fix: Lock time-zone not working properly (#19152)

* fix: flaky test organization.spec

* fix

.env.example

@@ -107,6 +107,15 @@ NEXT_PUBLIC_POSTHOG_KEY=
 
 NEXT_PUBLIC_POSTHOG_HOST=
 
+# plain.com config
+
+PLAIN_API_KEY=
+PLAIN_API_URL=https://api.plain.com/v1
+PLAIN_HMAC_SECRET_KEY=
+NEXT_PUBLIC_PLAIN_CHAT_ID=
+PLAIN_CHAT_HMAC_SECRET_KEY=
+NEXT_PUBLIC_PLAIN_CHAT_EXCLUDED_PATHS=
+
 # Zendesk Config
 NEXT_PUBLIC_ZENDESK_KEY=
 
@@ -119,7 +128,7 @@ NEXT_PUBLIC_FRESHCHAT_HOST=
 
 # Google OAuth credentials
 # To enable Login with Google you need to:
-# 1. Set `GOOGLE_API_CREDENTIALS` above
+# 1. Set `GOOGLE_API_CREDENTIALS` below
 # 2. Set `GOOGLE_LOGIN_ENABLED` to `true`
 # When self-hosting please ensure you configure the Google integration as an Internal app so no one else can login to your instance
 # @see https://support.google.com/cloud/answer/6158849#public-and-internal&zippy=%2Cpublic-and-internal-applications
@@ -129,6 +138,10 @@ GOOGLE_LOGIN_ENABLED=false
 # Needed to enable Google Calendar integration and Login with Google
 # @see https://github.com/calcom/cal.com#obtaining-the-google-api-credentials
 GOOGLE_API_CREDENTIALS=
+# Token to verify incoming webhooks from Google Calendar
+GOOGLE_WEBHOOK_TOKEN=
+# Optional URL to override for tunelling webhooks. Defaults to NEXT_PUBLIC_WEBAPP_URL.
+GOOGLE_WEBHOOK_URL=
 
 # Inbox to send user feedback
 SEND_FEEDBACK_EMAIL=
@@ -143,6 +156,8 @@ NEXT_PUBLIC_SENDGRID_SENDER_NAME=
 # Used for capturing exceptions and logging messages
 NEXT_PUBLIC_SENTRY_DSN=
 SENTRY_DEBUG=
+SENTRY_DISABLE_CLIENT_SOURCE_MAPS=
+SENTRY_DISABLE_SERVER_SOURCE_MAPS=
 SENTRY_MAX_SPANS=
 SENTRY_TRACES_SAMPLE_RATE=
 
@@ -227,13 +242,15 @@ E2E_TEST_MAILHOG_ENABLED=
 
 # Cloudflare Turnstile
 NEXT_PUBLIC_CLOUDFLARE_SITEKEY=
+NEXT_PUBLIC_CLOUDFLARE_USE_TURNSTILE_IN_BOOKER=
 CLOUDFLARE_TURNSTILE_SECRET=
 
 # Set the following value to true if you wish to enable Team Impersonation
 NEXT_PUBLIC_TEAM_IMPERSONATION=false
 
 # Close.com internal CRM
-CLOSECOM_API_KEY=
+CLOSECOM_CLIENT_ID=
+CLOSECOM_CLIENT_SECRET=
 
 # Sendgrid internal sync service
 SENDGRID_SYNC_API_KEY=
@@ -339,39 +356,9 @@ E2E_TEST_OIDC_USER_PASSWORD=
 # provide a value between 0 and 100 to ensure the percentage of traffic
 # redirected from the legacy to the future pages
 AB_TEST_BUCKET_PROBABILITY=50
-# whether we redirect to the future/event-types from event-types or not
-APP_ROUTER_EVENT_TYPES_ENABLED=0
-APP_ROUTER_SETTINGS_DEVELOPER_ENABLED=0
-APP_ROUTER_SETTINGS_ORG_ENABLED=0
-APP_ROUTER_APPS_INSTALLED_CATEGORY_ENABLED=0
-APP_ROUTER_APPS_SLUG_ENABLED=0
 APP_ROUTER_APPS_SLUG_SETUP_ENABLED=0
-# whether we redirect to the future/apps/categories from /apps/categories or not
-APP_ROUTER_APPS_CATEGORIES_ENABLED=0
-# whether we redirect to the future/apps/categories/[category] from /apps/categories/[category] or not
-APP_ROUTER_APPS_CATEGORIES_CATEGORY_ENABLED=0
-APP_ROUTER_BOOKING_ENABLED=0
-APP_ROUTER_BOOKINGS_STATUS_ENABLED=0
-APP_ROUTER_WORKFLOWS_ENABLED=0
-APP_ROUTER_SETTINGS_TEAMS_ENABLED=0
-APP_ROUTER_GETTING_STARTED_STEP_ENABLED=0
 APP_ROUTER_APPS_ENABLED=0
-APP_ROUTER_VIDEO_ENABLED=0
 APP_ROUTER_TEAM_ENABLED=0
-APP_ROUTER_TEAMS_ENABLED=0
-APP_ROUTER_AVAILABILITY_ENABLED=0
-APP_ROUTER_AUTH_FORGOT_PASSWORD_ENABLED=0
-APP_ROUTER_AUTH_LOGIN_ENABLED=0
-APP_ROUTER_AUTH_LOGOUT_ENABLED=0
-APP_ROUTER_AUTH_NEW_ENABLED=0
-APP_ROUTER_AUTH_SAML_ENABLED=0
-APP_ROUTER_AUTH_ERROR_ENABLED=0
-APP_ROUTER_AUTH_PLATFORM_ENABLED=0
-APP_ROUTER_AUTH_OAUTH2_ENABLED=0
-APP_ROUTER_MORE_ENABLED=0
-APP_ROUTER_MAINTENANCE_ENABLED=0
-APP_ROUTER_UPGRADE_ENABLED=0
-APP_ROUTER_CONNECT_AND_JOIN_ENABLED=0
 
 # disable setry server source maps
 SENTRY_DISABLE_SERVER_WEBPACK_PLUGIN=1
@@ -408,3 +395,14 @@ NEXT_PUBLIC_WEBSITE_TERMS_URL=
 # NEXT_PUBLIC_LOGGER_LEVEL=3 sets to log info, warn, error and fatal logs.
 # [0: silly & upwards, 1: trace & upwards, 2: debug & upwards, 3: info & upwards, 4: warn & upwards, 5: error & fatal, 6: fatal]
 NEXT_PUBLIC_LOGGER_LEVEL=
+
+# Used to use Replexica SDK, a tool for real-time AI-powered localization
+REPLEXICA_API_KEY=
+
+# Comma-separated list of DSyncData.directoryId to log SCIM API requests for. It can be enabled temporarily for debugging the requests being sent to SCIM server.
+DIRECTORY_IDS_TO_LOG=
+
+
+# Set this when Cal.com is used to serve only one organization's booking pages
+# Read more about it in the README.md
+NEXT_PUBLIC_SINGLE_ORG_SLUG=

.github/CODEOWNERS

@@ -0,0 +1,20 @@
+/apps/api/**/* @calcom/Platform
+/deploy/**/* @calcom/Foundation
+/infra/**/* @calcom/Foundation
+/packages/app-store/applecalendar/**/* @calcom/Foundation
+/packages/app-store/caldavcalendar/**/* @calcom/Foundation
+/packages/app-store/exchange2013calendar/**/* @calcom/Foundation
+/packages/app-store/exchange2016calendar/**/* @calcom/Foundation
+/packages/app-store/exchangecalendar/**/* @calcom/Foundation
+/packages/app-store/feishucalendar/**/* @calcom/Foundation
+/packages/app-store/googlecalendar/**/* @calcom/Foundation
+/packages/app-store/ics-feedcalendar/**/* @calcom/Foundation
+/packages/app-store/larkcalendar/**/* @calcom/Foundation
+/packages/app-store/office365calendar/**/* @calcom/Foundation
+/packages/app-store/zohocalendar/**/* @calcom/Foundation
+/packages/core/getUserAvailability.ts @calcom/Foundation
+/packages/features/bookings/lib/handleNewBooking/**/* @calcom/Foundation
+/packages/lib/slots.ts @calcom/Foundation
+/packages/platform/**/* @calcom/Platform
+/packages/prisma/**/* @calcom/Foundation
+/packages/trpc/server/routers/viewer/slots/**/* @calcom/Foundation

