chore: release v4.9.12

* remove getServerSideProps

* refactor teams route

.env.appStore.example

@@ -5,6 +5,7 @@
 #   - DAILY.CO VIDEO
 #   - GOOGLE CALENDAR/MEET/LOGIN
 #   - HUBSPOT
+#   - HUDDLE01
 #   - OFFICE 365
 #   - SLACK
 #   - STRIPE
@@ -137,3 +138,7 @@ REVERT_PUBLIC_TOKEN=
 # NOTE: If you're self hosting Revert, update this URL to point to your own instance.
 REVERT_API_URL=https://api.revert.dev/
 # *********************************************************************************************************
+
+#   - Huddle01
+# Used for the huddle01 integration
+HUDDLE01_API_TOKEN=

.env.example

@@ -16,7 +16,7 @@
 # - Acquire a commercial license to remove these terms by visiting: cal.com/sales
 #
 
-# To enable enterprise-only features please add your envrionment variable to the .env file then make your way to /auth/setup to select your license and follow instructions. 
+# To enable enterprise-only features please add your environment variable to the .env file then make your way to /auth/setup to select your license and follow instructions.
 CALCOM_LICENSE_KEY=
 # Signature token for the Cal.com License API (used for self-hosted integrations)
 # We will give you a token when we provide you with a license key this ensure you and only you can communicate with the Cal.com License API for your license key
@@ -102,6 +102,20 @@ NEXT_PUBLIC_INTERCOM_APP_ID=
 # Secret to enable Intercom Identity Verification
 INTERCOM_SECRET=
 
+# Posthog Config
+NEXT_PUBLIC_POSTHOG_KEY=
+
+NEXT_PUBLIC_POSTHOG_HOST=
+
+# plain.com config
+
+PLAIN_API_KEY=
+PLAIN_API_URL=https://api.plain.com/v1
+PLAIN_HMAC_SECRET_KEY=
+NEXT_PUBLIC_PLAIN_CHAT_ID=
+PLAIN_CHAT_HMAC_SECRET_KEY=
+NEXT_PUBLIC_PLAIN_CHAT_EXCLUDED_PATHS=
+
 # Zendesk Config
 NEXT_PUBLIC_ZENDESK_KEY=
 
@@ -114,7 +128,7 @@ NEXT_PUBLIC_FRESHCHAT_HOST=
 
 # Google OAuth credentials
 # To enable Login with Google you need to:
-# 1. Set `GOOGLE_API_CREDENTIALS` above
+# 1. Set `GOOGLE_API_CREDENTIALS` below
 # 2. Set `GOOGLE_LOGIN_ENABLED` to `true`
 # When self-hosting please ensure you configure the Google integration as an Internal app so no one else can login to your instance
 # @see https://support.google.com/cloud/answer/6158849#public-and-internal&zippy=%2Cpublic-and-internal-applications
@@ -124,11 +138,15 @@ GOOGLE_LOGIN_ENABLED=false
 # Needed to enable Google Calendar integration and Login with Google
 # @see https://github.com/calcom/cal.com#obtaining-the-google-api-credentials
 GOOGLE_API_CREDENTIALS=
+# Token to verify incoming webhooks from Google Calendar
+GOOGLE_WEBHOOK_TOKEN=
+# Optional URL to override for tunelling webhooks. Defaults to NEXT_PUBLIC_WEBAPP_URL.
+GOOGLE_WEBHOOK_URL=
 
 # Inbox to send user feedback
 SEND_FEEDBACK_EMAIL=
 
-# Sengrid
+# Sendgrid
 # Used for email reminders in workflows and internal sync services
 SENDGRID_API_KEY=
 SENDGRID_EMAIL=
@@ -137,6 +155,11 @@ NEXT_PUBLIC_SENDGRID_SENDER_NAME=
 # Sentry
 # Used for capturing exceptions and logging messages
 NEXT_PUBLIC_SENTRY_DSN=
+SENTRY_DEBUG=
+SENTRY_DISABLE_CLIENT_SOURCE_MAPS=
+SENTRY_DISABLE_SERVER_SOURCE_MAPS=
+SENTRY_MAX_SPANS=
+SENTRY_TRACES_SAMPLE_RATE=
 
 # Formbricks Experience Management Integration
 NEXT_PUBLIC_FORMBRICKS_HOST_URL=https://app.formbricks.com
@@ -168,13 +191,13 @@ NEXT_PUBLIC_STRIPE_PREMIUM_PLAN_PRICE=
 NEXT_PUBLIC_IS_PREMIUM_NEW_PLAN=0
 NEXT_PUBLIC_STRIPE_PREMIUM_NEW_PLAN_PRICE=
 STRIPE_TEAM_MONTHLY_PRICE_ID=
+STRIPE_TEAM_PRODUCT_ID=
 STRIPE_ORG_MONTHLY_PRICE_ID=
 STRIPE_WEBHOOK_SECRET=
 STRIPE_WEBHOOK_SECRET_APPS=
 STRIPE_PRIVATE_KEY=
 STRIPE_CLIENT_ID=
 
-
 # Use for internal Public API Keys and optional
 API_KEY_PREFIX=cal_
 # ***********************************************************************************************************
@@ -219,13 +242,15 @@ E2E_TEST_MAILHOG_ENABLED=
 
 # Cloudflare Turnstile
 NEXT_PUBLIC_CLOUDFLARE_SITEKEY=
+NEXT_PUBLIC_CLOUDFLARE_USE_TURNSTILE_IN_BOOKER=
 CLOUDFLARE_TURNSTILE_SECRET=
 
 # Set the following value to true if you wish to enable Team Impersonation
 NEXT_PUBLIC_TEAM_IMPERSONATION=false
 
 # Close.com internal CRM
-CLOSECOM_API_KEY=
+CLOSECOM_CLIENT_ID=
+CLOSECOM_CLIENT_SECRET=
 
 # Sendgrid internal sync service
 SENDGRID_SYNC_API_KEY=
@@ -262,7 +287,7 @@ ORGANIZATIONS_ENABLED=
 NEXT_PUBLIC_ORGANIZATIONS_MIN_SELF_SERVE_SEATS=30
 NEXT_PUBLIC_ORGANIZATIONS_SELF_SERVE_PRICE=3700 # $37.00 per seat
 
-# This variable should only be set to 1 or true if you want to autolink external provider sing-ups with
+# This variable should only be set to 1 or true if you want to autolink external provider sign-ups with
 # existing organizations based on email domain address
 ORGANIZATIONS_AUTOLINK=
 
