chore: release v5.3.1

* feat: automated changesets

* chore: update changesets to latest

* readme

.changeset/config.json

@@ -1,11 +1,15 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@2.3.0/schema.json",
-  "changelog": "@changesets/cli/changelog",
+  "changelog": ["@changesets/changelog-github", { "repo": "calcom/cal.com" }],
   "commit": false,
   "fixed": [],
   "linked": [],
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": []
+  "ignore": [],
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  }
 }

.env.example

@@ -159,13 +159,17 @@ SENDGRID_EMAIL=
 NEXT_PUBLIC_SENDGRID_SENDER_NAME=
 
 # Sentry
+SENTRY_ORG=
+SENTRY_PROJECT=
+SENTRY_AUTH_TOKEN=
 # Used for capturing exceptions and logging messages
 NEXT_PUBLIC_SENTRY_DSN=
 SENTRY_DEBUG=
-SENTRY_DISABLE_CLIENT_SOURCE_MAPS=
-SENTRY_DISABLE_SERVER_SOURCE_MAPS=
 SENTRY_MAX_SPANS=
+SENTRY_SAMPLE_RATE=
 SENTRY_TRACES_SAMPLE_RATE=
+SENTRY_REPLAYS_SESSION_SAMPLE_RATE=
+SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE=
 
 # Formbricks Experience Management Integration
 NEXT_PUBLIC_FORMBRICKS_HOST_URL=https://app.formbricks.com
@@ -187,6 +191,7 @@ TWILIO_WHATSAPP_PHONE_NUMBER=
 # For NEXT_PUBLIC_SENDER_ID only letters, numbers and spaces are allowed (max. 11 characters)
 NEXT_PUBLIC_SENDER_ID=
 TWILIO_VERIFY_SID=
+TWILIO_OPT_OUT_ENABLED=
 
 # Set it to "1" if you need to run E2E tests locally.
 NEXT_PUBLIC_IS_E2E=
@@ -197,6 +202,7 @@ NEXT_PUBLIC_STRIPE_PREMIUM_PLAN_PRICE=
 NEXT_PUBLIC_IS_PREMIUM_NEW_PLAN=0
 NEXT_PUBLIC_STRIPE_PREMIUM_NEW_PLAN_PRICE=
 STRIPE_TEAM_MONTHLY_PRICE_ID=
+NEXT_PUBLIC_STRIPE_CREDITS_PRICE_ID=
 STRIPE_TEAM_PRODUCT_ID=
 # It is a price ID in the product with id STRIPE_ORG_PRODUCT_ID
 STRIPE_ORG_MONTHLY_PRICE_ID=
@@ -362,9 +368,6 @@ E2E_TEST_OIDC_USER_PASSWORD=
 
 # ***********************************************************************************************************
 
-# disable setry server source maps
-SENTRY_DISABLE_SERVER_WEBPACK_PLUGIN=1
-
 # api v2
 NEXT_PUBLIC_API_V2_URL="http://localhost:5555/api/v2"
 
@@ -424,7 +427,7 @@ DIRECTORY_IDS_TO_LOG=
 # Read more about it in the README.md
 NEXT_PUBLIC_SINGLE_ORG_SLUG=
 
-AKISMET_API_KEY=
+IFFY_API_KEY=
 
 ## Env variables related to avoiding booking failures
 # Request for checking reservation would be attempted to send every these seconds if the request is stale at that time
@@ -442,4 +445,8 @@ NEXT_PUBLIC_QUICK_AVAILABILITY_ROLLOUT=10
 NEXT_PUBLIC_HEAD_SCRIPTS=
 NEXT_PUBLIC_BODY_SCRIPTS=
 
-DATABASE_CHUNK_SIZE=
+DATABASE_CHUNK_SIZE=
+
+# Service Account Encryption Key for encrypting/decrypting service account keys
+# You can use: `openssl rand -base64 24` to generate one
+CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY=

.github/CODEOWNERS

@@ -1,5 +1,9 @@
 /**/package.json @calcom/Foundation
 /apps/api/**/* @calcom/Platform @calcom/Foundation
+/apps/ui-playground/**/* @calcom/Consumer @calcom/Foundation
+/apps/web/**/layout.tsx @calcom/Consumer @calcom/Foundation
+/apps/web/lib/**/* @calcom/Foundation
+/apps/web/middleware.ts @calcom/Foundation
 /deploy/**/* @calcom/Foundation
 /infra/**/* @calcom/Foundation
 /packages/app-store/applecalendar/**/* @calcom/Foundation
@@ -20,4 +24,7 @@
 /packages/lib/slots.ts @calcom/Foundation
 /packages/platform/**/* @calcom/Platform @calcom/Foundation
 /packages/prisma/**/* @calcom/Foundation
+/packages/trpc/server/routers/viewer/bookings/confirm.handler.ts @calcom/Foundation
+/packages/trpc/server/routers/viewer/bookings/get.handler.ts @calcom/Foundation
 /packages/trpc/server/routers/viewer/slots/**/* @calcom/Foundation
+/packages/ui/**/* @calcom/Consumer @calcom/Foundation

.github/ISSUE_TEMPLATE/platform.md

@@ -0,0 +1,58 @@
+---
+name: Cal.com/platform request
+about: Suggest a feature or bug report for cal.com/platform
+title: ""
+labels: ["platform", "🚨 needs approval"]
+assignees: ""
+---
+
+### Is your proposal related to a problem?
+
+<!--
+  Provide a clear and concise description of what the problem is.
+  For example, "I'm always frustrated when..."
+-->
+
+(Write your answer here.)
+
+### Describe the solution you'd like
+
+<!--
+  Provide a clear and concise description of what you want to happen.
+-->
+
+(Describe your proposed solution here.)
+
+### Describe alternatives you've considered
+
+<!--
+  Let us know about other solutions you've tried or researched.
+-->
+
+(Write your answer here.)
+
+### Additional context
+
+<!--
+  Is there anything else you can add about the proposal?
+  You might want to link to related issues here, if you haven't already.
+-->
+
+(Write your answer here.)
+
+### Requirement/Document
+
+<!--
+  Is there any type of document that could support that feature?
+-->
+
+(Share it here.)
+
+---
+
+##### House rules
+
+- If this issue has a `🚨 needs approval` label, don't start coding yet. Wait until a core member approves feature request by removing this label, then you can start coding.
+  - For clarity: Non-core member issues automatically get the `🚨 needs approval` label.
+  - Your feature ideas are invaluable to us! However, they undergo review to ensure alignment with the product's direction.
+  - Follow Best Practices lined out in our [Contributor Docs](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)

.github/workflows/changesets.yml

@@ -0,0 +1,37 @@
+name: Create PR containing updated CHANGELOG.md and release packages to NPM once PR is merged
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+permissions: {} # remove permissions and set explicitly under "permissions:" below
+jobs:
+  release:
+    if: github.repository == 'calcom/cal.com' # prevent this action from running on forks
+    permissions:
+      id-token: write # for NPM provenance - developers can verify where and how it was built
+      contents: write # to create release by changesets/action below
+      pull-requests: write # to create pull request by changesets/action below
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Setup node, yarn and install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          version: yarn changesets-version
+          publish: yarn changesets-release
+          commit: "chore: version packages" # commit message
+          title: "chore: version packages" # PR title
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/cleanup-report.yml

@@ -0,0 +1,37 @@
+on:
+  workflow_call:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+jobs:
+  cleanup-report:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout GitHub Pages Branch
+        uses: actions/checkout@v4
+        with:
+          repository: calcom/test-results
+          ref: gh-pages
+          token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+      - name: Set Git User
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Cleanup HTML reports on PR close/merge
+        env:
+          BRANCH_REPORTS_DIR: reports/${{ github.event.pull_request.head.ref }}
+        run: |
+          if [ -d "$BRANCH_REPORTS_DIR" ]; then
+            rm -rf "$BRANCH_REPORTS_DIR"
+            git add .
+            git commit -m "workflow: remove all reports for branch ${{ github.event.pull_request.head.ref }} (PR closed/merged)"
+            git push
+          else
+            echo "No reports found for branch ${{ github.event.pull_request.head.ref }}. Nothing to clean up."
+          fi

.github/workflows/cron-checkSmsPrices.yml

@@ -0,0 +1,23 @@
+name: Cron - checkSmsPrices
+
+on:
+  # "Scheduled workflows run on the latest commit on the default or base branch."
+  # — https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#schedule
+  schedule:
+    # Runs “every minute” (see https://crontab.guru)
+    - cron: "* * * * *"
+jobs:
+  cron-checkSmsPrices:
+    env:
+      APP_URL: ${{ secrets.APP_URL }}
+      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: cURL request
+        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+        run: |
+          curl ${{ secrets.APP_URL }}/api/cron/checkSmsPrices \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            --fail

.github/workflows/cron-scheduleEmailReminders.yml

@@ -1,3 +1,5 @@
+# deprecated - use smtp with tasker instead */
+
 name: Cron - scheduleEmailReminders
 
 on:

.github/workflows/pr.yml

@@ -219,6 +219,17 @@ jobs:
     uses: ./.github/workflows/publish-report.yml
     secrets: inherit
 
+  cleanup-report:
+    name: Cleanup HTML report
+    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && (github.event.pull_request.merged == true || github.event.pull_request.state == 'closed') }}
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    needs: [changes, check-label, publish-report]
+    uses: ./.github/workflows/cleanup-report.yml
+    secrets: inherit
+
   required:
     needs:
       [

.yarn/versions/131c302f.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/1a9c19c8.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/3524136b.yml

@@ -0,0 +1,3 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/prisma"

.yarn/versions/4b30916e.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/4f0b582f.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/54a3a129.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/5d55574e.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/7370f650.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/8c8f795b.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/8c9cdea6.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/b17fdbcb.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/befbca2c.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/c02d84cf.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/f6d5d745.yml

@@ -0,0 +1,7 @@
+undecided:
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/fa70f6c1.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

.yarn/versions/fcc3519d.yml

@@ -0,0 +1,8 @@
+undecided:
+  - calcom-monorepo
+  - "@calcom/app-store-cli"
+  - "@calcom/platform-constants"
+  - "@calcom/platform-enums"
+  - "@calcom/platform-types"
+  - "@calcom/platform-utils"
+  - "@calcom/prisma"

CONTRIBUTING.md

@@ -1,43 +1,76 @@
 # Contributing to Cal.com
 
-Contributions are what makes the open source community such an amazing place to learn, inspire, and create. Any contributions you make are **greatly appreciated**.
+Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are **greatly appreciated**.
 
-## House rules
+## House Rules (for PRs and Issues)
 
-- Before submitting a new issue or PR, check if it already exists in [issues](https://github.com/calcom/cal.com/issues) or [PRs](https://github.com/calcom/cal.com/pulls).
-- GitHub issues: take note of the `🚨 needs approval` label.
-  - **For Contributors**:
-    - Feature Requests: Wait for a core member to approve and remove the `🚨 needs approval` label before you start coding or submit a PR.
-    - Bugs, Security, Performance, Documentation, etc.: You can start coding immediately, even if the `🚨 needs approval` label is present. This label mainly concerns feature requests.
-  - **Our Process**:
-    - Issues from non-core members automatically receive the `🚨 needs approval` label.
-    - We greatly value new feature ideas. To ensure consistency in the product's direction, they undergo review and approval.
+### 👥 Prevent Work Duplication
+
+Before submitting a new issue or PR, check if it already exists in the [Issues](https://github.com/calcom/cal.com/issues) or [Pull Requests](https://github.com/calcom/cal.com/pulls).
+
+### ✅ Work Only on Approved Issues
+
+For feature requests, please wait for a core team member to approve and remove the `🚨 needs approval` label before you start coding or submitting a PR.
+
+For bugs, security, performance, documentation, etc., you can start coding immediately—even if the `🚨 needs approval` label is present.
+
+We highly value new feature ideas, but to maintain consistency in the product direction, they must go through a review and approval process.
+
+### 🚫 Don’t Just Drop a Link
+
+Avoid posting third-party links (e.g., Slack threads or Linear tickets) without context. A GitHub issue or PR should stand on its own—reviewers shouldn’t have to chase information across multiple tools to understand the context.
+
+### 👀 Think Like a Reviewer
+
+Put yourself in the reviewer’s shoes. What would you want to know if reading this for the first time? Are there key decisions, goals, or constraints that need clarification? Does the PR assume knowledge that isn’t obvious? Are there related issues or previous PRs that should be linked?
+
+### 🧵 Bring in Context from Private Channels
+
+If the task originated from a private conversation (e.g., Slack), take a moment to extract the relevant details and include them in the GitHub issue or PR. Avoid sharing sensitive information, but make sure important reasoning is captured.
+
+> Example:  
+> “A user requested feature X to solve problem Y. I considered approaches A, B, and C, but chose C for the following reasons…”
+
+### 📚 Treat It Like Documentation
+
+GitHub is a shared source of truth. Every issue and PR contributes to the long-term understanding of the codebase. Write clearly enough that someone—possibly you—can revisit it months later and still understand what happened and why.
+
+### ✅ Summarize Your PR at the Top
+
+Even if the code changes are minor or self-explanatory, a short written summary helps reviewers quickly understand the intent. You can use GitHub Copilot’s auto-summarize feature, but make sure to verify it for accuracy and relevance.
+
+### 🔗 Use GitHub Keywords to Auto-Link Issues
+
+Use phrases like “Closes #123” or “Fixes #456” in your PR descriptions. This automatically links your PR to the related issue and closes it once merged—keeping everything traceable and organized.
+
+### 🧪 Mention What Was Tested (and How)
+
+Explain how you validated your changes. It doesn’t need to be exhaustive—just enough to give reviewers confidence that things were tested and work as expected.
+
+> Example:  
+> “Tested locally with mock data and confirmed the flow works on staging.”
+
+### 🧠 Assume Future-You Won’t Remember
+
+Write with the future in mind. If there are trade-offs, edge cases, or temporary workarounds, document them clearly so they don’t get lost or misinterpreted later.
 
 ## Priorities
 
 <table>
   <tr>
-    <td>
-      Type of Issue
-    </td>
-    <td>
-      Priority
-    </td>
+    <td><strong>Type of Issue</strong></td>
+    <td><strong>Priority</strong></td>
   </tr>
   <tr>
-    <td>
-      Minor improvements, non-core feature requests
-    </td>
+    <td>Minor improvements, non-core feature requests</td>
     <td>
       <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:%22Low+priority%22">
         <img src="https://img.shields.io/badge/-Low%20Priority-green">
       </a>
     </td>
   </tr>
-   <tr>
-    <td>
-      Confusing UX (... but working)
-    </td>
+  <tr>
+    <td>Confusing UX (but still functional)</td>
     <td>
       <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:%22Medium+priority%22">
         <img src="https://img.shields.io/badge/-Medium%20Priority-yellow">
@@ -45,9 +78,7 @@ Contributions are what makes the open source community such an amazing place to
     </td>
   </tr>
   <tr>
-    <td>
-      Core Features (Booking page, availability, timezone calculation)
-    </td>
+    <td>Core Features (Booking page, availability, timezone calculation)</td>
     <td>
       <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:%22High+priority%22">
         <img src="https://img.shields.io/badge/-High%20Priority-orange">
@@ -55,9 +86,7 @@ Contributions are what makes the open source community such an amazing place to
     </td>
   </tr>
   <tr>
-    <td>
-      Core Bugs (Login, Booking page, Emails are not working)
-    </td>
+    <td>Core Bugs (Login, Booking page, Emails not working)</td>
     <td>
       <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:Urgent">
         <img src="https://img.shields.io/badge/-Urgent-red">
@@ -68,59 +97,7 @@ Contributions are what makes the open source community such an amazing place to
 
 ## Developing
 
-The development branch is `main`. This is the branch that all pull
-requests should be made against. The changes on the `main`
-branch are tagged into a release monthly.
-
-To develop locally:
-
-1. [Fork](https://github.com/calcom/cal.com/fork/) this repository to your
-   own GitHub account and then
-   [clone](https://help.github.com/articles/cloning-a-repository/) it to your local device.
-2. Create a new branch:
-
-   ```sh
-   git checkout -b MY_BRANCH_NAME
-   ```
-
-3. Install yarn:
-
-   ```sh
-   npm install -g yarn
-   ```
-
-4. Install the dependencies with:
-
-   ```sh
-   yarn
-   ```
-
-5. Set up your `.env` file:
-
-   - Duplicate `.env.example` to `.env`.
-   - Use `openssl rand -base64 32` to generate a key and add it under `NEXTAUTH_SECRET` in the `.env` file.
-   - Use `openssl rand -base64 32` to generate a key and add it under `CALENDSO_ENCRYPTION_KEY` in the `.env` file.
-
-6. Setup Node
-   If your Node version does not meet the project's requirements as instructed by the docs, "nvm" (Node Version Manager) allows using Node at the version required by the project:
-
-   ```sh
-   nvm use
-   ```
-
-   You first might need to install the specific version:
-
-   ```sh
-   nvm install
-   ```
-
-   You can install nvm from [here](https://github.com/nvm-sh/nvm).
-
-7. Start developing and watch for code changes:
-
-   ```sh
-   yarn dev
-   ```
+[See README](https://github.com/calcom/cal.com#development)
 