.github/workflows/check-if-ui-has-changed.yml

@@ -1,39 +0,0 @@
-# .github/workflows/chromatic.yml
-
-# Workflow name
-name: "Chromatic"
-
-# Event for the workflow
-on:
-  pull_request_target: # So we can test on forks
-    branches:
-      - main
-    paths:
-      - apps/storybook/**
-      - packages/ui/**
-  workflow_dispatch:
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-# List of jobs
-jobs:
-  chromatic-deployment:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }} # So we can test on forks
-          fetch-depth: 0
-      - name: Install dependencies
-        run: yarn
-        # 👇 Adds Chromatic as a step in the workflow
-      - name: Publish to Chromatic
-        uses: chromaui/action@v1
-        # Options required to the GitHub Chromatic Action
-        with:
-          # 👇 Chromatic projectToken, refer to the manage page to obtain it.
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
-          workingDir: "apps/storybook"
-          buildScriptName: "build"

.github/workflows/cron-webhooks-triggers.yml

@@ -4,8 +4,8 @@ on:
   # "Scheduled workflows run on the latest commit on the default or base branch."
   # — https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#schedule
   schedule:
-    # Runs “every 5 minutes” (see https://crontab.guru)
-    - cron: "*/5 * * * *"
+    # Runs “every minute” (see https://crontab.guru)
+    - cron: "* * * * *"
 jobs:
   cron-webhookTriggers:
     env:

.github/workflows/draft-release.yml

@@ -0,0 +1,50 @@
+name: Draft release
+run-name: Draft release ${{ inputs.next_version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      next_version:
+        required: true
+        type: string
+        description: 'Version name'
+
+permissions:
+  contents: write
+
+jobs:
+  draft_release:
+    runs-on: ubuntu-latest
+
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: 'main'
+          token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config --local user.email "github-actions@github.com"
+          git config --local user.name "GitHub Actions"
+
+      - uses: ./.github/actions/yarn-install
+
+      - name: Bump version
+        run: |
+          cd apps/web
+          yarn version ${{ inputs.next_version }}
+
+      - name: Commit changes
+        run: |
+          git add .
+          git commit -m "chore: release v${{ inputs.next_version }}"
+          git push
+
+      - name: Draft release
+        run: gh release create v$VERSION --generate-notes --draft
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.next_version }}

.github/workflows/e2e-api-v2.yml

@@ -17,6 +17,7 @@ env:
   NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
   NODE_OPTIONS: --max-old-space-size=29000
   REDIS_URL: "redis://localhost:6379"
+  REPLEXICA_API_KEY: ${{ secrets.CI_REPLEXICA_API_KEY }}
   STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
   STRIPE_API_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
   STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}

.github/workflows/i18n.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
-      - uses: replexica/replexica@main
+      - uses: lingodotdev/lingo.dev@main
         env:
           GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
         with:

.github/workflows/lint.yml

@@ -12,16 +12,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
-      - name: Run Linting with Reports
-        run: yarn lint:report
+      - name: Run Lint
+        run: yarn lint
         continue-on-error: true
-
-      - name: Merge lint reports
-        run: jq -s '[.[]]|flatten' lint-results/*.json &> lint-results/eslint_report.json
-
-      - name: Upload ESLint report
-        if: ${{ always() }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: lint-results
-          path: lint-results

.github/workflows/nextjs-bundle-analysis.yml

@@ -17,7 +17,6 @@ env:
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
   DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
-  DEPLOYSENTINEL_API_KEY: ${{ secrets.DEPLOYSENTINEL_API_KEY }}
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
@@ -51,7 +50,8 @@ env:
 jobs:
   analyze:
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
@@ -60,6 +60,7 @@ jobs:
       - name: Analyze bundle
         run: |
           cd apps/web
+          export NODE_OPTIONS="--max_old_space_size=8192"
           npx -p nextjs-bundle-analysis@0.5.0 report
 
       - name: Upload bundle

.github/workflows/on-changes-requested.yml

@@ -0,0 +1,21 @@
+name: Changes Requested
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  changes-requested:
+    if: github.event.review.state == 'changes_requested'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Explanation
+        run: echo "This workflow triggers a workflow_run; it's necessary because otherwise the repo secrets aren't available for 'pull_request_review' events from externally forked pull requests"
+      - name: Save PR number to context.json
+        run: |
+            printf '{
+              "pr_number": ${{ github.event.pull_request.number }}
+            }' >> context.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: context.json
+          path: ./

.github/workflows/post-release.yml

@@ -0,0 +1,25 @@
+name: Post release
+on:
+  workflow_dispatch:
+  push:
+    # Pattern matched against refs/tags
+    tags:
+      - "*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: 'main'
+          token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config --local user.email "github-actions@github.com"
+          git config --local user.name "GitHub Actions"
+
+      - run: git push origin +main:production

.github/workflows/pr.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           filters: |
             has-files-requiring-all-checks:
-              - "!(**.md|.github/CODEOWNERS|docs/**|apps/web/public/static/locales/**/common.json)"
+              - "!(**.md|.github/CODEOWNERS|docs/**|help/**|apps/web/public/static/locales/**/common.json)"
       - name: Get Latest Commit SHA
         id: get_sha
         run: |

.github/workflows/re-draft.yml

@@ -0,0 +1,104 @@
+name: Re-draft
+on:
+  workflow_run:
+    workflows:
+      - Changes Requested
+    types:
+      - completed
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  download-context:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Download artifact'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               run_id: context.payload.workflow_run.id,
+            });
+            
+            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
+              return artifact.name == "context.json"
+            })[0];
+            
+            let download = await github.rest.actions.downloadArtifact({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               artifact_id: matchArtifact.id,
+               archive_format: 'zip',
+            });
+            
+            let fs = require('fs');
+            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/context.zip`, Buffer.from(download.data));
+            
+      - name: 'Unzip artifact'
+        run: unzip context.zip
+
+      - name: 'Return Parsed JSON'
+        uses: actions/github-script@v7
+        id: return-parsed-json
+        with:
+          script: |
+            let fs = require('fs');
+            let data = fs.readFileSync('./context.json');
+            return JSON.parse(data);
+
+    outputs:
+      pr_number: ${{fromJSON(steps.return-parsed-json.outputs.result).pr_number}}
+
+  re-draft:
+    needs:
+      - download-context
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      statuses: write
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "This PR was rejected"
+      - name: Convert PR to draft when changes are requested
+        uses: actions/github-script@v7
+        with:
+          script: |
+            async function getPullRequestId() {
+              const pull_number = ${{ needs.download-context.outputs.pr_number }}; 
+              const pullRequest = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number,
+              });
+              if (!pullRequest.data.node_id) throw new Error(`pullRequestId no found for '${pull_number}'`);
+              return pullRequest.data.node_id;
+            }
+            const query = `
+              mutation($id: ID!) {
+                convertPullRequestToDraft(input: { pullRequestId: $id }) {
+                  pullRequest {
+                    id
+                    number
+                    isDraft
+                  }
+                }
+              }
+            `;
+            const pullRequestId = await getPullRequestId();
+            const variables = {
+              id: pullRequestId,
+            }
+            const response = await github.graphql(query, variables)
+            if (!response.convertPullRequestToDraft) {
+              throw new Error("Failed to convert pull request to draft");
+            }
+            console.info("Pull request successfully converted to draft.");
+            console.info(`Draft conversion response: ${JSON.stringify(response, null, 2)}`);

.github/workflows/release-docker.yaml

@@ -4,6 +4,7 @@ on: # yamllint disable-line rule:truthy
   release:
     types:
       - created
+      - published
   # in case manual trigger is needed
   workflow_dispatch:
     inputs:

.github/workflows/release.yml

@@ -1,17 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    # Pattern matched against refs/tags
-    tags:
-      - "*" # Push events to every tag not containing /
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: main # Always checkout main even for tagged releases
-          fetch-depth: 0
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
-      - run: git push origin +main:production

.github/workflows/unit-tests.yml

@@ -1,6 +1,8 @@
 name: Unit
 on:
   workflow_call:
+env:
+  REPLEXICA_API_KEY: ${{ secrets.CI_REPLEXICA_API_KEY }}
 permissions:
   contents: read
 jobs:

.yarn/patches/libphonenumber-js+1.11.18.patch

@@ -1,5 +1,5 @@
 diff --git a/index.cjs b/index.cjs
-index c83f700ae9998cd87b4c2d66ecbb2ad3d7b4603c..76a2200b57f0b9243e2c61464d578b67746ad5a4 100644
+index c83f700..da6fc7e 100644
 --- a/index.cjs
 +++ b/index.cjs
 @@ -13,8 +13,8 @@ function withMetadataArgument(func, _arguments) {
@@ -12,4 +12,4 @@ index c83f700ae9998cd87b4c2d66ecbb2ad3d7b4603c..76a2200b57f0b9243e2c61464d578b67
 +// exports['default'] = min.parsePhoneNumberFromString
  
  // `parsePhoneNumberFromString()` named export is now considered legacy:
- // it has been promoted to a default export due to being too verbose.
+ // it has been promoted to a default export due to being too verbose.