@@ -331,42 +356,9 @@ E2E_TEST_OIDC_USER_PASSWORD=
 # provide a value between 0 and 100 to ensure the percentage of traffic
 # redirected from the legacy to the future pages
 AB_TEST_BUCKET_PROBABILITY=50
-# whether we redirect to the future/event-types from event-types or not
-APP_ROUTER_EVENT_TYPES_ENABLED=0
-APP_ROUTER_SETTINGS_DEVELOPER_ENABLED=0
-APP_ROUTER_SETTINGS_SECURITY_ENABLED=0
-APP_ROUTER_SETTINGS_ADMIN_ENABLED=0
-APP_ROUTER_SETTINGS_PLATFORM_ENABLED=0
-APP_ROUTER_SETTINGS_ORG_ENABLED=0
-APP_ROUTER_APPS_INSTALLED_CATEGORY_ENABLED=0
-APP_ROUTER_APPS_SLUG_ENABLED=0
 APP_ROUTER_APPS_SLUG_SETUP_ENABLED=0
-# whether we redirect to the future/apps/categories from /apps/categories or not
-APP_ROUTER_APPS_CATEGORIES_ENABLED=0
-# whether we redirect to the future/apps/categories/[category] from /apps/categories/[category] or not
-APP_ROUTER_APPS_CATEGORIES_CATEGORY_ENABLED=0
-APP_ROUTER_BOOKING_ENABLED=0
-APP_ROUTER_BOOKINGS_STATUS_ENABLED=0
-APP_ROUTER_WORKFLOWS_ENABLED=0
-APP_ROUTER_SETTINGS_TEAMS_ENABLED=0
-APP_ROUTER_GETTING_STARTED_STEP_ENABLED=0
 APP_ROUTER_APPS_ENABLED=0
-APP_ROUTER_VIDEO_ENABLED=0
 APP_ROUTER_TEAM_ENABLED=0
-APP_ROUTER_TEAMS_ENABLED=0
-APP_ROUTER_AVAILABILITY_ENABLED=0
-APP_ROUTER_AUTH_FORGOT_PASSWORD_ENABLED=0
-APP_ROUTER_AUTH_LOGIN_ENABLED=0
-APP_ROUTER_AUTH_LOGOUT_ENABLED=0
-APP_ROUTER_AUTH_NEW_ENABLED=0
-APP_ROUTER_AUTH_SAML_ENABLED=0
-APP_ROUTER_AUTH_ERROR_ENABLED=0
-APP_ROUTER_AUTH_PLATFORM_ENABLED=0
-APP_ROUTER_AUTH_OAUTH2_ENABLED=0
-APP_ROUTER_MORE_ENABLED=0
-APP_ROUTER_MAINTENANCE_ENABLED=0
-APP_ROUTER_UPGRADE_ENABLED=0
-APP_ROUTER_CONNECT_AND_JOIN_ENABLED=0
 
 # disable setry server source maps
 SENTRY_DISABLE_SERVER_WEBPACK_PLUGIN=1
@@ -385,6 +377,9 @@ UNKEY_ROOT_KEY=
 # https://retellai.com
 RETELL_AI_KEY=
 
+# Used for the huddle01 integration
+HUDDLE01_API_TOKEN=
+
 # Used to disallow emails as being added as guests on bookings
 BLACKLISTED_GUEST_EMAILS=
 
@@ -400,3 +395,14 @@ NEXT_PUBLIC_WEBSITE_TERMS_URL=
 # NEXT_PUBLIC_LOGGER_LEVEL=3 sets to log info, warn, error and fatal logs.
 # [0: silly & upwards, 1: trace & upwards, 2: debug & upwards, 3: info & upwards, 4: warn & upwards, 5: error & fatal, 6: fatal]
 NEXT_PUBLIC_LOGGER_LEVEL=
+
+# Used to use Replexica SDK, a tool for real-time AI-powered localization
+REPLEXICA_API_KEY=
+
+# Comma-separated list of DSyncData.directoryId to log SCIM API requests for. It can be enabled temporarily for debugging the requests being sent to SCIM server.
+DIRECTORY_IDS_TO_LOG=
+
+
+# Set this when Cal.com is used to serve only one organization's booking pages
+# Read more about it in the README.md
+NEXT_PUBLIC_SINGLE_ORG_SLUG=

.github/CODEOWNERS

@@ -0,0 +1,23 @@
+/apps/api/**/* @calcom/Platform
+/deploy/**/* @calcom/Foundation
+/infra/**/* @calcom/Foundation
+/packages/app-store/applecalendar/**/* @calcom/Foundation
+/packages/app-store/caldavcalendar/**/* @calcom/Foundation
+/packages/app-store/exchange2013calendar/**/* @calcom/Foundation
+/packages/app-store/exchange2016calendar/**/* @calcom/Foundation
+/packages/app-store/exchangecalendar/**/* @calcom/Foundation
+/packages/app-store/feishucalendar/**/* @calcom/Foundation
+/packages/app-store/googlecalendar/**/* @calcom/Foundation
+/packages/app-store/ics-feedcalendar/**/* @calcom/Foundation
+/packages/app-store/larkcalendar/**/* @calcom/Foundation
+/packages/app-store/office365calendar/**/* @calcom/Foundation
+/packages/app-store/zohocalendar/**/* @calcom/Foundation
+/packages/core/getAggregatedAvailability/index.ts @calcom/Foundation
+/packages/core/getAggregateWorkingHours.ts @calcom/Foundation
+/packages/core/getUserAvailability.ts @calcom/Foundation
+/packages/features/bookings/lib/**/* @calcom/Foundation
+/packages/lib/server/getLuckyUser.ts @calcom/Foundation
+/packages/lib/slots.ts @calcom/Foundation
+/packages/platform/**/* @calcom/Platform
+/packages/prisma/**/* @calcom/Foundation
+/packages/trpc/server/routers/viewer/slots/**/* @calcom/Foundation

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,7 +12,7 @@
 ## Mandatory Tasks (DO NOT REMOVE)
 
 - [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
-- [ ] I have added a Docs issue [here](https://github.com/calcom/docs/issues/new) if this PR makes changes that would require a [documentation change](https://docs.cal.com/docs). If N/A, write N/A here and check the checkbox.
+- [ ] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox.
 - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.
 
 ## How should this be tested?

.github/workflows/api-v1-production-build.yml

@@ -83,11 +83,12 @@ jobs:
             **/.turbo/**
             **/dist/**
           key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-      - run: |
+      - name: Log Cache Hit
+        if: steps.cache-api-v1-build.outputs.cache-hit == 'true'
+        run: echo "Cache hit for API v1 build. Skipping build."
+      - name: Run build
+        if: steps.cache-api-v1-build.outputs.cache-hit != 'true'
+        run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          if [ ${{ steps.cache-api-v1-build.outputs.cache-hit }} == 'true' ]; then
-            echo "Cache hit for API v1 build. Skipping build."
-          else
-            yarn turbo run build --filter=@calcom/api...
-          fi
+          yarn turbo run build --filter=@calcom/api...
         shell: bash