 ## Building
 
@@ -130,23 +107,19 @@ You can build the project with:
 yarn build
 ```
 
-Please be sure that you can make a full production build before pushing code.
+Please ensure that you can make a full production build before pushing code.
 
 ## Testing
 
 More info on how to add new tests coming soon.
 
-### Running tests
+### Running Tests
 
-This will run and test all flows in multiple Chromium windows to verify that no critical flow breaks:
+[See README](https://github.com/calcom/cal.com#e2e-testing)
 
-```sh
-yarn test-e2e
-```
+#### Resolving Issues
 
-#### Resolving issues
-
-##### E2E test browsers not installed
+##### E2E Test Browsers Not Installed
 
 Run `npx playwright install` to download test browsers and resolve the error below when running `yarn test-e2e`:
 
@@ -166,68 +139,8 @@ If you get errors, be sure to fix them before committing.
 
 ## Making a Pull Request
 
-- Be sure to [check the "Allow edits from maintainers" option](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork) while creating your PR.
-- If your PR refers to or fixes an issue, be sure to add `refs #XXX` or `fixes #XXX` to the PR description. Replacing `XXX` with the respective issue number. See more about [Linking a pull request to an issue](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).
-- Be sure to fill the PR Template accordingly.
-- Review [App Contribution Guidelines](./packages/app-store/CONTRIBUTING.md) when building integrations
-
-## Guidelines for committing yarn lockfile
-
-Do not commit your `yarn.lock` unless you've made changes to the `package.json`. If you've already committed `yarn.lock` unintentionally, follow these steps to undo:
-
-If your last commit has the `yarn.lock` file alongside other files and you only wish to uncommit the `yarn.lock`:
-
-```bash
-git checkout HEAD~1 yarn.lock
-git commit -m "Revert yarn.lock changes"
-```
-
-_NB_: You may have to bypass the pre-commit hook with by appending `--no-verify` to the git commit
-If you've pushed the commit with the `yarn.lock`:
-
-1.  Correct the commit locally using the above method.
-2.  Carefully force push:
-
-```bash
-git push origin <your-branch-name> --force
-```
-
-If `yarn.lock` was committed a while ago and there have been several commits since, you can use the following steps to revert just the `yarn.lock` changes without impacting the subsequent changes:
-
-1. **Checkout a Previous Version**:
-
-   - Find the commit hash before the `yarn.lock` was unintentionally committed. You can do this by viewing the Git log:
-
-     ```bash
-     git log yarn.lock
-     ```
-
-   - Once you have identified the commit hash, use it to checkout the previous version of `yarn.lock`:
-
-     ```bash
-     git checkout <commit_hash> yarn.lock
-     ```
-
-2. **Commit the Reverted Version**:
-
-   - After checking out the previous version of the `yarn.lock`, commit this change:
-
-     ```bash
-     git commit -m "Revert yarn.lock to its state before unintended changes"
-     ```
-
-3. **Proceed with Caution**:
-
-   - If you need to push this change, first pull the latest changes from your remote branch to ensure you're not overwriting other recent changes:
-
-     ```bash
-     git pull origin <your-branch-name>
-     ```
-
-   - Then push the updated branch:
-
-     ```bash
-     git push origin <your-branch-name>
-     ```
-
-Lastly, make sure to keep the branches updated (e.g. click the `Update branch` button on GitHub PR).
+- Be sure to [check the "Allow edits from maintainers" option](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork) when creating your PR. (This option isn't available if you're [contributing from a fork belonging to an organization](https://github.com/orgs/community/discussions/5634))
+- If your PR refers to or fixes an issue, add `refs #XXX` or `fixes #XXX` to the PR description. Replace `XXX` with the respective issue number. See more about [linking a pull request to an issue](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).
+- Fill out the PR template accordingly.
+- Review the [App Contribution Guidelines](./packages/app-store/CONTRIBUTING.md) when building integrations.
+- Lastly, make sure to keep your branches updated (e.g., click the `Update branch` button on the GitHub PR page).

PR_TODO.md

@@ -0,0 +1,15 @@
+Possible issue:
+- We won't be able to use already built calendar-cache when Delegation Credential is enabled because existing CalendarCache entries don't have userId set.
+
+## Approach of always using SelectedCalendar.credentialId for CalendarCache even for DelegationCredentials
+- Delete Credentials when DelegationCredential is disabled
+
+
+TO Test
+- New members beyond the batch size are processed
+
+
+
+
+
+

README.md

@@ -646,6 +646,14 @@ following
 15. Create a verify service
 16. Copy Verify Service SID to your `.env` file into the `TWILIO_VERIFY_SID` field
 
+## Changesets
+
+We use changesets to generate changelogs and publish public packages (packages with `private: true` are ignored).
+
+An example of good readme is [atoms readme](https://github.com/calcom/cal.com/blob/main/packages/platform/atoms/README.md). Every public package must:
+1. Follow semantic versioning when using changesets.
+2. Mark breaking changes using `❗️Breaking change`
+
 <!-- LICENSE -->
 
 ## License

apps/api/v1/lib/utils/bookings/get/buildWhereClause.ts

@@ -0,0 +1,37 @@
+/**
+ * Constructs the WHERE clause for Prisma booking findMany operation.
+ *
+ * @param userId - The ID of the user making the request. This is used to filter bookings where the user is either the host or an attendee.
+ * @param attendeeEmails - An array of emails provided in the request for filtering bookings by attendee emails, used in case of Admin calls.
+ * @param userIds - An array of user IDs to be included in the filter. Defaults to an empty array, and an array of user IDs in case of Admin call containing it.
+ * @param userEmails - An array of user emails to be included in the filter if it is an Admin call and contains userId in query parameter. Defaults to an empty array.
+ *
+ * @returns An object that represents the WHERE clause for the findMany/findUnique operation.
+ */
+export function buildWhereClause(userId: number | null, attendeeEmails: string[], userIds: number[] = []) {
+  const filterByAttendeeEmails = attendeeEmails.length > 0;
+  const userFilter = userIds.length > 0 ? { userId: { in: userIds } } : !!userId ? { userId } : {};
+
+  let whereClause = {};
+
+  if (filterByAttendeeEmails) {
+    whereClause = {
+      AND: [
+        userFilter,
+        {
+          attendees: {
+            some: {
+              email: { in: attendeeEmails },
+            },
+          },
+        },
+      ],
+    };
+  } else {
+    whereClause = {
+      ...userFilter,
+    };
+  }
+
+  return whereClause;
+}

apps/api/v1/package.json

@@ -30,7 +30,7 @@
     "@calcom/lib": "*",
     "@calcom/prisma": "*",
     "@calcom/trpc": "*",
-    "@sentry/nextjs": "^8.8.0",
+    "@sentry/nextjs": "^9.15.0",
     "bcryptjs": "^2.4.3",
     "memory-cache": "^0.2.0",
     "next": "^13.5.9",

apps/api/v1/pages/api/bookings/_get.ts

@@ -1,4 +1,4 @@
-import type { Prisma } from "@prisma/client";
+import type { Prisma, Booking } from "@prisma/client";
 import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
@@ -6,6 +6,7 @@ import { defaultResponder } from "@calcom/lib/server/defaultResponder";
 import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "~/lib/helpers/withMiddleware";
+import { buildWhereClause } from "~/lib/utils/bookings/get/buildWhereClause";
 import {
   getAccessibleUsers,
   retrieveOrgScopedAccessibleUsers,
@@ -151,58 +152,6 @@ type GetAdminArgsType = {
   userId: number;
 };
 
-/**
- * Constructs the WHERE clause for Prisma booking findMany operation.
- *
- * @param userId - The ID of the user making the request. This is used to filter bookings where the user is either the host or an attendee.
- * @param attendeeEmails - An array of emails provided in the request for filtering bookings by attendee emails, used in case of Admin calls.
- * @param userIds - An array of user IDs to be included in the filter. Defaults to an empty array, and an array of user IDs in case of Admin call containing it.
- * @param userEmails - An array of user emails to be included in the filter if it is an Admin call and contains userId in query parameter. Defaults to an empty array.
- *
- * @returns An object that represents the WHERE clause for the findMany/findUnique operation.
- */
-function buildWhereClause(
-  userId: number | null,
-  attendeeEmails: string[],
-  userIds: number[] = [],
-  userEmails: string[] = []
-) {
-  const filterByAttendeeEmails = attendeeEmails.length > 0;
-  const userFilter = userIds.length > 0 ? { userId: { in: userIds } } : !!userId ? { userId } : {};
-
-  let whereClause = {};
-
-  if (filterByAttendeeEmails) {
-    whereClause = {
-      AND: [
-        userFilter,
-        {
-          attendees: {
-            some: {
-              email: { in: attendeeEmails },
-            },
-          },
-        },
-      ],
-    };
-  } else {
-    whereClause = {
-      OR: [
-        userFilter,
-        {
-          attendees: {
-            some: {
-              email: { in: userEmails },
-            },
-          },
-        },
-      ],
-    };
-  }
-
-  return whereClause;
-}
-
 export async function handler(req: NextApiRequest) {
   const {
     userId,
@@ -238,6 +187,7 @@ export async function handler(req: NextApiRequest) {
     ? [queryFilterForAttendeeEmails.attendeeEmail]
     : [];
   const filterByAttendeeEmails = attendeeEmails.length > 0;
+  let userEmailsToFilterBy: string[] = [];
 
   /** Only admins can query other users */
   if (isSystemWideAdmin) {
@@ -251,7 +201,8 @@ export async function handler(req: NextApiRequest) {
         userId,
       };
       const { userId: argUserId, userIds, userEmails } = await handleSystemWideAdminArgs(systemWideAdminArgs);
-      args.where = buildWhereClause(argUserId, attendeeEmails, userIds, userEmails);
+      userEmailsToFilterBy = userEmails;
+      args.where = buildWhereClause(argUserId, attendeeEmails, userIds);
     }
   } else if (isOrganizationOwnerOrAdmin) {
     let requestedUserIds = [userId];
@@ -265,7 +216,8 @@ export async function handler(req: NextApiRequest) {
       userId,
     };
     const { userId: argUserId, userIds, userEmails } = await handleOrgWideAdminArgs(orgWideAdminArgs);
-    args.where = buildWhereClause(argUserId, attendeeEmails, userIds, userEmails);
+    userEmailsToFilterBy = userEmails;
+    args.where = buildWhereClause(argUserId, attendeeEmails, userIds);
   } else {
     const user = await prisma.user.findUnique({
       where: { id: userId },
@@ -276,7 +228,7 @@ export async function handler(req: NextApiRequest) {
     if (!user) {
       throw new HttpError({ message: "User not found", statusCode: 404 });
     }
-    args.where = buildWhereClause(userId, attendeeEmails, [], []);
+    args.where = buildWhereClause(userId, attendeeEmails, []);
   }
 
   if (dateFrom) {
@@ -317,7 +269,77 @@ export async function handler(req: NextApiRequest) {
     }
   }
 
-  const data = await prisma.booking.findMany(args);
+  let data: Booking[] = [];
+
+  if (!filterByAttendeeEmails && userEmailsToFilterBy.length > 0) {
+    const queryOne = prisma.booking.findMany(args);
+
+    const whereClauseForQueryTwo: Prisma.BookingWhereInput = {
+      attendees: {
+        some: {
+          email: { in: userEmailsToFilterBy },
+        },
+      },
+    };
+
+    if (dateFrom) {
+      whereClauseForQueryTwo.startTime = { gte: dateFrom };
+    }
+    if (dateTo) {
+      whereClauseForQueryTwo.endTime = { lte: dateTo };
+    }
+    if (status === "upcoming") {
+      whereClauseForQueryTwo.startTime = { gte: new Date().toISOString() };
+    }
+
+    const argsForQueryTwo: Prisma.BookingFindManyArgs = {
+      ...args,
+      where: whereClauseForQueryTwo,
+    };
+
+    const queryTwo = prisma.booking.findMany(argsForQueryTwo);
+
+    const [resultOne, resultTwo] = await Promise.all([queryOne, queryTwo]);
+
+    const bookingMap = new Map();
+    [...resultOne, ...resultTwo].forEach((booking) => {
+      bookingMap.set(booking.id, booking);
+    });
+
+    const dedupedResults = Array.from(bookingMap.values());
+
+    if (args.orderBy) {
+      let sortField: keyof Booking;
+      let sortDirection: "asc" | "desc" = "asc";
+
+      if (typeof args.orderBy === "object" && !Array.isArray(args.orderBy)) {
+        const orderByKey = Object.keys(args.orderBy)[0] as keyof typeof args.orderBy;
+        sortField = orderByKey as keyof Booking;
+        sortDirection = args.orderBy[orderByKey] as "asc" | "desc";
+      } else {
+        sortField = "id";
+      }
+
+      const sortOrder = sortDirection === "desc" ? -1 : 1;
+
+      dedupedResults.sort((a, b) => {
+        const aValue = a[sortField];
+        const bValue = b[sortField];
+
+        if (aValue < bValue) return -1 * sortOrder;
+        if (aValue > bValue) return 1 * sortOrder;
+        return 0;
+      });
+    }
+
+    if (args.take !== undefined && args.skip !== undefined) {
+      data = dedupedResults.slice(args.skip, args.skip + args.take);
+    } else {
+      data = dedupedResults;
+    }
+  } else {
+    data = await prisma.booking.findMany(args);
+  }
   return { bookings: data.map((booking) => schemaBookingReadPublic.parse(booking)) };
 }
 

apps/api/v1/pages/api/destination-calendars/[id]/_patch.ts

@@ -185,7 +185,12 @@ async function verifyCredentialsAndGetId({
   currentCredentialId: number | null;
 }) {
   if (parsedBody.integration && parsedBody.externalId) {
-    const calendarCredentials = getCalendarCredentialsWithoutDelegation(userCredentials);
+    const calendarCredentials = getCalendarCredentialsWithoutDelegation(
+      userCredentials.map((cred) => ({
+        ...cred,
+        delegationCredentialId: null,
+      }))
+    );
 
     const { connectedCalendars } = await getConnectedCalendars(
       calendarCredentials,

apps/api/v1/pages/api/memberships/_post.ts

@@ -24,7 +24,12 @@ import { membershipCreateBodySchema, schemaMembershipPublic } from "~/lib/valida
  */
 async function postHandler(req: NextApiRequest) {
   const data = membershipCreateBodySchema.parse(req.body);
-  const args: Prisma.MembershipCreateArgs = { data };
+  const args: Prisma.MembershipCreateArgs = {
+    data: {
+      createdAt: new Date(),
+      ...data,
+    },
+  };
 
   await checkPermissions(req);
 

apps/api/v1/pages/api/slots/_get.ts

@@ -3,8 +3,7 @@ import utc from "dayjs/plugin/utc";
 import type { NextApiRequest, NextApiResponse } from "next";
 
 import dayjs from "@calcom/dayjs";
-import { IS_PRODUCTION } from "@calcom/lib/constants";
-import { isSupportedTimeZone } from "@calcom/lib/date-fns";
+import { isSupportedTimeZone } from "@calcom/lib/dayjs";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
 import { createContext } from "@calcom/trpc/server/createContext";
@@ -18,15 +17,8 @@ import { getHTTPStatusCodeFromError } from "@trpc/server/http";
 dayjs.extend(utc);
 dayjs.extend(timezone);
 
-let isColdStart = true;
-
 async function handler(req: NextApiRequest, res: NextApiResponse) {
   try {
-    if (isColdStart && IS_PRODUCTION) {
-      console.log("Cold start of /v1/slots detected");
-      isColdStart = false;
-    }
-
     const { usernameList, isTeamEvent, ...rest } = req.query;
     const parsedIsTeamEvent = String(isTeamEvent).toLowerCase() === "true";
     let slugs = usernameList;

apps/api/v1/sentry.client.config.ts

@@ -1 +0,0 @@
-export {};

apps/api/v1/test/lib/bookings/_get.integration-test.ts

@@ -2,6 +2,7 @@ import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { createMocks } from "node-mocks-http";
 import { describe, expect, it } from "vitest";
+import { ZodError } from "zod";
 
 import prisma from "@calcom/prisma";
 
@@ -206,8 +207,155 @@ describe("GET /api/bookings", async () => {
       console.log("bookings=>", responseData.bookings);
       responseData.bookings.forEach((booking) => {
         if (booking.id === 31) expect(booking.eventType?.team?.slug).toBe("team1");
-        if (booking.id === 19) expect(booking.eventType?.team).toBe(null);
+        if (booking.id === 19) {
+          // The team field can be either null or undefined due to nullish() in the schema
+          expect(booking.eventType?.team === null || booking.eventType?.team === undefined).toBe(true);
+        }
       });
     });
   });
+
+  describe("Date filtering", () => {
+    it("filters bookings by dateFrom", async () => {
+      const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+        method: "GET",
+        query: {
+          dateFrom: "2023-01-01T00:00:00Z",
+        },
+        pagination: DefaultPagination,
+      });
+
+      req.userId = proUser.id;
+
+      const responseData = await handler(req);
+      responseData.bookings.forEach((booking) => {
+        expect(new Date(booking.startTime).getTime()).toBeGreaterThanOrEqual(
+          new Date("2023-01-01T00:00:00Z").getTime()
+        );
+      });
+    });
+
+    it("filters bookings by dateTo", async () => {
+      const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+        method: "GET",
+        query: {
+          dateTo: "2024-12-31T23:59:59Z",
+        },
+        pagination: DefaultPagination,
+      });
+
+      req.userId = proUser.id;
+
+      const responseData = await handler(req);
+      responseData.bookings.forEach((booking) => {
+        expect(new Date(booking.endTime).getTime()).toBeLessThanOrEqual(
+          new Date("2024-12-31T23:59:59Z").getTime()
+        );
+      });
+    });
+  });
+
+  describe("Sorting and ordering", () => {
+    it("sorts bookings by createdAt in descending order", async () => {
+      const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+        method: "GET",
+        query: {
+          sortBy: "createdAt",
+          order: "desc",
+        },
+        pagination: DefaultPagination,
+      });
+
+      req.userId = proUser.id;
+
+      const responseData = await handler(req);
+      const timestamps = responseData.bookings.map((b) => new Date(b.createdAt).getTime());
+      expect(timestamps).toEqual([...timestamps].sort((a, b) => b - a));
+    });
+  });
+
+  describe("Multiple attendee email filtering", () => {
+    it("filters bookings by multiple attendee emails", async () => {
+      const attendeeEmails = ["test1@example.com", "test2@example.com"];
+      const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+        method: "GET",
+        query: {
+          attendeeEmail: attendeeEmails,
+        },
+        pagination: DefaultPagination,
+      });
+
+      req.userId = proUser.id;
+
+      const responseData = await handler(req);
+      responseData.bookings.forEach((booking) => {
+        const bookingAttendeeEmails = booking.attendees?.map((a) => a.email);
+        expect(bookingAttendeeEmails?.some((email) => attendeeEmails.includes(email))).toBe(true);
+      });
+    });
+  });
+
+  describe("Error cases", () => {
+    it("throws error for invalid status parameter", async () => {
+      const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+        method: "GET",
+        query: {
+          status: "invalid_status",
+        },
+        pagination: DefaultPagination,
+      });
+
+      req.userId = proUser.id;
+
+      await expect(handler(req)).rejects.toThrow(ZodError);
+    });
+  });
+
+  describe("Result merging", () => {
+    it("does not return duplicate bookings when merging results from multiple queries", async () => {
+      const adminUser = await prisma.user.findFirstOrThrow({ where: { email: "owner1-acme@example.com" } });
+
+      const testUser = await prisma.user.findFirstOrThrow({ where: { email: "pro@example.com" } });
+
+      const testUserBooking = await prisma.booking.findFirstOrThrow({
+        where: { userId: testUser.id },
+        include: { attendees: true },
+      });
+
+      const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
+        method: "GET",
+        query: {
+          userId: testUser.id, // This will make userEmailsToFilterBy contain the test user's email
+        },
+        pagination: {
+          take: 100,
+          skip: 0,
+        },
+      });
+
+      req.isSystemWideAdmin = true;
+      req.userId = adminUser.id;
+
+      const responseData = await handler(req);
+
+      const bookingIds = responseData.bookings.map((booking) => booking.id);
+
+      const uniqueBookingIds = new Set(bookingIds);
+
+      expect(uniqueBookingIds.size).toBe(bookingIds.length);
+
+      if (uniqueBookingIds.size !== bookingIds.length) {
+        const counts = bookingIds.reduce((acc, id) => {
+          acc[id] = (acc[id] || 0) + 1;
+          return acc;
+        }, {} as Record<number, number>);
+
+        const duplicates = Object.entries(counts)
+          .filter(([_, count]) => count > 1)
+          .map(([id]) => id);
+
+        console.log(`Found duplicate booking IDs: ${duplicates.join(", ")}`);
+      }
+    });
+  });
 });

apps/api/v1/test/lib/bookings/get/buildWhereClause.test.ts

@@ -0,0 +1,75 @@
+import { describe, it, expect } from "vitest";
+
+import { buildWhereClause } from "~/lib/utils/bookings/get/buildWhereClause";
+
+describe("buildWhereClause", () => {
+  it("should return empty object when no filters are provided", () => {
+    const result = buildWhereClause(null, [], []);
+    expect(result).toEqual({});
+  });
+
+  it("should filter by userId when only userId is provided", () => {
+    const userId = 123;
+    const result = buildWhereClause(userId, [], []);
+    expect(result).toEqual({ userId: 123 });
+  });
+
+  it("should filter by userIds when userIds array is provided", () => {
+    const userIds = [1, 2, 3];
+    const result = buildWhereClause(null, [], userIds);
+    expect(result).toEqual({ userId: { in: [1, 2, 3] } });
+  });
+
+  it("should filter by attendee emails when provided", () => {
+    const attendeeEmails = ["test@example.com", "user@example.com"];
+    const result = buildWhereClause(null, attendeeEmails, []);
+    expect(result).toEqual({
+      AND: [
+        {},
+        {
+          attendees: {
+            some: {
+              email: { in: ["test@example.com", "user@example.com"] },
+            },
+          },
+        },
+      ],
+    });
+  });
+
+  it("should combine userId and attendee email filters", () => {
+    const userId = 123;
+    const attendeeEmails = ["test@example.com"];
+    const result = buildWhereClause(userId, attendeeEmails, []);
+    expect(result).toEqual({
+      AND: [
+        { userId: 123 },
+        {
+          attendees: {
+            some: {
+              email: { in: ["test@example.com"] },
+            },
+          },
+        },
+      ],
+    });
+  });
+
+  it("should combine userIds and attendee email filters", () => {
+    const userIds = [1, 2, 3];
+    const attendeeEmails = ["test@example.com"];
+    const result = buildWhereClause(null, attendeeEmails, userIds);
+    expect(result).toEqual({
+      AND: [
+        { userId: { in: [1, 2, 3] } },
+        {
+          attendees: {
+            some: {
+              email: { in: ["test@example.com"] },
+            },
+          },
+        },
+      ],
+    });
+  });
+});

apps/api/v2/README.md

@@ -107,6 +107,14 @@ $ yarn test:e2e:watch --testPathPattern=filePath
 $ yarn run test:cov
 ```
 