.yarn/versions/0f63a127.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/14a3a33b.yml

@@ -0,0 +1,6 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"

.yarn/versions/1b1ef70b.yml

@@ -0,0 +1,6 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"

.yarn/versions/2e3d771e.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/306bf815.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/354f3ba3.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/4a56dcaa.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/52e3b28d.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/727b22e1.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/74098419.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/86355425.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/8864696c.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/8e04affb.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/8f86d7b6.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/94d54193.yml

@@ -0,0 +1,7 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/a1fc426b.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/a33020ce.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/aa332bc0.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/ab66eddc.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/aecb4352.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/be9e9950.yml

@@ -0,0 +1,7 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/c041b45d.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/c2e72c83.yml

@@ -0,0 +1,7 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/c8975f9d.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/c92a78d0.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/cceb2606.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/d05ae1e0.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/e376493f.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/ecf390c8.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/ef07ed23.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarnrc.yml

@@ -5,5 +5,7 @@ plugins:
     spec: "@yarnpkg/plugin-interactive-tools"
   - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
     spec: "@yarnpkg/plugin-workspace-tools"
+  - path: .yarn/plugins/@yarnpkg/plugin-version.cjs
+    spec: "@yarnpkg/plugin-version"
 
 yarnPath: .yarn/releases/yarn-3.4.1.cjs

README.md

@@ -485,6 +485,15 @@ Don't code but still want to contribute? Join our [Discussions](https://github.c
 
 - Set CSP_POLICY="non-strict" env variable, which enables [Strict CSP](https://web.dev/strict-csp/) except for unsafe-inline in style-src . If you have some custom changes in your instance, you might have to make some code change to make your instance CSP compatible. Right now it enables strict CSP only on login page and on other SSR pages it is enabled in Report only mode to detect possible issues. On, SSG pages it is still not supported.
 
+## Single Org Mode
+If you want to have booker.yourcompany.com to be the domain used for both dashboard(e.g. https://booker.yourcompany.com/event-types) and booking pages(e.g. https://booker.yourcompany.com/john.joe/15min).
+- Set the `NEXT_PUBLIC_SINGLE_ORG_SLUG` environment variable to the slug of the organization you want to use. `NEXT_PUBLIC_SINGLE_ORG_SLUG=booker`
+- Set the `NEXT_PUBLIC_WEBAPP_URL` environment variable to the URL of the Cal.com self-hosted instance e.g. `NEXT_PUBLIC_WEBAPP_URL=https://booker.yourcompany.com`.
+- Set the `NEXT_PUBLIC_WEBSITE_URL` environment variable to the URL of the Cal.com self-hosted instance e.g. `NEXT_PUBLIC_WEBSITE_URL=https://booker.yourcompany.com`.
+- Set the `NEXTAUTH_URL` environment variable to the URL of the Cal.com self-hosted instance e.g. `NEXTAUTH_URL=https://booker.yourcompany.com`.
+
+Note: It causes root to serve the dashboard and not the organization profile page which shows all bookable users in the organization.
+
 ## Integrations
 
 ### Obtaining the Google API Credentials

__checks__/organization.spec.ts

@@ -11,15 +11,15 @@ test.describe("Org", () => {
       await expectPageToBeRenderedWithEmbedSsr(page);
     });
 
-    test("Org User(Peer) Page should be embeddable", async ({ page }) => {
-      const response = await page.goto("https://i.cal.com/peer/embed");
+    test("Org User(Rick) Page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/team-rick/embed");
       expect(response?.status()).toBe(200);
-      await expect(page.locator("text=Peer Richelsen")).toBeVisible();
+      await expect(page.locator("text=Used by Checkly")).toBeVisible();
       await expectPageToBeRenderedWithEmbedSsr(page);
     });
 
-    test("Org User Event(peer/meet) Page should be embeddable", async ({ page }) => {
-      const response = await page.goto("https://i.cal.com/peer/meet/embed");
+    test("Org User Event(/team-rick/test-event) Page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/team-rick/test-event/embed");
       expect(response?.status()).toBe(200);
       await expect(page.locator('[data-testid="decrementMonth"]')).toBeVisible();
       await expect(page.locator('[data-testid="incrementMonth"]')).toBeVisible();
@@ -58,10 +58,10 @@ test.describe("Org", () => {
       expect(response?.status()).toBe(200);
       expect(await page.locator('[data-testid="event-title"]').textContent()).toBe("Group Meeting");
 
-      expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(users[0].name);
-      expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(users[1].name);
-      // 2 users and 1 for the organization(2+1)
-      expect((await page.locator('[data-testid="event-meta"] [data-testid="avatar"]').all()).length).toBe(3);
+      expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(
+        "Join us for a meeting with multiple people"
+      );
+      expect((await page.locator('[data-testid="event-meta"] [data-testid="avatar"]').all()).length).toBe(2);
     });
   });
 
@@ -75,7 +75,9 @@ test.describe("Org", () => {
 
   test.describe("Browse the Engineering Team", async () => {
     test("By User Navigation", async ({ page }) => {
-      await page.goto("https://i.cal.com");
+      const response = await page.goto("https://i.cal.com");
+      await page.waitForLoadState("networkidle");
+      expect(response?.status()).toBe(200);
       await page.click('text="Engineering"');
       await expect(page.locator("text=Cal.com Engineering")).toBeVisible();
     });

apps/api/v1/lib/helpers/rateLimitApiKey.test.ts

@@ -1,24 +1,34 @@
+import type { RatelimitResponse } from "@unkey/ratelimit";
 import type { Request, Response } from "express";
 import type { NextApiResponse, NextApiRequest } from "next";
 import { createMocks } from "node-mocks-http";
 import { describe, it, expect, vi } from "vitest";
 
+import { handleAutoLock } from "@calcom/lib/autoLock";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
+import { HttpError } from "@calcom/lib/http-error";
 
 import { rateLimitApiKey } from "~/lib/helpers/rateLimitApiKey";
 
 type CustomNextApiRequest = NextApiRequest & Request;
 type CustomNextApiResponse = NextApiResponse & Response;
 
+const testUserId = 123;
+
 vi.mock("@calcom/lib/checkRateLimitAndThrowError", () => ({
   checkRateLimitAndThrowError: vi.fn(),
 }));
 
+vi.mock("@calcom/lib/autoLock", () => ({
+  handleAutoLock: vi.fn(),
+}));
+
 describe("rateLimitApiKey middleware", () => {
   it("should return 401 if no apiKey is provided", async () => {
     const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
       method: "GET",
       query: {},
+      userId: testUserId,
     });
 
     await rateLimitApiKey(req, res, vi.fn() as any);
@@ -31,6 +41,7 @@ describe("rateLimitApiKey middleware", () => {
     const { req, res } = createMocks({
       method: "GET",
       query: { apiKey: "test-key" },
+      userId: testUserId,
     });
 
     (checkRateLimitAndThrowError as any).mockResolvedValueOnce({
@@ -43,7 +54,7 @@ describe("rateLimitApiKey middleware", () => {
     await rateLimitApiKey(req, res, vi.fn() as any);
 
     expect(checkRateLimitAndThrowError).toHaveBeenCalledWith({
-      identifier: "test-key",
+      identifier: testUserId.toString(),
       rateLimitingType: "api",
       onRateLimiterResponse: expect.any(Function),
     });
@@ -53,17 +64,23 @@ describe("rateLimitApiKey middleware", () => {
     const { req, res } = createMocks({
       method: "GET",
       query: { apiKey: "test-key" },
+      userId: testUserId,
     });
 
-    const rateLimiterResponse = {
+    const rateLimiterResponse: RatelimitResponse = {
       limit: 100,
       remaining: 99,
       reset: Date.now(),
+      success: true,
     };
 
