chore: v4.3.5 (#16096)

* fix: Set user's timezone as fallback to event's timezone

Signed-off-by: Souptik Datta <souptikdatta2001@gmail.com>

* fix: Use find method instead of filter

Signed-off-by: Souptik Datta <souptikdatta2001@gmail.com>

* chore: Remove user default schedule ID check

Signed-off-by: Souptik Datta <souptikdatta2001@gmail.com>

* revert error message

* fix

---------

Signed-off-by: Souptik Datta <souptikdatta2001@gmail.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>

.env.example

@@ -15,10 +15,14 @@
 # - You can not repackage or sell the codebase
 # - Acquire a commercial license to remove these terms by visiting: cal.com/sales
 #
-# To enable enterprise-only features, as an admin, go to /auth/setup to select your license and follow
-# instructions. This environment variable is deprecated although still supported for backward compatibility.
-# @see https://console.cal.com
+
+# To enable enterprise-only features please add your envrionment variable to the .env file then make your way to /auth/setup to select your license and follow instructions. 
 CALCOM_LICENSE_KEY=
+# Signature token for the Cal.com License API (used for self-hosted integrations)
+# We will give you a token when we provide you with a license key this ensure you and only you can communicate with the Cal.com License API for your license key
+CAL_SIGNATURE_TOKEN=
+# The route to the Cal.com License API
+CALCOM_PRIVATE_API_ROUTE="https://goblin.cal.com"
 # ***********************************************************************************************************
 
 # - DATABASE ************************************************************************************************
@@ -180,6 +184,7 @@ API_KEY_PREFIX=cal_
 # allow access to the nodemailer transports from the .env file. E-mail templates are accessible within lib/emails/
 # Configures the global From: header whilst sending emails.
 EMAIL_FROM='notifications@yourselfhostedcal.com'
+EMAIL_FROM_NAME='Cal.com'
 
 # Configure SMTP settings (@see https://nodemailer.com/smtp/).
 # Configuration to receive emails locally (mailhog)
@@ -359,3 +364,6 @@ UNKEY_ROOT_KEY=
 # Used for Cal.ai Enterprise Voice AI Agents
 # https://retellai.com
 RETELL_AI_KEY=
+
+# Used to disallow emails as being added as guests on bookings
+BLACKLISTED_GUEST_EMAILS=

.eslintignore

@@ -1,4 +1,6 @@
 node_modules
+apps/api/v2/dist
+packages/platform/**/dist/*
 **/**/node_modules
 **/**/.next
 **/**/public

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,39 +0,0 @@
----
-name: Bug report
-about: Report any issues with the platform
-title: ""
-labels: bug
-assignees: ""
----
-
-Found a bug? Please fill out the sections below. 👍
-
-### Issue Summary
-
-A summary of the issue. This needs to be a clear detailed-rich summary.
-
-### Steps to Reproduce
-
-1. (for example) Went to ...
-2. Clicked on...
-3. ...
-
-Any other relevant information. For example, why do you consider this a bug and what did you expect to happen instead?
-
-### Actual Results
-
-- What's happening right now that is different from what is expected
-
-### Expected Results
-
-- This is an ideal result that the system should get after the tests are performed
-
-### Technical details
-
-- Browser version, screen recording, console logs, network requests: You can make a recording with [Bird Eats Bug](https://birdeatsbug.com/).
-- Node.js version
-- Anything else that you think could be an issue.
-
-### Evidence
-
-- How was this tested? This is quite mandatory in terms of bugs. Providing evidence of your testing with screenshots or/and videos is an amazing way to prove the bug and a troubleshooting chance to find the solution.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,81 @@
+name: Bug report
+description: "Please make sure you have checked for any duplicate issues."
+title: "(bug)"
+labels: ["🐛 bug"]
+assignees: []
+body:
+- type: textarea
+  id: issue-summary
+  attributes:
+    label: Issue Summary
+    description: A summary of the issue. This needs to be a clear detailed-rich summary.
+  validations:
+    required: true
+- type: textarea
+  id: steps-to-reproduce
+  attributes:
+    label: Steps to Reproduce
+    value: |
+      1. (for example) Went to ...
+      2. Clicked on...
+      3. ...
+  validations:
+    required: true
+- type: textarea
+  id: expected-behavior
+  attributes:
+    label: Expected behavior
+    description: A clear and concise description of what you expected to happen.
+  validations:
+    required: true
+- type: textarea
+  id: other-information
+  attributes:
+    label: Other information
+  validations:
+    required: false
+- type: textarea
+  id: screenshots
+  attributes:
+    label: Screenshots
+    description: If applicable, add screenshots to help explain your problem.
+  validations:
+    required: false
+- type: checkboxes
+  id: environment
+  attributes:
+    label: Environment
+    options:
+      - label: app.cal.com
+      - label: Self-hosted Cal
+- type: textarea
+  id: desktop-version
+  attributes:
+    label: Desktop (please complete the following information)
+    description: | 
+      examples: 
+      - **OS**: [e.g. iOS]
+      - **Browser**: [e.g. chrome, safari]
+      - **Version**: [e.g. 22]
+    value: |
+      - OS:
+      - Node:
+      - npm: 
+    render: markdown
+  validations:
+    required: true
+- type: markdown
+  id: nodejs-version
+  attributes:
+    value: | 
+      #### Node.JS version
+      
+      [e.g. v18.15.0] 
+- type: markdown
+  id: anything-else
+  attributes:
+    value: |
+      #### Anything else?
+      
+      - Screen recording, console logs, network requests: You can make a recording with [Loom](https://www.loom.com).
+      - Anything else that you think could be an issue?

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Questions
-    url: https://go.cal.com/discord
-    about: Ask a general question about the project on our discord community
+    url: https://github.com/calcom/cal.com/discussions
+    about: Need help selfhosting or ask a general question about the project? Open a discussion

.github/ISSUE_TEMPLATE/feature_request.md

@@ -2,7 +2,7 @@
 name: Feature request
 about: Suggest a feature or idea
 title: ""
-labels: feature
+labels: ["✨ feature", "🚨 needs approval"]
 assignees: ""
 ---
 
@@ -53,3 +53,4 @@ assignees: ""
 - If this issue has a `🚨 needs approval` label, don't start coding yet. Wait until a core member approves feature request by removing this label, then you can start coding.
   - For clarity: Non-core member issues automatically get the `🚨 needs approval` label.
   - Your feature ideas are invaluable to us! However, they undergo review to ensure alignment with the product's direction.
+  - Follow Best Practices lined out in our [Contributor Docs](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)

.github/PULL_REQUEST_TEMPLATE.md

@@ -11,9 +11,9 @@
 
 ## Mandatory Tasks (DO NOT REMOVE)
 
-- [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected)
-- [ ] I have added a Docs issue [here](https://github.com/calcom/docs/issues/new) if this PR makes changes that would require a [documentation change](https://docs.cal.com)
-- [ ] I have added or modified automated tests that prove my fix is effective or that my feature works (PRs might be rejected if logical changes are not properly tested)
+- [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
+- [ ] I have added a Docs issue [here](https://github.com/calcom/docs/issues/new) if this PR makes changes that would require a [documentation change](https://docs.cal.com). If N/A, write N/A here and check the checkbox.
+- [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.
 
 ## How should this be tested?
 

.github/actions/cache-build/action.yml

@@ -8,7 +8,7 @@ runs:
   using: "composite"
   steps:
     - name: Cache production build
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       id: cache-build
       env:
         # WARN: Don't touch this cache key. Currently github.sha refers to the latest commit in main
@@ -20,13 +20,14 @@ runs:
         key-2: ${{ hashFiles('apps/**/**.[jt]s', 'apps/**/**.[jt]sx', 'packages/**/**.[jt]s', 'packages/**/**.[jt]sx', '!**/node_modules') }}
         key-3: ${{ github.event.pull_request.number || github.ref }}
         key-4: ${{ github.sha }}
+        key-5: ${{ github.event.pull_request.head.sha }}
       with:
         path: |
           ${{ github.workspace }}/apps/web/.next
           ${{ github.workspace }}/apps/web/public/embed
           **/.turbo/**
           **/dist/**
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+        key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}-${{ env.key-5 }}
     - run: |
         export NODE_OPTIONS="--max_old_space_size=8192"
         yarn build

.github/actions/cache-db/action.yml

@@ -12,11 +12,12 @@ runs:
   steps:
     - name: Cache database
       id: cache-db
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       env:
         cache-name: cache-db
         key-1: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
         key-2: ${{ github.event.pull_request.number || github.ref }}
+        key-3: ${{ github.event.pull_request.head.sha }}
         DATABASE_URL: ${{ inputs.DATABASE_URL }}
         DATABASE_DIRECT_URL: ${{ inputs.DATABASE_URL }}
         E2E_TEST_CALCOM_QA_EMAIL: ${{ inputs.E2E_TEST_CALCOM_QA_EMAIL }}
@@ -24,7 +25,7 @@ runs:
         E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ inputs.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
       with:
         path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ inputs.path }}-${{ env.key-1 }}-${{ env.key-2 }}
+        key: ${{ runner.os }}-${{ env.cache-name }}-${{ inputs.path }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}
     - run: echo ${{ env.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }} && yarn db-seed
       if: steps.cache-db.outputs.cache-hit != 'true'
       shell: bash

.github/actions/dangerous-git-checkout/action.yml

@@ -4,7 +4,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 2

.github/actions/yarn-install/action.yml

@@ -20,7 +20,7 @@ runs:
   using: "composite"
   steps:
     - name: Use Node ${{ inputs.node_version }}
-      uses: buildjet/setup-node@v3
+      uses: buildjet/setup-node@v4
       with:
         node-version: ${{ inputs.node_version }}
     - name: Expose yarn config as "$GITHUB_OUTPUT"
@@ -32,7 +32,7 @@ runs:
     # Yarn rotates the downloaded cache archives, @see https://github.com/actions/setup-node/issues/325
     # Yarn cache is also reusable between arch and os.
     - name: Restore yarn cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       id: yarn-download-cache
       with:
         path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
@@ -43,7 +43,7 @@ runs:
     # Invalidated on yarn.lock changes
     - name: Restore node_modules
       id: yarn-nm-cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       with:
         path: "**/node_modules/"
         key: ${{ runner.os }}-yarn-nm-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
@@ -51,7 +51,7 @@ runs:
     # Invalidated on yarn.lock changes
     - name: Restore yarn install state
       id: yarn-install-state-cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       with:
         path: .yarn/ci-cache/
         key: ${{ runner.os }}-yarn-install-state-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}

.github/actions/yarn-playwright-install/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - name: Cache playwright binaries
       id: playwright-cache
-      uses: buildjet/cache@v3
+      uses: buildjet/cache@v4
       with:
         path: |
           ~/Library/Caches/ms-playwright

.github/labeler.yml

@@ -1,6 +1,10 @@
 "❗️ migrations":
-  - packages/prisma/migrations/**/migration.sql
+- changed-files:
+  - any-glob-to-any-file:
+    - packages/prisma/migrations/**/migration.sql
 
 "❗️ .env changes":
-  - .env.example
-  - .env.appStore.example
+- changed-files:
+  - any-glob-to-any-file:
+    - .env.example
+    - .env.appStore.example

.github/workflows/all-checks.yml

@@ -0,0 +1,79 @@
+name: All checks
+
+on:
+  merge_group:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  type-check:
+    name: Type check
+    uses: ./.github/workflows/check-types.yml
+    secrets: inherit
+
+  lint:
+    name: Linters
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+
+  unit-test:
+    name: Tests
+    uses: ./.github/workflows/unit-tests.yml
+    secrets: inherit
+
+  build-api-v1:
+    name: Production builds
+    uses: ./.github/workflows/api-v1-production-build.yml
+    secrets: inherit
+
+  build-api-v2:
+    name: Production builds
+    uses: ./.github/workflows/api-v2-production-build.yml
+    secrets: inherit
+
+  build:
+    name: Production builds
+    uses: ./.github/workflows/production-build-without-database.yml
+    secrets: inherit
+
+  integration-test:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/integration-tests.yml
+    secrets: inherit
+
+  e2e:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e.yml
+    secrets: inherit
+
+  e2e-app-store:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e-app-store.yml
+    secrets: inherit
+
+  e2e-embed:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e-embed.yml
+    secrets: inherit
+
+  e2e-embed-react:
+    name: Tests
+    needs: [lint, build, build-api-v1, build-api-v2]
+    uses: ./.github/workflows/e2e-embed-react.yml
+    secrets: inherit
+
+  required:
+    needs: [lint, type-check, unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
+    if: always()
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    steps:
+      - name: fail if conditional jobs failed
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')
+        run: exit 1