+## Conventions
+
+### Guards
+1. In case a guard would return "false" for "canActivate" instead throw ForbiddenException with an error message containing guard name and the error.
+2. In case a guard would return "false" for "canActivate" DO NOT cache the result in redis, because we don't want that someone is forbidden, updates whatever was the problem, and then has to wait for cache to expire. We only cache in redis guard results where "canAccess" is "true".
+3. If you use ApiAuthGuard but want that only specific auth method is allowed, for example, api key, then you also need to add `@ApiAuthGuardOnlyAllow(["API_KEY"])` under the `@UseGuards(ApiAuthGuard)`. Shortly, use `ApiAuthGuardOnlyAllow` to specify which auth methods are allowed by `ApiAuthGuard`. If `ApiAuthGuardOnlyAllow` is not used or nothing is passed to it or empty array it means that
+all auth methods are allowed.
+
 ## Support
 
 Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please [read more here](https://docs.nestjs.com/support).

apps/api/v2/jest-e2e.json

@@ -11,6 +11,7 @@
     "^.+\\.(t|j)s$": "ts-jest"
   },
   "setupFiles": ["<rootDir>/test/setEnvVars.ts", "jest-date-mock"],
+  "setupFilesAfterEnv": ["<rootDir>/test/jest.setup-e2e.ts"],
   "reporters": ["default", "jest-summarizing-reporter"],
   "workerIdleMemoryLimit": "512MB",
   "maxWorkers": 8

apps/api/v2/package.json

@@ -3,7 +3,6 @@
   "version": "0.0.1",
   "description": "Platform API for Cal.com",
   "author": "Cal.com Inc.",
-  "private": true,
   "license": "UNLICENSED",
   "scripts": {
     "build": "yarn dev:build && nest build",
@@ -38,7 +37,7 @@
     "@axiomhq/winston": "^1.2.0",
     "@calcom/platform-constants": "*",
     "@calcom/platform-enums": "*",
-    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.172",
+    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.202",
     "@calcom/platform-libraries-0.0.2": "npm:@calcom/platform-libraries@0.0.2",
     "@calcom/platform-types": "*",
     "@calcom/platform-utils": "*",
@@ -46,6 +45,7 @@
     "@golevelup/ts-jest": "^0.4.0",
     "@microsoft/microsoft-graph-types-beta": "^0.42.0-preview",
     "@nest-lab/throttler-storage-redis": "1.0.0",
+    "@nestjs/axios": "^4.0.0",
     "@nestjs/bull": "^10.1.1",
     "@nestjs/common": "^10.0.0",
     "@nestjs/config": "^3.1.1",

apps/api/v2/src/ee/bookings/2024-04-15/bookings.module.ts

@@ -9,6 +9,7 @@ import { ApiKeysRepository } from "@/modules/api-keys/api-keys-repository";
 import { AppsRepository } from "@/modules/apps/apps.repository";
 import { BillingModule } from "@/modules/billing/billing.module";
 import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
+import { KyselyModule } from "@/modules/kysely/kysely.module";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { OAuthClientUsersService } from "@/modules/oauth-clients/services/oauth-clients-users.service";
 import { OAuthFlowService } from "@/modules/oauth-clients/services/oauth-flow.service";
@@ -23,6 +24,7 @@ import { Module } from "@nestjs/common";
 @Module({
   imports: [
     PrismaModule,
+    KyselyModule,
     RedisModule,
     TokensModule,
     BillingModule,

apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts

@@ -13,6 +13,7 @@ import { Permissions } from "@/modules/auth/decorators/permissions/permissions.d
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
 import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
 import { BillingService } from "@/modules/billing/services/billing.service";
+import { KyselyReadService } from "@/modules/kysely/kysely-read.service";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { OAuthClientUsersService } from "@/modules/oauth-clients/services/oauth-clients-users.service";
 import { OAuthFlowService } from "@/modules/oauth-clients/services/oauth-flow.service";
@@ -99,6 +100,7 @@ export class BookingsController_2024_04_15 {
   constructor(
     private readonly oAuthFlowService: OAuthFlowService,
     private readonly prismaReadService: PrismaReadService,
+    private readonly kyselyReadService: KyselyReadService,
     private readonly oAuthClientRepository: OAuthClientRepository,
     private readonly billingService: BillingService,
     private readonly config: ConfigService,
@@ -129,6 +131,7 @@ export class BookingsController_2024_04_15 {
       ctx: {
         user: { email: user.email, id: user.id, orgId: profile?.organizationId },
         prisma: this.prismaReadService.prisma as unknown as PrismaClient,
+        kysely: this.kyselyReadService.kysely,
       },
     });
 

apps/api/v2/src/ee/bookings/2024-08-13/booking-references.repository.ts

@@ -0,0 +1,27 @@
+import { BookingReferencesFilterInput_2024_08_13 } from "@/ee/bookings/2024-08-13/inputs/booking-references-filter.input";
+import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
+import { Injectable } from "@nestjs/common";
+import type { Prisma } from "@prisma/client";
+
+@Injectable()
+export class BookingReferencesRepository_2024_08_13 {
+  constructor(private readonly dbRead: PrismaReadService) {}
+
+  async getBookingReferences(bookingId: number, filter?: BookingReferencesFilterInput_2024_08_13) {
+    const whereClause: Prisma.BookingReferenceWhereInput = { bookingId };
+
+    if (filter?.type) {
+      whereClause.type = filter.type;
+    }
+
+    return this.dbRead.prisma.bookingReference.findMany({
+      where: whereClause,
+      select: {
+        type: true,
+        uid: true,
+        id: true,
+        externalCalendarId: true,
+      },
+    });
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/bookings.module.ts

@@ -1,7 +1,11 @@
+import { BookingReferencesRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/booking-references.repository";
 import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/bookings.repository";
 import { BookingsController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/bookings.controller";
+import { BookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-references.service";
 import { BookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/bookings.service";
+import { ErrorsBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/errors.service";
 import { InputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/input.service";
+import { OutputBookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output-booking-references.service";
 import { OutputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output.service";
 import { PlatformBookingsService } from "@/ee/bookings/shared/platform-bookings.service";
 import { CalendarsRepository } from "@/ee/calendars/calendars.repository";
@@ -16,12 +20,18 @@ import { BillingModule } from "@/modules/billing/billing.module";
 import { BookingSeatModule } from "@/modules/booking-seat/booking-seat.module";
 import { BookingSeatRepository } from "@/modules/booking-seat/booking-seat.repository";
 import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
+import { KyselyModule } from "@/modules/kysely/kysely.module";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { OAuthClientUsersService } from "@/modules/oauth-clients/services/oauth-clients-users.service";
 import { OAuthFlowService } from "@/modules/oauth-clients/services/oauth-flow.service";
+import { OrganizationsRepository } from "@/modules/organizations/index/organizations.repository";
+import { OrganizationsTeamsRepository } from "@/modules/organizations/teams/index/organizations-teams.repository";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
 import { RedisModule } from "@/modules/redis/redis.module";
 import { SelectedCalendarsRepository } from "@/modules/selected-calendars/selected-calendars.repository";
+import { StripeModule } from "@/modules/stripe/stripe.module";
+import { TeamsEventTypesModule } from "@/modules/teams/event-types/teams-event-types.module";
+import { TeamsModule } from "@/modules/teams/teams/teams.module";
 import { TokensModule } from "@/modules/tokens/tokens.module";
 import { TokensRepository } from "@/modules/tokens/tokens.repository";
 import { UsersModule } from "@/modules/users/users.module";
@@ -30,6 +40,7 @@ import { Module } from "@nestjs/common";
 @Module({
   imports: [
     PrismaModule,
+    KyselyModule,
     RedisModule,
     TokensModule,
     BillingModule,
@@ -38,6 +49,9 @@ import { Module } from "@nestjs/common";
     SchedulesModule_2024_04_15,
     EventTypesModule_2024_04_15,
     EventTypesModule_2024_06_14,
+    StripeModule,
+    TeamsModule,
+    TeamsEventTypesModule,
   ],
   providers: [
     TokensRepository,
@@ -47,6 +61,7 @@ import { Module } from "@nestjs/common";
     BookingsService_2024_08_13,
     InputBookingsService_2024_08_13,
     OutputBookingsService_2024_08_13,
+    OutputBookingReferencesService_2024_08_13,
     BookingsRepository_2024_08_13,
     EventTypesRepository_2024_06_14,
     BookingSeatRepository,
@@ -57,6 +72,11 @@ import { Module } from "@nestjs/common";
     AppsRepository,
     CalendarsRepository,
     SelectedCalendarsRepository,
+    OrganizationsTeamsRepository,
+    OrganizationsRepository,
+    ErrorsBookingsService_2024_08_13,
+    BookingReferencesService_2024_08_13,
+    BookingReferencesRepository_2024_08_13,
   ],
   controllers: [BookingsController_2024_08_13],
   exports: [InputBookingsService_2024_08_13, OutputBookingsService_2024_08_13, BookingsService_2024_08_13],

apps/api/v2/src/ee/bookings/2024-08-13/controllers/bookings.controller.ts

@@ -1,15 +1,20 @@
 import { BookingUidGuard } from "@/ee/bookings/2024-08-13/guards/booking-uid.guard";
+import { BookingReferencesFilterInput_2024_08_13 } from "@/ee/bookings/2024-08-13/inputs/booking-references-filter.input";
+import { BookingReferencesOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/booking-references.output";
 import { CalendarLinksOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/calendar-links.output";
 import { CancelBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/cancel-booking.output";
 import { CreateBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/create-booking.output";
 import { MarkAbsentBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/mark-absent.output";
 import { ReassignBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/reassign-booking.output";
 import { RescheduleBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/reschedule-booking.output";
+import { BookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-references.service";
 import { BookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/bookings.service";
 import { VERSION_2024_08_13_VALUE, VERSION_2024_08_13 } from "@/lib/api-versions";
 import { API_KEY_OR_ACCESS_TOKEN_HEADER } from "@/lib/docs/headers";
+import { PlatformPlan } from "@/modules/auth/decorators/billing/platform-plan.decorator";
 import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
 import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
+import { Roles } from "@/modules/auth/decorators/roles/roles.decorator";
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
 import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
 import { UsersService } from "@/modules/users/services/users.service";
@@ -82,7 +87,8 @@ export class BookingsController_2024_08_13 {
 
   constructor(
     private readonly bookingsService: BookingsService_2024_08_13,
-    private readonly usersService: UsersService
+    private readonly usersService: UsersService,
+    private readonly bookingReferencesService: BookingReferencesService_2024_08_13
   ) {}
 
   @Post("/")
@@ -100,9 +106,13 @@ export class BookingsController_2024_08_13 {
 
       The start needs to be in UTC aka if the timezone is GMT+2 in Rome and meeting should start at 11, then UTC time should have hours 09:00 aka without time zone.
 
-      Finally, there are 2 ways to book an event type:
+      Finally, there are 2 ways to book an event type belonging to an individual user:
       1. Provide \`eventTypeId\` in the request body.
       2. Provide \`eventTypeSlug\` and \`username\` and optionally \`organizationSlug\` if the user with the username is within an organization.
+
+      And 2 ways to book and event type belonging to a team:
+      1. Provide \`eventTypeId\` in the request body.
+      2. Provide \`eventTypeSlug\` and \`teamSlug\` and optionally \`organizationSlug\` if the team with the teamSlug is within an organization.
       `,
   })
   @ApiBody({
@@ -172,7 +182,7 @@ export class BookingsController_2024_08_13 {
   ): Promise<GetBookingsOutput_2024_08_13> {
     const profile = this.usersService.getUserMainProfile(user);
 
-    const bookings = await this.bookingsService.getBookings(queryParams, {
+    const { bookings, pagination } = await this.bookingsService.getBookings(queryParams, {
       email: user.email,
       id: user.id,
       orgId: profile?.organizationId,
@@ -181,6 +191,7 @@ export class BookingsController_2024_08_13 {
     return {
       status: SUCCESS_STATUS,
       data: bookings,
+      pagination,
     };
   }
 
@@ -256,7 +267,8 @@ export class BookingsController_2024_08_13 {
   @UseGuards(ApiAuthGuard, BookingUidGuard)
   @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @ApiOperation({
-    summary: "Mark a booking absence - provided authorization header refers to owner of the booking.",
+    summary: "Mark a booking absence",
+    description: "The provided authorization header refers to the owner of the booking.",
   })
   async markNoShow(
     @Param("bookingUid") bookingUid: string,
@@ -277,8 +289,8 @@ export class BookingsController_2024_08_13 {
   @UseGuards(ApiAuthGuard, BookingUidGuard)
   @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @ApiOperation({
-    summary:
-      "Automatically reassign booking to a new host automatically - provided authorization header refers to person who reassigned the booking.",
+    summary: "Reassign a booking to auto-selected host",
+    description: "The provided authorization header refers to the owner of the booking.",
   })
   async reassignBooking(
     @Param("bookingUid") bookingUid: string,
@@ -298,8 +310,8 @@ export class BookingsController_2024_08_13 {
   @UseGuards(ApiAuthGuard, BookingUidGuard)
   @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @ApiOperation({
-    summary:
-      "Reassign a booking to a specific user specified by the :userId - provided authorization header refers to person who reassigned the booking.",
+    summary: "Reassign a booking to a specific host",
+    description: "The provided authorization header refers to the owner of the booking.",
   })
   async reassignBookingToUser(
     @Param("bookingUid") bookingUid: string,
@@ -326,8 +338,8 @@ export class BookingsController_2024_08_13 {
   @UseGuards(ApiAuthGuard, BookingUidGuard)
   @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @ApiOperation({
-    summary:
-      "Confirm booking that requires a confirmation - provided authorization header refers to owner of the booking.",
+    summary: "Confirm a booking",
+    description: "The provided authorization header refers to the owner of the booking.",
   })
   async confirmBooking(
     @Param("bookingUid") bookingUid: string,
@@ -347,8 +359,8 @@ export class BookingsController_2024_08_13 {
   @UseGuards(ApiAuthGuard, BookingUidGuard)
   @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @ApiOperation({
-    summary:
-      "Decline booking that requires a confirmation - provided authorization header refers to owner of the booking.",
+    summary: "Decline a booking",
+    description: "The provided authorization header refers to the owner of the booking.",
   })
   async declineBooking(
     @Param("bookingUid") bookingUid: string,
@@ -381,4 +393,30 @@ export class BookingsController_2024_08_13 {
       data: calendarLinks,
     };
   }
+
+  @Get("/:bookingUid/references")
+  @PlatformPlan("SCALE")
+  @UseGuards(ApiAuthGuard, BookingUidGuard)
+  @Permissions([BOOKING_READ])
+  @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
+  @ApiOperation({
+    summary: "Get 'Booking References' for a booking",
+  })
+  @HttpCode(HttpStatus.OK)
+  async getBookingReferences(
+    @Param("bookingUid") bookingUid: string,
+    @GetUser("id") userId: number,
+    @Query() filter: BookingReferencesFilterInput_2024_08_13
+  ): Promise<BookingReferencesOutput_2024_08_13> {
+    const bookingReferences = await this.bookingReferencesService.getBookingReferences(
+      bookingUid,
+      userId,
+      filter
+    );
+
+    return {
+      status: SUCCESS_STATUS,
+      data: bookingReferences,
+    };
+  }
 }

