst({ where: { id, userId } });
   if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });

apps/api/v1/pages/api/event-types/[id]/_get.ts

@@ -87,12 +87,13 @@ async function checkPermissions<T extends BaseEventTypeCheckPermissions>(
   req: NextApiRequest,
   eventType: (T & Partial<Omit<T, keyof BaseEventTypeCheckPermissions>>) | null
 ) {
-  if (req.isAdmin) return true;
+  if (req.isSystemWideAdmin) return true;
   if (eventType?.teamId) {
     req.query.teamId = String(eventType.teamId);
     await canAccessTeamEventOrThrow(req, {
       in: [MembershipRole.OWNER, MembershipRole.ADMIN, MembershipRole.MEMBER],
     });
+    return true;
   }
   if (eventType?.userId === req.userId) return true; // is owner.
   throw new HttpError({ statusCode: 403, message: "Forbidden" });

apps/api/v1/pages/api/event-types/[id]/_patch.ts

@@ -237,9 +237,9 @@ export async function patchHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: z.infer<typeof schemaEventTypeBaseBodyParams>) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   /** Only event type owners can modify it */
   const eventType = await prisma.eventType.findFirst({ where: { id, userId } });
   if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });

apps/api/v1/pages/api/event-types/[id]/index.ts

@@ -4,11 +4,8 @@ import { defaultHandler, defaultResponder } from "@calcom/lib/server";
 
 import { withMiddleware } from "~/lib/helpers/withMiddleware";
 
-import authMiddleware from "./_auth-middleware";
-
 export default withMiddleware()(
   defaultResponder(async (req: NextApiRequest, res: NextApiResponse) => {
-    await authMiddleware(req);
     return defaultHandler({
       GET: import("./_get"),
       PATCH: import("./_patch"),