.github/workflows/api-v1-production-build.yml

@@ -3,6 +3,9 @@ name: Production Builds
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
@@ -60,11 +63,31 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
+      - name: Cache API v1 production build
+        uses: buildjet/cache@v4
+        id: cache-api-v1-build
+        env:
+          cache-name: api-v1-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('apps/api/v1/**.[jt]s', 'apps/api/v1/**.[jt]sx', '!**/node_modules') }}
+          key-3: ${{ github.event.pull_request.number || github.ref }}
+          # Ensures production-build.yml will always be fresh
+          key-4: ${{ github.sha }}
+        with:
+          path: |
+            ${{ github.workspace }}/apps/api/v1/.next
+            **/.turbo/**
+            **/dist/**
+          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
       - run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn turbo run build --filter=@calcom/api...
+          if [ ${{ steps.cache-api-v1-build.outputs.cache-hit }} == 'true' ]; then
+            echo "Cache hit for API v1 build. Skipping build."
+          else
+            yarn turbo run build --filter=@calcom/api...
+          fi
         shell: bash

.github/workflows/api-v2-production-build.yml

@@ -10,6 +10,8 @@ env:
 jobs:
   build:
     name: Build API v2
+    permissions:
+      contents: read
     runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 30
     services:
@@ -30,13 +32,31 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
+      - name: Cache API v2 production build
+        uses: buildjet/cache@v4
+        id: cache-api-v2-build
+        env:
+          cache-name: api-v2-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('apps/api/v2/**.[jt]s', 'apps/api/v2/**.[jt]sx', '!**/node_modules') }}
+          key-3: ${{ github.event.pull_request.number || github.ref }}
+          # Ensures production-build.yml will always be fresh
+          key-4: ${{ github.sha }}
+        with:
+          path: |
+            **/dist/**
+          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
       - run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn workspace @calcom/api-v2 run generate-schemas
-          rm -rf apps/api/v2/node_modules
-          yarn install
-          yarn workspace @calcom/api-v2 run build
+          if [ ${{ steps.cache-api-v2-build.outputs.cache-hit }} == 'true' ]; then
+            echo "Cache hit for API v2 build. Skipping build."
+          else
+            yarn workspace @calcom/api-v2 run generate-schemas
+            rm -rf apps/api/v2/node_modules
+            yarn install
+            yarn workspace @calcom/api-v2 run build
+          fi
         shell: bash

.github/workflows/cache-clean.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Cleanup
         run: |

.github/workflows/check-if-ui-has-changed.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }} # So we can test on forks
           fetch-depth: 0

.github/workflows/check-types.yml

@@ -3,11 +3,13 @@ on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+permissions:
+  contents: read
 jobs:
   check-types:
     runs-on: buildjet-4vcpu-ubuntu-2204
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - name: Show info

.github/workflows/cron-monthlyDigestEmail.yml

@@ -18,9 +18,9 @@ jobs:
         run: |
           LAST_DAY=$(date -d tomorrow +%d)
           if [ "$LAST_DAY" == "01" ]; then
-            echo "::set-output name=is_last_day::true"
+            echo "is_last_day=true" >> "$GITHUB_OUTPUT"
           else
-            echo "::set-output name=is_last_day::false"
+            echo "is_last_day=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: cURL request

.github/workflows/crowdin.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.GH_ACCESS_TOKEN }}
 

.github/workflows/delete-buildjet-cache.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - uses: buildjet/cache-delete@v1
         with:
           cache_key: ${{ inputs.cache_key }}

.github/workflows/e2e-api-v2.yml

@@ -0,0 +1,79 @@
+name: E2E
+on:
+  workflow_call:
+env:
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  API_KEY_PREFIX: ${{ secrets.CI_API_KEY_PREFIX }}
+  API_PORT: ${{ vars.CI_API_V2_PORT }}
+  CALCOM_LICENSE_KEY: ${{ secrets.CI_CALCOM_LICENSE_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_READ_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_WRITE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  IS_E2E: true
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NODE_OPTIONS: --max-old-space-size=4096
+  REDIS_URL: "redis://localhost:6379"
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_API_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+jobs:
+  e2e:
+    timeout-minutes: 20
+    name: E2E API v2
+    runs-on: buildjet-8vcpu-ubuntu-2204
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+      redis:
+        image: redis:latest
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - uses: ./.github/actions/yarn-playwright-install
+      - uses: ./.github/actions/cache-db
+      - name: Run Tests
+        working-directory: apps/api/v2
+        run: |
+          yarn test:e2e
+          EXIT_CODE=$?
+          echo "yarn test:e2e command exit code: $EXIT_CODE"
+          exit $EXIT_CODE
+      - name: Upload Test Results
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-api-v2
+          path: test-results

.github/workflows/e2e-app-store.yml

@@ -1,6 +1,9 @@
-name: E2E App-Store Apps Tests
+name: E2E App Store Tests
 on:
   workflow_call:
+permissions:
+  actions: write
+  contents: read
 env:
   NODE_OPTIONS: --max-old-space-size=4096
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
@@ -41,7 +44,7 @@ env:
 jobs:
   e2e-app-store:
     timeout-minutes: 20
-    name: E2E App Store (${{ matrix.shard }}/${{ strategy.job-total }})
+    name: E2E App Store
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
@@ -70,16 +73,13 @@ jobs:
           - 1025:1025
     strategy:
       fail-fast: false
-      matrix:
-        ## There aren't many tests for AppStore. So, just start with 2 shards. Increase if needed.
-        shard: [1, 2]
 
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
@@ -93,10 +93,10 @@ jobs:
           E2E_TEST_CALCOM_GCAL_KEYS: ${{ secrets.E2E_TEST_CALCOM_GCAL_KEYS }}
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:app-store --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+        run: yarn e2e:app-store
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: app-store-results-${{ matrix.shard }}_${{ strategy.job-total }}
+          name: app-store-results
           path: test-results

.github/workflows/e2e-embed-react.yml

@@ -1,6 +1,9 @@
 name: E2E Embed React tests and booking flow (for non-embed as well)
 on:
   workflow_call:
+permissions:
+  actions: write
+  contents: read
 env:
   NODE_OPTIONS: --max-old-space-size=4096
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
@@ -41,7 +44,7 @@ env:
 jobs:
   e2e-embed:
     timeout-minutes: 20
-    name: E2E Embed React (${{ matrix.shard }}/${{ strategy.job-total }})
+    name: E2E Embed React
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
@@ -62,16 +65,13 @@ jobs:
           - 5432:5432
     strategy:
       fail-fast: false
-      matrix:
-        ## There aren't many tests for embed-react. So, just start with 2 shards. Increase if needed.
-        shard: [1, 2]
 
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
@@ -79,11 +79,11 @@ jobs:
       - uses: ./.github/actions/cache-build
       - name: Run Tests
         run: |
-          yarn e2e:embed-react --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+          yarn e2e:embed-react
           yarn workspace @calcom/embed-react packaged:tests
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: embed-react-results-${{ matrix.shard }}_${{ strategy.job-total }}
+          name: embed-react-results
           path: test-results

.github/workflows/e2e-embed.yml

@@ -1,6 +1,9 @@
 name: E2E Embed Core tests and booking flow (for non-embed as well)
 on:
   workflow_call:
+permissions:
+  actions: write
+  contents: read
 env:
   NODE_OPTIONS: --max-old-space-size=4096
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
@@ -41,7 +44,7 @@ env:
 jobs:
   e2e-embed:
     timeout-minutes: 20
-    name: E2E Embed Core (${{ matrix.shard }}/${{ strategy.job-total }})
+    name: E2E Embed Core
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
@@ -70,26 +73,23 @@ jobs:
           - 1025:1025
     strategy:
       fail-fast: false
-      matrix:
-        ## There aren't many tests for embed-core. So, just start with 2 shards. Increase if needed.
-        shard: [1, 2]
 
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:embed --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+        run: yarn e2e:embed
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: embed-core-results-${{ matrix.shard }}_${{ strategy.job-total }}
+          name: embed-core-results
           path: test-results

.github/workflows/e2e.yml

@@ -1,6 +1,9 @@
-name: E2E tests
+name: E2E
 on:
   workflow_call:
+permissions:
+  actions: write
+  contents: read
 env:
   NODE_OPTIONS: --max-old-space-size=4096
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
@@ -41,7 +44,7 @@ env:
 jobs:
   e2e:
     timeout-minutes: 20
-    name: E2E tests (${{ matrix.shard }}/${{ strategy.job-total }})
+    name: E2E (${{ matrix.shard }}/${{ strategy.job-total }})
     runs-on: buildjet-8vcpu-ubuntu-2204
     services:
       postgres:
@@ -71,13 +74,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7]
+        shard: [1, 2, 3, 4]
     steps:
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install

.github/workflows/integration-tests.yml

@@ -0,0 +1,92 @@
+name: Integration
+on:
+  workflow_call:
+permissions:
+  contents: read
+env:
+  NODE_OPTIONS: --max-old-space-size=4096
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
+  EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
+  EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
+  EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+jobs:
+  integration:
+    timeout-minutes: 20
+    name: Integration
+    runs-on: buildjet-8vcpu-ubuntu-2204
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+      mailhog:
+        image: mailhog/mailhog:v1.0.1
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        ports:
+          - 8025:8025
+          - 1025:1025
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - uses: ./.github/actions/cache-db
+      - name: Run Tests
+        run: yarn test -- --integrationTestsOnly
+      # TODO: Generate test results so we can upload them
+      # - name: Upload Test Results
+      #   if: ${{ always() }}
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: test-results
+      #     path: test-results

.github/workflows/labeler.yml

@@ -12,18 +12,16 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v4
+      - uses: actions/labeler@v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
-          # https://github.com/actions/labeler/issues/442#issuecomment-1297359481
-          sync-labels: ""
   team-labels:
     permissions:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: equitybee/team-label-action@main
         with:
           repo-token: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN }}
@@ -39,7 +37,7 @@ jobs:
 
     steps:
       - name: Apply labels from linked issue to PR
-        uses: actions/github-script@v5
+        uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/lint.yml

@@ -1,12 +1,15 @@
 name: Lint
 on:
   workflow_call:
+permissions:
+  actions: write
+  contents: read
 jobs:
   lint:
     runs-on: buildjet-4vcpu-ubuntu-2204
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - name: Run Linting with Reports
@@ -16,13 +19,6 @@ jobs:
       - name: Merge lint reports
         run: jq -s '[.[]]|flatten' lint-results/*.json &> lint-results/eslint_report.json
 
-      - name: Annotate Code Linting Results
-        uses: ataylorme/eslint-annotate-action@v2
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          report-json: "lint-results/eslint_report.json"
-          only-pr-files: false
-
       - name: Upload ESLint report
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/nextjs-bundle-analysis-annotation.yml