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/booking-fields.e2e-spec.ts

@@ -55,6 +55,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
     let eventTypeId: number;
     let seatedEvent: EventType;
     let eventTypeWithBookingFields: EventType;
+    let eventTypeWithBookingFielsCustom: EventType;
     const eventTypeSlug = `booking-fields-2024-08-13-event-type-${randomString()}`;
     const eventTypeWithBookingFieldsSlug = `booking-fields-2024-08-13-event-type-${randomString()}`;
     const seatedEventTypeSlug = `booking-fields-2024-08-13-event-type-${randomString()}`;
@@ -331,6 +332,313 @@ describe("Bookings Endpoints 2024-08-13", () => {
         user.id
       );
 
+      eventTypeWithBookingFielsCustom = await eventTypesRepositoryFixture.create(
+        {
+          title: "test booking field types",
+          slug: "test-booking-field-types",
+          length: 30,
+          bookingFields: [
+            {
+              name: "name",
+              type: "name",
+              sources: [{ id: "default", type: "default", label: "Default" }],
+              variant: "fullName",
+              editable: "system",
+              required: true,
+              defaultLabel: "your_name",
+              variantsConfig: {
+                variants: {
+                  fullName: {
+                    fields: [
+                      {
+                        name: "fullName",
+                        type: "text",
+                        required: true,
+                      },
+                    ],
+                  },
+                  firstAndLastName: {
+                    fields: [
+                      {
+                        name: "firstName",
+                        type: "text",
+                        label: "",
+                        required: true,
+                        placeholder: "",
+                      },
+                      {
+                        name: "lastName",
+                        type: "text",
+                        label: "",
+                        required: false,
+                        placeholder: "",
+                      },
+                    ],
+                  },
+                },
+              },
+            },
+            {
+              name: "email",
+              type: "email",
+              sources: [{ id: "default", type: "default", label: "Default" }],
+              editable: "system",
+              required: true,
+              defaultLabel: "email_address",
+            },
+            {
+              name: "location",
+              type: "radioInput",
+              sources: [{ id: "default", type: "default", label: "Default" }],
+              editable: "system",
+              required: false,
+              defaultLabel: "location",
+              getOptionsAt: "locations",
+              optionsInputs: {
+                phone: { type: "phone", required: true, placeholder: "" },
+                somewhereElse: { type: "text", required: true, placeholder: "" },
+                attendeeInPerson: { type: "address", required: true, placeholder: "" },
+              },
+              hideWhenJustOneOption: true,
+            },
+            {
+              name: "test-phone",
+              type: "phone",
+              label: "test-phone",
+              hidden: false,
+              sources: [{ id: "user", type: "user", label: "User", fieldRequired: true }],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-address",
+              type: "address",
+              label: "test-address",
+              hidden: false,
+              sources: [{ id: "user", type: "user", label: "User", fieldRequired: true }],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-text",
+              type: "text",
+              label: "test-text",
+              hidden: false,
+              sources: [{ id: "user", type: "user", label: "User", fieldRequired: true }],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-number",
+              type: "number",
+              label: "test-number",
+              hidden: false,
+              sources: [{ id: "user", type: "user", label: "User", fieldRequired: true }],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-textarea",
+              type: "textarea",
+              label: "test-textarea",
+              hidden: false,
+              sources: [{ id: "user", type: "user", label: "User", fieldRequired: true }],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-boolean",
+              type: "boolean",
+              label: "test-boolean",
+              hidden: false,
+              sources: [{ id: "user", type: "user", label: "User", fieldRequired: true }],
+              editable: "user",
+              required: false,
+              labelAsSafeHtml: "<p>test-boolean</p>\n",
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-url",
+              type: "url",
+              label: "test-url",
+              hidden: false,
+              sources: [{ id: "user", type: "user", label: "User", fieldRequired: true }],
+              editable: "user",
+              required: false,
+              placeholder: "",
+              labelAsSafeHtml: "<p>test-url</p>\n",
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-multiemail",
+              type: "multiemail",
+              label: "test-multiemail",
+              hidden: false,
+              sources: [
+                {
+                  id: "user",
+                  type: "user",
+                  label: "User",
+                  fieldRequired: true,
+                },
+              ],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-multiselect",
+              type: "multiselect",
+              label: "test-multiselect",
+              hidden: false,
+              options: [
+                {
+                  label: "apple",
+                  value: "apple",
+                },
+                {
+                  label: "orange",
+                  value: "orange",
+                },
+              ],
+              sources: [
+                {
+                  id: "user",
+                  type: "user",
+                  label: "User",
+                  fieldRequired: true,
+                },
+              ],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-checkbox",
+              type: "checkbox",
+              label: "test-checkbox",
+              hidden: false,
+              options: [
+                {
+                  label: "blue",
+                  value: "blue",
+                },
+                {
+                  label: "red",
+                  value: "red",
+                },
+              ],
+              sources: [
+                {
+                  id: "user",
+                  type: "user",
+                  label: "User",
+                  fieldRequired: true,
+                },
+              ],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-radio",
+              type: "radio",
+              label: "test-radio",
+              hidden: false,
+              options: [
+                {
+                  label: "pineapple",
+                  value: "pineapple",
+                },
+              ],
+              sources: [
+                {
+                  id: "user",
+                  type: "user",
+                  label: "User",
+                  fieldRequired: true,
+                },
+              ],
+              editable: "user",
+              required: false,
+              disableOnPrefill: false,
+            },
+            {
+              name: "test-select",
+              type: "select",
+              label: "test-select",
+              options: [
+                {
+                  label: "water",
+                  value: "water",
+                },
+                {
+                  label: "juice",
+                  value: "juice",
+                },
+              ],
+              sources: [
+                {
+                  id: "user",
+                  type: "user",
+                  label: "User",
+                  fieldRequired: true,
+                },
+              ],
+              editable: "user",
+              required: true,
+              placeholder: "",
+              disableOnPrefill: false,
+            },
+            {
+              name: "title",
+              type: "text",
+              hidden: true,
+              sources: [{ id: "default", type: "default", label: "Default" }],
+              editable: "system-but-optional",
+              required: true,
+              defaultLabel: "what_is_this_meeting_about",
+              defaultPlaceholder: "",
+            },
+            {
+              name: "notes",
+              type: "textarea",
+              sources: [{ id: "default", type: "default", label: "Default" }],
+              editable: "system-but-optional",
+              required: false,
+              defaultLabel: "additional_notes",
+              defaultPlaceholder: "share_additional_notes",
+            },
+            {
+              name: "guests",
+              type: "multiemail",
+              hidden: false,
+              sources: [{ id: "default", type: "default", label: "Default" }],
+              editable: "system-but-optional",
+              required: false,
+              defaultLabel: "additional_guests",
+              defaultPlaceholder: "email",
+            },
+            {
+              name: "rescheduleReason",
+              type: "textarea",
+              views: [{ id: "reschedule", label: "Reschedule View" }],
+              sources: [{ id: "default", type: "default", label: "Default" }],
+              editable: "system-but-optional",
+              required: false,
+              defaultLabel: "reason_for_reschedule",
+              defaultPlaceholder: "reschedule_placeholder",
+            },
+          ],
+        },
+        user.id
+      );
+
       bookingWithSplitName = await bookingsRepositoryFixture.create({
         user: {
           connect: {
@@ -543,6 +851,318 @@ describe("Bookings Endpoints 2024-08-13", () => {
       });
     });
 
+    describe("Booking Field Type Validation", () => {
+      const basePayload = {
+        start: "2025-06-19T11:00:00.000Z",
+        attendee: {
+          name: "Charlie TypeTest",
+          email: "charlie.typetest@example.com",
+          timeZone: "Europe/Madrid",
+          language: "en",
+        },
+      };
+
+      it("should reject with 400 if 'test-phone' (phone) is not a string", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-phone": 12345,
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-phone'. Expected type string (compatible with field type 'phone'), but received number."
+        );
+      });
+
+      it("should reject with 400 if 'test-address' (address) is not a string", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-address": true,
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-address'. Expected type string (compatible with field type 'address'), but received boolean."
+        );
+      });
+
+      it("should reject with 400 if 'test-text' (text) is not a string", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-text": 123,
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-text'. Expected type string (compatible with field type 'text'), but received number."
+        );
+      });
+
+      it("should reject with 400 if 'test-number' (number) is not a number", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-number": "123",
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-number'. Expected type number (compatible with field type 'number'), but received string."
+        );
+      });
+
+      it("should reject with 400 if 'test-textarea' (textarea) is not a string", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-textarea": { text: "invalid" },
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-textarea'. Expected type string (compatible with field type 'textarea'), but received object."
+        );
+      });
+
+      it("should reject with 400 if 'test-boolean' (boolean) is not a boolean", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-boolean": "true",
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-boolean'. Expected type boolean (compatible with field type 'boolean'), but received string."
+        );
+      });
+
+      it("should reject with 400 if 'test-url' (url) is not a string", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-url": 12345,
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-url'. Expected type string (compatible with field type 'url'), but received number."
+        );
+      });
+
+      it("should reject with 400 if 'test-multiemail' (multiemail) is not an array", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-multiemail": "not-an-array@example.com",
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-multiemail'. Expected type array (compatible with field type 'multiemail'), but received string."
+        );
+      });
+
+      it("should reject with 400 if 'test-multiselect' (multiselect) is not an array", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-multiselect": "not-an-array",
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-multiselect'. Expected type array (compatible with field type 'multiselect'), but received string."
+        );
+      });
+
+      it("should reject with 400 if 'test-checkbox' (checkbox) is not an array", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-checkbox": true,
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-checkbox'. Expected type array (compatible with field type 'checkbox'), but received boolean."
+        );
+      });
+
+      it("should reject with 400 if 'test-radio' (radio) is not a string or number", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-radio": true,
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-radio'. Expected type string or number (compatible with field type 'radio'), but received boolean."
+        );
+      });
+
+      it("should reject with 400 if 'test-select' (select) is not a string or number", async () => {
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            "test-select": true,
+          },
+        };
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+        expect(response.status).toBe(400);
+        expect(response.body.error.message).toBe(
+          "Invalid type for booking field 'test-select'. Expected type string or number (compatible with field type 'select'), but received boolean."
+        );
+      });
+
+      it("should throw BadRequestException for test-select field with invalid option", async () => {
+        const fieldName = "test-select";
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            [fieldName]: "INVALID_DRINK",
+          },
+        };
+
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(400);
+
+        expect(response.body.error.message).toBe(
+          `Invalid option 'INVALID_DRINK' for booking field '${fieldName}'. Allowed options are: water, juice.`
+        );
+      });
+
+      it("should throw BadRequestException for test-radio field with invalid option", async () => {
+        const fieldName = "test-radio";
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            [fieldName]: "INVALID_FRUIT_FOR_RADIO",
+          },
+        };
+
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(400);
+
+        expect(response.body.error.message).toBe(
+          `Invalid option 'INVALID_FRUIT_FOR_RADIO' for booking field '${fieldName}'. Allowed options are: pineapple.`
+        );
+      });
+
+      it("should throw BadRequestException for test-multiselect field with an invalid option", async () => {
+        const fieldName = "test-multiselect";
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            [fieldName]: ["apple", "INVALID_FRUIT"],
+          },
+        };
+
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(400);
+
+        expect(response.body.error.message).toBe(
+          `One or more invalid options for booking field '${fieldName}'. Allowed options are: apple, orange.`
+        );
+      });
+
+      it("should throw BadRequestException for test-checkbox field with invalid options", async () => {
+        const fieldName = "test-checkbox";
+        const payload = {
+          ...basePayload,
+          eventTypeId: eventTypeWithBookingFielsCustom.id,
+          bookingFieldsResponses: {
+            [fieldName]: ["blue", "INVALID_COLOR"],
+          },
+        };
+
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings`)
+          .send(payload)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(400);
+
+        expect(response.body.error.message).toBe(
+          `One or more invalid options for booking field '${fieldName}'. Allowed options are: blue, red.`
+        );
+      });
+    });
+
     afterAll(async () => {
       await oauthClientRepositoryFixture.delete(oAuthClient.id);
       await teamRepositoryFixture.delete(organization.id);

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/emails/confirm-emails.e2e-spec.ts

@@ -385,7 +385,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
               emailsEnabledSetup.createdBookingUid = responseBody.data.uid;
             } else {
               throw new Error(
-                "Invalid response data - expected booking but received array of possibily recurring bookings"
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
               );
             }
           });
@@ -430,7 +430,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
                 emailsEnabledSetup.rescheduledBookingUid = responseBody.data.uid;
               } else {
                 throw new Error(
-                  "Invalid response data - expected booking but received array of possibily recurring bookings"
+                  "Invalid response data - expected booking but received array of possibly recurring bookings"
                 );
               }
             });
@@ -459,7 +459,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
                 emailsEnabledSetup.rescheduledBookingUid = responseBody.data.uid;
               } else {
                 throw new Error(
-                  "Invalid response data - expected booking but received array of possibily recurring bookings"
+                  "Invalid response data - expected booking but received array of possibly recurring bookings"
                 );
               }
             });
@@ -502,7 +502,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
               emailsEnabledSetup.createdBookingUid = responseBody.data.uid;
             } else {
               throw new Error(
-                "Invalid response data - expected booking but received array of possibily recurring bookings"
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
               );
             }
           });

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/seated-bookings.e2e-spec.ts

@@ -58,14 +58,11 @@ describe("Bookings Endpoints 2024-08-13", () => {
     let user: User;
 
     let seatedEventTypeId: number;
-    let recurringSeatedEventTypeId: number;
     const maxRecurrenceCount = 3;
 
     const seatedEventSlug = `seated-bookings-event-type-${randomString()}`;
-    const recurringSeatedEventSlug = `seated-bookings-event-type-${randomString()}`;
 
     let createdSeatedBooking: CreateSeatedBookingOutput_2024_08_13;
-    let createdRecurringSeatedBooking: CreateRecurringSeatedBookingOutput_2024_08_13[];
 
     const emailAttendeeOne = `seated-bookings-attendee1-${randomString()}@api.com`;
     const nameAttendeeOne = `Attendee One ${randomString()}`;
@@ -126,22 +123,6 @@ describe("Bookings Endpoints 2024-08-13", () => {
       );
       seatedEventTypeId = seatedEvent.id;
 
-      const recurringSeatedEvent = await eventTypesRepositoryFixture.create(
-        // note(Lauris): freq 2 means weekly, interval 1 means every week and count 3 means 3 weeks in a row
-        {
-          title: `seated-bookings-2024-08-13-recurring-event-type-${randomString()}`,
-          slug: recurringSeatedEventSlug,
-          length: 60,
-          recurringEvent: { freq: 2, count: maxRecurrenceCount, interval: 1 },
-          seatsPerTimeSlot: 5,
-          seatsShowAttendees: true,
-          seatsShowAvailabilityCount: true,
-          locations: [{ type: "inPerson", address: "via 10, rome, italy" }],
-        },
-        user.id
-      );
-      recurringSeatedEventTypeId = recurringSeatedEvent.id;
-
       app = moduleRef.createNestApplication();
       bootstrap(app as NestExpressApplication);
 
@@ -321,127 +302,6 @@ describe("Bookings Endpoints 2024-08-13", () => {
         });
     });
 
-    it("should book a recurring event type with seats", async () => {
-      const recurrenceCount = 2;
-      const body: CreateRecurringBookingInput_2024_08_13 = {
-        start: new Date(Date.UTC(2030, 0, 8, 11, 0, 0)).toISOString(),
-        eventTypeId: recurringSeatedEventTypeId,
-        attendee: {
-          name: "Mr Proper",
-          email: "mr_proper@gmail.com",
-          timeZone: "Europe/Rome",
-          language: "it",
-        },
-        location: googleMeetUrl,
-        bookingFieldsResponses: {
-          codingLanguage: "TypeScript",
-        },
-        recurrenceCount,
-        metadata: {
-          userId: "300",
-        },
-      };
-
-      return request(app.getHttpServer())
-        .post("/v2/bookings")
-        .send(body)
-        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
-        .expect(201)
-        .then(async (response) => {
-          const responseBody: CreateBookingOutput_2024_08_13 = response.body;
-          expect(responseBody.status).toEqual(SUCCESS_STATUS);
-          expect(responseBody.data).toBeDefined();
-          expect(responseDataIsCreateRecurringSeatedBooking(responseBody.data)).toBe(true);
-
-          if (responseDataIsCreateRecurringSeatedBooking(responseBody.data)) {
-            const data: CreateRecurringSeatedBookingOutput_2024_08_13[] = responseBody.data;
-            expect(data.length).toEqual(recurrenceCount);
-
-            const firstBooking = data[0];
-            expect(firstBooking.seatUid).toBeDefined();
-            const seatUid = firstBooking.seatUid;
-            expect(firstBooking.id).toBeDefined();
-            expect(firstBooking.uid).toBeDefined();
-            expect(firstBooking.hosts[0].id).toEqual(user.id);
-            expect(firstBooking.status).toEqual("accepted");
-            expect(firstBooking.start).toEqual(body.start);
-            expect(firstBooking.end).toEqual(
-              DateTime.fromISO(body.start, { zone: "utc" }).plus({ hours: 1 }).toISO()
-            );
-            expect(firstBooking.duration).toEqual(60);
-            expect(firstBooking.eventTypeId).toEqual(recurringSeatedEventTypeId);
-            expect(firstBooking.eventType).toEqual({
-              id: recurringSeatedEventTypeId,
-              slug: recurringSeatedEventSlug,
-            });
-            expect(firstBooking.attendees.length).toEqual(1);
-            expect(firstBooking.attendees[0]).toEqual({
-              name: body.attendee.name,
-              email: body.attendee.email,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid,
-              bookingFieldsResponses: {
-                name: body.attendee.name,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: body.metadata,
-            });
-            expect(firstBooking.location).toEqual(body.location);
-            expect(firstBooking.absentHost).toEqual(false);
-
-            const secondBooking = data[1];
-            expect(secondBooking.seatUid).toBeDefined();
-            const secondSeatUid = secondBooking.seatUid;
-            expect(secondBooking.id).toBeDefined();
-            expect(secondBooking.uid).toBeDefined();
-            expect(secondBooking.hosts[0].id).toEqual(user.id);
-            expect(secondBooking.status).toEqual("accepted");
-            const expectedStart = DateTime.fromISO(body.start, { zone: "utc" }).plus({ weeks: 1 }).toISO();
-            expect(secondBooking.start).toEqual(expectedStart);
-            expect(secondBooking.end).toEqual(
-              DateTime.fromISO(expectedStart!, { zone: "utc" }).plus({ hours: 1 }).toISO()
-            );
-            expect(secondBooking.duration).toEqual(60);
-            expect(secondBooking.eventTypeId).toEqual(recurringSeatedEventTypeId);
-            expect(secondBooking.eventType).toEqual({
-              id: recurringSeatedEventTypeId,
-              slug: recurringSeatedEventSlug,
-            });
-            expect(secondBooking.attendees.length).toEqual(1);
-            expect(secondBooking.attendees[0]).toEqual({
-              name: body.attendee.name,
-              email: body.attendee.email,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid: secondSeatUid,
-              bookingFieldsResponses: {
-                name: body.attendee.name,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: body.metadata,
-            });
-            expect(secondBooking.location).toEqual(body.location);
-            expect(secondBooking.absentHost).toEqual(false);
-            createdRecurringSeatedBooking = data;
-          } else {
-            throw new Error(
-              "Invalid response data - expected recurring booking but received non array response"
-            );
-          }
-        });
-    });
-
     it("should get a booking for an event type with seats", async () => {
       return request(app.getHttpServer())
         .get(`/v2/bookings/${createdSeatedBooking.uid}`)
@@ -469,62 +329,6 @@ describe("Bookings Endpoints 2024-08-13", () => {
         });
     });
 