-    (checkRateLimitAndThrowError as any).mockImplementationOnce(({ onRateLimiterResponse }) => {
-      onRateLimiterResponse(rateLimiterResponse);
-    });
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
 
     // @ts-expect-error weird typing between middleware and createMocks
     await rateLimitApiKey(req, res, vi.fn() as any);
@@ -77,6 +94,7 @@ describe("rateLimitApiKey middleware", () => {
     const { req, res } = createMocks({
       method: "GET",
       query: { apiKey: "test-key" },
+      userId: testUserId,
     });
 
     (checkRateLimitAndThrowError as any).mockRejectedValue(new Error("Rate limit exceeded"));
@@ -87,4 +105,139 @@ describe("rateLimitApiKey middleware", () => {
     expect(res._getStatusCode()).toBe(429);
     expect(res._getJSONData()).toEqual({ message: "Rate limit exceeded" });
   });
+
+  it("should lock API key when rate limit is repeatedly exceeded", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    const rateLimiterResponse: RatelimitResponse = {
+      success: false,
+      remaining: 0,
+      limit: 100,
+      reset: Date.now(),
+    };
+
+    // Mock rate limiter to trigger the onRateLimiterResponse callback
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
+
+    // Mock handleAutoLock to indicate the key was locked
+    vi.mocked(handleAutoLock).mockResolvedValueOnce(true);
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(handleAutoLock).toHaveBeenCalledWith({
+      identifier: testUserId.toString(),
+      identifierType: "userId",
+      rateLimitResponse: rateLimiterResponse,
+    });
+
+    expect(res._getStatusCode()).toBe(429);
+    expect(res._getJSONData()).toEqual({ message: "Too many requests" });
+  });
+
+  it("should handle API key not found error during auto-lock", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    const rateLimiterResponse: RatelimitResponse = {
+      success: false,
+      remaining: 0,
+      limit: 100,
+      reset: Date.now(),
+    };
+
+    // Mock rate limiter to trigger the onRateLimiterResponse callback
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
+
+    // Mock handleAutoLock to throw a "No user found" error
+    vi.mocked(handleAutoLock).mockRejectedValueOnce(new Error("No user found for this API key."));
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(handleAutoLock).toHaveBeenCalledWith({
+      identifier: testUserId.toString(),
+      identifierType: "userId",
+      rateLimitResponse: rateLimiterResponse,
+    });
+
+    expect(res._getStatusCode()).toBe(401);
+    expect(res._getJSONData()).toEqual({ message: "No user found for this API key." });
+  });
+
+  it("should continue if auto-lock returns false (not locked)", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    const rateLimiterResponse: RatelimitResponse = {
+      success: false,
+      remaining: 0,
+      limit: 100,
+      reset: Date.now(),
+    };
+
+    // Mock rate limiter to trigger the onRateLimiterResponse callback
+    (checkRateLimitAndThrowError as any).mockImplementationOnce(
+      ({ onRateLimiterResponse }: { onRateLimiterResponse: (response: RatelimitResponse) => void }) => {
+        onRateLimiterResponse(rateLimiterResponse);
+      }
+    );
+
+    // Mock handleAutoLock to indicate the key was not locked
+    vi.mocked(handleAutoLock).mockResolvedValueOnce(false);
+
+    const next = vi.fn();
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, next);
+
+    expect(handleAutoLock).toHaveBeenCalledWith({
+      identifier: testUserId.toString(),
+      identifierType: "userId",
+      rateLimitResponse: rateLimiterResponse,
+    });
+
+    // Verify headers were set but request continued
+    expect(res.getHeader("X-RateLimit-Limit")).toBe(rateLimiterResponse.limit);
+    expect(next).toHaveBeenCalled();
+  });
+
+  it("should handle HttpError during rate limiting", async () => {
+    const { req, res } = createMocks({
+      method: "GET",
+      query: { apiKey: "test-key" },
+      userId: testUserId,
+    });
+
+    // Mock checkRateLimitAndThrowError to throw HttpError
+    vi.mocked(checkRateLimitAndThrowError).mockRejectedValueOnce(
+      new HttpError({
+        statusCode: 429,
+        message: "Custom rate limit error",
+      })
+    );
+
+    // @ts-expect-error weird typing between middleware and createMocks
+    await rateLimitApiKey(req, res, vi.fn() as any);
+
+    expect(res._getStatusCode()).toBe(429);
+    expect(res._getJSONData()).toEqual({ message: "Custom rate limit error" });
+  });
 });

apps/api/v1/lib/helpers/rateLimitApiKey.ts

@@ -1,23 +1,47 @@
 import type { NextMiddleware } from "next-api-middleware";
 
+import { handleAutoLock } from "@calcom/lib/autoLock";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
+import { HttpError } from "@calcom/lib/http-error";
 
 export const rateLimitApiKey: NextMiddleware = async (req, res, next) => {
+  if (!req.userId) return res.status(401).json({ message: "No userId provided" });
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
 
   // TODO: Add a way to add trusted api keys
   try {
+    const identifier = req.userId.toString();
     await checkRateLimitAndThrowError({
-      identifier: req.query.apiKey as string,
+      identifier,
       rateLimitingType: "api",
-      onRateLimiterResponse: (response) => {
+      onRateLimiterResponse: async (response) => {
         res.setHeader("X-RateLimit-Limit", response.limit);
         res.setHeader("X-RateLimit-Remaining", response.remaining);
         res.setHeader("X-RateLimit-Reset", response.reset);
+
+        try {
+          const didLock = await handleAutoLock({
+            identifier,
+            identifierType: "userId",
+            rateLimitResponse: response,
+          });
+
+          if (didLock) {
+            return res.status(429).json({ message: "Too many requests" });
+          }
+        } catch (error) {
+          if (error instanceof Error && error.message === "No user found for this API key.") {
+            return res.status(401).json({ message: error.message });
+          }
+          throw error;
+        }
       },
     });
   } catch (error) {
-    res.status(429).json({ message: "Rate limit exceeded" });
+    if (error instanceof HttpError) {
+      return res.status(error.statusCode).json({ message: error.message });
+    }
+    return res.status(429).json({ message: "Rate limit exceeded" });
   }
 
   await next();

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -6,6 +6,7 @@ import { IS_PRODUCTION } from "@calcom/lib/constants";
 import prisma from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";
+import { isLockedOrBlocked } from "../utils/isLockedOrBlocked";
 import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 
 // Used to check if the apiKey is not expired, could be extracted if reused. but not for now.
@@ -24,23 +25,35 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   if (!hasValidLicense && IS_PRODUCTION) {
     return res.status(401).json({ error: "Invalid or missing CALCOM_LICENSE_KEY environment variable" });
   }
-  // Check if the apiKey query param is provided.
+
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
-  // remove the prefix from the user provided api_key. If no env set default to "cal_"
+
   const strippedApiKey = `${req.query.apiKey}`.replace(process.env.API_KEY_PREFIX || "cal_", "");
-  // Hash the key again before matching against the database records.
   const hashedKey = hashAPIKey(strippedApiKey);
-  // Check if the hashed api key exists in database.
-  const apiKey = await prisma.apiKey.findUnique({ where: { hashedKey } });
-  // If cannot find any api key. Throw a 401 Unauthorized.
-  if (!apiKey) return res.status(401).json({ error: "Your apiKey is not valid" });
+  const apiKey = await prisma.apiKey.findUnique({
+    where: { hashedKey },
+    include: {
+      user: {
+        select: { role: true, locked: true, email: true },
+      },
+    },
+  });
+  if (!apiKey) return res.status(401).json({ error: "Your API key is not valid." });
   if (apiKey.expiresAt && dateNotInPast(apiKey.expiresAt)) {
-    return res.status(401).json({ error: "This apiKey is expired" });
+    return res.status(401).json({ error: "This API key is expired." });
   }
-  if (!apiKey.userId) return res.status(404).json({ error: "No user found for this apiKey" });
+  if (!apiKey.userId || !apiKey.user)
+    return res.status(404).json({ error: "No user found for this API key." });
+
   // save the user id in the request for later use
   req.userId = apiKey.userId;
+  req.user = apiKey.user;
+
   const { isAdmin, scope } = await isAdminGuard(req);
+  const userIsLockedOrBlocked = await isLockedOrBlocked(req);
+
+  if (userIsLockedOrBlocked)
+    return res.status(403).json({ error: "You are not authorized to perform this request." });
 
   req.isSystemWideAdmin = isAdmin && scope === ScopeOfAdmin.SystemWide;
   req.isOrganizationOwnerOrAdmin = isAdmin && scope === ScopeOfAdmin.OrgOwnerOrAdmin;

apps/api/v1/lib/utils/isAdmin.ts

@@ -6,8 +6,7 @@ import { UserPermissionRole, MembershipRole } from "@calcom/prisma/enums";
 import { ScopeOfAdmin } from "./scopeOfAdmin";
 
 export const isAdminGuard = async (req: NextApiRequest) => {
-  const { userId } = req;
-  const user = await prisma.user.findUnique({ where: { id: userId }, select: { role: true } });
+  const { user, userId } = req;
   if (!user) return { isAdmin: false, scope: null };
 
   const { role: userRole } = user;
@@ -34,7 +33,7 @@ export const isAdminGuard = async (req: NextApiRequest) => {
       },
     },
   });
-  if (!orgOwnerOrAdminMemberships.length) return { isAdmin: false, scope: null };
+  if (orgOwnerOrAdminMemberships.length > 0) return { isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin };
 