@@ -0,0 +1,81 @@
+name: "Next.js Bundle Analysis Annotation"
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: write
+
+jobs:
+  annotate:
+    if: always()
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/yarn-install
+      - uses: ./.github/actions/cache-build
+      - name: Download base branch bundle stats
+        uses: dawidd6/action-download-artifact@v2
+        if: success()
+        with:
+          workflow: nextjs-bundle-analysis.yml
+          branch: ${{ github.event.pull_request.base.ref }}
+          path: apps/web/.next/analyze/base
+
+      # And here's the second place - this runs after we have both the current and
+      # base branch bundle stats, and will compare them to determine what changed.
+      # There are two configurable arguments that come from package.json:
+      #
+      # - budget: optional, set a budget (bytes) against which size changes are measured
+      #           it's set to 350kb here by default, as informed by the following piece:
+      #           https://infrequently.org/2021/03/the-performance-inequality-gap/
+      #
+      # - red-status-percentage: sets the percent size increase where you get a red
+      #                          status indicator, defaults to 20%
+      #
+      # Either of these arguments can be changed or removed by editing the `nextBundleAnalysis`
+      # entry in your package.json file.
+
+      - name: Compare with base branch bundle
+        if: success()
+        run: |
+          cd apps/web
+          ls -laR .next/analyze/base && npx -p nextjs-bundle-analysis compare
+
+      - name: Get comment body
+        id: get-comment-body
+        if: success() && github.event.number
+        run: |
+          cd apps/web
+          body=$(cat .next/analyze/__bundle_analysis_comment.txt)
+          body="${body//'%'/'%25'}"
+          body="${body//$'\n'/'%0A'}"
+          body="${body//$'\r'/'%0D'}"
+          echo ::set-output name=body::$body
+
+      - name: Find Comment
+        uses: peter-evans/find-comment@v2
+        if: success() && github.event.number
+        id: fc
+        with:
+          issue-number: ${{ github.event.number }}
+          body-includes: "<!-- __NEXTJS_BUNDLE_@calcom/web -->"
+
+      - name: Create Comment
+        uses: peter-evans/create-or-update-comment@v3
+        if: success() && github.event.number && steps.fc.outputs.comment-id == 0
+        with:
+          issue-number: ${{ github.event.number }}
+          body: ${{ steps.get-comment-body.outputs.body }}
+
+      - name: Update Comment
+        uses: peter-evans/create-or-update-comment@v3
+        if: success() && github.event.number && steps.fc.outputs.comment-id != 0
+        with:
+          issue-number: ${{ github.event.number }}
+          body: ${{ steps.get-comment-body.outputs.body }}
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          edit-mode: replace

.github/workflows/nextjs-bundle-analysis.yml

@@ -7,6 +7,10 @@ on:
     branches:
       - main
 
+permissions:
+  actions: write
+  contents: read
+
 env:
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
@@ -45,17 +49,11 @@ env:
   TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
 jobs:
-  build:
-    name: Production builds
-    if: ${{ github.event_name == 'push' }}
-    uses: ./.github/workflows/production-build-without-database.yml
-    secrets: inherit
   analyze:
-    needs: build
     if: always()
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-build
@@ -69,65 +67,3 @@ jobs:
         with:
           name: bundle
           path: apps/web/.next/analyze/__bundle_analysis.json
-
-      - name: Download base branch bundle stats
-        uses: dawidd6/action-download-artifact@v2
-        if: success()
-        with:
-          workflow: nextjs-bundle-analysis.yml
-          branch: ${{ github.event.pull_request.base.ref }}
-          path: apps/web/.next/analyze/base
-
-      # And here's the second place - this runs after we have both the current and
-      # base branch bundle stats, and will compare them to determine what changed.
-      # There are two configurable arguments that come from package.json:
-      #
-      # - budget: optional, set a budget (bytes) against which size changes are measured
-      #           it's set to 350kb here by default, as informed by the following piece:
-      #           https://infrequently.org/2021/03/the-performance-inequality-gap/
-      #
-      # - red-status-percentage: sets the percent size increase where you get a red
-      #                          status indicator, defaults to 20%
-      #
-      # Either of these arguments can be changed or removed by editing the `nextBundleAnalysis`
-      # entry in your package.json file.
-      - name: Compare with base branch bundle
-        if: success()
-        run: |
-          cd apps/web
-          ls -laR .next/analyze/base && npx -p nextjs-bundle-analysis compare
-
-      - name: Get comment body
-        id: get-comment-body
-        if: success() && github.event.number
-        run: |
-          cd apps/web
-          body=$(cat .next/analyze/__bundle_analysis_comment.txt)
-          body="${body//'%'/'%25'}"
-          body="${body//$'\n'/'%0A'}"
-          body="${body//$'\r'/'%0D'}"
-          echo ::set-output name=body::$body
-
-      - name: Find Comment
-        uses: peter-evans/find-comment@v2
-        if: success() && github.event.number
-        id: fc
-        with:
-          issue-number: ${{ github.event.number }}
-          body-includes: "<!-- __NEXTJS_BUNDLE_@calcom/web -->"
-
-      - name: Create Comment
-        uses: peter-evans/create-or-update-comment@v3
-        if: success() && github.event.number && steps.fc.outputs.comment-id == 0
-        with:
-          issue-number: ${{ github.event.number }}
-          body: ${{ steps.get-comment-body.outputs.body }}
-
-      - name: Update Comment
-        uses: peter-evans/create-or-update-comment@v3
-        if: success() && github.event.number && steps.fc.outputs.comment-id != 0
-        with:
-          issue-number: ${{ github.event.number }}
-          body: ${{ steps.get-comment-body.outputs.body }}
-          comment-id: ${{ steps.fc.outputs.comment-id }}
-          edit-mode: replace

.github/workflows/pr-review.yml

@@ -0,0 +1,17 @@
+name: PR Reviewed
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  label-pr:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Label PR as ready for E2E
+        if: github.event.review.state == 'approved'
+        uses: actions-ecosystem/action-add-labels@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          labels: 'ready-for-e2e'

.github/workflows/pr.yml

@@ -2,11 +2,16 @@ name: PR Update
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
     branches:
       - main
-  merge_group:
+      - gh-actions-test-branch
   workflow_dispatch:
 
+permissions:
+  actions: write
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -19,94 +24,165 @@ jobs:
       pull-requests: read
     outputs:
       has-files-requiring-all-checks: ${{ steps.filter.outputs.has-files-requiring-all-checks }}
+      commit-sha: ${{ steps.get_sha.outputs.commit-sha }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
-      - uses: dorny/paths-filter@v2
+      - uses: dorny/paths-filter@v3
         id: filter
         with:
           filters: |
             has-files-requiring-all-checks:
               - "!(**.md|.github/CODEOWNERS)"
+      - name: Get Latest Commit SHA
+        id: get_sha
+        run: |
+          echo "commit-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
+  check-label:
+    needs: [changes]
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    name: Check for E2E label
+    permissions:
+      pull-requests: read
+    outputs:
+      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' && (github.event.action != 'labeled' || (github.event.action == 'labeled' && github.event.label.name == 'ready-for-e2e')) }}
+    steps:
+      - name: Check if PR exists with ready-for-e2e label for this SHA
+        id: check-if-pr-has-label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let labels = [];
+
+            if (context.payload.pull_request) {
+              labels = context.payload.pull_request.labels;
+            } else {
+              try {
+                const sha = '${{ needs.changes.outputs.commit-sha }}';
+                console.log('sha', sha);
+                const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  commit_sha: sha
+                });
+
+                if (prs.length === 0) {
+                  core.setOutput('run-e2e', false);
+                  console.log(`No pull requests found for commit SHA ${sha}`);
+                  return;
+                }
+
+                const pr = prs[0];
+                console.log(`PR number: ${pr.number}`);
+                console.log(`PR title: ${pr.title}`);
+                console.log(`PR state: ${pr.state}`);
+                console.log(`PR URL: ${pr.html_url}`);
+
+                labels = pr.labels;
+              }
+              catch (e) {
+                core.setOutput('run-e2e', false);
+                console.log(e);
+              }
+            }
+
+            const labelFound = labels.map(l => l.name).includes('ready-for-e2e');
+            console.log('Found the label?', labelFound);
+            core.setOutput('run-e2e', labelFound);
+
   type-check:
     name: Type check
-    needs: [changes]
+    needs: [changes, check-label]
     if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/check-types.yml
     secrets: inherit
 
-  test:
-    name: Unit tests
-    needs: [changes]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    uses: ./.github/workflows/unit-tests.yml
-    secrets: inherit
-
   lint:
     name: Linters
-    needs: [changes]
+    needs: [changes, check-label]
     if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/lint.yml
     secrets: inherit
 
+  unit-test:
+    name: Tests
+    needs: [changes, check-label]
+    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/unit-tests.yml
+    secrets: inherit
+
   build-api-v1:
     name: Production builds
-    needs: [changes]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [changes, check-label]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v1-production-build.yml
     secrets: inherit
 
   build-api-v2:
     name: Production builds
-    needs: [changes]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [changes, check-label]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v2-production-build.yml
     secrets: inherit
 
   build:
     name: Production builds
-    needs: [changes]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [changes, check-label]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/production-build-without-database.yml
     secrets: inherit
 
-  e2e:
-    name: E2E tests
-    needs: [changes, lint, build, build-api-v1, build-api-v2]
+  integration-test:
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
     if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/integration-tests.yml
+    secrets: inherit
+
+  e2e:
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e.yml
     secrets: inherit
 
+  e2e-api-v2:
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/e2e-api-v2.yml
+    secrets: inherit
+
   e2e-app-store:
-    name: E2E App Store tests
-    needs: [changes, lint, build, build-api-v1, build-api-v2]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-app-store.yml
     secrets: inherit
 
   e2e-embed:
-    name: E2E embeds tests
-    needs: [changes, lint, build, build-api-v1, build-api-v2]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed.yml
     secrets: inherit
 
   e2e-embed-react:
-    name: E2E React embeds tests
-    needs: [changes, lint, build, build-api-v1, build-api-v2]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    name: Tests
+    needs: [changes, check-label, build, build-api-v1, build-api-v2]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
   analyze:
     name: Analyze Build
-    needs: [changes, build]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [build]
     uses: ./.github/workflows/nextjs-bundle-analysis.yml
     secrets: inherit
 
   required:
-    needs: [changes, lint, type-check, test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
+    needs: [changes, lint, type-check, unit-test, integration-test, check-label, build, build-api-v1, build-api-v2, e2e, e2e-api-v2, e2e-embed, e2e-embed-react, e2e-app-store]
     if: always()
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:

.github/workflows/pre-release.yml

@@ -1,77 +0,0 @@
-name: Pre-release checks
-
-on:
-  workflow_dispatch:
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: buildjet-4vcpu-ubuntu-2204
-    permissions:
-      pull-requests: read
-    outputs:
-      app-store: ${{ steps.filter.outputs.app-store }}
-      embed: ${{ steps.filter.outputs.embed }}
-      embed-react: ${{ steps.filter.outputs.embed-react }}
-    steps:
-      - uses: actions/checkout@v3
-      - uses: ./.github/actions/dangerous-git-checkout
-      - uses: dorny/paths-filter@v2
-        id: filter
-        with:
-          filters: |
-            app-store:
-              - 'apps/web/**'
-              - 'packages/app-store/**'
-              - 'playwright.config.ts'
-            embed:
-              - 'apps/web/**'
-              - 'packages/embeds/**'
-              - 'playwright.config.ts'
-            embed-react:
-              - 'apps/web/**'
-              - 'packages/embeds/**'
-              - 'playwright.config.ts'
-
-  lint:
-    name: Linters
-    uses: ./.github/workflows/lint.yml
-    secrets: inherit
-
-  build:
-    name: Production builds
-    uses: ./.github/workflows/production-build-without-database.yml
-    secrets: inherit
-
-  e2e:
-    name: E2E tests
-    needs: [changes, lint, build]
-    uses: ./.github/workflows/e2e.yml
-    secrets: inherit
-
-  e2e-app-store:
-    name: E2E App Store tests
-    needs: [changes, lint, build]
-    uses: ./.github/workflows/e2e-app-store.yml
-    secrets: inherit
-
-  e2e-embed:
-    name: E2E embeds tests
-    needs: [changes, lint, build]
-    uses: ./.github/workflows/e2e-embed.yml
-    secrets: inherit
-
-  e2e-embed-react:
-    name: E2E React embeds tests
-    needs: [changes, lint, build]
-    uses: ./.github/workflows/e2e-embed-react.yml
-    secrets: inherit
-
-  required:
-    needs: [changes, lint, build, e2e, e2e-app-store, e2e-embed, e2e-embed-react]
-    if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
-    steps:
-      - name: fail if conditional jobs failed
-        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')
-        run: exit 1