-    it("should get a booking for a recurring event type with seats", async () => {
-      return request(app.getHttpServer())
-        .get(`/v2/bookings/${createdRecurringSeatedBooking[1].recurringBookingUid}`)
-        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
-        .expect(200)
-        .then(async (response) => {
-          const responseBody: GetBookingOutput_2024_08_13 = response.body;
-          expect(responseBody.status).toEqual(SUCCESS_STATUS);
-          expect(responseBody.data).toBeDefined();
-          expect(responseDataIsGetRecurringSeatedBooking(responseBody.data)).toBe(true);
-
-          if (responseDataIsGetRecurringSeatedBooking(responseBody.data)) {
-            const data: GetRecurringSeatedBookingOutput_2024_08_13[] = responseBody.data;
-            const expected = structuredClone(createdRecurringSeatedBooking);
-            for (const booking of expected) {
-              // note(Lauris): seatUid in get response resides only in each attendee object
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore
-              delete booking.seatUid;
-            }
-            expect(data).toEqual(expected);
-          } else {
-            throw new Error(
-              "Invalid response data - expected recurring booking but received non array response"
-            );
-          }
-        });
-    });
-
-    it("should get a specific recurrence of a booking for a recurring event type with seats", async () => {
-      return request(app.getHttpServer())
-        .get(`/v2/bookings/${createdRecurringSeatedBooking[0].uid}`)
-        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
-        .expect(200)
-        .then(async (response) => {
-          const responseBody: GetBookingOutput_2024_08_13 = response.body;
-          expect(responseBody.status).toEqual(SUCCESS_STATUS);
-          expect(responseBody.data).toBeDefined();
-          expect(responseDataIsGetSeatedBooking(responseBody.data)).toBe(true);
-
-          if (responseDataIsGetSeatedBooking(responseBody.data)) {
-            const data: GetSeatedBookingOutput_2024_08_13 = responseBody.data;
-            const expected = structuredClone(createdRecurringSeatedBooking[0]);
-            // note(Lauris): seatUid in get response resides only in each attendee object
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore
-            delete expected.seatUid;
-            expect(data).toEqual(expected);
-          } else {
-            throw new Error(
-              "Invalid response data - expected recurring booking but received non array response"
-            );
-          }
-        });
-    });
-
     it("should get all seated bookings", async () => {
       return request(app.getHttpServer())
         .get("/v2/bookings?sortCreated=asc")
@@ -534,7 +338,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
           const responseBody: GetBookingsOutput_2024_08_13 = response.body;
           expect(responseBody.status).toEqual(SUCCESS_STATUS);
           expect(responseBody.data).toBeDefined();
-          expect(responseBody.data.length).toEqual(3);
+          expect(responseBody.data.length).toEqual(1);
 
           const seatedBooking = responseBody.data[0];
           const seatedBookingExpected = structuredClone(createdSeatedBooking);
@@ -543,16 +347,6 @@ describe("Bookings Endpoints 2024-08-13", () => {
           // @ts-ignore
           delete seatedBookingExpected.seatUid;
           expect(seatedBooking).toEqual(seatedBookingExpected);
-
-          const recurringSeatedBookings = [responseBody.data[1], responseBody.data[2]];
-          const recurringSeatedBookingsExpected = structuredClone(createdRecurringSeatedBooking);
-          for (const booking of recurringSeatedBookingsExpected) {
-            // note(Lauris): seatUid in get response resides only in each attendee object
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore
-            delete booking.seatUid;
-          }
-          expect(recurringSeatedBookings).toEqual(recurringSeatedBookingsExpected);
         });
     });
 
@@ -682,424 +476,4 @@ describe("Bookings Endpoints 2024-08-13", () => {
       await app.close();
     });
   });
-
-  describe("Recurring seated bookings creation", () => {
-    let app: INestApplication;
-    let organization: Team;
-
-    let userRepositoryFixture: UserRepositoryFixture;
-    let bookingsRepositoryFixture: BookingsRepositoryFixture;
-    let schedulesService: SchedulesService_2024_04_15;
-    let eventTypesRepositoryFixture: EventTypesRepositoryFixture;
-    let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
-    let oAuthClient: PlatformOAuthClient;
-    let teamRepositoryFixture: TeamRepositoryFixture;
-
-    const userEmail = `seated-bookings-user-${randomString()}@api.com`;
-    let user: User;
-
-    let seatedEventTypeId: number;
-    let recurringSeatedEventTypeId: number;
-    const maxRecurrenceCount = 3;
-
-    const seatedEventSlug = `seated-bookings-event-type-${randomString()}`;
-    const recurringSeatedEventSlug = `seated-bookings-event-type-${randomString()}`;
-
-    let createdSeatedBooking: CreateSeatedBookingOutput_2024_08_13;
-    let createdRecurringSeatedBooking: CreateRecurringSeatedBookingOutput_2024_08_13[];
-
-    const emailAttendeeOne = `seated-bookings-attendee1-${randomString()}@api.com`;
-    const nameAttendeeOne = `Attendee One ${randomString()}`;
-    const emailAttendeeTwo = `seated-bookings-attendee2-${randomString()}@api.com`;
-    const nameAttendeeTwo = `Attendee Two ${randomString()}`;
-
-    beforeAll(async () => {
-      const moduleRef = await withApiAuth(
-        userEmail,
-        Test.createTestingModule({
-          imports: [AppModule, PrismaModule, UsersModule, SchedulesModule_2024_04_15],
-        })
-      )
-        .overrideGuard(PermissionsGuard)
-        .useValue({
-          canActivate: () => true,
-        })
-        .compile();
-
-      userRepositoryFixture = new UserRepositoryFixture(moduleRef);
-      bookingsRepositoryFixture = new BookingsRepositoryFixture(moduleRef);
-      eventTypesRepositoryFixture = new EventTypesRepositoryFixture(moduleRef);
-      oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
-      teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
-      schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
-
-      organization = await teamRepositoryFixture.create({
-        name: `seated-bookings-organization-${randomString()}`,
-      });
-      oAuthClient = await createOAuthClient(organization.id);
-
-      user = await userRepositoryFixture.create({
-        email: userEmail,
-        platformOAuthClients: {
-          connect: {
-            id: oAuthClient.id,
-          },
-        },
-      });
-
-      const userSchedule: CreateScheduleInput_2024_04_15 = {
-        name: `seated-bookings-2024-08-13-schedule-${randomString()}`,
-        timeZone: "Europe/Rome",
-        isDefault: true,
-      };
-      await schedulesService.createUserSchedule(user.id, userSchedule);
-      const seatedEvent = await eventTypesRepositoryFixture.create(
-        {
-          title: `seated-bookings-2024-08-13-event-type-${randomString()}`,
-          slug: seatedEventSlug,
-          length: 60,
-          seatsPerTimeSlot: 3,
-        },
-        user.id
-      );
-      seatedEventTypeId = seatedEvent.id;
-
-      const recurringSeatedEvent = await eventTypesRepositoryFixture.create(
-        // note(Lauris): freq 2 means weekly, interval 1 means every week and count 3 means 3 weeks in a row
-        {
-          title: `seated-bookings-2024-08-13-recurring-event-type-${randomString()}`,
-          slug: recurringSeatedEventSlug,
-          length: 60,
-          seatsPerTimeSlot: 3,
-          recurringEvent: { freq: 2, count: maxRecurrenceCount, interval: 1 },
-        },
-        user.id
-      );
-      recurringSeatedEventTypeId = recurringSeatedEvent.id;
-
-      app = moduleRef.createNestApplication();
-      bootstrap(app as NestExpressApplication);
-
-      await app.init();
-    });
-
-    async function createOAuthClient(organizationId: number) {
-      const data = {
-        logo: "logo-url",
-        name: "name",
-        redirectUris: ["http://localhost:5555"],
-        permissions: 32,
-      };
-      const secret = "secret";
-
-      const client = await oauthClientRepositoryFixture.create(organizationId, data, secret);
-      return client;
-    }
-
-    it("should book a recurring event type with seats for the first time", async () => {
-      const recurrenceCount = 2;
-      const body: CreateRecurringBookingInput_2024_08_13 = {
-        start: new Date(Date.UTC(2030, 0, 8, 11, 0, 0)).toISOString(),
-        eventTypeId: recurringSeatedEventTypeId,
-        attendee: {
-          name: nameAttendeeOne,
-          email: emailAttendeeOne,
-          timeZone: "Europe/Rome",
-          language: "it",
-        },
-        location: googleMeetUrl,
-        bookingFieldsResponses: {
-          codingLanguage: "TypeScript",
-        },
-        metadata: {
-          userId: "1000",
-        },
-        recurrenceCount,
-      };
-
-      return request(app.getHttpServer())
-        .post("/v2/bookings")
-        .send(body)
-        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
-        .expect(201)
-        .then(async (response) => {
-          const responseBody: CreateBookingOutput_2024_08_13 = response.body;
-          expect(responseBody.status).toEqual(SUCCESS_STATUS);
-          expect(responseBody.data).toBeDefined();
-          expect(responseDataIsCreateRecurringSeatedBooking(responseBody.data)).toBe(true);
-
-          if (responseDataIsCreateRecurringSeatedBooking(responseBody.data)) {
-            const data: CreateRecurringSeatedBookingOutput_2024_08_13[] = responseBody.data;
-            expect(data.length).toEqual(recurrenceCount);
-
-            const firstBooking = data[0];
-            expect(firstBooking.seatUid).toBeDefined();
-            const seatUid = firstBooking.seatUid;
-            expect(firstBooking.id).toBeDefined();
-            expect(firstBooking.uid).toBeDefined();
-            expect(firstBooking.hosts[0].id).toEqual(user.id);
-            expect(firstBooking.status).toEqual("accepted");
-            expect(firstBooking.start).toEqual(body.start);
-            expect(firstBooking.end).toEqual(
-              DateTime.fromISO(body.start, { zone: "utc" }).plus({ hours: 1 }).toISO()
-            );
-            expect(firstBooking.duration).toEqual(60);
-            expect(firstBooking.eventTypeId).toEqual(recurringSeatedEventTypeId);
-            expect(firstBooking.eventType).toEqual({
-              id: recurringSeatedEventTypeId,
-              slug: recurringSeatedEventSlug,
-            });
-            expect(firstBooking.attendees.length).toEqual(1);
-            expect(firstBooking.attendees[0]).toEqual({
-              name: body.attendee.name,
-              email: body.attendee.email,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid,
-              bookingFieldsResponses: {
-                name: body.attendee.name,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: body.metadata,
-            });
-            expect(firstBooking.location).toEqual(body.location);
-            expect(firstBooking.absentHost).toEqual(false);
-
-            const secondBooking = data[1];
-            expect(secondBooking.seatUid).toBeDefined();
-            const secondSeatUid = secondBooking.seatUid;
-            expect(secondBooking.id).toBeDefined();
-            expect(secondBooking.uid).toBeDefined();
-            expect(secondBooking.hosts[0].id).toEqual(user.id);
-            expect(secondBooking.status).toEqual("accepted");
-            const expectedStart = DateTime.fromISO(body.start, { zone: "utc" }).plus({ weeks: 1 }).toISO();
-            expect(secondBooking.start).toEqual(expectedStart);
-            expect(secondBooking.end).toEqual(
-              DateTime.fromISO(expectedStart!, { zone: "utc" }).plus({ hours: 1 }).toISO()
-            );
-            expect(secondBooking.duration).toEqual(60);
-            expect(secondBooking.eventTypeId).toEqual(recurringSeatedEventTypeId);
-            expect(secondBooking.eventType).toEqual({
-              id: recurringSeatedEventTypeId,
-              slug: recurringSeatedEventSlug,
-            });
-            expect(secondBooking.attendees.length).toEqual(1);
-            expect(secondBooking.attendees[0]).toEqual({
-              name: body.attendee.name,
-              email: body.attendee.email,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid: secondSeatUid,
-              bookingFieldsResponses: {
-                name: body.attendee.name,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: body.metadata,
-            });
-            expect(secondBooking.location).toEqual(body.location);
-            expect(secondBooking.absentHost).toEqual(false);
-            createdRecurringSeatedBooking = data;
-          } else {
-            throw new Error(
-              "Invalid response data - expected recurring booking but received non array response"
-            );
-          }
-        });
-    });
-
-    it("should book a recurring event type with seats for the second time", async () => {
-      const recurrenceCount = 2;
-      const body: CreateRecurringBookingInput_2024_08_13 = {
-        start: new Date(Date.UTC(2030, 0, 8, 11, 0, 0)).toISOString(),
-        eventTypeId: recurringSeatedEventTypeId,
-        attendee: {
-          name: nameAttendeeTwo,
-          email: emailAttendeeTwo,
-          timeZone: "Europe/Rome",
-          language: "it",
-        },
-        location: googleMeetUrl,
-        bookingFieldsResponses: {
-          codingLanguage: "TypeScript",
-        },
-        metadata: {
-          userId: "2000",
-        },
-        recurrenceCount,
-      };
-
-      return request(app.getHttpServer())
-        .post("/v2/bookings")
-        .send(body)
-        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
-        .expect(201)
-        .then(async (response) => {
-          const responseBody: CreateBookingOutput_2024_08_13 = response.body;
-          expect(responseBody.status).toEqual(SUCCESS_STATUS);
-          expect(responseBody.data).toBeDefined();
-          expect(responseDataIsCreateRecurringSeatedBooking(responseBody.data)).toBe(true);
-
-          if (responseDataIsCreateRecurringSeatedBooking(responseBody.data)) {
-            const data: CreateRecurringSeatedBookingOutput_2024_08_13[] = responseBody.data;
-            expect(data.length).toEqual(recurrenceCount);
-
-            const firstBooking = data[0];
-            expect(firstBooking.seatUid).toBeDefined();
-            const seatUid = firstBooking.seatUid;
-            expect(firstBooking.id).toBeDefined();
-            expect(firstBooking.uid).toBeDefined();
-            expect(firstBooking.hosts[0].id).toEqual(user.id);
-            expect(firstBooking.status).toEqual("accepted");
-            expect(firstBooking.start).toEqual(body.start);
-            expect(firstBooking.end).toEqual(
-              DateTime.fromISO(body.start, { zone: "utc" }).plus({ hours: 1 }).toISO()
-            );
-            expect(firstBooking.duration).toEqual(60);
-            expect(firstBooking.eventTypeId).toEqual(recurringSeatedEventTypeId);
-            expect(firstBooking.eventType).toEqual({
-              id: recurringSeatedEventTypeId,
-              slug: recurringSeatedEventSlug,
-            });
-            expect(firstBooking.attendees.length).toEqual(2);
-            const firstAttendee = firstBooking.attendees.find(
-              (attendee) => attendee.name === nameAttendeeOne
-            );
-            expect(firstAttendee).toEqual({
-              name: nameAttendeeOne,
-              email: emailAttendeeOne,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid: createdRecurringSeatedBooking[0].seatUid,
-              bookingFieldsResponses: {
-                name: nameAttendeeOne,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: createdRecurringSeatedBooking[0].attendees[0].metadata,
-            });
-            const secondAttendee = firstBooking.attendees.find(
-              (attendee) => attendee.name === nameAttendeeTwo
-            );
-            expect(secondAttendee).toEqual({
-              name: nameAttendeeTwo,
-              email: emailAttendeeTwo,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid,
-              bookingFieldsResponses: {
-                name: nameAttendeeTwo,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: body.metadata,
-            });
-            expect(firstBooking.location).toEqual(body.location);
-            expect(firstBooking.absentHost).toEqual(false);
-
-            const secondBooking = data[1];
-            expect(secondBooking.seatUid).toBeDefined();
-            const secondSeatUid = secondBooking.seatUid;
-            expect(secondBooking.id).toBeDefined();
-            expect(secondBooking.uid).toBeDefined();
-            expect(secondBooking.hosts[0].id).toEqual(user.id);
-            expect(secondBooking.status).toEqual("accepted");
-            const expectedStart = DateTime.fromISO(body.start, { zone: "utc" }).plus({ weeks: 1 }).toISO();
-            expect(secondBooking.start).toEqual(expectedStart);
-            expect(secondBooking.end).toEqual(
-              DateTime.fromISO(expectedStart!, { zone: "utc" }).plus({ hours: 1 }).toISO()
-            );
-            expect(secondBooking.duration).toEqual(60);
-            expect(secondBooking.eventTypeId).toEqual(recurringSeatedEventTypeId);
-            expect(secondBooking.eventType).toEqual({
-              id: recurringSeatedEventTypeId,
-              slug: recurringSeatedEventSlug,
-            });
-            expect(secondBooking.attendees.length).toEqual(2);
-            expect(secondBooking.attendees[0]).toEqual({
-              name: nameAttendeeOne,
-              email: emailAttendeeOne,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid: createdRecurringSeatedBooking[1].seatUid,
-              bookingFieldsResponses: {
-                name: nameAttendeeOne,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: createdRecurringSeatedBooking[0].attendees[0].metadata,
-            });
-            expect(secondBooking.attendees[1]).toEqual({
-              name: nameAttendeeTwo,
-              email: emailAttendeeTwo,
-              timeZone: body.attendee.timeZone,
-              language: body.attendee.language,
-              absent: false,
-              seatUid: secondSeatUid,
-              bookingFieldsResponses: {
-                name: nameAttendeeTwo,
-                ...body.bookingFieldsResponses,
-                location: {
-                  optionValue: googleMeetUrl,
-                  value: "link",
-                },
-              },
-              metadata: body.metadata,
-            });
-            expect(secondBooking.location).toEqual(body.location);
-            expect(secondBooking.absentHost).toEqual(false);
-            createdRecurringSeatedBooking = data;
-          } else {
-            throw new Error(
-              "Invalid response data - expected recurring booking but received non array response"
-            );
-          }
-        });
-    });
-
-    function responseDataIsCreateRecurringSeatedBooking(
-      data: any
-    ): data is CreateRecurringSeatedBookingOutput_2024_08_13[] {
-      return Array.isArray(data);
-    }
-
-    function responseDataIsGetSeatedBooking(data: any): data is GetSeatedBookingOutput_2024_08_13 {
-      return data?.attendees?.every((attendee: any) => attendee?.hasOwnProperty("seatUid"));
-    }
-
-    function responseDataIsGetRecurringSeatedBooking(
-      data: any
-    ): data is GetRecurringSeatedBookingOutput_2024_08_13[] {
-      return Array.isArray(data);
-    }
-
-    afterAll(async () => {
-      await oauthClientRepositoryFixture.delete(oAuthClient.id);
-      await teamRepositoryFixture.delete(organization.id);
-      await userRepositoryFixture.deleteByEmail(user.email);
-      await bookingsRepositoryFixture.deleteAllBookings(user.id, user.email);
-      await app.close();
-    });
-  });
 });