.github/workflows/api-v2-production-build.yml

@@ -49,14 +49,15 @@ jobs:
           path: |
             **/dist/**
           key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-      - run: |
+      - name: Log Cache Hit
+        if: steps.cache-api-v2-build.outputs.cache-hit == 'true'
+        run: echo "Cache hit for API v2 build. Skipping build."
+      - name: Run build
+        if: steps.cache-api-v2-build.outputs.cache-hit != 'true'
+        run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          if [ ${{ steps.cache-api-v2-build.outputs.cache-hit }} == 'true' ]; then
-            echo "Cache hit for API v2 build. Skipping build."
-          else
-            yarn workspace @calcom/api-v2 run generate-schemas
-            rm -rf apps/api/v2/node_modules
-            yarn install
-            yarn workspace @calcom/api-v2 run build
-          fi
+          yarn workspace @calcom/api-v2 run generate-schemas
+          rm -rf apps/api/v2/node_modules
+          yarn install
+          yarn workspace @calcom/api-v2 run build
         shell: bash

.github/workflows/atoms-production-build.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   build:
-    name: Build atoms
+    name: Build Atoms
     permissions:
       contents: read
     runs-on: buildjet-4vcpu-ubuntu-2204
@@ -28,13 +28,14 @@ jobs:
           path: |
             **/dist/**
           key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-      - run: |
+      - name: Log Cache Hit
+        if: steps.cache-atoms-build.outputs.cache-hit == 'true'
+        run: echo "Cache hit for Atoms build. Skipping build."
+      - name: Run build
+        if: steps.cache-atoms-build.outputs.cache-hit != 'true'
+        run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          if [ ${{ steps.cache-atoms-build.outputs.cache-hit }} == 'true' ]; then
-            echo "Cache hit for atoms build. Skipping build."
-          else
-            rm -rf packages/platform/atoms/node_modules
-            yarn install
-            yarn workspace @calcom/atoms run build
-          fi
+          rm -rf packages/platform/atoms/node_modules
+          yarn install
+          yarn workspace @calcom/atoms run build
         shell: bash

.github/workflows/check-if-ui-has-changed.yml

@@ -1,39 +0,0 @@
-# .github/workflows/chromatic.yml
-
-# Workflow name
-name: "Chromatic"
-
-# Event for the workflow
-on:
-  pull_request_target: # So we can test on forks
-    branches:
-      - main
-    paths:
-      - apps/storybook/**
-      - packages/ui/**
-  workflow_dispatch:
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-# List of jobs
-jobs:
-  chromatic-deployment:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }} # So we can test on forks
-          fetch-depth: 0
-      - name: Install dependencies
-        run: yarn
-        # 👇 Adds Chromatic as a step in the workflow
-      - name: Publish to Chromatic
-        uses: chromaui/action@v1
-        # Options required to the GitHub Chromatic Action
-        with:
-          # 👇 Chromatic projectToken, refer to the manage page to obtain it.
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
-          workingDir: "apps/storybook"
-          buildScriptName: "build"

.github/workflows/cron-webhooks-triggers.yml

@@ -4,8 +4,8 @@ on:
   # "Scheduled workflows run on the latest commit on the default or base branch."
   # — https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#schedule
   schedule:
-    # Runs “every 5 minutes” (see https://crontab.guru)
-    - cron: "*/5 * * * *"
+    # Runs “every minute” (see https://crontab.guru)
+    - cron: "* * * * *"
 jobs:
   cron-webhookTriggers:
     env:

.github/workflows/docs-build.yml

@@ -0,0 +1,42 @@
+# This is just to test this file
+name: Build
+
+on:
+  workflow_call:
+
+jobs:
+  build:
+    name: Build Docs
+    permissions:
+      contents: read
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - name: Cache Docs build
+        uses: buildjet/cache@v4
+        id: cache-docs-build
+        env:
+          cache-name: docs-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('docs/**.*', '!**/node_modules') }}
+          key-3: ${{ github.event.pull_request.number || github.ref }}
+          key-4: ${{ github.sha }}
+        with:
+          path: |
+            **/docs/**
+          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+            # Log cache hit
+      - name: Log Cache Hit
+        if: steps.cache-docs-build.outputs.cache-hit == 'true'
+        run: echo "Cache hit for Docs build. Skipping build."
+      - name: Run build
+        if: steps.cache-docs-build.outputs.cache-hit != 'true'
+        working-directory: docs
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          npm install -g mintlify
+          mintlify dev &
+          sleep 5 # Let it run for 5 seconds
+          kill $!
+        shell: bash

.github/workflows/draft-release.yml

@@ -0,0 +1,50 @@
+name: Draft release
+run-name: Draft release ${{ inputs.next_version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      next_version:
+        required: true
+        type: string
+        description: 'Version name'
+
+permissions:
+  contents: write
+
+jobs:
+  draft_release:
+    runs-on: ubuntu-latest
+
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: 'main'
+          token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config --local user.email "github-actions@github.com"
+          git config --local user.name "GitHub Actions"
+
+      - uses: ./.github/actions/yarn-install
+
+      - name: Bump version
+        run: |
+          cd apps/web
+          yarn version ${{ inputs.next_version }}
+
+      - name: Commit changes
+        run: |
+          git add .
+          git commit -m "chore: release v${{ inputs.next_version }}"
+          git push
+
+      - name: Draft release
+        run: gh release create v$VERSION --generate-notes --draft
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.next_version }}

.github/workflows/e2e-api-v2.yml

@@ -17,6 +17,7 @@ env:
   NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
   NODE_OPTIONS: --max-old-space-size=29000
   REDIS_URL: "redis://localhost:6379"
+  REPLEXICA_API_KEY: ${{ secrets.CI_REPLEXICA_API_KEY }}
   STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
   STRIPE_API_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
   STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
@@ -65,7 +66,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
-      - uses: ./.github/actions/yarn-playwright-install
       - uses: ./.github/actions/cache-db
       - name: Run Tests
         working-directory: apps/api/v2

.github/workflows/i18n.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
-      - uses: replexica/replexica@main
+      - uses: lingodotdev/lingo.dev@main
         env:
           GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
         with:

.github/workflows/lint.yml

@@ -12,16 +12,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
-      - name: Run Linting with Reports
-        run: yarn lint:report
+      - name: Run Lint
+        run: yarn lint
         continue-on-error: true
-
-      - name: Merge lint reports
-        run: jq -s '[.[]]|flatten' lint-results/*.json &> lint-results/eslint_report.json
-
-      - name: Upload ESLint report
-        if: ${{ always() }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: lint-results
-          path: lint-results

.github/workflows/nextjs-bundle-analysis.yml

@@ -17,7 +17,6 @@ env:
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
   DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
-  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
@@ -51,7 +50,8 @@ env:
 jobs:
   analyze:
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
@@ -60,6 +60,7 @@ jobs:
       - name: Analyze bundle
         run: |
           cd apps/web
+          export NODE_OPTIONS="--max_old_space_size=8192"
           npx -p nextjs-bundle-analysis@0.5.0 report
 
       - name: Upload bundle

.github/workflows/on-changes-requested.yml

@@ -0,0 +1,21 @@
+name: Changes Requested
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  changes-requested:
+    if: github.event.review.state == 'changes_requested'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Explanation
+        run: echo "This workflow triggers a workflow_run; it's necessary because otherwise the repo secrets aren't available for 'pull_request_review' events from externally forked pull requests"
+      - name: Save PR number to context.json
+        run: |
+            printf '{
+              "pr_number": ${{ github.event.pull_request.number }}
+            }' >> context.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: context.json
+          path: ./