.github/workflows/production-build-without-database.yml

@@ -2,6 +2,9 @@ name: Production Builds
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
@@ -40,7 +43,7 @@ jobs:
     runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-build

.github/workflows/release-docker.yaml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: "Determine tag"
         run: 'echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV'

.github/workflows/release.yml

@@ -9,7 +9,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: main # Always checkout main even for tagged releases
           fetch-depth: 0

.github/workflows/semantic-pull-requests.yml

@@ -37,12 +37,3 @@ jobs:
             ```
             ${{ steps.lint_pr_title.outputs.error_message }}
             ```
-
-      # Delete a previous comment when the issue has been resolved
-      - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          header: pr-title-lint-error
-          message: |
-            Thank you for following the naming conventions! 🙏 Feel free to join our [discord](https://go.cal.com/discord) and post your PR link.           
-

.github/workflows/submodule-sync.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: recursive
           token: ${{ secrets.GH_ACCESS_TOKEN }}

.github/workflows/unit-tests.yml

@@ -1,18 +1,22 @@
-name: Unit tests
+name: Unit
 on:
   workflow_call:
-  workflow_run:
-    workflows: [Crowdin Action]
-    types: [completed]
+permissions:
+  contents: read
 jobs:
   test:
+    name: Unit
     timeout-minutes: 20
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
-      # Should be an 8GB machine as per https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners
       - run: yarn test
       # We could add different timezones here that we need to run our tests in
       - run: TZ=America/Los_Angeles yarn test -- --timeZoneDependentTestsOnly
+      - name: Run API v2 tests
+        working-directory: apps/api/v2
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          yarn test

.github/workflows/yarn-install.yml

@@ -3,12 +3,15 @@ name: Yarn install
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     name: Yarn install & cache
     runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install

CONTRIBUTING.md

@@ -74,7 +74,7 @@ branch are tagged into a release monthly.
 
 To develop locally:
 
-1. [Fork](https://help.github.com/articles/fork-a-repo/) this repository to your
+1. [Fork](https://github.com/calcom/cal.com/fork/) this repository to your
    own GitHub account and then
    [clone](https://help.github.com/articles/cloning-a-repository/) it to your local device.
 2. Create a new branch:
@@ -99,7 +99,7 @@ To develop locally:
 
    - Duplicate `.env.example` to `.env`.
    - Use `openssl rand -base64 32` to generate a key and add it under `NEXTAUTH_SECRET` in the `.env` file.
-   - Use `openssl rand -base64 24` to generate a key and add it under `CALENDSO_ENCRYPTION_KEY` in the `.env` file.
+   - Use `openssl rand -base64 32` to generate a key and add it under `CALENDSO_ENCRYPTION_KEY` in the `.env` file.
 
 6. Setup Node
    If your Node version does not meet the project's requirements as instructed by the docs, "nvm" (Node Version Manager) allows using Node at the version required by the project:

apps/api/v1/instrumentation.ts

@@ -0,0 +1,15 @@
+import * as Sentry from "@sentry/nextjs";
+
+export function register() {
+  if (process.env.NEXT_RUNTIME === "nodejs") {
+    Sentry.init({
+      dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    });
+  }
+
+  if (process.env.NEXT_RUNTIME === "edge") {
+    Sentry.init({
+      dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    });
+  }
+}

apps/api/v1/lib/helpers/rateLimitApiKey.test.ts

@@ -0,0 +1,90 @@
+import type { Request, Response } from "express";
+import type { NextApiResponse, NextApiRequest } from "next";
+import { createMocks } from "node-mocks-http";
+import { describe, it, expect, vi } from "vitest";
+
+import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
+
+import { rateLimitApiKey } from "~/lib/helpers/rateLimitApiKey";
+
+type CustomNextApiRequest = NextApiRequest & Request;
+type CustomNextApiResponse = NextApiResponse & Response;
+
+vi.mock("@calcom/lib/checkRateLimitAndThrowError", () => ({
+  checkRateLimitAndThrowError: vi.fn(),
+}));
+
+describe("rateLimitApiKey middleware", () => {
+  it("should return 401 if no apiKey is provided", async () => {
+    const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+      method: "GET",
+      query: {},
+    });
+
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res._getStatusCode()).toBe(401);
+    expect(res._getJSONData()).toEqual({ message: "No apiKey provided" });
+  });
+
+  it("should call checkRateLimitAndThrowError with correct parameters", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+    });
+
+    (checkRateLimitAndThrowError as any).mockResolvedValueOnce({
+      limit: 100,
+      remaining: 99,
+      reset: Date.now(),
+    });
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(checkRateLimitAndThrowError).toHaveBeenCalledWith({
+      identifier: "test-key",
+      rateLimitingType: "api",
+      onRateLimiterResponse: expect.any(Function),
+    });
+  });
+
+  it("should set rate limit headers correctly", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+    });
+
+    const rateLimiterResponse = {
+      limit: 100,
+      remaining: 99,
+      reset: Date.now(),
+    };
+
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(({ onRateLimiterResponse }) => {
+      onRateLimiterResponse(rateLimiterResponse);
+    });
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res.getHeader("X-RateLimit-Limit")).toBe(rateLimiterResponse.limit);
+    expect(res.getHeader("X-RateLimit-Remaining")).toBe(rateLimiterResponse.remaining);
+    expect(res.getHeader("X-RateLimit-Reset")).toBe(rateLimiterResponse.reset);
+  });
+
+  it("should return 429 if rate limit is exceeded", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+    });
+
+    (checkRateLimitAndThrowError as any).mockRejectedValue(new Error("Rate limit exceeded"));
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res._getStatusCode()).toBe(429);
+    expect(res._getJSONData()).toEqual({ message: "Rate limit exceeded" });
+  });
+});

apps/api/v1/lib/helpers/rateLimitApiKey.ts

@@ -6,15 +6,19 @@ export const rateLimitApiKey: NextMiddleware = async (req, res, next) => {
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
 
   // TODO: Add a way to add trusted api keys
-  await checkRateLimitAndThrowError({
-    identifier: req.query.apiKey as string,
-    rateLimitingType: "api",
-    onRateLimiterResponse: (response) => {
-      res.setHeader("X-RateLimit-Limit", response.limit);
-      res.setHeader("X-RateLimit-Remaining", response.remaining);
-      res.setHeader("X-RateLimit-Reset", response.reset);
-    },
-  });
+  try {
+    await checkRateLimitAndThrowError({
+      identifier: req.query.apiKey as string,
+      rateLimitingType: "api",
+      onRateLimiterResponse: (response) => {
+        res.setHeader("X-RateLimit-Limit", response.limit);
+        res.setHeader("X-RateLimit-Remaining", response.remaining);
+        res.setHeader("X-RateLimit-Reset", response.reset);
+      },
+    });
+  } catch (error) {
+    res.status(429).json({ message: "Rate limit exceeded" });
+  }
 
   await next();
 };

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -1,11 +1,12 @@
 import type { NextMiddleware } from "next-api-middleware";
 
+import LicenseKeyService from "@calcom/ee/common/server/LicenseKeyService";
 import { hashAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
-import checkLicense from "@calcom/features/ee/common/server/checkLicense";
 import { IS_PRODUCTION } from "@calcom/lib/constants";
 import prisma from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";
+import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 
 // Used to check if the apiKey is not expired, could be extracted if reused. but not for now.
 export const dateNotInPast = function (date: Date) {
@@ -17,9 +18,12 @@ export const dateNotInPast = function (date: Date) {
 
 // This verifies the apiKey and sets the user if it is valid.
 export const verifyApiKey: NextMiddleware = async (req, res, next) => {
-  const hasValidLicense = await checkLicense(prisma);
-  if (!hasValidLicense && IS_PRODUCTION)
+  const licenseKeyService = await LicenseKeyService.create();
+  const hasValidLicense = await licenseKeyService.checkLicense();
+
+  if (!hasValidLicense && IS_PRODUCTION) {
     return res.status(401).json({ error: "Invalid or missing CALCOM_LICENSE_KEY environment variable" });
+  }
   // Check if the apiKey query param is provided.
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
   // remove the prefix from the user provided api_key. If no env set default to "cal_"
@@ -36,7 +40,10 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   if (!apiKey.userId) return res.status(404).json({ error: "No user found for this apiKey" });
   // save the user id in the request for later use
   req.userId = apiKey.userId;
-  // save the isAdmin boolean here for later use
-  req.isAdmin = await isAdminGuard(req);
+  const { isAdmin, scope } = await isAdminGuard(req);
+
+  req.isSystemWideAdmin = isAdmin && scope === ScopeOfAdmin.SystemWide;
+  req.isOrganizationOwnerOrAdmin = isAdmin && scope === ScopeOfAdmin.OrgOwnerOrAdmin;
+
   await next();
 };

apps/api/v1/lib/helpers/verifyCredentialSyncEnabled.ts

@@ -3,9 +3,9 @@ import type { NextMiddleware } from "next-api-middleware";
 import { APP_CREDENTIAL_SHARING_ENABLED } from "@calcom/lib/constants";
 
 export const verifyCredentialSyncEnabled: NextMiddleware = async (req, res, next) => {
-  const { isAdmin } = req;
+  const { isSystemWideAdmin } = req;
 
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     return res.status(403).json({ error: "Only admin API keys can access credential syncing endpoints" });
   }
 

apps/api/v1/lib/utils/extractUserIdsFromQuery.ts

@@ -4,9 +4,9 @@ import { HttpError } from "@calcom/lib/http-error";
 
 import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/queryUserId";
 
-export function extractUserIdsFromQuery({ isAdmin, query }: NextApiRequest) {
+export function extractUserIdsFromQuery({ isSystemWideAdmin, query }: NextApiRequest) {
   /** Guard: Only admins can query other users */
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     throw new HttpError({ statusCode: 401, message: "ADMIN required" });
   }
   const { userId: userIdOrUserIds } = schemaQuerySingleOrMultipleUserIds.parse(query);

apps/api/v1/lib/utils/isAdmin.ts

@@ -1,10 +1,40 @@
 import type { NextApiRequest } from "next";
 
 import prisma from "@calcom/prisma";
-import { UserPermissionRole } from "@calcom/prisma/enums";
+import { UserPermissionRole, MembershipRole } from "@calcom/prisma/enums";
+
+import { ScopeOfAdmin } from "./scopeOfAdmin";
 
 export const isAdminGuard = async (req: NextApiRequest) => {
   const { userId } = req;
-  const user = await prisma.user.findUnique({ where: { id: userId } });
-  return user?.role === UserPermissionRole.ADMIN;
+  const user = await prisma.user.findUnique({ where: { id: userId }, select: { role: true } });
+  if (!user) return { isAdmin: false, scope: null };
+
+  const { role: userRole } = user;
+  if (userRole === UserPermissionRole.ADMIN) return { isAdmin: true, scope: ScopeOfAdmin.SystemWide };
+
+  const orgOwnerOrAdminMemberships = await prisma.membership.findMany({
+    where: {
+      userId: userId,
+      accepted: true,
+      team: {
+        isOrganization: true,
+        organizationSettings: {
+          isAdminAPIEnabled: true,
+        },
+      },
+      OR: [{ role: MembershipRole.OWNER }, { role: MembershipRole.ADMIN }],
+    },
+    select: {
+      team: {
+        select: {
+          id: true,
+          isOrganization: true,
+        },
+      },
+    },
+  });
+  if (!orgOwnerOrAdminMemberships.length) return { isAdmin: false, scope: null };
+
+  return { isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin };
 };