-  return { isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin };
+  return { isAdmin: false, scope: null };
 };

apps/api/v1/lib/utils/isLockedOrBlocked.ts

@@ -0,0 +1,9 @@
+import type { NextApiRequest } from "next";
+
+import { checkIfEmailIsBlockedInWatchlistController } from "@calcom/features/watchlist/operations/check-if-email-in-watchlist.controller";
+
+export async function isLockedOrBlocked(req: NextApiRequest) {
+  const user = req.user;
+  if (!user?.email) return false;
+  return user.locked || (await checkIfEmailIsBlockedInWatchlistController(user.email));
+}

apps/api/v1/lib/validations/booking.ts

@@ -23,6 +23,7 @@ const schemaBookingBaseBodyParams = Booking.pick({
   status: true,
   rescheduledBy: true,
   cancelledBy: true,
+  createdAt: true,
 }).partial();
 
 export const schemaBookingCreateBodyParams = extendedBookingCreateBody.merge(schemaQueryUserId.partial());
@@ -37,6 +38,23 @@ export const schemaBookingGetParams = z.object({
 
 export type Status = z.infer<typeof schemaBookingGetParams>["status"];
 
+export const bookingCancelSchema = z.object({
+  id: z.number(),
+  allRemainingBookings: z.boolean().optional(),
+  cancelSubsequentBookings: z.boolean().optional(),
+  cancellationReason: z.string().optional().default("Not Provided"),
+  seatReferenceUid: z.string().optional(),
+  cancelledBy: z.string().email({ message: "Invalid email" }).optional(),
+  internalNote: z
+    .object({
+      id: z.number(),
+      name: z.string(),
+      cancellationReason: z.string().optional().nullable(),
+    })
+    .optional()
+    .nullable(),
+});
+
 const schemaBookingEditParams = z
   .object({
     title: z.string().optional(),
@@ -119,4 +137,5 @@ export const schemaBookingReadPublic = Booking.extend({
   fromReschedule: true,
   cancelledBy: true,
   rescheduledBy: true,
+  createdAt: true,
 });

apps/api/v1/lib/validations/selected-calendar.ts

@@ -9,11 +9,25 @@ export const schemaSelectedCalendarBaseBodyParams = SelectedCalendar;
 
 export const schemaSelectedCalendarPublic = SelectedCalendar.omit({});
 
-export const schemaSelectedCalendarBodyParams = schemaSelectedCalendarBaseBodyParams.partial({
-  userId: true,
-});
+export const schemaSelectedCalendarBodyParams = schemaSelectedCalendarBaseBodyParams
+  .partial({
+    userId: true,
+  })
+  .omit({
+    // id will be set by the database
+    id: true,
+    // No eventTypeId support in API v1
+    eventTypeId: true,
+  });
 
-export const schemaSelectedCalendarUpdateBodyParams = schemaSelectedCalendarBaseBodyParams.partial();
+export const schemaSelectedCalendarUpdateBodyParams = schemaSelectedCalendarBaseBodyParams
+  .omit({
+    // id is decided by DB
+    id: true,
+    // No eventTypeId support in API v1
+    eventTypeId: true,
+  })
+  .partial();
 
 export const selectedCalendarIdSchema = schemaQueryIdAsString.transform((v, ctx) => {
   /** We can assume the first part is the userId since it's an integer */

apps/api/v1/lib/validations/shared/jsonSchema.ts

@@ -1,9 +1,11 @@
 import { z } from "zod";
 
 // Helper schema for JSON fields
-type Literal = boolean | number | string;
+type Literal = boolean | number | string | null;
 type Json = Literal | { [key: string]: Json } | Json[];
-const literalSchema = z.union([z.string(), z.number(), z.boolean()]);
+const literalSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+const jsonObjectSchema = z.record(z.lazy(() => jsonSchema));
+const jsonArraySchema = z.array(z.lazy(() => jsonSchema));
 export const jsonSchema: z.ZodSchema<Json> = z.lazy(() =>
-  z.union([literalSchema, z.array(jsonSchema), z.record(jsonSchema)])
+  z.union([literalSchema, jsonObjectSchema, jsonArraySchema])
 );

apps/api/v1/next.d.ts

@@ -8,6 +8,7 @@ export declare module "next" {
     session?: Session | null;
 
     userId: number;
+    user?: { role: string; locked: boolean; email: string } | null;
     method: string;
     // session: { user: { id: number } };
     // query: Partial<{ [key: string]: string | string[] }>;

apps/api/v1/package.json

@@ -14,7 +14,8 @@
     "lint:fix": "eslint . --ext .ts,.js,.tsx,.jsx --fix",
     "start": "PORT=3003 next start",
     "docker-start-api": "PORT=80 next start",
-    "type-check": "tsc --pretty --noEmit"
+    "type-check": "tsc --pretty --noEmit",
+    "type-check:ci": "tsc-absolute --pretty --noEmit"
   },
   "devDependencies": {
     "@calcom/tsconfig": "*",

apps/api/v1/pages/api/bookings/[id]/_delete.ts

@@ -2,8 +2,8 @@ import type { NextApiRequest } from "next";
 
 import handleCancelBooking from "@calcom/features/bookings/lib/handleCancelBooking";
 import { defaultResponder } from "@calcom/lib/server";
-import { bookingCancelSchema } from "@calcom/prisma/zod-utils";
 
+import { bookingCancelSchema } from "~/lib/validations/booking";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 /**
@@ -70,6 +70,7 @@ async function handler(req: NextApiRequest) {
       ...req.query,
       allRemainingBookings: req.query.allRemainingBookings === "true",
     });
+
   // Normalizing for universal handler
   req.body = { id, allRemainingBookings, cancellationReason };
   return await handleCancelBooking(req);

apps/api/v1/pages/api/bookings/_post.ts

@@ -5,6 +5,7 @@ import handleNewBooking from "@calcom/features/bookings/lib/handleNewBooking";
 import { ErrorCode } from "@calcom/lib/errorCodes";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import { CreationSource } from "@calcom/prisma/enums";
 
 import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
 
@@ -213,6 +214,10 @@ import { getAccessibleUsers } from "~/lib/utils/retrieveScopedAccessibleUsers";
  */
 async function handler(req: NextApiRequest) {
   const { userId, isSystemWideAdmin, isOrganizationOwnerOrAdmin } = req;
+  req.body = {
+    ...req.body,
+    creationSource: CreationSource.API_V1,
+  };
   if (isSystemWideAdmin) req.userId = req.body.userId || userId;
 
   if (isOrganizationOwnerOrAdmin) {

apps/api/v1/pages/api/connected-calendars/_get.ts

@@ -1,9 +1,10 @@
 import type { NextApiRequest } from "next";
 
 import type { UserWithCalendars } from "@calcom/lib/getConnectedDestinationCalendars";
-import { getConnectedDestinationCalendars } from "@calcom/lib/getConnectedDestinationCalendars";
+import { getConnectedDestinationCalendarsAndEnsureDefaultsInDb } from "@calcom/lib/getConnectedDestinationCalendars";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import { UserRepository } from "@calcom/lib/server/repository/user";
 import prisma from "@calcom/prisma";
 
 import { extractUserIdsFromQuery } from "~/lib/utils/extractUserIdsFromQuery";
@@ -104,12 +105,8 @@ async function getHandler(req: NextApiRequest) {
 
   const userIds = req.query.userId ? extractUserIdsFromQuery(req) : [userId];
 