.github/workflows/post-release.yml

@@ -0,0 +1,25 @@
+name: Post release
+on:
+  workflow_dispatch:
+  push:
+    # Pattern matched against refs/tags
+    tags:
+      - "*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: 'main'
+          token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config --local user.email "github-actions@github.com"
+          git config --local user.name "GitHub Actions"
+
+      - run: git push origin +main:production

.github/workflows/pr.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           filters: |
             has-files-requiring-all-checks:
-              - "!(**.md|.github/CODEOWNERS)"
+              - "!(**.md|.github/CODEOWNERS|docs/**|help/**|apps/web/public/static/locales/**/common.json)"
       - name: Get Latest Commit SHA
         id: get_sha
         run: |
@@ -139,6 +139,13 @@ jobs:
     uses: ./.github/workflows/atoms-production-build.yml
     secrets: inherit
 
+  build-docs:
+    name: Production builds
+    needs: [changes, check-label, deps]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/docs-build.yml
+    secrets: inherit
+
   build:
     name: Production builds
     needs: [changes, check-label, deps]
@@ -225,6 +232,7 @@ jobs:
         build-api-v1,
         build-api-v2,
         build-atoms,
+        build-docs,
         e2e,
         e2e-api-v2,
         e2e-embed,

.github/workflows/production-build-without-database.yml

@@ -39,7 +39,7 @@ env:
 
 jobs:
   build:
-    name: Web App
+    name: Build Web App
     runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 30
     steps:

.github/workflows/re-draft.yml

@@ -0,0 +1,104 @@
+name: Re-draft
+on:
+  workflow_run:
+    workflows:
+      - Changes Requested
+    types:
+      - completed
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  download-context:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Download artifact'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               run_id: context.payload.workflow_run.id,
+            });
+            
+            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
+              return artifact.name == "context.json"
+            })[0];
+            
+            let download = await github.rest.actions.downloadArtifact({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               artifact_id: matchArtifact.id,
+               archive_format: 'zip',
+            });
+            
+            let fs = require('fs');
+            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/context.zip`, Buffer.from(download.data));
+            
+      - name: 'Unzip artifact'
+        run: unzip context.zip
+
+      - name: 'Return Parsed JSON'
+        uses: actions/github-script@v7
+        id: return-parsed-json
+        with:
+          script: |
+            let fs = require('fs');
+            let data = fs.readFileSync('./context.json');
+            return JSON.parse(data);
+
+    outputs:
+      pr_number: ${{fromJSON(steps.return-parsed-json.outputs.result).pr_number}}
+
+  re-draft:
+    needs:
+      - download-context
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      statuses: write
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "This PR was rejected"
+      - name: Convert PR to draft when changes are requested
+        uses: actions/github-script@v7
+        with:
+          script: |
+            async function getPullRequestId() {
+              const pull_number = ${{ needs.download-context.outputs.pr_number }}; 
+              const pullRequest = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number,
+              });
+              if (!pullRequest.data.node_id) throw new Error(`pullRequestId no found for '${pull_number}'`);
+              return pullRequest.data.node_id;
+            }
+            const query = `
+              mutation($id: ID!) {
+                convertPullRequestToDraft(input: { pullRequestId: $id }) {
+                  pullRequest {
+                    id
+                    number
+                    isDraft
+                  }
+                }
+              }
+            `;
+            const pullRequestId = await getPullRequestId();
+            const variables = {
+              id: pullRequestId,
+            }
+            const response = await github.graphql(query, variables)
+            if (!response.convertPullRequestToDraft) {
+              throw new Error("Failed to convert pull request to draft");
+            }
+            console.info("Pull request successfully converted to draft.");
+            console.info(`Draft conversion response: ${JSON.stringify(response, null, 2)}`);

.github/workflows/release-docker.yaml

@@ -4,6 +4,7 @@ on: # yamllint disable-line rule:truthy
   release:
     types:
       - created
+      - published
   # in case manual trigger is needed
   workflow_dispatch:
     inputs:

.github/workflows/release.yml

@@ -1,17 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    # Pattern matched against refs/tags
-    tags:
-      - "*" # Push events to every tag not containing /
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: main # Always checkout main even for tagged releases
-          fetch-depth: 0
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
-      - run: git push origin +main:production

.github/workflows/unit-tests.yml

@@ -1,6 +1,8 @@
 name: Unit
 on:
   workflow_call:
+env:
+  REPLEXICA_API_KEY: ${{ secrets.CI_REPLEXICA_API_KEY }}
 permissions:
   contents: read
 jobs:

.yarn/patches/libphonenumber-js+1.11.18.patch

@@ -1,5 +1,5 @@
 diff --git a/index.cjs b/index.cjs
-index c83f700ae9998cd87b4c2d66ecbb2ad3d7b4603c..76a2200b57f0b9243e2c61464d578b67746ad5a4 100644
+index c83f700..da6fc7e 100644
 --- a/index.cjs
 +++ b/index.cjs
 @@ -13,8 +13,8 @@ function withMetadataArgument(func, _arguments) {
@@ -12,4 +12,4 @@ index c83f700ae9998cd87b4c2d66ecbb2ad3d7b4603c..76a2200b57f0b9243e2c61464d578b67
 +// exports['default'] = min.parsePhoneNumberFromString
  
  // `parsePhoneNumberFromString()` named export is now considered legacy:
- // it has been promoted to a default export due to being too verbose.
+ // it has been promoted to a default export due to being too verbose.

.yarn/versions/0f63a127.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/14a3a33b.yml

@@ -0,0 +1,6 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"

.yarn/versions/1b1ef70b.yml

@@ -0,0 +1,6 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"

.yarn/versions/2e3d771e.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/306bf815.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/354f3ba3.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/3c2036fd.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/4a56dcaa.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/52e3b28d.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/727b22e1.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/74098419.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/81bea150.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/86355425.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/8864696c.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/8e04affb.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/8f86d7b6.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/94d54193.yml

@@ -0,0 +1,7 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/a1fc426b.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/a33020ce.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/aa332bc0.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/ab66eddc.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/aecb4352.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/b7d8df6e.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/be9e9950.yml

@@ -0,0 +1,7 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/c041b45d.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/c2e72c83.yml

@@ -0,0 +1,7 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/c8975f9d.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/c92a78d0.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/cceb2606.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/d05ae1e0.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/e376493f.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/ecf390c8.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/ef07ed23.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarnrc.yml

@@ -5,5 +5,7 @@ plugins:
     spec: "@yarnpkg/plugin-interactive-tools"
   - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
     spec: "@yarnpkg/plugin-workspace-tools"
+  - path: .yarn/plugins/@yarnpkg/plugin-version.cjs
+    spec: "@yarnpkg/plugin-version"
 
 yarnPath: .yarn/releases/yarn-3.4.1.cjs

CONTRIBUTING.md

@@ -108,10 +108,10 @@ To develop locally:
    nvm use
    ```
 
-   You first might need to install the specific version and then use it:
+   You first might need to install the specific version:
 
    ```sh
-   nvm install && nvm use
+   nvm install
    ```
 
    You can install nvm from [here](https://github.com/nvm-sh/nvm).