apps/api/v1/lib/utils/retrieveScopedAccessibleUsers.ts

@@ -0,0 +1,92 @@
+import prisma from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/enums";
+
+type AccessibleUsersType = {
+  memberUserIds: number[];
+  adminUserId: number;
+};
+
+const getAllOrganizationMemberships = async (
+  memberships: {
+    userId: number;
+    role: MembershipRole;
+    teamId: number;
+  }[],
+  orgId: number
+) => {
+  return memberships.reduce<number[]>((acc, membership) => {
+    if (membership.teamId === orgId) {
+      acc.push(membership.userId);
+    }
+    return acc;
+  }, []);
+};
+
+const getAllAdminMemberships = async (userId: number) => {
+  return await prisma.membership.findMany({
+    where: {
+      userId: userId,
+      accepted: true,
+      OR: [{ role: MembershipRole.OWNER }, { role: MembershipRole.ADMIN }],
+    },
+    select: {
+      team: {
+        select: {
+          id: true,
+          isOrganization: true,
+        },
+      },
+    },
+  });
+};
+
+const getAllOrganizationMembers = async (organizationId: number) => {
+  return await prisma.membership.findMany({
+    where: {
+      teamId: organizationId,
+      accepted: true,
+    },
+    select: {
+      userId: true,
+    },
+  });
+};
+
+export const getAccessibleUsers = async ({
+  memberUserIds,
+  adminUserId,
+}: AccessibleUsersType): Promise<number[]> => {
+  const memberships = await prisma.membership.findMany({
+    where: {
+      team: {
+        isOrganization: true,
+      },
+      accepted: true,
+      OR: [
+        { userId: { in: memberUserIds } },
+        { userId: adminUserId, role: { in: [MembershipRole.OWNER, MembershipRole.ADMIN] } },
+      ],
+    },
+    select: {
+      userId: true,
+      role: true,
+      teamId: true,
+    },
+  });
+
+  const orgId = memberships.find((membership) => membership.userId === adminUserId)?.teamId;
+  if (!orgId) return [];
+
+  const allAccessibleMemberUserIds = await getAllOrganizationMemberships(memberships, orgId);
+  const accessibleUserIds = allAccessibleMemberUserIds.filter((userId) => userId !== adminUserId);
+  return accessibleUserIds;
+};
+
+export const retrieveOrgScopedAccessibleUsers = async ({ adminId }: { adminId: number }) => {
+  const adminMemberships = await getAllAdminMemberships(adminId);
+  const organizationId = adminMemberships.find((membership) => membership.team.isOrganization)?.team.id;
+  if (!organizationId) return [];
+
+  const allMemberships = await getAllOrganizationMembers(organizationId);
+  return allMemberships.map((membership) => membership.userId);
+};

apps/api/v1/lib/utils/scopeOfAdmin.ts

@@ -0,0 +1,4 @@
+export const ScopeOfAdmin = {
+  SystemWide: "SystemWide",
+  OrgOwnerOrAdmin: "OrgOwnerOrAdmin",
+} as const;

apps/api/v1/lib/validations/booking.ts

@@ -21,6 +21,8 @@ export const schemaBookingCreateBodyParams = extendedBookingCreateBody.merge(sch
 export const schemaBookingGetParams = z.object({
   dateFrom: iso8601.optional(),
   dateTo: iso8601.optional(),
+  order: z.enum(["asc", "desc"]).default("asc"),
+  sortBy: z.enum(["createdAt", "updatedAt"]).optional(),
 });
 
 const schemaBookingEditParams = z
@@ -55,7 +57,7 @@ export const schemaBookingReadPublic = Booking.extend({
       timeZone: true,
       locale: true,
     })
-    .optional(),
+    .nullish(),
   payment: z
     .array(
       _PaymentModel.pick({

apps/api/v1/lib/validations/shared/queryIdTransformParseInt.ts

@@ -14,3 +14,7 @@ export const withValidQueryIdTransformParseInt = withValidation({
   type: "Zod",
   mode: "query",
 });
+
+export const getTranscriptFromRecordingId = schemaQueryIdParseInt.extend({
+  recordingId: z.string(),
+});

apps/api/v1/next.config.js

@@ -2,7 +2,12 @@ const { withAxiom } = require("next-axiom");
 const { withSentryConfig } = require("@sentry/nextjs");
 
 const plugins = [withAxiom];
+
+/** @type {import("next").NextConfig} */
 const nextConfig = {
+  experimental: {
+    instrumentationHook: true,
+  },
   transpilePackages: [
     "@calcom/app-store",
     "@calcom/core",
@@ -87,12 +92,12 @@ const nextConfig = {
 };
 
 if (!!process.env.NEXT_PUBLIC_SENTRY_DSN) {
-  nextConfig["sentry"] = {
-    autoInstrumentServerFunctions: true,
-    hideSourceMaps: true,
-  };
-
-  plugins.push(withSentryConfig);
+  plugins.push((nextConfig) =>
+    withSentryConfig(nextConfig, {
+      autoInstrumentServerFunctions: true,
+      hideSourceMaps: true,
+    })
+  );
 }
 
 module.exports = () => plugins.reduce((acc, next) => next(acc), nextConfig);

apps/api/v1/next.d.ts

@@ -11,7 +11,8 @@ export declare module "next" {
     method: string;
     // session: { user: { id: number } };
     // query: Partial<{ [key: string]: string | string[] }>;
-    isAdmin: boolean;
+    isSystemWideAdmin: boolean;
+    isOrganizationOwnerOrAdmin: boolean;
     pagination: { take: number; skip: number };
   }
 }

apps/api/v1/package.json

@@ -30,7 +30,7 @@
     "@calcom/lib": "*",
     "@calcom/prisma": "*",
     "@calcom/trpc": "*",
-    "@sentry/nextjs": "^7.73.0",
+    "@sentry/nextjs": "^8.8.0",
     "bcryptjs": "^2.4.3",
     "memory-cache": "^0.2.0",
     "next": "^13.5.4",

apps/api/v1/pages/api/api-keys/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdAsString } from "~/lib/validations/shared/queryIdString";
 
 export async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdAsString.parse(req.query);
   // Admin can check any api key
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Check if user can access the api key
   const apiKey = await prisma.apiKey.findFirst({
     where: { id, userId },

apps/api/v1/pages/api/api-keys/_get.ts

@@ -16,8 +16,8 @@ type CustomNextApiRequest = NextApiRequest & {
 function handleAdminRequests(req: CustomNextApiRequest) {
   // To match type safety with runtime
   if (!hasReqArgs(req)) throw Error("Missing req.args");
-  const { userId, isAdmin } = req;
-  if (isAdmin && req.query.userId) {
+  const { userId, isSystemWideAdmin } = req;
+  if (isSystemWideAdmin && req.query.userId) {
     const query = schemaQuerySingleOrMultipleUserIds.parse(req.query);
     const userIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
     req.args.where = { userId: { in: userIds } };
@@ -30,8 +30,8 @@ function hasReqArgs(req: CustomNextApiRequest): req is Ensure<CustomNextApiReque
 }
 
 async function getHandler(req: CustomNextApiRequest) {
-  const { userId, isAdmin } = req;
-  req.args = isAdmin ? {} : { where: { userId } };
+  const { userId, isSystemWideAdmin } = req;
+  req.args = isSystemWideAdmin ? {} : { where: { userId } };
   // Proof of concept: allowing mutation in exchange of composability
   handleAdminRequests(req);
   const data = await prisma.apiKey.findMany(req.args);

apps/api/v1/pages/api/api-keys/_post.ts

@@ -10,7 +10,7 @@ import prisma from "@calcom/prisma";
 import { apiKeyCreateBodySchema, apiKeyPublicSchema } from "~/lib/validations/api-key";
 
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { neverExpires, userId: bodyUserId, ...input } = apiKeyCreateBodySchema.parse(req.body);
   const [hashedKey, apiKey] = generateUniqueAPIKey();
   const args: Prisma.ApiKeyCreateArgs = {
@@ -24,9 +24,10 @@ async function postHandler(req: NextApiRequest) {
     },
   };
 
-  if (!isAdmin && bodyUserId) throw new HttpError({ statusCode: 403, message: `ADMIN required for userId` });
+  if (!isSystemWideAdmin && bodyUserId)
+    throw new HttpError({ statusCode: 403, message: `ADMIN required for userId` });
 
-  if (isAdmin && bodyUserId) {
+  if (isSystemWideAdmin && bodyUserId) {
     const where: Prisma.UserWhereInput = { id: bodyUserId };
     await prisma.user.findFirstOrThrow({ where });
     args.data.userId = bodyUserId;

apps/api/v1/pages/api/attendees/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const query = schemaQueryIdParseInt.parse(req.query);
   // @note: Here we make sure to only return attendee's of the user's own bookings if the user is not an admin.
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Find all user bookings, including attendees
   const attendee = await prisma.attendee.findFirst({
     where: { id: query.id, booking: { userId } },

apps/api/v1/pages/api/attendees/[id]/_patch.ts

@@ -63,8 +63,8 @@ export async function patchHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: z.infer<typeof schemaAttendeeEditBodyParams>) {
-  const { isAdmin } = req;
-  if (isAdmin) return;
+  const { isSystemWideAdmin } = req;
+  if (isSystemWideAdmin) return;
   const { userId } = req;
   const { bookingId } = body;
   if (bookingId) {

apps/api/v1/pages/api/attendees/_get.ts

@@ -31,8 +31,8 @@ import { schemaAttendeeReadPublic } from "~/lib/validations/attendee";
  *         description: No attendees were found
  */
 async function handler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  const args: Prisma.AttendeeFindManyArgs = isAdmin ? {} : { where: { booking: { userId } } };
+  const { userId, isSystemWideAdmin } = req;
+  const args: Prisma.AttendeeFindManyArgs = isSystemWideAdmin ? {} : { where: { booking: { userId } } };
   const data = await prisma.attendee.findMany(args);
   const attendees = data.map((attendee) => schemaAttendeeReadPublic.parse(attendee));
   if (!attendees) throw new HttpError({ statusCode: 404, message: "No attendees were found" });

apps/api/v1/pages/api/attendees/_post.ts

@@ -52,10 +52,10 @@ import { schemaAttendeeCreateBodyParams, schemaAttendeeReadPublic } from "~/lib/
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const body = schemaAttendeeCreateBodyParams.parse(req.body);
 
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     const userBooking = await prisma.booking.findFirst({
       where: { userId, id: body.bookingId },
       select: { id: true },

apps/api/v1/pages/api/availabilities/[id]/_auth-middleware.ts

@@ -5,10 +5,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin, query } = req;
+  const { userId, isSystemWideAdmin, query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   /** Admins can skip the ownership verification */
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   /**
    * There's a caveat here. If the availability exists but the user doesn't own it,
    * the user will see a 404 error which may or not be the desired behavior.