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/team-bookings.e2e-spec.ts

@@ -39,7 +39,10 @@ import { PlatformOAuthClient, Team } from "@calcom/prisma/client";
 describe("Bookings Endpoints 2024-08-13", () => {
   describe("Team bookings", () => {
     let app: INestApplication;
+    const organizationSlug = `team-bookings-organization-${randomString()}`;
     let organization: Team;
+    const team1Slug = `team-bookings-team1-${randomString()}`;
+    const team2Slug = `team-bookings-team2-${randomString()}`;
     let team1: Team;
     let team2: Team;
 
@@ -95,12 +98,15 @@ describe("Bookings Endpoints 2024-08-13", () => {
       schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
 
       organization = await organizationsRepositoryFixture.create({
-        name: `team-bookings-organization-${randomString()}`,
+        name: organizationSlug,
+        slug: organizationSlug,
+        isOrganization: true,
       });
       oAuthClient = await createOAuthClient(organization.id);
 
       team1 = await teamRepositoryFixture.create({
-        name: `team-bookings-team1-${randomString()}`,
+        name: team1Slug,
+        slug: team1Slug,
         isOrganization: false,
         parent: { connect: { id: organization.id } },
         createdByOAuthClient: {
@@ -111,7 +117,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
       });
 
       team2 = await teamRepositoryFixture.create({
-        name: `team-bookings-team2-${randomString()}`,
+        name: team2Slug,
+        slug: team2Slug,
         isOrganization: false,
         parent: { connect: { id: organization.id } },
         createdByOAuthClient: {
@@ -668,6 +675,84 @@ describe("Bookings Endpoints 2024-08-13", () => {
       });
     });
 
+    describe("book using teamSlug, eventTypeSlug and organizationSlug", () => {
+      it("should not be able to book if missing organizationSlug", async () => {
+        const body: CreateBookingInput_2024_08_13 = {
+          start: new Date(Date.UTC(2040, 0, 9, 13, 0, 0)).toISOString(),
+          teamSlug: team1Slug,
+          eventTypeSlug: team1EventTypeSlug,
+          attendee: {
+            name: "alice",
+            email: "alice@gmail.com",
+            timeZone: "Europe/Madrid",
+            language: "es",
+          },
+          meetingUrl: "https://meet.google.com/abc-def-ghi",
+        };
+
+        return request(app.getHttpServer())
+          .post("/v2/bookings")
+          .send(body)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(404);
+      });
+
+      it("should book using teamSlug and eventTypeSlug and organizationSlug", async () => {
+        const body: CreateBookingInput_2024_08_13 = {
+          start: new Date(Date.UTC(2040, 0, 9, 13, 0, 0)).toISOString(),
+          teamSlug: team1Slug,
+          eventTypeSlug: team1EventTypeSlug,
+          organizationSlug: organizationSlug,
+          attendee: {
+            name: "alice",
+            email: "alice@gmail.com",
+            timeZone: "Europe/Madrid",
+            language: "es",
+          },
+          meetingUrl: "https://meet.google.com/abc-def-ghi",
+        };
+
+        return request(app.getHttpServer())
+          .post("/v2/bookings")
+          .send(body)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(201)
+          .then(async (response) => {
+            const responseBody: CreateBookingOutput_2024_08_13 = response.body;
+            expect(responseBody.status).toEqual(SUCCESS_STATUS);
+            expect(responseBody.data).toBeDefined();
+            expect(responseDataIsBooking(responseBody.data)).toBe(true);
+
+            if (responseDataIsBooking(responseBody.data)) {
+              const data: BookingOutput_2024_08_13 = responseBody.data;
+              expect(data.id).toBeDefined();
+              expect(data.uid).toBeDefined();
+              expect(data.hosts.length).toEqual(1);
+              expect(data.hosts[0].id).toEqual(teamUser.id);
+              expect(data.status).toEqual("accepted");
+              expect(data.start).toEqual(body.start);
+              expect(data.end).toEqual(new Date(Date.UTC(2040, 0, 9, 14, 0, 0)).toISOString());
+              expect(data.duration).toEqual(60);
+              expect(data.eventTypeId).toEqual(team1EventTypeId);
+              expect(data.attendees.length).toEqual(1);
+              expect(data.attendees[0]).toEqual({
+                name: body.attendee.name,
+                email: body.attendee.email,
+                timeZone: body.attendee.timeZone,
+                language: body.attendee.language,
+                absent: false,
+              });
+              expect(data.meetingUrl).toEqual(body.meetingUrl);
+              expect(data.absentHost).toEqual(false);
+            } else {
+              throw new Error(
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
+              );
+            }
+          });
+      });
+    });
+
     async function createOAuthClient(organizationId: number) {
       const data = {
         logo: "logo-url",

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/user-bookings.e2e-spec.ts

@@ -14,7 +14,7 @@ import { UsersModule } from "@/modules/users/users.module";
 import { INestApplication } from "@nestjs/common";
 import { NestExpressApplication } from "@nestjs/platform-express";
 import { Test } from "@nestjs/testing";
-import { EventType, User } from "@prisma/client";
+import { EventType, User, Workflow } from "@prisma/client";
 import { advanceTo, clear } from "jest-date-mock";
 import * as request from "supertest";
 import { BookingsRepositoryFixture } from "test/fixtures/repository/bookings.repository.fixture";
@@ -22,6 +22,8 @@ import { EventTypesRepositoryFixture } from "test/fixtures/repository/event-type
 import { OAuthClientRepositoryFixture } from "test/fixtures/repository/oauth-client.repository.fixture";
 import { TeamRepositoryFixture } from "test/fixtures/repository/team.repository.fixture";
 import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
+import { WorkflowReminderRepositoryFixture } from "test/fixtures/repository/workflow-reminder.repository.fixture";
+import { WorkflowRepositoryFixture } from "test/fixtures/repository/workflow.repository.fixture";
 import { randomString } from "test/utils/randomString";
 import { withApiAuth } from "test/utils/withApiAuth";
 
@@ -32,8 +34,10 @@ import {
   VERSION_2024_08_13,
   X_CAL_CLIENT_ID,
 } from "@calcom/platform-constants";
+import { AttendeeScheduledEmail, OrganizerScheduledEmail } from "@calcom/platform-libraries/emails";
 import {
   CreateEventTypeInput_2024_06_14,
+  FAILED_EVENT_TYPE_IDENTIFICATION_ERROR_MESSAGE,
   GetBookingOutput_2024_08_13,
   GetBookingsOutput_2024_08_13,
   GetSeatedBookingOutput_2024_08_13,
@@ -59,6 +63,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
     let schedulesService: SchedulesService_2024_04_15;
     let eventTypesRepositoryFixture: EventTypesRepositoryFixture;
     let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
+    let workflowReminderRepositoryFixture: WorkflowReminderRepositoryFixture;
+    let workflowRepositoryFixture: WorkflowRepositoryFixture;
     let oAuthClient: PlatformOAuthClient;
     let teamRepositoryFixture: TeamRepositoryFixture;
 
@@ -67,6 +73,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
 
     let eventTypeId: number;
     let eventType: EventType;
+    let eventTypeWithAttendeeSmsReminder: EventType;
+    let workflow: Workflow;
     const eventTypeSlug = `user-bookings-event-type-${randomString()}`;
     let recurringEventTypeId: number;
     const recurringEventTypeSlug = `user-bookings-event-type-${randomString()}`;
@@ -96,6 +104,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
       oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
       teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
       schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
+      workflowReminderRepositoryFixture = new WorkflowReminderRepositoryFixture(moduleRef);
+      workflowRepositoryFixture = new WorkflowRepositoryFixture(moduleRef);
 
       organization = await teamRepositoryFixture.create({
         name: `user-bookings-organization-${randomString()}`,
@@ -176,6 +186,85 @@ describe("Bookings Endpoints 2024-08-13", () => {
         rating: 10,
       });
 
+      workflow = await workflowRepositoryFixture.create({
+        user: {
+          connect: {
+            id: user.id,
+          },
+        },
+        trigger: "BEFORE_EVENT",
+        time: 24,
+        timeUnit: "HOUR",
+        position: 0,
+        isActiveOnAll: false,
+        name: "Attendee SMS Reminder",
+        steps: {
+          create: {
+            stepNumber: 1,
+            action: "SMS_ATTENDEE",
+            sendTo: null,
+            reminderBody:
+              "Hi {ATTENDEE}, this is a reminder that your meeting ({EVENT_NAME}) with {ORGANIZER} is on {EVENT_DATE_YYYY MMM D} at {EVENT_TIME_h:mma} {TIMEZONE}.",
+            emailSubject: "Reminder: {EVENT_NAME} - {EVENT_DATE_ddd, MMM D, YYYY h:mma}",
+            template: "REMINDER",
+            numberRequired: true,
+            sender: "Cal",
+            numberVerificationPending: false,
+            includeCalendarEvent: false,
+            verifiedAt: new Date(),
+          },
+        },
+      });
+
+      eventTypeWithAttendeeSmsReminder = await eventTypesRepositoryFixture.create(
+        {
+          title: "event with attendee sms reminder",
+          slug: "event-with-attendee-sms-reminder",
+          length: 15,
+          bookingFields: [
+            {
+              name: "smsReminderNumber",
+              type: "phone",
+              sources: [
+                {
+                  id: String(workflow.id),
+                  type: "workflow",
+                  label: "Workflow",
+                  editUrl: `/workflows/${workflow.id}`,
+                  fieldRequired: true,
+                },
+              ],
+              editable: "system",
+              required: true,
+              defaultLabel: "number_text_notifications",
+              defaultPlaceholder: "enter_phone_number",
+            },
+          ],
+          metadata: {
+            disableStandardEmails: {
+              all: {
+                attendee: true,
+                host: true,
+              },
+              confirmation: {
+                host: true,
+                attendee: true,
+              },
+            },
+          },
+          workflows: {
+            create: {
+              workflow: {
+                connect: {
+                  id: workflow.id,
+                },
+              },
+            },
+          },
+        },
+        user.id
+      );
+
       app = moduleRef.createNestApplication();
       bootstrap(app as NestExpressApplication);
 
@@ -582,7 +671,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               expect(data.rating).toEqual(bookingInThePast.rating);
             } else {
               throw new Error(
-                "Invalid response data - expected booking but received array of possibily recurring bookings"
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
               );
             }
           });
@@ -641,7 +730,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               await bookingsRepositoryFixture.deleteById(mockBooking.id);
             } else {
               throw new Error(
-                "Invalid response data - expected booking but received array of possibily recurring bookings"
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
               );
             }
           });
@@ -1667,7 +1756,6 @@ describe("Bookings Endpoints 2024-08-13", () => {
 
     describe("book by username and event type slug", () => {
       it("should not create a booking by if neither event type id nor username and event type slug provided", async () => {
-        const googleMeetUrl = "https://meet.google.com/abc-def-ghi";
         const body = {
           start: new Date(Date.UTC(2036, 0, 8, 15, 0, 0)).toISOString(),
           attendee: {
@@ -1676,7 +1764,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
             timeZone: "Europe/Rome",
             language: "it",
           },
-          location: googleMeetUrl,
+          location: "https://meet.google.com/abc-def-ghi",
           bookingFieldsResponses: {
             customField: "customValue",
           },
@@ -1692,11 +1780,9 @@ describe("Bookings Endpoints 2024-08-13", () => {
           .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
           .expect(400);
 
-        expect(
-          response.body.error.message.includes(
-            "Either eventTypeId OR (eventTypeSlug + username) must be provided"
-          )
-        ).toBe(true);
+        expect(response.body.error.message.includes(FAILED_EVENT_TYPE_IDENTIFICATION_ERROR_MESSAGE)).toBe(
+          true
+        );
       });
 
       it("should create a booking by username and event type slug", async () => {
@@ -2228,6 +2314,91 @@ describe("Bookings Endpoints 2024-08-13", () => {
       });
     });
 
+    describe("create booking with attendee sms reminder", () => {
+      it("should not be able create a booking if attendee sms reminder is missing", async () => {
+        const body: CreateBookingInput_2024_08_13 = {
+          start: new Date(Date.UTC(2030, 0, 8, 15, 0, 0)).toISOString(),
+          eventTypeId: eventTypeWithAttendeeSmsReminder.id,
+          attendee: {
+            name: "Mr Proper",
+            email: "mr_proper@gmail.com",
+            timeZone: "Europe/Rome",
+            language: "it",
+          },
+        };
+
+        const response = await request(app.getHttpServer())
+          .post("/v2/bookings")
+          .send(body)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(400);
+
+        expect(response.body.error.message).toEqual(
+          `Missing attendee phone number - it is required by the event type. Pass it as \"attendee.phoneNumber\" string in the request.`
+        );
+      });
+
+      it("should be able create a booking if attendee sms reminder is provided", async () => {
+        const phoneNumber = "+37122222222";
+        const body: CreateBookingInput_2024_08_13 = {
+          start: new Date(Date.UTC(2030, 0, 8, 15, 0, 0)).toISOString(),
+          eventTypeId: eventTypeWithAttendeeSmsReminder.id,
+          attendee: {
+            name: "Mr Proper",
+            email: "mr_proper@gmail.com",
+            timeZone: "Europe/Rome",
+            language: "it",
+            phoneNumber,
+          },
+        };
+
+        const response = await request(app.getHttpServer())
+          .post("/v2/bookings")
+          .send(body)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(201);
+
+        const responseBody: CreateBookingOutput_2024_08_13 = response.body;
+        expect(responseBody.status).toEqual(SUCCESS_STATUS);
+        expect(responseBody.data).toBeDefined();
+        expect(responseDataIsBooking(responseBody.data)).toBe(true);
+
+        if (responseDataIsBooking(responseBody.data)) {
+          const data: BookingOutput_2024_08_13 = responseBody.data;
+          expect(data.id).toBeDefined();
+          expect(data.uid).toBeDefined();
+          expect(data.hosts.length).toEqual(1);
+          expect(data.hosts[0].id).toEqual(user.id);
+          expect(data.status).toEqual("accepted");
+          expect(data.start).toEqual(body.start);
+          expect(data.end).toEqual(new Date(Date.UTC(2030, 0, 8, 15, 15, 0)).toISOString());
+          expect(data.duration).toEqual(15);
+          expect(data.eventTypeId).toEqual(eventTypeWithAttendeeSmsReminder.id);
+          expect(data.attendees.length).toEqual(1);
+          expect(data.attendees[0]).toEqual({
+            name: body.attendee.name,
+            email: body.attendee.email,
+            timeZone: body.attendee.timeZone,
+            language: body.attendee.language,
+            phoneNumber: body.attendee.phoneNumber,
+            absent: false,
+          });
+          expect(data.bookingFieldsResponses).toEqual({
+            name: body.attendee.name,
+            email: body.attendee.email,
+            attendeePhoneNumber: body.attendee.phoneNumber,
+            smsReminderNumber: body.attendee.phoneNumber,
+          });
+          const dbBooking = await bookingsRepositoryFixture.getById(data.id);
+          expect(dbBooking?.smsReminderNumber).toEqual(phoneNumber);
+          const dbWorkflowReminder = await workflowReminderRepositoryFixture.getByBookingUid(data.uid);
+          expect(dbWorkflowReminder?.method).toEqual("SMS");
+        } else {
+          throw new Error("Invalid response data");
+        }
+      });
+    });
+
     function responseDataIsRecurranceBooking(data: any): data is RecurringBookingOutput_2024_08_13 {
       return (
         !Array.isArray(data) &&

apps/api/v2/src/ee/bookings/2024-08-13/guards/booking-uid.guard.ts

@@ -8,7 +8,7 @@ export class BookingUidGuard implements CanActivate {
     const bookingUid = request.params.bookingUid;
 