README.md

@@ -485,6 +485,15 @@ Don't code but still want to contribute? Join our [Discussions](https://github.c
 
 - Set CSP_POLICY="non-strict" env variable, which enables [Strict CSP](https://web.dev/strict-csp/) except for unsafe-inline in style-src . If you have some custom changes in your instance, you might have to make some code change to make your instance CSP compatible. Right now it enables strict CSP only on login page and on other SSR pages it is enabled in Report only mode to detect possible issues. On, SSG pages it is still not supported.
 
+## Single Org Mode
+If you want to have booker.yourcompany.com to be the domain used for both dashboard(e.g. https://booker.yourcompany.com/event-types) and booking pages(e.g. https://booker.yourcompany.com/john.joe/15min).
+- Set the `NEXT_PUBLIC_SINGLE_ORG_SLUG` environment variable to the slug of the organization you want to use. `NEXT_PUBLIC_SINGLE_ORG_SLUG=booker`
+- Set the `NEXT_PUBLIC_WEBAPP_URL` environment variable to the URL of the Cal.com self-hosted instance e.g. `NEXT_PUBLIC_WEBAPP_URL=https://booker.yourcompany.com`.
+- Set the `NEXT_PUBLIC_WEBSITE_URL` environment variable to the URL of the Cal.com self-hosted instance e.g. `NEXT_PUBLIC_WEBSITE_URL=https://booker.yourcompany.com`.
+- Set the `NEXTAUTH_URL` environment variable to the URL of the Cal.com self-hosted instance e.g. `NEXTAUTH_URL=https://booker.yourcompany.com`.
+
+Note: It causes root to serve the dashboard and not the organization profile page which shows all bookable users in the organization.
+
 ## Integrations
 
 ### Obtaining the Google API Credentials

__checks__/organization.spec.ts

@@ -11,15 +11,15 @@ test.describe("Org", () => {
       await expectPageToBeRenderedWithEmbedSsr(page);
     });
 
-    test("Org User(Peer) Page should be embeddable", async ({ page }) => {
-      const response = await page.goto("https://i.cal.com/peer/embed");
+    test("Org User(Rick) Page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/team-rick/embed");
       expect(response?.status()).toBe(200);
-      await expect(page.locator("text=Peer Richelsen")).toBeVisible();
+      await expect(page.locator("text=Used by Checkly")).toBeVisible();
       await expectPageToBeRenderedWithEmbedSsr(page);
     });
 
-    test("Org User Event(peer/meet) Page should be embeddable", async ({ page }) => {
-      const response = await page.goto("https://i.cal.com/peer/meet/embed");
+    test("Org User Event(/team-rick/test-event) Page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/team-rick/test-event/embed");
       expect(response?.status()).toBe(200);
       await expect(page.locator('[data-testid="decrementMonth"]')).toBeVisible();
       await expect(page.locator('[data-testid="incrementMonth"]')).toBeVisible();
@@ -58,10 +58,10 @@ test.describe("Org", () => {
       expect(response?.status()).toBe(200);
       expect(await page.locator('[data-testid="event-title"]').textContent()).toBe("Group Meeting");
 
-      expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(users[0].name);
-      expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(users[1].name);
-      // 2 users and 1 for the organization(2+1)
-      expect((await page.locator('[data-testid="event-meta"] [data-testid="avatar"]').all()).length).toBe(3);
+      expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(
+        "Join us for a meeting with multiple people"
+      );
+      expect((await page.locator('[data-testid="event-meta"] [data-testid="avatar"]').all()).length).toBe(2);
     });
   });
 
@@ -75,7 +75,9 @@ test.describe("Org", () => {
 
   test.describe("Browse the Engineering Team", async () => {
     test("By User Navigation", async ({ page }) => {
-      await page.goto("https://i.cal.com");
+      const response = await page.goto("https://i.cal.com");
+      await page.waitForLoadState("networkidle");
+      expect(response?.status()).toBe(200);
       await page.click('text="Engineering"');
       await expect(page.locator("text=Cal.com Engineering")).toBeVisible();
     });

apps/api/v1/lib/helpers/rateLimitApiKey.test.ts

@@ -1,24 +1,34 @@
+import type { RatelimitResponse } from "@unkey/ratelimit";
 import type { Request, Response } from "express";
 import type { NextApiResponse, NextApiRequest } from "next";
 import { createMocks } from "node-mocks-http";
 import { describe, it, expect, vi } from "vitest";
 
+import { handleAutoLock } from "@calcom/lib/autoLock";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
+import { HttpError } from "@calcom/lib/http-error";
 
 import { rateLimitApiKey } from "~/lib/helpers/rateLimitApiKey";
 
 type CustomNextApiRequest = NextApiRequest & Request;
 type CustomNextApiResponse = NextApiResponse & Response;
 
+const testUserId = 123;
+
 vi.mock("@calcom/lib/checkRateLimitAndThrowError", () => ({
   checkRateLimitAndThrowError: vi.fn(),
 }));
 
+vi.mock("@calcom/lib/autoLock", () => ({
+  handleAutoLock: vi.fn(),
+}));
+
 describe("rateLimitApiKey middleware", () => {
   it("should return 401 if no apiKey is provided", async () => {
     const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
       method: "GET",
       query: {},
+      userId: testUserId,
     });
 
     await rateLimitApiKey(req, res, vi.fn() as any);
@@ -31,6 +41,7 @@ describe("rateLimitApiKey middleware", () => {
     const { req, res } = createMocks({
       method: "GET",
       query: { apiKey: "test-key" },
+      userId: testUserId,
     });
 
     (checkRateLimitAndThrowError as any).mockResolvedValueOnce({
@@ -43,7 +54,7 @@ describe("rateLimitApiKey middleware", () => {
     await rateLimitApiKey(req, res, vi.fn() as any);
 
     expect(checkRateLimitAndThrowError).toHaveBeenCalledWith({
-      identifier: "test-key",
+      identifier: testUserId.toString(),
       rateLimitingType: "api",
       onRateLimiterResponse: expect.any(Function),
     });
@@ -53,17 +64,23 @@ describe("rateLimitApiKey middleware", () => {
     const { req, res } = createMocks({
       method: "GET",
       query: { apiKey: "test-key" },
+      userId: testUserId,
     });
 
-    const rateLimiterResponse = {
+    const rateLimiterResponse: RatelimitResponse = {
       limit: 100,
       remaining: 99,
       reset: Date.now(),
+      success: true,
     };
 
-    (checkRateLimitAndThrowError as any).mockImplementationOnce(({ onRateLimiterResponse }) => {
-      onRateLimiterResponse(rateLimiterResponse);
-    });
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
 