apps/api/v1/pages/api/availabilities/_post.ts

@@ -86,8 +86,8 @@ async function postHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  if (isAdmin) return;
+  const { userId, isSystemWideAdmin } = req;
+  if (isSystemWideAdmin) return;
   const data = schemaAvailabilityCreateBodyParams.parse(req.body);
   const schedule = await prisma.schedule.findFirst({
     where: { userId, id: data.scheduleId },

apps/api/v1/pages/api/availability/_get.ts

@@ -189,7 +189,7 @@ const availabilitySchema = z
   );
 
 async function handler(req: NextApiRequest) {
-  const { isAdmin, userId: reqUserId } = req;
+  const { isSystemWideAdmin, userId: reqUserId } = req;
   const { username, userId, eventTypeId, dateTo, dateFrom, teamId } = availabilitySchema.parse(req.query);
   if (!teamId)
     return getUserAvailability({
@@ -224,7 +224,7 @@ async function handler(req: NextApiRequest) {
   const isUserAdminOrOwner =
     memberRoles[reqUserId] == MembershipRole.ADMIN ||
     memberRoles[reqUserId] == MembershipRole.OWNER ||
-    isAdmin;
+    isSystemWideAdmin;
   if (!isUserAdminOrOwner) throw new HttpError({ statusCode: 403, message: "Forbidden" });
   const availabilities = members.map(async (user) => {
     return {

apps/api/v1/pages/api/booking-references/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
   // Here we make sure to only return references of the user's own bookings if the user is not an admin.
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Find all references where the user has bookings
   const bookingReference = await prisma.bookingReference.findFirst({
     where: { id, booking: { userId } },

apps/api/v1/pages/api/booking-references/[id]/_patch.ts

@@ -60,12 +60,12 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Authorization information is missing or invalid.
  */
 export async function patchHandler(req: NextApiRequest) {
-  const { query, body, isAdmin, userId } = req;
+  const { query, body, isSystemWideAdmin, userId } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const data = schemaBookingEditBodyParams.parse(body);
   /* If user tries to update bookingId, we run extra checks */
   if (data.bookingId) {
-    const args: Prisma.BookingFindFirstOrThrowArgs = isAdmin
+    const args: Prisma.BookingFindFirstOrThrowArgs = isSystemWideAdmin
       ? /* If admin, we only check that the booking exists */
         { where: { id: data.bookingId } }
       : /* For non-admins we make sure the booking belongs to the user */

apps/api/v1/pages/api/booking-references/_get.ts

@@ -30,8 +30,10 @@ import { schemaBookingReferenceReadPublic } from "~/lib/validations/booking-refe
  *         description: No booking references were found
  */
 async function getHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  const args: Prisma.BookingReferenceFindManyArgs = isAdmin ? {} : { where: { booking: { userId } } };
+  const { userId, isSystemWideAdmin } = req;
+  const args: Prisma.BookingReferenceFindManyArgs = isSystemWideAdmin
+    ? {}
+    : { where: { booking: { userId } } };
   const data = await prisma.bookingReference.findMany(args);
   return { booking_references: data.map((br) => schemaBookingReferenceReadPublic.parse(br)) };
 }

apps/api/v1/pages/api/booking-references/_post.ts

@@ -62,9 +62,9 @@ import {
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const body = schemaBookingCreateBodyParams.parse(req.body);
-  const args: Prisma.BookingFindFirstOrThrowArgs = isAdmin
+  const args: Prisma.BookingFindFirstOrThrowArgs = isSystemWideAdmin
     ? /* If admin, we only check that the booking exists */
       { where: { id: body.bookingId } }
     : /* For non-admins we make sure the booking belongs to the user */

apps/api/v1/pages/api/bookings/[id]/_auth-middleware.ts

@@ -3,15 +3,33 @@ import type { NextApiRequest } from "next";
 import { HttpError } from "@calcom/lib/http-error";
 import prisma from "@calcom/prisma";
 
+import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin, query } = req;
-  if (isAdmin) {
+  const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin, query } = req;
+  if (isSystemWideAdmin) {
     return;
   }
 
   const { id } = schemaQueryIdParseInt.parse(query);
+  if (isOrganizationOwnerOrAdmin) {
+    const booking = await prisma.booking.findUnique({
+      where: { id },
+      select: { userId: true },
+    });
+    if (booking) {
+      const bookingUserId = booking.userId;
+      if (bookingUserId) {
+        const accessibleUsersIds = await getAccessibleUsers({
+          adminUserId: userId,
+          memberUserIds: [bookingUserId],
+        });
+        if (accessibleUsersIds.length > 0) return;
+      }
+    }
+  }
+
   const userWithBookingsAndTeamIds = await prisma.user.findUnique({
     where: { id: userId },
     include: {
@@ -43,7 +61,7 @@ async function authMiddleware(req: NextApiRequest) {
     });
 
     if (!teamBookings) {
-      throw new HttpError({ statusCode: 401, message: "You are not authorized" });
+      throw new HttpError({ statusCode: 403, message: "You are not authorized" });
     }
   }
 }

apps/api/v1/pages/api/bookings/[id]/_patch.ts

@@ -5,6 +5,7 @@ import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
 
+import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
 import { schemaBookingEditBodyParams, schemaBookingReadPublic } from "~/lib/validations/booking";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
@@ -109,14 +110,27 @@ export async function patchHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: z.infer<typeof schemaBookingEditBodyParams>) {
-  const { isAdmin } = req;
-  if (body.userId && !isAdmin) {
+  const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin } = req;
+  if (body.userId && !isSystemWideAdmin && !isOrganizationOwnerOrAdmin) {
     // Organizer has to be a cal user and we can't allow a booking to be transfered to some other cal user's name
     throw new HttpError({
       statusCode: 403,
       message: "Only admin can change the organizer of a booking",
     });
   }
+
+  if (body.userId && isOrganizationOwnerOrAdmin) {
+    const accessibleUsersIds = await getAccessibleUsers({
+      adminUserId: userId,
+      memberUserIds: [body.userId],
+    });
+    if (accessibleUsersIds.length === 0) {
+      throw new HttpError({
+        statusCode: 403,
+        message: "Only admin can change the organizer of a booking",
+      });
+    }
+  }
 }
 
 export default defaultResponder(patchHandler);

apps/api/v1/pages/api/bookings/[id]/recordings/_get.ts

@@ -0,0 +1,99 @@
+import type { NextApiRequest } from "next";
+
+import { getRecordingsOfCalVideoByRoomName } from "@calcom/core/videoClient";
+import { getDownloadLinkOfCalVideoByRecordingId } from "@calcom/core/videoClient";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
+import type { RecordingItemSchema } from "@calcom/prisma/zod-utils";
+import type { PartialReference } from "@calcom/types/EventManager";
+
+import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
+
+/**
+ * @swagger
+ * /bookings/{id}/recordings:
+ *   get:
+ *     summary: Find all Cal video recordings of that booking
+ *     operationId: getRecordingsByBookingId
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         schema:
+ *           type: integer
+ *         required: true
+ *         description: ID of the booking for which recordings need to be fetched. Recording download link is only valid for 12 hours and you would have to fetch the recordings again to get new download link
+ *       - in: query
+ *         name: apiKey
+ *         required: true
+ *         schema:
+ *           type: string
+ *         description: Your API key
+ *     tags:
+ *     - bookings
+ *     responses:
+ *       200:
+ *         description: OK
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: "#/components/schemas/ArrayOfRecordings"
+ *             examples:
+ *               recordings:
+ *                 value:
+ *                   - id: "ad90a2e7-154f-49ff-a815-5da1db7bf899"
+ *                     room_name: "0n22w24AQ5ZFOtEKX2gX"
+ *                     start_ts: 1716215386
+ *                     status: "finished"
+ *                     max_participants: 1
+ *                     duration: 11
+ *                     share_token: "x94YK-69Gnh7"
+ *                     download_link: "https://daily-meeting-recordings..."
+ *       401:
+ *         description: Authorization information is missing or invalid.
+ *       404:
+ *         description: Booking was not found
+ */
+
+export async function getHandler(req: NextApiRequest) {
+  const { query } = req;
+  const { id } = schemaQueryIdParseInt.parse(query);
+
+  const booking = await prisma.booking.findUnique({
+    where: { id },
+    include: { references: true },
+  });
+
+  if (!booking)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking found with booking id ${id}`,
+    });
+
+  const roomName =
+    booking?.references?.find((reference: PartialReference) => reference.type === "daily_video")?.meetingId ??
+    undefined;
+
+  if (!roomName)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Cal Video reference found with booking id ${booking.id}`,
+    });
+
+  const recordings = await getRecordingsOfCalVideoByRoomName(roomName);
+
+  if (!recordings || !("data" in recordings)) return [];
+
+  const recordingWithDownloadLink = recordings.data.map((recording: RecordingItemSchema) => {
+    return getDownloadLinkOfCalVideoByRecordingId(recording.id)
+      .then((res) => ({
+        ...recording,
+        download_link: res?.download_link,
+      }))
+      .catch((err) => ({ ...recording, download_link: null, error: err.message }));
+  });
+  const res = await Promise.all(recordingWithDownloadLink);
+  return res;
+}
+
+export default defaultResponder(getHandler);

apps/api/v1/pages/api/bookings/[id]/recordings/index.ts

@@ -0,0 +1,16 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+
+import authMiddleware from "../_auth-middleware";
+
+export default withMiddleware()(
+  defaultResponder(async (req: NextApiRequest, res: NextApiResponse) => {
+    await authMiddleware(req);
+    return defaultHandler({
+      GET: import("./_get"),
+    })(req, res);
+  })
+);

apps/api/v1/pages/api/bookings/[id]/transcripts/[recordingId]/_get.ts

@@ -0,0 +1,94 @@
+import type { NextApiRequest } from "next";
+
+import {
+  getTranscriptsAccessLinkFromRecordingId,
+  checkIfRoomNameMatchesInRecording,
+} from "@calcom/core/videoClient";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
+import type { PartialReference } from "@calcom/types/EventManager";
+
+import { getTranscriptFromRecordingId } from "~/lib/validations/shared/queryIdTransformParseInt";
+
+/**
+ * @swagger
+ * /bookings/{id}/transcripts/{recordingId}:
+ *   get:
+ *     summary: Find all Cal video transcripts of that recording
+ *     operationId: getTranscriptsByRecordingId
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         schema:
+ *           type: integer
+ *         required: true
+ *         description: ID of the booking for which transcripts need to be fetched.
+ *       - in: path
+ *         name: recordingId
+ *         schema:
+ *           type: string
+ *         required: true
+ *         description: ID of the recording(daily.co recording id) for which transcripts need to be fetched.
+ *       - in: query
+ *         name: apiKey
+ *         required: true
+ *         schema:
+ *           type: string
+ *         description: Your API key
+ *     tags:
+ *     - bookings
+ *     responses:
+ *       200:
+ *         description: OK
+ *         content:
+ *           application/json:
+ *       401:
+ *         description: Authorization information is missing or invalid.
+ *       404:
+ *         description: Booking was not found
+ */
+
+export async function getHandler(req: NextApiRequest) {
+  const { query } = req;
+  const { id, recordingId } = getTranscriptFromRecordingId.parse(query);
+
+  await checkIfRecordingBelongsToBooking(id, recordingId);
+
+  const transcriptsAccessLinks = await getTranscriptsAccessLinkFromRecordingId(recordingId);
+
+  return transcriptsAccessLinks;
+}
+
+const checkIfRecordingBelongsToBooking = async (bookingId: number, recordingId: string) => {
+  const booking = await prisma.booking.findUnique({
+    where: { id: bookingId },
+    include: { references: true },
+  });
+
+  if (!booking)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking found with booking id ${bookingId}`,
+    });
+
+  const roomName =
+    booking?.references?.find((reference: PartialReference) => reference.type === "daily_video")?.meetingId ??
+    undefined;
+
+  if (!roomName)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking Reference with Daily Video found with booking id ${bookingId}`,
+    });
+
+  const canUserAccessRecordingId = await checkIfRoomNameMatchesInRecording(roomName, recordingId);
+  if (!canUserAccessRecordingId) {
+    throw new HttpError({
+      statusCode: 403,
+      message: `This Recording Id ${recordingId} does not belong to booking ${bookingId}`,
+    });
+  }
+};
+
+export default defaultResponder(getHandler);

apps/api/v1/pages/api/bookings/[id]/transcripts/[recordingId]/index.ts

@@ -0,0 +1,16 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+
+import authMiddleware from "../../_auth-middleware";
+
+export default withMiddleware()(
+  defaultResponder(async (req: NextApiRequest, res: NextApiResponse) => {
+    await authMiddleware(req);
+    return defaultHandler({
+      GET: import("./_get"),
+    })(req, res);
+  })
+);