-  const usersWithCalendars = await prisma.user.findMany({
-    where: { id: { in: userIds } },
-    include: {
-      selectedCalendars: true,
-      destinationCalendar: true,
-    },
+  const usersWithCalendars = await UserRepository.findManyByIdsIncludeDestinationAndSelectedCalendars({
+    ids: userIds,
   });
 
   return await getConnectedCalendars(usersWithCalendars);
@@ -117,11 +114,12 @@ async function getHandler(req: NextApiRequest) {
 
 async function getConnectedCalendars(users: UserWithCalendars[]) {
   const connectedDestinationCalendarsPromises = users.map((user) =>
-    getConnectedDestinationCalendars(user, false, prisma).then((connectedCalendarsResult) =>
-      connectedCalendarsResult.connectedCalendars.map((calendar) => ({
-        userId: user.id,
-        ...calendar,
-      }))
+    getConnectedDestinationCalendarsAndEnsureDefaultsInDb({ user, onboarding: false, prisma }).then(
+      (connectedCalendarsResult) =>
+        connectedCalendarsResult.connectedCalendars.map((calendar) => ({
+          userId: user.id,
+          ...calendar,
+        }))
     )
   );
   const connectedDestinationCalendars = await Promise.all(connectedDestinationCalendarsPromises);

apps/api/v1/pages/api/invites/_post.ts

@@ -3,6 +3,7 @@ import type { NextApiRequest, NextApiResponse } from "next";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
+import { CreationSource } from "@calcom/prisma/enums";
 import { createContext } from "@calcom/trpc/server/createContext";
 import { viewerTeamsRouter } from "@calcom/trpc/server/routers/viewer/teams/_router";
 import type { TInviteMemberInputSchema } from "@calcom/trpc/server/routers/viewer/teams/inviteMember/inviteMember.schema";
@@ -43,6 +44,7 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
       language: data.language,
       teamId: data.teamId,
       usernameOrEmail: data.usernameOrEmail,
+      creationSource: CreationSource.API_V1,
     });
 
     return { success: true, message: `${data.usernameOrEmail} has been invited.` };

apps/api/v1/pages/api/selected-calendars/[id]/_delete.ts

@@ -1,7 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
-import prisma from "@calcom/prisma";
+import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
 
 import { selectedCalendarIdSchema } from "~/lib/validations/selected-calendar";
 
@@ -49,7 +49,9 @@ import { selectedCalendarIdSchema } from "~/lib/validations/selected-calendar";
 export async function deleteHandler(req: NextApiRequest) {
   const { query } = req;
   const userId_integration_externalId = selectedCalendarIdSchema.parse(query);
-  await prisma.selectedCalendar.delete({ where: { userId_integration_externalId } });
+  await SelectedCalendarRepository.deleteUserLevel({
+    where: userId_integration_externalId,
+  });
   return { message: `Selected Calendar with id: ${query.id} deleted successfully` };
 }
 

apps/api/v1/pages/api/selected-calendars/[id]/_get.ts

@@ -1,7 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
-import prisma from "@calcom/prisma";
+import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
 
 import { schemaSelectedCalendarPublic, selectedCalendarIdSchema } from "~/lib/validations/selected-calendar";
 
@@ -49,8 +49,8 @@ import { schemaSelectedCalendarPublic, selectedCalendarIdSchema } from "~/lib/va
 export async function getHandler(req: NextApiRequest) {
   const { query } = req;
   const userId_integration_externalId = selectedCalendarIdSchema.parse(query);
-  const data = await prisma.selectedCalendar.findUniqueOrThrow({
-    where: { userId_integration_externalId },
+  const data = await SelectedCalendarRepository.findUserLevelUniqueOrThrow({
+    where: userId_integration_externalId,
   });
   return { selected_calendar: schemaSelectedCalendarPublic.parse(data) };
 }

apps/api/v1/pages/api/selected-calendars/[id]/_patch.ts

@@ -3,6 +3,8 @@ import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import type { UpdateArguments } from "@calcom/lib/server/repository/selectedCalendar";
+import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
 import prisma from "@calcom/prisma";
 
 import {
@@ -56,7 +58,7 @@ export async function patchHandler(req: NextApiRequest) {
   const { query, isSystemWideAdmin } = req;
   const userId_integration_externalId = selectedCalendarIdSchema.parse(query);
   const { userId: bodyUserId, ...data } = schemaSelectedCalendarUpdateBodyParams.parse(req.body);
-  const args: Prisma.SelectedCalendarUpdateArgs = { where: { userId_integration_externalId }, data };
+  const args: UpdateArguments = { where: { ...userId_integration_externalId }, data };
 
   if (!isSystemWideAdmin && bodyUserId)
     throw new HttpError({ statusCode: 403, message: `ADMIN required for userId` });
@@ -67,7 +69,7 @@ export async function patchHandler(req: NextApiRequest) {
     args.data.userId = bodyUserId;
   }
 
-  const result = await prisma.selectedCalendar.update(args);
+  const result = await SelectedCalendarRepository.updateUserLevel(args);
   return { selected_calendar: schemaSelectedCalendarPublic.parse(result) };
 }
 

apps/api/v1/pages/api/selected-calendars/_get.ts

@@ -1,9 +1,9 @@
-import type { Prisma } from "@prisma/client";
 import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
-import prisma from "@calcom/prisma";
+import type { FindManyArgs } from "@calcom/lib/server/repository/selectedCalendar";
+import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
 
 import { schemaSelectedCalendarPublic } from "~/lib/validations/selected-calendar";
 import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/queryUserId";
@@ -34,7 +34,7 @@ import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/que
 async function getHandler(req: NextApiRequest) {
   const { userId, isSystemWideAdmin } = req;
   /* Admin gets all selected calendar by default, otherwise only the user's ones */
-  const args: Prisma.SelectedCalendarFindManyArgs = isSystemWideAdmin ? {} : { where: { userId } };
+  const args: FindManyArgs = isSystemWideAdmin ? {} : { where: { userId } };
 
   /** Only admins can query other users */
   if (!isSystemWideAdmin && req.query.userId)
@@ -46,7 +46,7 @@ async function getHandler(req: NextApiRequest) {
     if (Array.isArray(query.userId)) args.orderBy = { userId: "asc" };
   }
 
-  const data = await prisma.selectedCalendar.findMany(args);
+  const data = await SelectedCalendarRepository.findManyUserLevel(args);
   return { selected_calendars: data.map((v) => schemaSelectedCalendarPublic.parse(v)) };
 }
 

apps/api/v1/pages/api/selected-calendars/_post.ts

@@ -3,6 +3,7 @@ import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
 import prisma from "@calcom/prisma";
 
 import {
@@ -52,7 +53,11 @@ import {
 async function postHandler(req: NextApiRequest) {
   const { userId, isSystemWideAdmin } = req;
   const { userId: bodyUserId, ...body } = schemaSelectedCalendarBodyParams.parse(req.body);
-  const args: Prisma.SelectedCalendarCreateArgs = { data: { ...body, userId } };
+  const args: {
+    data: Prisma.SelectedCalendarUncheckedCreateInput;
+  } = {
+    data: { ...body, userId },
+  };
 
   if (!isSystemWideAdmin && bodyUserId)
     throw new HttpError({ statusCode: 403, message: `ADMIN required for userId` });
@@ -63,7 +68,7 @@ async function postHandler(req: NextApiRequest) {
     args.data.userId = bodyUserId;
   }
 