     // @ts-expect-error weird typing between middleware and createMocks
     await rateLimitApiKey(req, res, vi.fn() as any);
@@ -77,6 +94,7 @@ describe("rateLimitApiKey middleware", () => {
     const { req, res } = createMocks({
       method: "GET",
       query: { apiKey: "test-key" },
+      userId: testUserId,
     });
 
     (checkRateLimitAndThrowError as any).mockRejectedValue(new Error("Rate limit exceeded"));
@@ -87,4 +105,139 @@ describe("rateLimitApiKey middleware", () => {
     expect(res._getStatusCode()).toBe(429);
     expect(res._getJSONData()).toEqual({ message: "Rate limit exceeded" });
   });
+
+  it("should lock API key when rate limit is repeatedly exceeded", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    const rateLimiterResponse: RatelimitResponse = {
+      success: false,
+      remaining: 0,
+      limit: 100,
+      reset: Date.now(),
+    };
+
+    // Mock rate limiter to trigger the onRateLimiterResponse callback
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
+
+    // Mock handleAutoLock to indicate the key was locked
+    vi.mocked(handleAutoLock).mockResolvedValueOnce(true);
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(handleAutoLock).toHaveBeenCalledWith({
+      identifier: testUserId.toString(),
+      identifierType: "userId",
+      rateLimitResponse: rateLimiterResponse,
+    });
+
+    expect(res._getStatusCode()).toBe(429);
+    expect(res._getJSONData()).toEqual({ message: "Too many requests" });
+  });
+
+  it("should handle API key not found error during auto-lock", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    const rateLimiterResponse: RatelimitResponse = {
+      success: false,
+      remaining: 0,
+      limit: 100,
+      reset: Date.now(),
+    };
+
+    // Mock rate limiter to trigger the onRateLimiterResponse callback
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
+
+    // Mock handleAutoLock to throw a "No user found" error
+    vi.mocked(handleAutoLock).mockRejectedValueOnce(new Error("No user found for this API key."));
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(handleAutoLock).toHaveBeenCalledWith({
+      identifier: testUserId.toString(),
+      identifierType: "userId",
+      rateLimitResponse: rateLimiterResponse,
+    });
+
+    expect(res._getStatusCode()).toBe(401);
+    expect(res._getJSONData()).toEqual({ message: "No user found for this API key." });
+  });
+
+  it("should continue if auto-lock returns false (not locked)", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    const rateLimiterResponse: RatelimitResponse = {
+      success: false,
+      remaining: 0,
+      limit: 100,
+      reset: Date.now(),
+    };
+
+    // Mock rate limiter to trigger the onRateLimiterResponse callback
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
+
+    // Mock handleAutoLock to indicate the key was not locked
+    vi.mocked(handleAutoLock).mockResolvedValueOnce(false);
+
+    const next = vi.fn();
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, next);
+
+    expect(handleAutoLock).toHaveBeenCalledWith({
+      identifier: testUserId.toString(),
+      identifierType: "userId",
+      rateLimitResponse: rateLimiterResponse,
+    });
+
+    // Verify headers were set but request continued
+    expect(res.getHeader("X-RateLimit-Limit")).toBe(rateLimiterResponse.limit);
+    expect(next).toHaveBeenCalled();
+  });
+
+  it("should handle HttpError during rate limiting", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    // Mock checkRateLimitAndThrowError to throw HttpError
+    vi.mocked(checkRateLimitAndThrowError).mockRejectedValueOnce(
+      new HttpError({
+        statusCode: 429,
+        message: "Custom rate limit error",
+      })
+    );
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res._getStatusCode()).toBe(429);
+    expect(res._getJSONData()).toEqual({ message: "Custom rate limit error" });
+  });
 });

apps/api/v1/lib/helpers/rateLimitApiKey.ts

@@ -1,23 +1,47 @@
 import type { NextMiddleware } from "next-api-middleware";
 
+import { handleAutoLock } from "@calcom/lib/autoLock";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
+import { HttpError } from "@calcom/lib/http-error";
 
 export const rateLimitApiKey: NextMiddleware = async (req, res, next) => {
+  if (!req.userId) return res.status(401).json({ message: "No userId provided" });
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
 
   // TODO: Add a way to add trusted api keys
   try {
+    const identifier = req.userId.toString();
     await checkRateLimitAndThrowError({
-      identifier: req.query.apiKey as string,
+      identifier,
       rateLimitingType: "api",
-      onRateLimiterResponse: (response) => {
+      onRateLimiterResponse: async (response) => {
         res.setHeader("X-RateLimit-Limit", response.limit);
         res.setHeader("X-RateLimit-Remaining", response.remaining);
         res.setHeader("X-RateLimit-Reset", response.reset);
+
+        try {
+          const didLock = await handleAutoLock({
+            identifier,
+            identifierType: "userId",
+            rateLimitResponse: response,
+          });
+
+          if (didLock) {
+            return res.status(429).json({ message: "Too many requests" });
+          }
+        } catch (error) {
+          if (error instanceof Error && error.message === "No user found for this API key.") {
+            return res.status(401).json({ message: error.message });
+          }
+          throw error;
+        }
       },
     });
   } catch (error) {
-    res.status(429).json({ message: "Rate limit exceeded" });
+    if (error instanceof HttpError) {
+      return res.status(error.statusCode).json({ message: error.message });
+    }
+    return res.status(429).json({ message: "Rate limit exceeded" });
   }
 
   await next();

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -6,6 +6,7 @@ import { IS_PRODUCTION } from "@calcom/lib/constants";
 import prisma from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";
+import { isLockedOrBlocked } from "../utils/isLockedOrBlocked";
 import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 
 // Used to check if the apiKey is not expired, could be extracted if reused. but not for now.
@@ -24,23 +25,35 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   if (!hasValidLicense && IS_PRODUCTION) {
     return res.status(401).json({ error: "Invalid or missing CALCOM_LICENSE_KEY environment variable" });
   }
-  // Check if the apiKey query param is provided.
+
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
-  // remove the prefix from the user provided api_key. If no env set default to "cal_"
+
   const strippedApiKey = `${req.query.apiKey}`.replace(process.env.API_KEY_PREFIX || "cal_", "");
-  // Hash the key again before matching against the database records.
   const hashedKey = hashAPIKey(strippedApiKey);
-  // Check if the hashed api key exists in database.
-  const apiKey = await prisma.apiKey.findUnique({ where: { hashedKey } });
-  // If cannot find any api key. Throw a 401 Unauthorized.
-  if (!apiKey) return res.status(401).json({ error: "Your apiKey is not valid" });
+  const apiKey = await prisma.apiKey.findUnique({
+    where: { hashedKey },
+    include: {
+      user: {
+        select: { role: true, locked: true, email: true },
+      },
+    },
+  });
+  if (!apiKey) return res.status(401).json({ error: "Your API key is not valid." });
   if (apiKey.expiresAt && dateNotInPast(apiKey.expiresAt)) {
-    return res.status(401).json({ error: "This apiKey is expired" });
+    return res.status(401).json({ error: "This API key is expired." });
   }
-  if (!apiKey.userId) return res.status(404).json({ error: "No user found for this apiKey" });
+  if (!apiKey.userId || !apiKey.user)
+    return res.status(404).json({ error: "No user found for this API key." });
+
   // save the user id in the request for later use
   req.userId = apiKey.userId;
+  req.user = apiKey.user;
+
   const { isAdmin, scope } = await isAdminGuard(req);
+  const userIsLockedOrBlocked = await isLockedOrBlocked(req);
+
+  if (userIsLockedOrBlocked)
+    return res.status(403).json({ error: "You are not authorized to perform this request." });
 