apps/api/v1/pages/api/bookings/[id]/transcripts/_get.ts

@@ -0,0 +1,73 @@
+import type { NextApiRequest } from "next";
+
+import { getAllTranscriptsAccessLinkFromRoomName } from "@calcom/core/videoClient";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
+import type { PartialReference } from "@calcom/types/EventManager";
+
+import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
+
+/**
+ * @swagger
+ * /bookings/{id}/transcripts:
+ *   get:
+ *     summary: Find all Cal video transcripts of that booking
+ *     operationId: getTranscriptsByBookingId
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         schema:
+ *           type: integer
+ *         required: true
+ *         description: ID of the booking for which recordings need to be fetched.
+ *       - in: query
+ *         name: apiKey
+ *         required: true
+ *         schema:
+ *           type: string
+ *         description: Your API key
+ *     tags:
+ *     - bookings
+ *     responses:
+ *       200:
+ *         description: OK
+ *         content:
+ *           application/json:
+ *       401:
+ *         description: Authorization information is missing or invalid.
+ *       404:
+ *         description: Booking was not found
+ */
+
+export async function getHandler(req: NextApiRequest) {
+  const { query } = req;
+  const { id } = schemaQueryIdParseInt.parse(query);
+
+  const booking = await prisma.booking.findUnique({
+    where: { id },
+    include: { references: true },
+  });
+
+  if (!booking)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Booking found with booking id ${id}`,
+    });
+
+  const roomName =
+    booking?.references?.find((reference: PartialReference) => reference.type === "daily_video")?.meetingId ??
+    undefined;
+
+  if (!roomName)
+    throw new HttpError({
+      statusCode: 404,
+      message: `No Cal Video reference found with booking id ${booking.id}`,
+    });
+
+  const transcripts = await getAllTranscriptsAccessLinkFromRoomName(roomName);
+
+  return transcripts;
+}
+
+export default defaultResponder(getHandler);

apps/api/v1/pages/api/bookings/[id]/transcripts/index.ts

@@ -0,0 +1,16 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+
+import authMiddleware from "../_auth-middleware";
+
+export default withMiddleware()(
+  defaultResponder(async (req: NextApiRequest, res: NextApiResponse) => {
+    await authMiddleware(req);
+    return defaultHandler({
+      GET: import("./_get"),
+    })(req, res);
+  })
+);

apps/api/v1/pages/api/bookings/_get.ts

@@ -5,6 +5,11 @@ import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
 
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+import {
+  getAccessibleUsers,
+  retrieveOrgScopedAccessibleUsers,
+} from "~/lib/utils/retrieveScopedAccessibleUsers";
 import { schemaBookingGetParams, schemaBookingReadPublic } from "~/lib/validations/booking";
 import { schemaQuerySingleOrMultipleAttendeeEmails } from "~/lib/validations/shared/queryAttendeeEmail";
 import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/queryUserId";
@@ -46,6 +51,18 @@ import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/que
  *                type: string
  *                format: email
  *              example: [john.doe@example.com, jane.doe@example.com]
+ *        - in: query
+ *          name: order
+ *          required: false
+ *          schema:
+ *          type: string
+ *          enum: [asc, desc]
+ *       - in: query
+ *         name: sortBy
+ *         required: false
+ *         schema:
+ *          type: string
+ *          enum: [createdAt, updatedAt]
  *     operationId: listBookings
  *     tags:
  *     - bookings
@@ -108,7 +125,11 @@ import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/que
  *       404:
  *         description: No bookings were found
  */
-
+type GetAdminArgsType = {
+  adminDidQueryUserIds?: boolean;
+  requestedUserIds: number[];
+  userId: number;
+};
 /**
  * Constructs the WHERE clause for Prisma booking findMany operation.
  *
@@ -161,12 +182,20 @@ function buildWhereClause(
   };
 }
 
-async function handler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-
-  const { dateFrom, dateTo } = schemaBookingGetParams.parse(req.query);
+export async function handler(req: NextApiRequest) {
+  const {
+    userId,
+    isSystemWideAdmin,
+    isOrganizationOwnerOrAdmin,
+    pagination: { take, skip },
+  } = req;
+  const { dateFrom, dateTo, order, sortBy } = schemaBookingGetParams.parse(req.query);
 
   const args: Prisma.BookingFindManyArgs = {};
+  if (req.query.take && req.query.page) {
+    args.take = take;
+    args.skip = skip;
+  }
   args.include = {
     attendees: true,
     user: true,
@@ -182,19 +211,32 @@ async function handler(req: NextApiRequest) {
   const filterByAttendeeEmails = attendeeEmails.length > 0;
 
   /** Only admins can query other users */
-  if (isAdmin) {
-    if (req.query.userId) {
+  if (isSystemWideAdmin) {
+    if (req.query.userId || filterByAttendeeEmails) {
       const query = schemaQuerySingleOrMultipleUserIds.parse(req.query);
-      const userIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
-      const users = await prisma.user.findMany({
-        where: { id: { in: userIds } },
-        select: { email: true },
-      });
-      const userEmails = users.map((u) => u.email);
-      args.where = buildWhereClause(userId, attendeeEmails, userIds, userEmails);
-    } else if (filterByAttendeeEmails) {
-      args.where = buildWhereClause(null, attendeeEmails, [], []);
+      const requestedUserIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
+
+      const systemWideAdminArgs = {
+        adminDidQueryUserIds: !!req.query.userId,
+        requestedUserIds,
+        userId,
+      };
+      const { userId: argUserId, userIds, userEmails } = await handleSystemWideAdminArgs(systemWideAdminArgs);
+      args.where = buildWhereClause(argUserId, attendeeEmails, userIds, userEmails);
     }
+  } else if (isOrganizationOwnerOrAdmin) {
+    let requestedUserIds = [userId];
+    if (req.query.userId || filterByAttendeeEmails) {
+      const query = schemaQuerySingleOrMultipleUserIds.parse(req.query);
+      requestedUserIds = Array.isArray(query.userId) ? query.userId : [query.userId || userId];
+    }
+    const orgWideAdminArgs = {
+      adminDidQueryUserIds: !!req.query.userId,
+      requestedUserIds,
+      userId,
+    };
+    const { userId: argUserId, userIds, userEmails } = await handleOrgWideAdminArgs(orgWideAdminArgs);
+    args.where = buildWhereClause(argUserId, attendeeEmails, userIds, userEmails);
   } else {
     const user = await prisma.user.findUnique({
       where: { id: userId },
@@ -203,7 +245,7 @@ async function handler(req: NextApiRequest) {
       },
     });
     if (!user) {
-      throw new HttpError({ message: "User not found", statusCode: 500 });
+      throw new HttpError({ message: "User not found", statusCode: 404 });
     }
     args.where = buildWhereClause(userId, attendeeEmails, [], []);
   }
@@ -221,8 +263,69 @@ async function handler(req: NextApiRequest) {
     };
   }
 
+  if (sortBy === "updatedAt") {
+    args.orderBy = {
+      updatedAt: order,
+    };
+  }
+
+  if (sortBy === "createdAt") {
+    args.orderBy = {
+      createdAt: order,
+    };
+  }
+
   const data = await prisma.booking.findMany(args);
   return { bookings: data.map((booking) => schemaBookingReadPublic.parse(booking)) };
 }
 
-export default defaultResponder(handler);
+const handleSystemWideAdminArgs = async ({
+  adminDidQueryUserIds,
+  requestedUserIds,
+  userId,
+}: GetAdminArgsType) => {
+  if (adminDidQueryUserIds) {
+    const users = await prisma.user.findMany({
+      where: { id: { in: requestedUserIds } },
+      select: { email: true },
+    });
+    const userEmails = users.map((u) => u.email);
+
+    return { userId, userIds: requestedUserIds, userEmails };
+  }
+  return { userId: null, userIds: [], userEmails: [] };
+};
+
+const handleOrgWideAdminArgs = async ({
+  adminDidQueryUserIds,
+  requestedUserIds,
+  userId,
+}: GetAdminArgsType) => {
+  if (adminDidQueryUserIds) {
+    const accessibleUsersIds = await getAccessibleUsers({
+      adminUserId: userId,
+      memberUserIds: requestedUserIds,
+    });
+
+    if (!accessibleUsersIds.length) throw new HttpError({ message: "No User found", statusCode: 404 });
+    const users = await prisma.user.findMany({
+      where: { id: { in: accessibleUsersIds } },
+      select: { email: true },
+    });
+    const userEmails = users.map((u) => u.email);
+    return { userId, userIds: accessibleUsersIds, userEmails };
+  } else {
+    const accessibleUsersIds = await retrieveOrgScopedAccessibleUsers({
+      adminId: userId,
+    });
+
+    const users = await prisma.user.findMany({
+      where: { id: { in: accessibleUsersIds } },
+      select: { email: true },
+    });
+    const userEmails = users.map((u) => u.email);
+    return { userId, userIds: accessibleUsersIds, userEmails };
+  }
+};
+
+export default withMiddleware("pagination")(defaultResponder(handler));

apps/api/v1/pages/api/bookings/_post.ts

@@ -2,8 +2,12 @@ import type { NextApiRequest } from "next";
 
 import getBookingDataSchemaForApi from "@calcom/features/bookings/lib/getBookingDataSchemaForApi";
 import handleNewBooking from "@calcom/features/bookings/lib/handleNewBooking";
+import { ErrorCode } from "@calcom/lib/errorCodes";
+import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 
+import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
+
 /**
  * @swagger
  * /bookings:
@@ -43,6 +47,10 @@ import { defaultResponder } from "@calcom/lib/server";
  *                 type: string
  *                 format: date-time
  *                 description: 'End time of the Event'
+ *               rescheduleUid:
+ *                 type: string
+ *                 format: UID
+ *                 description: 'Uid of the booking to reschedule'
  *               responses:
  *                 type: object
  *                 required:
@@ -204,10 +212,28 @@ import { defaultResponder } from "@calcom/lib/server";
  *         description: Authorization information is missing or invalid.
  */
 async function handler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  if (isAdmin) req.userId = req.body.userId || userId;
+  const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin } = req;
+  if (isSystemWideAdmin) req.userId = req.body.userId || userId;
 
-  return await handleNewBooking(req, getBookingDataSchemaForApi);
+  if (isOrganizationOwnerOrAdmin) {
+    const accessibleUsersIds = await getAccessibleUsers({
+      adminUserId: userId,
+      memberUserIds: [req.body.userId || userId],
+    });
+    const [requestedUserId] = accessibleUsersIds;
+    req.userId = requestedUserId || userId;
+  }
+
+  try {
+    return await handleNewBooking(req, getBookingDataSchemaForApi);
+  } catch (error: unknown) {
+    const knownError = error as Error;
+    if (knownError?.message === ErrorCode.NoAvailableUsersFound) {
+      throw new HttpError({ statusCode: 400, message: knownError.message });
+    }
+
+    throw error;
+  }
 }
 
 export default defaultResponder(handler);

apps/api/v1/pages/api/connected-calendars/_get.ts

@@ -97,9 +97,10 @@ import { schemaConnectedCalendarsReadPublic } from "~/lib/validations/connected-
  */
 
 async function getHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
 
-  if (!isAdmin && req.query.userId) throw new HttpError({ statusCode: 403, message: "ADMIN required" });
+  if (!isSystemWideAdmin && req.query.userId)
+    throw new HttpError({ statusCode: 403, message: "ADMIN required" });
 
   const userIds = req.query.userId ? extractUserIdsFromQuery(req) : [userId];
 

apps/api/v1/pages/api/custom-inputs/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
   // Admins can just skip this check
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Check if the current user can access the event type of this input
   const eventTypeCustomInput = await prisma.eventTypeCustomInput.findFirst({
     where: { id, eventType: { userId } },

apps/api/v1/pages/api/custom-inputs/_get.ts

@@ -29,8 +29,10 @@ import { schemaEventTypeCustomInputPublic } from "~/lib/validations/event-type-c
  *         description: No eventTypeCustomInputs were found
  */
 async function getHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
-  const args: Prisma.EventTypeCustomInputFindManyArgs = isAdmin ? {} : { where: { eventType: { userId } } };
+  const { userId, isSystemWideAdmin } = req;
+  const args: Prisma.EventTypeCustomInputFindManyArgs = isSystemWideAdmin
+    ? {}
+    : { where: { eventType: { userId } } };
   const data = await prisma.eventTypeCustomInput.findMany(args);
   return { event_type_custom_inputs: data.map((v) => schemaEventTypeCustomInputPublic.parse(v)) };
 }

apps/api/v1/pages/api/custom-inputs/_post.ts

@@ -80,10 +80,10 @@ import {
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { eventTypeId, ...body } = schemaEventTypeCustomInputBodyParams.parse(req.body);
 