-  const data = await prisma.selectedCalendar.create(args);
+  const data = await SelectedCalendarRepository.create(args.data);
 
   return {
     selected_calendar: schemaSelectedCalendarPublic.parse(data),

apps/api/v1/pages/api/teams/_post.ts

@@ -2,6 +2,7 @@ import type { NextApiRequest } from "next";
 
 import { getStripeCustomerIdFromUserId } from "@calcom/app-store/stripepayment/lib/customer";
 import stripe from "@calcom/app-store/stripepayment/lib/server";
+import { getDubCustomer } from "@calcom/features/auth/lib/dub";
 import { IS_PRODUCTION } from "@calcom/lib/constants";
 import { IS_TEAM_BILLING_ENABLED, WEBAPP_URL } from "@calcom/lib/constants";
 import { HttpError } from "@calcom/lib/http-error";
@@ -192,11 +193,26 @@ const generateTeamCheckoutSession = async ({
   pendingPaymentTeamId: number;
   ownerId: number;
 }) => {
-  const customer = await getStripeCustomerIdFromUserId(ownerId);
+  const [customer, dubCustomer] = await Promise.all([
+    getStripeCustomerIdFromUserId(ownerId),
+    getDubCustomer(ownerId.toString()),
+  ]);
+
   const session = await stripe.checkout.sessions.create({
     customer,
     mode: "subscription",
-    allow_promotion_codes: true,
+    ...(dubCustomer?.discount?.couponId
+      ? {
+          discounts: [
+            {
+              coupon:
+                process.env.NODE_ENV !== "production" && dubCustomer.discount.couponTestId
+                  ? dubCustomer.discount.couponTestId
+                  : dubCustomer.discount.couponId,
+            },
+          ],
+        }
+      : { allow_promotion_codes: true }),
     success_url: `${WEBAPP_URL}/api/teams/api/create?session_id={CHECKOUT_SESSION_ID}`,
     cancel_url: `${WEBAPP_URL}/settings/my-account/profile`,
     line_items: [

apps/api/v1/pages/api/users/_post.ts

@@ -3,6 +3,7 @@ import type { NextApiRequest } from "next";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
+import { CreationSource } from "@calcom/prisma/enums";
 
 import { schemaUserCreateBodyParams } from "~/lib/validations/user";
 
@@ -92,7 +93,7 @@ async function postHandler(req: NextApiRequest) {
   // If user is not ADMIN, return unauthorized.
   if (!isSystemWideAdmin) throw new HttpError({ statusCode: 401, message: "You are not authorized" });
   const data = await schemaUserCreateBodyParams.parseAsync(req.body);
-  const user = await prisma.user.create({ data });
+  const user = await prisma.user.create({ data: { ...data, creationSource: CreationSource.API_V1 } });
   req.statusCode = 201;
   return { user };
 }

apps/api/v1/test/lib/attendees/_post.test.ts

@@ -52,6 +52,8 @@ describe("POST /api/attendees", () => {
         bookingId: 1,
       };
 
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-expect-error
       prismaMock.attendee.create.mockResolvedValue(attendeeData);
       req.isSystemWideAdmin = true;
       req.userId = 123;
@@ -84,7 +86,8 @@ describe("POST /api/attendees", () => {
         timeZone: "UTC",
         bookingId: 1,
       };
-
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-expect-error
       prismaMock.attendee.create.mockResolvedValue(attendeeData);
 
       req.userId = 123;

apps/api/v1/test/lib/bookings/_post.test.ts

@@ -11,7 +11,8 @@ import sendPayload from "@calcom/features/webhooks/lib/sendOrSchedulePayload";
 import { ErrorCode } from "@calcom/lib/errorCodes";
 import { buildBooking, buildEventType, buildWebhook } from "@calcom/lib/test/builder";
 import prisma from "@calcom/prisma";
-import type { Booking } from "@calcom/prisma";
+import type { Booking } from "@calcom/prisma/client";
+import { CreationSource } from "@calcom/prisma/enums";
 
 import handler from "../../../pages/api/bookings/_post";
 
@@ -220,6 +221,34 @@ describe.skipIf(true)("POST /api/bookings", () => {
         });
         expect(previousBooking?.status).toBe("cancelled");
       });
+
+      test("Creates source as api_v1", async () => {
+        const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+          method: "POST",
+          body: {
+            name: "test",
+            start: dayjs().format(),
+            end: dayjs().add(1, "day").format(),
+            eventTypeId: 2,
+            email: "test@example.com",
+            location: "Cal.com Video",
+            timeZone: "America/Montevideo",
+            language: "en",
+            customInputs: [],
+            metadata: {},
+            userId: 4,
+          },
+          prisma,
+        });
+
+        prismaMock.eventType.findUniqueOrThrow.mockResolvedValue(buildEventType());
+        prismaMock.booking.findMany.mockResolvedValue([]);
+
+        await handler(req, res);
+        createdBooking = JSON.parse(res._getData());
+        expect(createdBooking.creationSource).toEqual(CreationSource.API_V1);
+        expect(prismaMock.booking.create).toHaveBeenCalledTimes(1);
+      });
     });
 
     describe("Recurring event-type", () => {

apps/api/v1/test/lib/event-types/[id]/_delete.test.ts

@@ -21,6 +21,8 @@ describe("DELETE /api/event-types/[id]", () => {
   beforeEach(() => {
     vi.resetAllMocks();
     // Mocking membership.findFirst
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-expect-error
     prismaMock.membership.findFirst.mockImplementation(({ where }) => {
       const { userId, teamId, accepted, role } = where;
       const mockData = [

apps/api/v1/test/lib/event-types/_post.test.ts

@@ -72,6 +72,7 @@ describe("POST /api/event-types", () => {
         },
       });
       req.userId = memberUserId;
+      // @ts-expect-error - Return type is wrong
       vi.mocked(canUserAccessTeamWithRole).mockImplementationOnce(async () => false);
 
       await handler(req, res);
@@ -114,6 +115,7 @@ describe("POST /api/event-types", () => {
       req.isSystemWideAdmin = true;
       req.userId = adminUserId;
 
+      // @ts-expect-error - Return type is wrong
       vi.mocked(canUserAccessTeamWithRole).mockImplementationOnce(async () => false);
 
       await handler(req, res);
@@ -138,6 +140,7 @@ describe("POST /api/event-types", () => {
       req.isSystemWideAdmin = true;
       req.userId = adminUserId;
 
+      // @ts-expect-error - Return type is wrong
       vi.mocked(canUserAccessTeamWithRole).mockImplementationOnce(async () => true);
       vi.mocked(checkParentEventOwnership).mockImplementationOnce(async () => undefined);
       vi.mocked(checkUserMembership).mockImplementationOnce(async () => undefined);

apps/api/v1/test/lib/middleware/verifyApiKey.test.ts

@@ -1,17 +1,18 @@
-import prismaMock from "../../../../../../tests/libs/__mocks__/prismaMock";
+import prismock from "../../../../../../tests/libs/__mocks__/prisma";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { createMocks } from "node-mocks-http";
-import { describe, vi, it, expect, afterEach, beforeEach } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+import type { ILicenseKeyService } from "@calcom/ee/common/server/LicenseKeyService";
 import LicenseKeyService from "@calcom/ee/common/server/LicenseKeyService";
 import prisma from "@calcom/prisma";
+import { MembershipRole, UserPermissionRole } from "@calcom/prisma/enums";
 
-import { isAdminGuard } from "~/lib/utils/isAdmin";
+import { hashAPIKey } from "~/../../../packages/features/ee/api-keys/lib/apiKeys";
 
 import { verifyApiKey } from "../../../lib/helpers/verifyApiKey";
-import { ScopeOfAdmin } from "../../../lib/utils/scopeOfAdmin";
 
 type CustomNextApiRequest = NextApiRequest & Request;
 type CustomNextApiResponse = NextApiResponse & Response;
@@ -20,13 +21,8 @@ afterEach(() => {
   vi.resetAllMocks();
 });
 
-vi.mock("@calcom/prisma");
-vi.mock("~/lib/utils/isAdmin", () => ({
-  isAdminGuard: vi.fn(),
-}));
-
 describe("Verify API key", () => {
-  let service: LicenseKeyService;
+  let service: ILicenseKeyService;
 
   beforeEach(async () => {
     service = await LicenseKeyService.create();
@@ -45,7 +41,6 @@ describe("Verify API key", () => {
     };
 
     vi.mocked(service.checkLicense).mockResolvedValue(false);
-    vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: false, scope: null });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
 
@@ -69,7 +64,6 @@ describe("Verify API key", () => {
     };
 
     vi.mocked(service.checkLicense).mockResolvedValue(true);
-    vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: false, scope: null });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
 
@@ -91,10 +85,18 @@ describe("Verify API key", () => {
       },
       prisma,
     });
-
-    prismaMock.apiKey.findUnique.mockResolvedValue({
-      id: 1,
-      userId: 2,
+    const hashedKey = hashAPIKey("test_key");
+    await prismock.apiKey.create({
+      data: {
+        hashedKey,
+        user: {
+          create: {
+            email: "admin@example.com",
+            role: UserPermissionRole.ADMIN,
+            locked: false,
+          },
+        },
+      },
     });
 
     const middleware = {
@@ -102,7 +104,6 @@ describe("Verify API key", () => {
     };
 
     vi.mocked(service.checkLicense).mockResolvedValue(true);
-    vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: true, scope: ScopeOfAdmin.SystemWide });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
 