     if (!bookingUid) {
-      throw new BadRequestException("Booking UID missing in the request path");
+      throw new BadRequestException("BookingUidGuard - Booking UID missing in the request path");
     }
 
     return true;

apps/api/v2/src/ee/bookings/2024-08-13/inputs/booking-references-filter.input.ts

@@ -0,0 +1,23 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { IsIn, IsOptional } from "class-validator";
+
+export const BookingReferences = [
+  "google_calendar",
+  "office365_calendar",
+  "daily_video",
+  "google_video",
+  "office365_video",
+  "zoom_video",
+] as const;
+
+export class BookingReferencesFilterInput_2024_08_13 {
+  @ApiProperty({
+    description: "Filter booking references by type",
+    required: false,
+    enum: BookingReferences,
+    example: "google_calendar",
+  })
+  @IsOptional()
+  @IsIn(BookingReferences)
+  type?: (typeof BookingReferences)[number];
+}

apps/api/v2/src/ee/bookings/2024-08-13/outputs/booking-references.output.ts

@@ -0,0 +1,46 @@
+import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import { IsEnum, IsNumber, IsString } from "class-validator";
+
+import { SUCCESS_STATUS, ERROR_STATUS } from "@calcom/platform-constants";
+
+export class BookingReference {
+  @IsString()
+  @ApiProperty({
+    description: "The type of the booking reference",
+  })
+  type!: string;
+
+  @IsString()
+  @ApiProperty({
+    description: "The event uid of the booking",
+  })
+  eventUid!: string;
+
+  @IsString()
+  @ApiProperty({
+    description: "The id of the calendar the event is created in",
+    nullable: true,
+  })
+  destinationCalendarId!: string | null;
+
+  @IsNumber()
+  @ApiProperty({
+    description: "The id of the booking reference",
+  })
+  id!: number;
+}
+
+export class BookingReferencesOutput_2024_08_13 {
+  @ApiProperty({
+    description: "The status of the request, always 'success' for successful responses",
+    example: SUCCESS_STATUS,
+  })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+
+  @ApiProperty({
+    description: "Booking References",
+    type: [BookingReference],
+  })
+  data!: BookingReference[];
+}

apps/api/v2/src/ee/bookings/2024-08-13/services/booking-references.service.ts

@@ -0,0 +1,46 @@
+import { BookingReferencesRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/booking-references.repository";
+import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/bookings.repository";
+import { BookingReferencesFilterInput_2024_08_13 } from "@/ee/bookings/2024-08-13/inputs/booking-references-filter.input";
+import { OutputBookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output-booking-references.service";
+import { Injectable, NotFoundException, BadRequestException } from "@nestjs/common";
+
+@Injectable()
+export class BookingReferencesService_2024_08_13 {
+  constructor(
+    private readonly bookingsRepository: BookingsRepository_2024_08_13,
+    private readonly bookingReferencesRepository: BookingReferencesRepository_2024_08_13,
+    private readonly outputBookingReferencesService: OutputBookingReferencesService_2024_08_13
+  ) {}
+
+  async getBookingReferences(
+    bookingUid: string,
+    userId: number,
+    filter?: BookingReferencesFilterInput_2024_08_13
+  ) {
+    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);
+
+    if (!booking) {
+      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);
+    }
+
+    if (booking.user?.id !== userId) {
+      throw new BadRequestException(`Booking with uid ${bookingUid} does not belong to user`);
+    }
+
+    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);
+
+    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);
+  }
+
+  async getOrgBookingReferences(bookingUid: string, filter?: BookingReferencesFilterInput_2024_08_13) {
+    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);
+
+    if (!booking) {
+      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);
+    }
+
+    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);
+
+    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts

@@ -1,19 +1,26 @@
 import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/bookings.repository";
 import { CalendarLink } from "@/ee/bookings/2024-08-13/outputs/calendar-links.output";
+import { ErrorsBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/errors.service";
 import { InputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/input.service";
 import { OutputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output.service";
 import { PlatformBookingsService } from "@/ee/bookings/shared/platform-bookings.service";
 import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.repository";
 import { BillingService } from "@/modules/billing/services/billing.service";
 import { BookingSeatRepository } from "@/modules/booking-seat/booking-seat.repository";
+import { KyselyReadService } from "@/modules/kysely/kysely-read.service";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { OAuthClientUsersService } from "@/modules/oauth-clients/services/oauth-clients-users.service";
+import { OrganizationsRepository } from "@/modules/organizations/index/organizations.repository";
+import { OrganizationsTeamsRepository } from "@/modules/organizations/teams/index/organizations-teams.repository";
 import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
+import { TeamsEventTypesRepository } from "@/modules/teams/event-types/teams-event-types.repository";
+import { TeamsRepository } from "@/modules/teams/teams/teams.repository";
 import { UsersService } from "@/modules/users/services/users.service";
 import { UsersRepository, UserWithProfile } from "@/modules/users/users.repository";
-import { Injectable, Logger, NotFoundException } from "@nestjs/common";
+import { ConflictException, Injectable, Logger, NotFoundException } from "@nestjs/common";
 import { BadRequestException } from "@nestjs/common";
 import { Request } from "express";
+import { DateTime } from "luxon";
 import { z } from "zod";
 
 import {
@@ -53,13 +60,17 @@ type CreatedBooking = {
   start: string;
 };
 
-const eventTypeBookingFieldSchema = z.object({
-  name: z.string(),
-  required: z.boolean(),
-  editable: z.string(),
-});
+const eventTypeBookingFieldSchema = z
+  .object({
+    name: z.string(),
+    required: z.boolean(),
+    editable: z.string(),
+    type: z.string(),
+    options: z.array(z.object({ value: z.string() })).optional(),
+  })
+  .passthrough();
 
-const eventTypeBookingFieldsSchema = z.array(eventTypeBookingFieldSchema);
+export const eventTypeBookingFieldsSchema = z.array(eventTypeBookingFieldSchema);
 
 export type EventTypeWithOwnerAndTeam = EventType & { owner: User | null; team: Team | null };
 
@@ -73,28 +84,28 @@ export class BookingsService_2024_08_13 {
     private readonly bookingSeatRepository: BookingSeatRepository,
     private readonly eventTypesRepository: EventTypesRepository_2024_06_14,
     private readonly prismaReadService: PrismaReadService,
+    private readonly kyselyReadService: KyselyReadService,
     private readonly billingService: BillingService,
     private readonly usersService: UsersService,
     private readonly usersRepository: UsersRepository,
     private readonly platformBookingsService: PlatformBookingsService,
-    private readonly oAuthClientRepository: OAuthClientRepository
+    private readonly oAuthClientRepository: OAuthClientRepository,
+    private readonly organizationsTeamsRepository: OrganizationsTeamsRepository,
+    private readonly organizationsRepository: OrganizationsRepository,
+    private readonly teamsRepository: TeamsRepository,
+    private readonly teamsEventTypesRepository: TeamsEventTypesRepository,
+    private readonly errorsBookingsService: ErrorsBookingsService_2024_08_13
   ) {}
 
   async createBooking(request: Request, body: CreateBookingInput) {
+    let bookingTeamEventType = false;
     try {
       const eventType = await this.getBookedEventType(body);
+      if (eventType?.team) {
+        bookingTeamEventType = true;
+      }
       if (!eventType) {
-        if (body.username && body.eventTypeSlug && !body.organizationSlug) {
-          throw new NotFoundException(
-            `Event type with slug ${body.eventTypeSlug} belonging to user ${body.username} not found.`
-          );
-        }
-        if (body.username && body.eventTypeSlug && body.organizationSlug) {
-          throw new NotFoundException(
-            `Event type with slug ${body.eventTypeSlug} belonging to user ${body.username} within organization ${body.organizationSlug} not found.`
-          );
-        }
-        throw new NotFoundException(`Event type with id ${body.eventTypeId} not found.`);
+        this.errorsBookingsService.handleEventTypeToBeBookedNotFound(body);
       }
 
       body.eventTypeId = eventType.id;
@@ -120,12 +131,7 @@ export class BookingsService_2024_08_13 {
 
       return await this.createRegularBooking(request, body, eventType);
     } catch (error) {
-      if (error instanceof Error) {
-        if (error.message === "no_available_users_found_error") {
-          throw new BadRequestException("User either already has booking at this time or is not available");
-        }
-      }
-      throw error;
+      this.errorsBookingsService.handleBookingError(error, bookingTeamEventType);
     }
   }
 
@@ -141,37 +147,227 @@ export class BookingsService_2024_08_13 {
         user.id,
         body.eventTypeSlug
       );
+    } else if (body.teamSlug && body.eventTypeSlug) {
+      const team = await this.getBookedEventTypeTeam(body.teamSlug, body.organizationSlug);
+      if (!team) {
+        throw new NotFoundException(`Team with slug ${body.teamSlug} not found`);
+      }
+      return await this.teamsEventTypesRepository.getEventTypeByTeamIdAndSlugWithOwnerAndTeam(
+        team.id,
+        body.eventTypeSlug
+      );
     }
     return null;
   }
 
+  async getBookedEventTypeTeam(teamSlug: string, organizationSlug: string | undefined) {
+    if (!organizationSlug) {
+      return await this.teamsRepository.findTeamBySlug(teamSlug);
+    }
+
+    const organization = await this.organizationsRepository.findOrgBySlug(organizationSlug);
+    if (!organization) {
+      throw new NotFoundException(
+        `slots-input.service.ts: Organization with slug ${organizationSlug} not found`
+      );
+    }
+
+    return await this.organizationsTeamsRepository.findOrgTeamBySlug(organization.id, teamSlug);
+  }
+
   async hasRequiredBookingFieldsResponses(body: CreateBookingInput, eventType: EventType | null) {
-    const bookingFields = body.bookingFieldsResponses;
-    if (!bookingFields || !eventType || !eventType.bookingFields) {
+    const bookingFieldsResponses: Record<string, unknown> = {
+      ...body.bookingFieldsResponses,
+      attendeePhoneNumber: body.attendee.phoneNumber,
+      smsReminderNumber: body.attendee.phoneNumber,
+    };
+    if (!eventType?.bookingFields) {
       return true;
     }
 
-    // note(Lauris): we filter out system fields, because some of them are set by default and name and email are passed in the body.attendee
+    // note(Lauris): we filter out system fields, because some of them are set by default and name and email are passed in the body.attendee. Only exception
+    // is smsReminderNumber, because if it is required and not passed sms workflow won't work.
     const eventTypeBookingFields = eventTypeBookingFieldsSchema
       .parse(eventType.bookingFields)
-      .filter((field) => !field.editable.startsWith("system"));
+      .filter((field) => !field.editable.startsWith("system") || field.name === "smsReminderNumber");
 
-    for (const field of eventTypeBookingFields) {
-      if (field.required && !(field.name in bookingFields)) {
-        throw new BadRequestException(`
-          Missing required booking field response: ${field.name} - it is required by the event type booking fields, but missing in the bookingFieldsResponses.
-          You can fetch the event type with ID ${eventType.id} to see the required fields.`);
+    if (!eventTypeBookingFields.length) {
+      return true;
+    }
+
+    for (const eventTypeBookingField of eventTypeBookingFields) {
+      if (
+        eventTypeBookingField.required &&
+        (bookingFieldsResponses[eventTypeBookingField.name] === null ||
+          bookingFieldsResponses[eventTypeBookingField.name] === undefined)
+      ) {
+        if (
+          eventTypeBookingField.name === "attendeePhoneNumber" ||
+          eventTypeBookingField.name === "smsReminderNumber"
+        ) {
+          throw new BadRequestException(
+            `Missing attendee phone number - it is required by the event type. Pass it as "attendee.phoneNumber" string in the request.`
+          );
+        }
+        throw new BadRequestException(
+          `Missing required booking field response: ${eventTypeBookingField.name} - it is required by the event type booking fields, but missing in the bookingFieldsResponses. You can fetch the event type with ID ${eventType.id} to see the required fields.`
+        );
+      }
+
+      const bookingFieldResponseValue = bookingFieldsResponses[eventTypeBookingField.name];
+      if (bookingFieldResponseValue !== undefined) {
+        const bookingFieldResponseValueType = typeof bookingFieldResponseValue;
+        let expectedBookingFieldResponseValueType = "";
+        let isValidType = false;
+        const eventTypeBookingFieldType = eventTypeBookingField.type;
+
+        switch (eventTypeBookingFieldType) {
+          case "phone":
+            expectedBookingFieldResponseValueType = "string";
+            isValidType = bookingFieldResponseValueType === "string";
+            break;
+          case "address":
+            expectedBookingFieldResponseValueType = "string";
+            isValidType = bookingFieldResponseValueType === "string";
+            break;
+          case "text":
+            expectedBookingFieldResponseValueType = "string";
+            isValidType = bookingFieldResponseValueType === "string";
+            break;
+          case "number":
+            expectedBookingFieldResponseValueType = "number";
+            isValidType = bookingFieldResponseValueType === "number";
+            break;
+          case "textarea":
+            expectedBookingFieldResponseValueType = "string";
+            isValidType = bookingFieldResponseValueType === "string";
+            break;
+          case "multiemail":
+            expectedBookingFieldResponseValueType = "array";
+            isValidType = Array.isArray(bookingFieldResponseValue);
+            break;
+          case "boolean":
+            expectedBookingFieldResponseValueType = "boolean";
+            isValidType = bookingFieldResponseValueType === "boolean";
+            break;
+          case "select":
+            expectedBookingFieldResponseValueType = "string or number";
+            isValidType =
+              bookingFieldResponseValueType === "string" || bookingFieldResponseValueType === "number";
+            if (isValidType && Array.isArray(eventTypeBookingField.options)) {
+              const submittedValue = bookingFieldResponseValue as string | number;
+              const allowedOptionValues = eventTypeBookingField.options.map((opt) => opt.value);
+              if (!this.isValidSingleOptionValue(submittedValue, allowedOptionValues)) {
+                throw new BadRequestException(
+                  `Invalid option '${submittedValue}' for booking field '${
+                    eventTypeBookingField.name
+                  }'. Allowed options are: ${allowedOptionValues.join(", ")}.`
+                );
+              }
+            }
+            break;
+          case "multiselect":
+            expectedBookingFieldResponseValueType = "array";
+            isValidType = Array.isArray(bookingFieldResponseValue);
+            if (isValidType && Array.isArray(eventTypeBookingField.options)) {
+              const submittedValues = bookingFieldResponseValue as (string | number)[];
+              const allowedOptionValues = eventTypeBookingField.options.map((opt) => opt.value);
+              if (!this.areValidMultipleOptionValues(submittedValues, allowedOptionValues)) {
+                throw new BadRequestException(
+                  `One or more invalid options for booking field '${
+                    eventTypeBookingField.name
+                  }'. Allowed options are: ${allowedOptionValues.join(", ")}.`
+                );
+              }
+            }
+            break;
+          case "checkbox":
+            expectedBookingFieldResponseValueType = "array";
+            isValidType = Array.isArray(bookingFieldResponseValue);
+            if (isValidType && Array.isArray(eventTypeBookingField.options)) {
+              const submittedValues = bookingFieldResponseValue as (string | number)[];
+              const allowedOptionValues = eventTypeBookingField.options.map((opt) => opt.value);
+              if (!this.areValidMultipleOptionValues(submittedValues, allowedOptionValues)) {
+                throw new BadRequestException(
+                  `One or more invalid options for booking field '${
+                    eventTypeBookingField.name
+                  }'. Allowed options are: ${allowedOptionValues.join(", ")}.`
+                );
+              }
+            }
+            break;
+          case "radio":
+            expectedBookingFieldResponseValueType = "string or number";
+            isValidType =
+              bookingFieldResponseValueType === "string" || bookingFieldResponseValueType === "number";
+            if (isValidType && Array.isArray(eventTypeBookingField.options)) {
+              const submittedValue = bookingFieldResponseValue as string | number;
+              const allowedOptionValues = eventTypeBookingField.options.map((opt) => opt.value);
+              if (!this.isValidSingleOptionValue(submittedValue, allowedOptionValues)) {
+                throw new BadRequestException(
+                  `Invalid option '${submittedValue}' for booking field '${
+                    eventTypeBookingField.name
+                  }'. Allowed options are: ${allowedOptionValues.join(", ")}.`
+                );
+              }
+            }
+            break;
+          case "url":
+            expectedBookingFieldResponseValueType = "string";
+            isValidType = bookingFieldResponseValueType === "string";
+            break;
+          default:
+            // note(Lauris): by default pass the field if we have a missing "case" in the switch
+            isValidType = true;
+            break;
+        }
+
+        if (!isValidType) {
+          throw new BadRequestException(
+            `Invalid type for booking field '${eventTypeBookingField.name}'. Expected type ${expectedBookingFieldResponseValueType} (compatible with field type '${eventTypeBookingFieldType}'), but received ${bookingFieldResponseValueType}.`
+          );
+        }
       }
     }
 
     return true;
   }
 
+  private isValidSingleOptionValue(
+    bookingFieldResponseValue: string | number,
+    eventTypeBookingFieldOptions: string[]
+  ): boolean {
+    if (eventTypeBookingFieldOptions.length === 0) {
+      // note(Lauris): If no options defined, cannot validate against them, so pass.
+      return true;
+    }
+    return eventTypeBookingFieldOptions.some((val) => val === String(bookingFieldResponseValue));
+  }
+
+  private areValidMultipleOptionValues(
+    bookingFieldResponseValues: (string | number)[],
+    eventTypeBookingFieldOptions: string[]
+  ): boolean {
+    if (eventTypeBookingFieldOptions.length === 0) {
+      // note(Lauris): If no options defined, cannot validate against them, so pass.
+      return true;
+    }
+    return bookingFieldResponseValues.every((submittedVal) =>
+      eventTypeBookingFieldOptions.some((allowedVal) => allowedVal === String(submittedVal))
+    );
+  }
+
   async createInstantBooking(
     request: Request,
     body: CreateInstantBookingInput_2024_08_13,
     eventType: EventTypeWithOwnerAndTeam
   ) {
+    if (!eventType.team?.id) {
+      throw new BadRequestException(
+        "Instant bookings are only supported for team event types, not individual user event types."
+      );
+    }
+
     const bookingRequest = await this.inputService.createBookingRequest(request, body, eventType);
     const booking = await handleInstantMeeting(bookingRequest);
 
@@ -185,7 +381,11 @@ export class BookingsService_2024_08_13 {
     return this.outputService.getOutputBooking(databaseBooking);
   }
 