   req.isSystemWideAdmin = isAdmin && scope === ScopeOfAdmin.SystemWide;
   req.isOrganizationOwnerOrAdmin = isAdmin && scope === ScopeOfAdmin.OrgOwnerOrAdmin;

apps/api/v1/lib/utils/isAdmin.ts

@@ -6,8 +6,7 @@ import { UserPermissionRole, MembershipRole } from "@calcom/prisma/enums";
 import { ScopeOfAdmin } from "./scopeOfAdmin";
 
 export const isAdminGuard = async (req: NextApiRequest) => {
-  const { userId } = req;
-  const user = await prisma.user.findUnique({ where: { id: userId }, select: { role: true } });
+  const { user, userId } = req;
   if (!user) return { isAdmin: false, scope: null };
 
   const { role: userRole } = user;
@@ -34,7 +33,7 @@ export const isAdminGuard = async (req: NextApiRequest) => {
       },
     },
   });
-  if (!orgOwnerOrAdminMemberships.length) return { isAdmin: false, scope: null };
+  if (orgOwnerOrAdminMemberships.length > 0) return { isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin };
 
-  return { isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin };
+  return { isAdmin: false, scope: null };
 };

apps/api/v1/lib/utils/isLockedOrBlocked.ts

@@ -0,0 +1,9 @@
+import type { NextApiRequest } from "next";
+
+import { checkIfEmailIsBlockedInWatchlistController } from "@calcom/features/watchlist/operations/check-if-email-in-watchlist.controller";
+
+export async function isLockedOrBlocked(req: NextApiRequest) {
+  const user = req.user;
+  if (!user?.email) return false;
+  return user.locked || (await checkIfEmailIsBlockedInWatchlistController(user.email));
+}

apps/api/v1/lib/validations/attendee.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
 import { _AttendeeModel as Attendee } from "@calcom/prisma/zod";
 
 import { timeZone } from "~/lib/validations/shared/timeZone";
@@ -14,7 +15,7 @@ export const schemaAttendeeBaseBodyParams = Attendee.pick({
 const schemaAttendeeCreateParams = z
   .object({
     bookingId: z.number().int(),
-    email: z.string().email(),
+    email: emailSchema,
     name: z.string(),
     timeZone: timeZone,
   })
@@ -23,7 +24,7 @@ const schemaAttendeeCreateParams = z
 const schemaAttendeeEditParams = z
   .object({
     name: z.string().optional(),
-    email: z.string().email().optional(),
+    email: emailSchema.optional(),
     timeZone: timeZone.optional(),
   })
   .strict();

apps/api/v1/lib/validations/booking.ts

@@ -23,6 +23,7 @@ const schemaBookingBaseBodyParams = Booking.pick({
   status: true,
   rescheduledBy: true,
   cancelledBy: true,
+  createdAt: true,
 }).partial();
 
 export const schemaBookingCreateBodyParams = extendedBookingCreateBody.merge(schemaQueryUserId.partial());
@@ -37,6 +38,23 @@ export const schemaBookingGetParams = z.object({
 
 export type Status = z.infer<typeof schemaBookingGetParams>["status"];
 
+export const bookingCancelSchema = z.object({
+  id: z.number(),
+  allRemainingBookings: z.boolean().optional(),
+  cancelSubsequentBookings: z.boolean().optional(),
+  cancellationReason: z.string().optional().default("Not Provided"),
+  seatReferenceUid: z.string().optional(),
+  cancelledBy: z.string().email({ message: "Invalid email" }).optional(),
+  internalNote: z
+    .object({
+      id: z.number(),
+      name: z.string(),
+      cancellationReason: z.string().optional().nullable(),
+    })
+    .optional()
+    .nullable(),
+});
+
 const schemaBookingEditParams = z
   .object({
     title: z.string().optional(),
@@ -73,6 +91,7 @@ export const schemaBookingReadPublic = Booking.extend({
   attendees: z
     .array(
       _AttendeeModel.pick({
+        id: true,
         email: true,
         name: true,
         timeZone: true,
@@ -118,4 +137,5 @@ export const schemaBookingReadPublic = Booking.extend({
   fromReschedule: true,
   cancelledBy: true,
   rescheduledBy: true,
+  createdAt: true,
 });

apps/api/v1/lib/validations/event-type.ts

@@ -168,7 +168,10 @@ export const schemaEventTypeReadPublic = EventType.pick({
     metadata: jsonSchema.nullable(),
     customInputs: customInputSchema.array().optional(),
     link: z.string().optional(),
-    hashedLink: z.object({ link: z.string() }).optional().nullable(),
+    hashedLink: z
+      .array(z.object({ link: z.string() }))
+      .optional()
+      .default([]),
     bookingFields: eventTypeBookingFields.optional().nullable(),
   })
 );

apps/api/v1/lib/validations/selected-calendar.ts

@@ -9,11 +9,25 @@ export const schemaSelectedCalendarBaseBodyParams = SelectedCalendar;
 
 export const schemaSelectedCalendarPublic = SelectedCalendar.omit({});
 
-export const schemaSelectedCalendarBodyParams = schemaSelectedCalendarBaseBodyParams.partial({
-  userId: true,
-});
+export const schemaSelectedCalendarBodyParams = schemaSelectedCalendarBaseBodyParams
+  .partial({
+    userId: true,
+  })
+  .omit({
+    // id will be set by the database
+    id: true,
+    // No eventTypeId support in API v1
+    eventTypeId: true,
+  });
 
-export const schemaSelectedCalendarUpdateBodyParams = schemaSelectedCalendarBaseBodyParams.partial();
+export const schemaSelectedCalendarUpdateBodyParams = schemaSelectedCalendarBaseBodyParams
+  .omit({
+    // id is decided by DB
+    id: true,
+    // No eventTypeId support in API v1
+    eventTypeId: true,
+  })
+  .partial();
 
 export const selectedCalendarIdSchema = schemaQueryIdAsString.transform((v, ctx) => {
   /** We can assume the first part is the userId since it's an integer */

apps/api/v1/lib/validations/shared/jsonSchema.ts

@@ -1,9 +1,11 @@
 import { z } from "zod";
 