@@ -125,10 +126,36 @@ describe("Verify API key", () => {
       },
       prisma,
     });
-
-    prismaMock.apiKey.findUnique.mockResolvedValue({
-      id: 1,
-      userId: 2,
+    const hashedKey = hashAPIKey("test_key");
+    await prismock.apiKey.create({
+      data: {
+        hashedKey,
+        user: {
+          create: {
+            email: "org-admin@acme.com",
+            role: UserPermissionRole.USER,
+            locked: false,
+            teams: {
+              create: {
+                accepted: true,
+                role: MembershipRole.OWNER,
+                team: {
+                  create: {
+                    name: "ACME",
+                    isOrganization: true,
+                    organizationSettings: {
+                      create: {
+                        isAdminAPIEnabled: true,
+                        orgAutoAcceptEmail: "acme.com",
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
     });
 
     const middleware = {
@@ -136,7 +163,6 @@ describe("Verify API key", () => {
     };
 
     vi.mocked(service.checkLicense).mockResolvedValue(true);
-    vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
 
@@ -149,4 +175,44 @@ describe("Verify API key", () => {
     expect(req.isSystemWideAdmin).toBe(false);
     expect(req.isOrganizationOwnerOrAdmin).toBe(true);
   });
+
+  it("should return 403 if user is locked or blocked", async () => {
+    const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+      method: "POST",
+      body: {},
+      query: {
+        apiKey: "cal_test_key",
+      },
+      prisma,
+    });
+    const hashedKey = hashAPIKey("test_key");
+    await prismock.apiKey.create({
+      data: {
+        hashedKey,
+        user: {
+          create: {
+            email: "locked@example.com",
+            role: UserPermissionRole.USER,
+            locked: true,
+          },
+        },
+      },
+    });
+
+    const middleware = {
+      fn: verifyApiKey,
+    };
+
+    vi.mocked(service.checkLicense).mockResolvedValue(true);
+
+    const serverNext = vi.fn((next: void) => Promise.resolve(next));
+    const middlewareSpy = vi.spyOn(middleware, "fn");
+
+    await middleware.fn(req, res, serverNext);
+
+    expect(middlewareSpy).toBeCalled();
+    expect(res.statusCode).toBe(403);
+    expect(JSON.parse(res._getData())).toEqual({ error: "You are not authorized to perform this request." });
+    expect(serverNext).not.toHaveBeenCalled();
+  });
 });

apps/api/v1/test/lib/selected-calendars/_post.test.ts

@@ -79,6 +79,15 @@ describe("POST /api/selected-calendars", () => {
         integration: "google",
         externalId: "ext123",
         userId: 444444,
+        id: "xxx-xxx",
+        eventTypeId: null,
+        domainWideDelegationCredentialId: null,
+        googleChannelId: null,
+        googleChannelKind: null,
+        googleChannelResourceId: null,
+        googleChannelResourceUri: null,
+        googleChannelExpiration: null,
+        error: null,
       });
 
       await handler(req, res);
@@ -104,10 +113,19 @@ describe("POST /api/selected-calendars", () => {
       req.userId = 333333;
 
       prismaMock.selectedCalendar.create.mockResolvedValue({
+        id: "xxx-xxx",
         credentialId: 1,
         integration: "google",
         externalId: "ext123",
         userId: 333333,
+        googleChannelId: null,
+        googleChannelKind: null,
+        googleChannelResourceId: null,
+        googleChannelResourceUri: null,
+        googleChannelExpiration: null,
+        domainWideDelegationCredentialId: null,
+        eventTypeId: null,
+        error: null,
       });
 
       await handler(req, res);

apps/api/v1/test/lib/utils/isAdmin.integration-test.ts

@@ -19,6 +19,7 @@ describe("isAdmin guard", () => {
     });
 
     req.userId = 0;
+    req.user = undefined;
 
     const { isAdmin, scope } = await isAdminGuard(req);
 
@@ -35,6 +36,7 @@ describe("isAdmin guard", () => {
     const memberUser = await prisma.user.findFirstOrThrow({ where: { email: "member2-acme@example.com" } });
 
     req.userId = memberUser.id;
+    req.user = memberUser;
 
     const { isAdmin, scope } = await isAdminGuard(req);
 
@@ -51,6 +53,7 @@ describe("isAdmin guard", () => {
     const adminUser = await prisma.user.findFirstOrThrow({ where: { email: "admin@example.com" } });
 
     req.userId = adminUser.id;
+    req.user = adminUser;
 
     const { isAdmin, scope } = await isAdminGuard(req);
 
@@ -67,6 +70,8 @@ describe("isAdmin guard", () => {
     const adminUser = await prisma.user.findFirstOrThrow({ where: { email: "owner1-acme@example.com" } });
 
     req.userId = adminUser.id;
+    req.user = adminUser;
+
     const { isAdmin, scope } = await isAdminGuard(req);
     expect(isAdmin).toBe(true);
     expect(scope).toBe(ScopeOfAdmin.OrgOwnerOrAdmin);
@@ -81,6 +86,8 @@ describe("isAdmin guard", () => {
     const adminUser = await prisma.user.findFirstOrThrow({ where: { email: "owner1-dunder@example.com" } });
 
     req.userId = adminUser.id;
+    req.user = adminUser;
+
     const { isAdmin } = await isAdminGuard(req);
     expect(isAdmin).toBe(false);
   });

apps/api/v1/test/lib/utils/isLockedOrBlocked.test.ts

@@ -0,0 +1,91 @@
+import prismock from "../../../../../../tests/libs/__mocks__/prisma";
+
+import { describe, expect, it, beforeEach } from "vitest";
+
+import { WatchlistSeverity } from "@calcom/prisma/enums";
+
+import { isLockedOrBlocked } from "../../../lib/utils/isLockedOrBlocked";
+
+describe("isLockedOrBlocked", () => {
+  beforeEach(async () => {
+    await prismock.watchlist.createMany({
+      data: [
+        {
+          type: "DOMAIN",
+          value: "spam.com",
+          createdById: 1,
+        },
+        {
+          type: "DOMAIN",
+          value: "blocked.com",
+          severity: WatchlistSeverity.CRITICAL,
+          createdById: 1,
+        },
+      ],
+    });
+  });
+
+  it("should return false if no user in request", async () => {
+    const req = { userId: null, user: null } as any;
+    const result = await isLockedOrBlocked(req);
+    expect(result).toBe(false);
+  });
+
+  it("should return false if user has no email", async () => {
+    const req = { userId: 123, user: { email: null } } as any;
+    const result = await isLockedOrBlocked(req);
+    expect(result).toBe(false);
+  });
+
+  it("should return true if user is locked", async () => {
+    const req = {
+      userId: 123,
+      user: {
+        locked: true,
+        email: "test@example.com",
+      },
+    } as any;
+
+    const result = await isLockedOrBlocked(req);
+    expect(result).toBe(true);
+  });
+
+  it("should return true if user email domain is watchlisted", async () => {
+    const req = {
+      userId: 123,
+      user: {
+        locked: false,
+        email: "test@blocked.com",
+      },
+    } as any;
+
+    const result = await isLockedOrBlocked(req);
+    expect(result).toBe(true);
+  });
+
+  it("should return false if user is not locked and email domain is not watchlisted", async () => {
+    const req = {
+      userId: 123,
+      user: {
+        locked: false,
+        email: "test@example.com",
+      },
+    } as any;
+
+    const result = await isLockedOrBlocked(req);
+    expect(result).toBe(false);
+  });
+
+  it("should handle email domains case-insensitively", async () => {
+    const req = {
+      userId: 123,
+      user: {
+        locked: false,
+        email: "test@BLOCKED.COM",
+      },
+    } as any;
+
+    const result = await isLockedOrBlocked(req);
+    expect(result).toBe(true);
+  });
+});

apps/api/v1/tsconfig.json

@@ -12,6 +12,7 @@
   },
   "include": [
     "next-env.d.ts",
+    "./next.d.ts",
     "**/*.ts",
     "**/*.tsx",
     "../../../packages/types/*.d.ts",

apps/api/v2/Dockerfile

@@ -6,6 +6,7 @@ ARG DATABASE_URL
 WORKDIR /calcom
 
 RUN set -eux;
+RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3
 
 ENV NODE_ENV="production"
 ENV NODE_OPTIONS="--max-old-space-size=8192"