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     /* We check that the user has access to the event type he's trying to add a custom input to. */
     const eventType = await prisma.eventType.findFirst({
       where: { id: eventTypeId, userId },

apps/api/v1/pages/api/destination-calendars/[id]/_auth-middleware.ts

@@ -6,9 +6,9 @@ import prisma from "@calcom/prisma";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   const userEventTypes = await prisma.eventType.findMany({
     where: { userId },
     select: { id: true },

apps/api/v1/pages/api/destination-calendars/[id]/_patch.ts

@@ -83,10 +83,10 @@ type UserCredentialType = {
 };
 
 export async function patchHandler(req: NextApiRequest) {
-  const { userId, isAdmin, query, body } = req;
+  const { userId, isSystemWideAdmin, query, body } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const parsedBody = schemaDestinationCalendarEditBodyParams.parse(body);
-  const assignedUserId = isAdmin ? parsedBody.userId || userId : userId;
+  const assignedUserId = isSystemWideAdmin ? parsedBody.userId || userId : userId;
 
   validateIntegrationInput(parsedBody);
   const destinationCalendarObject: DestinationCalendarType = await getDestinationCalendar(id, prisma);

apps/api/v1/pages/api/destination-calendars/_post.ts

@@ -61,11 +61,11 @@ import {
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin, body } = req;
+  const { userId, isSystemWideAdmin, body } = req;
   const parsedBody = schemaDestinationCalendarCreateBodyParams.parse(body);
   await checkPermissions(req, userId);
 
-  const assignedUserId = isAdmin && parsedBody.userId ? parsedBody.userId : userId;
+  const assignedUserId = isSystemWideAdmin && parsedBody.userId ? parsedBody.userId : userId;
 
   /* Check if credentialId data matches the ownership and integration passed in */
   const userCredentials = await prisma.credential.findMany({
@@ -120,19 +120,20 @@ async function postHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, userId: number) {
-  const { isAdmin } = req;
+  const { isSystemWideAdmin } = req;
   const body = schemaDestinationCalendarCreateBodyParams.parse(req.body);
 
   /* Non-admin users can only create destination calendars for themselves */
-  if (!isAdmin && body.userId)
+  if (!isSystemWideAdmin && body.userId)
     throw new HttpError({
       statusCode: 401,
       message: "ADMIN required for `userId`",
     });
   /* Admin users are required to pass in a userId */
-  if (isAdmin && !body.userId) throw new HttpError({ statusCode: 400, message: "`userId` required" });
+  if (isSystemWideAdmin && !body.userId)
+    throw new HttpError({ statusCode: 400, message: "`userId` required" });
   /* User should only be able to create for their own destination calendars*/
-  if (!isAdmin && body.eventTypeId) {
+  if (!isSystemWideAdmin && body.eventTypeId) {
     const ownsEventType = await prisma.eventType.findFirst({ where: { id: body.eventTypeId, userId } });
     if (!ownsEventType) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
   }

apps/api/v1/pages/api/docs.ts

@@ -27,6 +27,37 @@ const swaggerHandler = withSwagger({
             $ref: "#/components/schemas/Booking",
           },
         },
+        ArrayOfRecordings: {
+          type: "array",
+          items: {
+            $ref: "#/components/schemas/Recording",
+          },
+        },
+        Recording: {
+          properties: {
+            id: {
+              type: "string",
+            },
+            room_name: {
+              type: "string",
+            },
+            start_ts: {
+              type: "number",
+            },
+            status: {
+              type: "string",
+            },
+            max_participants: {
+              type: "number",
+            },
+            duration: {
+              type: "number",
+            },
+            download_link: {
+              type: "string",
+            },
+          },
+        },
         Booking: {
           properties: {
             id: {

apps/api/v1/pages/api/event-types/[id]/_delete.ts

@@ -46,9 +46,9 @@ export async function deleteHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   /** Only event type owners can delete it */
   const eventType = await prisma.eventType.findFirst({ where: { id, userId } });
   if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });

apps/api/v1/pages/api/event-types/[id]/_get.ts

@@ -87,7 +87,7 @@ async function checkPermissions<T extends BaseEventTypeCheckPermissions>(
   req: NextApiRequest,
   eventType: (T & Partial<Omit<T, keyof BaseEventTypeCheckPermissions>>) | null
 ) {
-  if (req.isAdmin) return true;
+  if (req.isSystemWideAdmin) return true;
   if (eventType?.teamId) {
     req.query.teamId = String(eventType.teamId);
     await canAccessTeamEventOrThrow(req, {

apps/api/v1/pages/api/event-types/[id]/_patch.ts

@@ -237,9 +237,9 @@ export async function patchHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: z.infer<typeof schemaEventTypeBaseBodyParams>) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   /** Only event type owners can modify it */
   const eventType = await prisma.eventType.findFirst({ where: { id, userId } });
   if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });

apps/api/v1/pages/api/event-types/_get.ts

@@ -43,10 +43,10 @@ import getCalLink from "./_utils/getCalLink";
  *         description: No event types were found
  */
 async function getHandler(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const userIds = req.query.userId ? extractUserIdsFromQuery(req) : [userId];
   const { slug } = schemaQuerySlug.parse(req.query);
-  const shouldUseUserId = !isAdmin || !slug || !!req.query.userId;
+  const shouldUseUserId = !isSystemWideAdmin || !slug || !!req.query.userId;
   // When user is admin and no query params are provided we should return all event types.
   // But currently we return only the event types of the user. Not changing this for backwards compatibility.
   const data = await prisma.eventType.findMany({
@@ -74,9 +74,9 @@ async function getHandler(req: NextApiRequest) {
   };
 }
 // TODO: Extract & reuse.
-function extractUserIdsFromQuery({ isAdmin, query }: NextApiRequest) {
+function extractUserIdsFromQuery({ isSystemWideAdmin, query }: NextApiRequest) {
   /** Guard: Only admins can query other users */
-  if (!isAdmin) {
+  if (!isSystemWideAdmin) {
     throw new HttpError({ statusCode: 401, message: "ADMIN required" });
   }
   const { userId: userIdOrUserIds } = schemaQuerySingleOrMultipleUserIds.parse(query);

apps/api/v1/pages/api/event-types/_post.ts

@@ -265,7 +265,7 @@ import ensureOnlyMembersAsHosts from "./_utils/ensureOnlyMembersAsHosts";
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin, body } = req;
+  const { userId, isSystemWideAdmin, body } = req;
 
   const {
     hosts = [],
@@ -278,8 +278,8 @@ async function postHandler(req: NextApiRequest) {
 
   let data: Prisma.EventTypeCreateArgs["data"] = {
     ...parsedBody,
-    userId,
-    users: { connect: { id: userId } },
+    userId: !!parsedBody.teamId ? null : userId,
+    users: !!parsedBody.teamId ? undefined : { connect: { id: userId } },
     bookingLimits: bookingLimits === null ? Prisma.DbNull : bookingLimits,
     durationLimits: durationLimits === null ? Prisma.DbNull : durationLimits,
   };
@@ -291,7 +291,7 @@ async function postHandler(req: NextApiRequest) {
     await checkUserMembership(req);
   }
 
-  if (isAdmin && parsedBody.userId) {
+  if (isSystemWideAdmin && parsedBody.userId && !parsedBody.teamId) {
     data = { ...parsedBody, users: { connect: { id: parsedBody.userId } } };
   }
 
@@ -311,18 +311,18 @@ async function postHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest) {
-  const { isAdmin } = req;
+  const { isSystemWideAdmin } = req;
   const body = schemaEventTypeCreateBodyParams.parse(req.body);
   /* Non-admin users can only create event types for themselves */
-  if (!isAdmin && body.userId)
+  if (!isSystemWideAdmin && body.userId)
     throw new HttpError({
       statusCode: 401,
       message: "ADMIN required for `userId`",
     });
   if (
     body.teamId &&
-    !isAdmin &&
-    !(await canUserAccessTeamWithRole(req.userId, isAdmin, body.teamId, {
+    !isSystemWideAdmin &&
+    !(await canUserAccessTeamWithRole(req.userId, isSystemWideAdmin, body.teamId, {
       in: [MembershipRole.OWNER, MembershipRole.ADMIN],
     }))
   )
@@ -331,7 +331,7 @@ async function checkPermissions(req: NextApiRequest) {
       message: "ADMIN required for `teamId`",
     });
   /* Admin users are required to pass in a userId or teamId */
-  if (isAdmin && !body.userId && !body.teamId)
+  if (isSystemWideAdmin && !body.userId && !body.teamId)
     throw new HttpError({ statusCode: 400, message: "`userId` or `teamId` required" });
 }
 

apps/api/v1/pages/api/event-types/_utils/checkTeamEventEditPermission.ts

@@ -10,9 +10,9 @@ export default async function checkTeamEventEditPermission(
   req: NextApiRequest,
   body: Pick<z.infer<typeof schemaEventTypeCreateBodyParams>, "teamId" | "userId">
 ) {
-  const { isAdmin } = req;
+  const { isSystemWideAdmin } = req;
   let userId = req.userId;
-  if (isAdmin && body.userId) {
+  if (isSystemWideAdmin && body.userId) {
     userId = body.userId;
   }
   if (body.teamId) {

apps/api/v1/pages/api/invites/_post.ts

@@ -43,7 +43,6 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
       language: data.language,
       teamId: data.teamId,
       usernameOrEmail: data.usernameOrEmail,
-      isOrg: data.isOrg,
     });
 
     return { success: true, message: `${data.usernameOrEmail} has been invited.` };
@@ -58,10 +57,10 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: TInviteMemberInputSchema) {
-  const { userId, isAdmin } = req;
-  if (isAdmin) return;
+  const { userId, isSystemWideAdmin } = req;
+  if (isSystemWideAdmin) return;
   // To prevent auto-accepted invites, limit it to ADMIN users
-  if (!isAdmin && "accepted" in body)
+  if (!isSystemWideAdmin && "accepted" in body)
     throw new HttpError({ statusCode: 403, message: "ADMIN needed for `accepted`" });
   // Only team OWNERS and ADMINS can add other members
   const membership = await prisma.membership.findFirst({

apps/api/v1/pages/api/me/_get.ts

@@ -7,7 +7,12 @@ import { schemaUserReadPublic } from "~/lib/validations/user";
 
 async function handler({ userId }: NextApiRequest) {
   const data = await prisma.user.findUniqueOrThrow({ where: { id: userId } });
-  return { user: schemaUserReadPublic.parse(data) };
+  return {
+    user: schemaUserReadPublic.parse({
+      ...data,
+      avatar: data.avatarUrl,
+    }),
+  };
 }
 
 export default defaultResponder(handler);

apps/api/v1/pages/api/memberships/[id]/_auth-middleware.ts

@@ -6,10 +6,10 @@ import prisma from "@calcom/prisma";
 import { membershipIdSchema } from "~/lib/validations/membership";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin } = req;
+  const { userId, isSystemWideAdmin } = req;
   const { teamId } = membershipIdSchema.parse(req.query);
   // Admins can just skip this check
-  if (isAdmin) return;
+  if (isSystemWideAdmin) return;
   // Only team members can modify a membership
   const membership = await prisma.membership.findFirst({ where: { userId, teamId } });
   if (!membership) throw new HttpError({ statusCode: 403, message: "Forbidden" });

apps/api/v1/pages/api/memberships/[id]/_delete.ts

@@ -43,10 +43,10 @@ export async function deleteHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest) {
-  const { isAdmin, userId, query } = req;
+  const { isSystemWideAdmin, userId, query } = req;
   const userId_teamId = membershipIdSchema.parse(query);
   // Admin User can do anything including deletion of Admin Team Member in any team
-  if (isAdmin) {
+  if (isSystemWideAdmin) {
     return;
   }