 // Helper schema for JSON fields
-type Literal = boolean | number | string;
+type Literal = boolean | number | string | null;
 type Json = Literal | { [key: string]: Json } | Json[];
-const literalSchema = z.union([z.string(), z.number(), z.boolean()]);
+const literalSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+const jsonObjectSchema = z.record(z.lazy(() => jsonSchema));
+const jsonArraySchema = z.array(z.lazy(() => jsonSchema));
 export const jsonSchema: z.ZodSchema<Json> = z.lazy(() =>
-  z.union([literalSchema, z.array(jsonSchema), z.record(jsonSchema)])
+  z.union([literalSchema, jsonObjectSchema, jsonArraySchema])
 );

apps/api/v1/lib/validations/shared/queryAttendeeEmail.ts

@@ -1,16 +1,18 @@
 import { withValidation } from "next-validations";
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
+
 import { baseApiParams } from "./baseApiParams";
 
 // Extracted out as utility function so can be reused
 // at different endpoints that require this validation.
 export const schemaQueryAttendeeEmail = baseApiParams.extend({
-  attendeeEmail: z.string().email(),
+  attendeeEmail: emailSchema,
 });
 
 export const schemaQuerySingleOrMultipleAttendeeEmails = z.object({
-  attendeeEmail: z.union([z.string().email(), z.array(z.string().email())]).optional(),
+  attendeeEmail: z.union([emailSchema, z.array(emailSchema)]).optional(),
 });
 
 export const withValidQueryAttendeeEmail = withValidation({

apps/api/v1/lib/validations/shared/queryUserEmail.ts

@@ -1,16 +1,18 @@
 import { withValidation } from "next-validations";
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
+
 import { baseApiParams } from "./baseApiParams";
 
 // Extracted out as utility function so can be reused
 // at different endpoints that require this validation.
 export const schemaQueryUserEmail = baseApiParams.extend({
-  email: z.string().email(),
+  email: emailSchema,
 });
 
 export const schemaQuerySingleOrMultipleUserEmails = z.object({
-  email: z.union([z.string().email(), z.array(z.string().email())]),
+  email: z.union([emailSchema, z.array(emailSchema)]),
 });
 
 export const withValidQueryUserEmail = withValidation({

apps/api/v1/lib/validations/team.ts

@@ -11,6 +11,7 @@ export const schemaTeamBaseBodyParams = Team.omit({ id: true, createdAt: true })
   smsLockState: true,
   smsLockReviewedByAdmin: true,
   bookingLimits: true,
+  includeManagedEventsInLimits: true,
 });
 
 const schemaTeamRequiredParams = z.object({

apps/api/v1/lib/validations/user.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
 import { checkUsername } from "@calcom/lib/server/checkUsername";
 import { _UserModel as User } from "@calcom/prisma/zod";
 import { iso8601 } from "@calcom/prisma/zod-utils";
@@ -92,7 +93,7 @@ export const schemaUserBaseBodyParams = User.pick({
 // Here we can both require or not (adding optional or nullish) and also rewrite validations for any value
 // for example making weekStart only accept weekdays as input
 const schemaUserEditParams = z.object({
-  email: z.string().email().toLowerCase(),
+  email: emailSchema.toLowerCase(),
   username: usernameSchema,
   weekStart: z.nativeEnum(weekdays).optional(),
   brandColor: z.string().min(4).max(9).regex(/^#/).optional(),
@@ -115,7 +116,7 @@ const schemaUserEditParams = z.object({
 // merging both BaseBodyParams with RequiredParams, and omiting whatever we want at the end.
 
 const schemaUserCreateParams = z.object({
-  email: z.string().email().toLowerCase(),
+  email: emailSchema.toLowerCase(),
   username: usernameSchema,
   weekStart: z.nativeEnum(weekdays).optional(),
   brandColor: z.string().min(4).max(9).regex(/^#/).optional(),

apps/api/v1/next.d.ts

@@ -8,6 +8,7 @@ export declare module "next" {
     session?: Session | null;
 
     userId: number;
+    user?: { role: string; locked: boolean; email: string } | null;
     method: string;
     // session: { user: { id: number } };
     // query: Partial<{ [key: string]: string | string[] }>;

apps/api/v1/package.json

@@ -14,7 +14,8 @@
     "lint:fix": "eslint . --ext .ts,.js,.tsx,.jsx --fix",
     "start": "PORT=3003 next start",
     "docker-start-api": "PORT=80 next start",
-    "type-check": "tsc --pretty --noEmit"
+    "type-check": "tsc --pretty --noEmit",
+    "type-check:ci": "tsc-absolute --pretty --noEmit"
   },
   "devDependencies": {
     "@calcom/tsconfig": "*",
@@ -33,7 +34,7 @@
     "@sentry/nextjs": "^8.8.0",
     "bcryptjs": "^2.4.3",
     "memory-cache": "^0.2.0",
-    "next": "^13.5.4",
+    "next": "^13.5.6",
     "next-api-middleware": "^1.0.1",
     "next-axiom": "^0.17.0",
     "next-swagger-doc": "^0.3.6",

apps/api/v1/pages/api/availability/_get.ts

@@ -199,6 +199,7 @@ async function handler(req: NextApiRequest) {
       eventTypeId,
       userId,
       returnDateOverrides: true,
+      bypassBusyCalendarTimes: false,
     });
   const team = await prisma.team.findUnique({
     where: { id: teamId },
@@ -235,6 +236,7 @@ async function handler(req: NextApiRequest) {
         dateTo,
         eventTypeId,
         returnDateOverrides: true,
+        bypassBusyCalendarTimes: false,
       }),
     };
   });

apps/api/v1/pages/api/bookings/[id]/_delete.ts

@@ -2,8 +2,8 @@ import type { NextApiRequest } from "next";
 
 import handleCancelBooking from "@calcom/features/bookings/lib/handleCancelBooking";
 import { defaultResponder } from "@calcom/lib/server";
-import { schemaBookingCancelParams } from "@calcom/prisma/zod-utils";
 
+import { bookingCancelSchema } from "~/lib/validations/booking";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 /**
@@ -65,11 +65,12 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  */
 async function handler(req: NextApiRequest) {
   const { id, allRemainingBookings, cancellationReason } = schemaQueryIdParseInt
-    .merge(schemaBookingCancelParams.pick({ allRemainingBookings: true, cancellationReason: true }))
+    .merge(bookingCancelSchema.pick({ allRemainingBookings: true, cancellationReason: true }))
     .parse({
       ...req.query,
       allRemainingBookings: req.query.allRemainingBookings === "true",
     });
+
   // Normalizing for universal handler
   req.body = { id, allRemainingBookings, cancellationReason };
   return await handleCancelBooking(req);

apps/api/v1/pages/api/bookings/_post.ts

@@ -5,6 +5,7 @@ import handleNewBooking from "@calcom/features/bookings/lib/handleNewBooking";
 import { ErrorCode } from "@calcom/lib/errorCodes";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import { CreationSource } from "@calcom/prisma/enums";
 
 import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
 
@@ -213,6 +214,10 @@ import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
  */
 async function handler(req: NextApiRequest) {
   const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin } = req;
+  req.body = {
+    ...req.body,
+    creationSource: CreationSource.API_V1,
+  };
   if (isSystemWideAdmin) req.userId = req.body.userId || userId;
 
   if (isOrganizationOwnerOrAdmin) {