-  async createRecurringBooking(request: Request, body: CreateRecurringBookingInput_2024_08_13, eventType: EventTypeWithOwnerAndTeam) {
+  async createRecurringBooking(
+    request: Request,
+    body: CreateRecurringBookingInput_2024_08_13,
+    eventType: EventTypeWithOwnerAndTeam
+  ) {
     const bookingRequest = await this.inputService.createRecurringBookingRequest(request, body, eventType);
     const bookings = await handleNewRecurringBooking({
       bookingData: bookingRequest.body,
@@ -202,7 +402,11 @@ export class BookingsService_2024_08_13 {
     return this.outputService.getOutputRecurringBookings(ids);
   }
 
-  async createRecurringSeatedBooking(request: Request, body: CreateRecurringBookingInput_2024_08_13, eventType: EventTypeWithOwnerAndTeam) {
+  async createRecurringSeatedBooking(
+    request: Request,
+    body: CreateRecurringBookingInput_2024_08_13,
+    eventType: EventTypeWithOwnerAndTeam
+  ) {
     const bookingRequest = await this.inputService.createRecurringBookingRequest(request, body, eventType);
     const bookings = await handleNewRecurringBooking({
       bookingData: bookingRequest.body,
@@ -219,7 +423,11 @@ export class BookingsService_2024_08_13 {
     );
   }
 
-  async createRegularBooking(request: Request, body: CreateBookingInput_2024_08_13,  eventType: EventTypeWithOwnerAndTeam) {
+  async createRegularBooking(
+    request: Request,
+    body: CreateBookingInput_2024_08_13,
+    eventType: EventTypeWithOwnerAndTeam
+  ) {
     const bookingRequest = await this.inputService.createBookingRequest(request, body, eventType);
     const booking = await handleNewBooking({
       bookingData: bookingRequest.body,
@@ -244,31 +452,43 @@ export class BookingsService_2024_08_13 {
     return this.outputService.getOutputBooking(databaseBooking);
   }
 
-  async createSeatedBooking(request: Request, body: CreateBookingInput_2024_08_13, eventType: EventTypeWithOwnerAndTeam) {
+  async createSeatedBooking(
+    request: Request,
+    body: CreateBookingInput_2024_08_13,
+    eventType: EventTypeWithOwnerAndTeam
+  ) {
     const bookingRequest = await this.inputService.createBookingRequest(request, body, eventType);
-    const booking = await handleNewBooking({
-      bookingData: bookingRequest.body,
-      userId: bookingRequest.userId,
-      hostname: bookingRequest.headers?.host || "",
-      platformClientId: bookingRequest.platformClientId,
-      platformRescheduleUrl: bookingRequest.platformRescheduleUrl,
-      platformCancelUrl: bookingRequest.platformCancelUrl,
-      platformBookingUrl: bookingRequest.platformBookingUrl,
-      platformBookingLocation: bookingRequest.platformBookingLocation,
-    });
+    try {
+      const booking = await handleNewBooking({
+        bookingData: bookingRequest.body,
+        userId: bookingRequest.userId,
+        hostname: bookingRequest.headers?.host || "",
+        platformClientId: bookingRequest.platformClientId,
+        platformRescheduleUrl: bookingRequest.platformRescheduleUrl,
+        platformCancelUrl: bookingRequest.platformCancelUrl,
+        platformBookingUrl: bookingRequest.platformBookingUrl,
+        platformBookingLocation: bookingRequest.platformBookingLocation,
+      });
 
-    if (!booking.uid) {
-      throw new Error("Booking missing uid");
+      if (!booking.uid) {
+        throw new Error("Booking missing uid");
+      }
+
+      const databaseBooking =
+        await this.bookingsRepository.getByUidWithAttendeesWithBookingSeatAndUserAndEvent(booking.uid);
+      if (!databaseBooking) {
+        throw new Error(`Booking with uid=${booking.uid} was not found in the database`);
+      }
+
+      return this.outputService.getOutputCreateSeatedBooking(databaseBooking, booking.seatReferenceUid || "");
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message === "booking_seats_full_error") {
+          throw new ConflictException("No more seats left at this seated booking.");
+        }
+      }
+      throw error;
     }
-
-    const databaseBooking = await this.bookingsRepository.getByUidWithAttendeesWithBookingSeatAndUserAndEvent(
-      booking.uid
-    );
-    if (!databaseBooking) {
-      throw new Error(`Booking with uid=${booking.uid} was not found in the database`);
-    }
-
-    return this.outputService.getOutputCreateSeatedBooking(databaseBooking, booking.seatReferenceUid || "");
   }
 
   async getBooking(uid: string) {
@@ -312,7 +532,7 @@ export class BookingsService_2024_08_13 {
       queryParams.attendeeEmail = await this.getAttendeeEmail(queryParams.attendeeEmail, user);
     }
 
-    const fetchedBookings: { bookings: { id: number }[] } = await getAllUserBookings({
+    const fetchedBookings: { bookings: { id: number }[]; totalCount: number } = await getAllUserBookings({
       bookingListingByStatus: queryParams.status || [],
       skip: queryParams.skip ?? 0,
       take: queryParams.take ?? 100,
@@ -323,6 +543,7 @@ export class BookingsService_2024_08_13 {
       ctx: {
         user,
         prisma: this.prismaReadService.prisma as unknown as PrismaClient,
+        kysely: this.kyselyReadService.kysely,
       },
       sort: this.inputService.transformGetBookingsSort(queryParams),
     });
@@ -367,7 +588,29 @@ export class BookingsService_2024_08_13 {
       }
     }
 
-    return formattedBookings;
+    const skip = Math.abs(queryParams?.skip ?? 0);
+    const take = Math.abs(queryParams?.take ?? 100);
+    const itemsPerPage = take;
+    const totalPages = itemsPerPage !== 0 ? Math.ceil(fetchedBookings.totalCount / itemsPerPage) : 0;
+    const currentPage = Math.floor(skip / itemsPerPage) + 1;
+    const hasNextPage = skip + itemsPerPage < fetchedBookings.totalCount;
+    const hasPreviousPage = skip > 0;
+    return {
+      bookings: formattedBookings,
+      pagination: {
+        totalItems: fetchedBookings.totalCount,
+        // clamp remainingItems between 0 and totalCount
+        remainingItems: Math.min(
+          Math.max(fetchedBookings.totalCount - (skip + take), 0),
+          fetchedBookings.totalCount
+        ),
+        itemsPerPage: itemsPerPage,
+        currentPage: currentPage,
+        totalPages: totalPages,
+        hasNextPage: hasNextPage,
+        hasPreviousPage: hasPreviousPage,
+      },
+    };
   }
 
   async getAttendeeEmail(queryParamsAttendeeEmail: string, user: { id: number }) {
@@ -507,6 +750,20 @@ export class BookingsService_2024_08_13 {
   async markAbsent(bookingUid: string, bookingOwnerId: number, body: MarkAbsentBookingInput_2024_08_13) {
     const bodyTransformed = this.inputService.transformInputMarkAbsentBooking(body);
     const bookingBefore = await this.bookingsRepository.getByUid(bookingUid);
+
+    if (!bookingBefore) {
+      throw new NotFoundException(`Booking with uid=${bookingUid} not found.`);
+    }
+
+    const nowUtc = DateTime.utc();
+    const bookingStartTimeUtc = DateTime.fromJSDate(bookingBefore.startTime, { zone: "utc" });
+
+    if (nowUtc < bookingStartTimeUtc) {
+      throw new BadRequestException(
+        `Bookings can only be marked as absent after their scheduled start time. Current time in UTC+0: ${nowUtc.toISO()}, Booking start time in UTC+0: ${bookingStartTimeUtc.toISO()}`
+      );
+    }
+
     const platformClientParams = bookingBefore?.eventTypeId
       ? await this.platformBookingsService.getOAuthClientParams(bookingBefore.eventTypeId)
       : undefined;
@@ -579,13 +836,24 @@ export class BookingsService_2024_08_13 {
 
     const profile = this.usersService.getUserMainProfile(requestUser);
 
-    await roundRobinReassignment({
-      bookingId: booking.id,
-      orgId: profile?.organizationId || null,
-      emailsEnabled,
-      platformClientParams,
-      reassignedById: requestUser.id,
-    });
+    try {
+      await roundRobinReassignment({
+        bookingId: booking.id,
+        orgId: profile?.organizationId || null,
+        emailsEnabled,
+        platformClientParams,
+        reassignedById: requestUser.id,
+      });
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message === "no_available_users_found_error") {
+          throw new BadRequestException(
+            "Can't reassign the booking because no other host is available at that time."
+          );
+        }
+      }
+      throw error;
+    }
 
     const reassigned = await this.bookingsRepository.getByUidWithUser(bookingUid);
     if (!reassigned) {
@@ -619,17 +887,28 @@ export class BookingsService_2024_08_13 {
 
     const profile = this.usersService.getUserMainProfile(user);
 
-    const reassigned = await roundRobinManualReassignment({
-      bookingId: booking.id,
-      newUserId,
-      orgId: profile?.organizationId || null,
-      reassignReason: body.reason,
-      reassignedById,
-      emailsEnabled,
-      platformClientParams,
-    });
+    try {
+      const reassigned = await roundRobinManualReassignment({
+        bookingId: booking.id,
+        newUserId,
+        orgId: profile?.organizationId || null,
+        reassignReason: body.reason,
+        reassignedById,
+        emailsEnabled,
+        platformClientParams,
+      });
 
-    return this.outputService.getOutputReassignedBooking(reassigned);
+      return this.outputService.getOutputReassignedBooking(reassigned);
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message === "invalid_round_robin_host") {
+          throw new BadRequestException(
+            `User with id=${newUserId} is not a valid Round Robin host - the user to which you reassign this booking must be one of the booking hosts. Fetch the booking using following endpoint and select id of one of the hosts: https://cal.com/docs/api-reference/v2/bookings/get-a-booking`
+          );
+        }
+      }
+      throw error;
+    }
   }
 
   async confirmBooking(bookingUid: string, requestUser: UserWithProfile) {

apps/api/v2/src/ee/bookings/2024-08-13/services/errors.service.ts

@@ -0,0 +1,55 @@
+import { BadRequestException, Injectable, NotFoundException } from "@nestjs/common";
+import { Logger } from "@nestjs/common";
+
+import { CreateBookingInput } from "@calcom/platform-types";
+
+@Injectable()
+export class ErrorsBookingsService_2024_08_13 {
+  private readonly logger = new Logger("ErrorsBookingsService_2024_08_13");
+
+  handleEventTypeToBeBookedNotFound(body: CreateBookingInput): never {
+    if (body.username && body.eventTypeSlug && !body.organizationSlug) {
+      throw new NotFoundException(
+        `Event type with slug ${body.eventTypeSlug} belonging to user ${body.username} not found.`
+      );
+    }
+    if (body.username && body.eventTypeSlug && body.organizationSlug) {
+      throw new NotFoundException(
+        `Event type with slug ${body.eventTypeSlug} belonging to user ${body.username} within organization ${body.organizationSlug} not found.`
+      );
+    }
+    if (body.teamSlug && body.eventTypeSlug && !body.organizationSlug) {
+      throw new NotFoundException(
+        `Event type with slug ${body.eventTypeSlug} belonging to team ${body.teamSlug} not found.`
+      );
+    }
+    if (body.teamSlug && body.eventTypeSlug && body.organizationSlug) {
+      throw new NotFoundException(
+        `Event type with slug ${body.eventTypeSlug} belonging to team ${body.teamSlug} within organization ${body.organizationSlug} not found.`
+      );
+    }
+    throw new NotFoundException(`Event type with id ${body.eventTypeId} not found.`);
+  }
+
+  handleBookingError(error: unknown, bookingTeamEventType: boolean): never {
+    const hostsUnavaile = "One of the hosts either already has booking at this time or is not available";
+
+    if (error instanceof Error) {
+      if (error.message === "no_available_users_found_error") {
+        if (bookingTeamEventType) {
+          throw new BadRequestException(hostsUnavaile);
+        }
+        throw new BadRequestException("User either already has booking at this time or is not available");
+      } else if (error.message === "booking_time_out_of_bounds_error") {
+        throw new BadRequestException(
+          `The event type can't be booked at the "start" time provided. This could be because it's too soon (violating the minimum booking notice) or too far in the future (outside the event's scheduling window). Try fetching available slots first using the GET /v2/slots endpoint and then make a booking with "start" time equal to one of the available slots: https://cal.com/docs/api-reference/v2/slots`
+        );
+      } else if (error.message === "Attempting to book a meeting in the past.") {
+        throw new BadRequestException("Attempting to book a meeting in the past.");
+      } else if (error.message === "hosts_unavailable_for_booking") {
+        throw new BadRequestException(hostsUnavaile);
+      }
+    }
+    throw error;
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts

@@ -1,5 +1,8 @@
 import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/bookings.repository";
-import { EventTypeWithOwnerAndTeam } from "@/ee/bookings/2024-08-13/services/bookings.service";
+import {
+  eventTypeBookingFieldsSchema,
+  EventTypeWithOwnerAndTeam,
+} from "@/ee/bookings/2024-08-13/services/bookings.service";
 import {
   bookingResponsesSchema,
   seatedBookingDataSchema,
@@ -159,6 +162,12 @@ export class InputBookingsService_2024_08_13 {
     this.isBookingLocationWithEventTypeLocations(inputLocation, eventType);
     const location = inputLocation ? this.transformLocation(inputLocation) : undefined;
 
+    const needsSmsReminderNumber = eventType.bookingFields
+      ? eventTypeBookingFieldsSchema
+          .parse(eventType.bookingFields)
+          .find((field) => field.name === "smsReminderNumber")
+      : undefined;
+
     return {
       start: startTime.toISO(),
       end: endTime.toISO(),
@@ -174,6 +183,7 @@ export class InputBookingsService_2024_08_13 {
         name: inputBooking.attendee.name,
         email: attendeeEmail ?? "",
         attendeePhoneNumber: inputBooking.attendee.phoneNumber,
+        smsReminderNumber: needsSmsReminderNumber ? inputBooking.attendee.phoneNumber : undefined,
         guests,
         location,
       },

apps/api/v2/src/ee/bookings/2024-08-13/services/output-booking-references.service.ts

@@ -0,0 +1,20 @@
+import { Injectable } from "@nestjs/common";
+
+interface IBookingReference {
+  type: string;
+  uid: string;
+  id: number;
+  externalCalendarId: string | null;
+}
+
+@Injectable()
+export class OutputBookingReferencesService_2024_08_13 {
+  getOutputBookingReferences(bookingReferences: IBookingReference[]) {
+    return bookingReferences.map((bookingReference) => ({
+      type: bookingReference.type,
+      eventUid: bookingReference.uid,
+      id: bookingReference.id,
+      destinationCalendarId: bookingReference?.externalCalendarId,
+    }));
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/services/output.service.ts

@@ -22,7 +22,7 @@ import {
   RecurringBookingOutput_2024_08_13,
   SeatedAttendee,
 } from "@calcom/platform-types";
-import { Booking, BookingSeat } from "@calcom/prisma/client";
+import { Booking, BookingReference, BookingSeat } from "@calcom/prisma/client";
 
 export const bookingResponsesSchema = z
   .object({

apps/api/v2/src/ee/calendars/controllers/calendars.controller.e2e-spec.ts

@@ -129,7 +129,7 @@ describe("Platform Calendars Endpoints", () => {
 
   it(`/GET/v2/calendars/${GOOGLE_CALENDAR}/connect: it should redirect to auth-url for google calendar OAuth with valid access token `, async () => {
     const response = await request(app.getHttpServer())
-      .get(`/v2/calendars/${GOOGLE_CALENDAR}/connect`)
+      .get(`/v2/calendars/${GOOGLE_CALENDAR}/connect?redir=https://cal.com&isDryRun=false`)
       .set("Authorization", `Bearer ${accessTokenSecret}`)
       .set("Origin", CLIENT_REDIRECT_URI)
       .expect(200);

apps/api/v2/src/ee/calendars/controllers/calendars.controller.ts

@@ -15,6 +15,7 @@ import { IcsFeedService } from "@/ee/calendars/services/ics-feed.service";
 import { OutlookService } from "@/ee/calendars/services/outlook.service";
 import { API_VERSIONS_VALUES } from "@/lib/api-versions";
 import { API_KEY_OR_ACCESS_TOKEN_HEADER } from "@/lib/docs/headers";
+import { ApiAuthGuardOnlyAllow } from "@/modules/auth/decorators/api-auth-guard-only-allow.decorator";
 import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
 import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
@@ -34,6 +35,7 @@ import {
   BadRequestException,
   Post,
   Body,
+  ParseBoolPipe,
 } from "@nestjs/common";
 import { ApiHeader, ApiOperation, ApiParam, ApiQuery, ApiTags as DocsTags } from "@nestjs/swagger";
 import { User } from "@prisma/client";
@@ -50,7 +52,7 @@ import {
   APPLE_CALENDAR,
   CREDENTIAL_CALENDARS,
 } from "@calcom/platform-constants";
-import { ApiResponse, CalendarBusyTimesInput } from "@calcom/platform-types";
+import { ApiResponse, CalendarBusyTimesInput, CreateCalendarCredentialsInput } from "@calcom/platform-types";
 
 @Controller({
   path: "/v2/calendars",
@@ -134,6 +136,7 @@ export class CalendarsController {
     name: "calendar",
   })
   @UseGuards(ApiAuthGuard)
+  @ApiAuthGuardOnlyAllow(["API_KEY", "ACCESS_TOKEN"])
   @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @Get("/:calendar/connect")
   @HttpCode(HttpStatus.OK)
@@ -148,13 +151,14 @@ export class CalendarsController {
     @Req() req: Request,
     @Headers("Authorization") authorization: string,
     @Param("calendar") calendar: string,
-    @Query("redir") redir?: string | null
+    @Query("redir") redir?: string | null,
+    @Query("isDryRun", new ParseBoolPipe({ optional: true })) isDryRun?: boolean
   ): Promise<ApiResponse<{ authUrl: string }>> {
     switch (calendar) {
       case OFFICE_365_CALENDAR:
-        return await this.outlookService.connect(authorization, req, redir ?? "");
+        return await this.outlookService.connect(authorization, req, redir ?? "", isDryRun);
       case GOOGLE_CALENDAR:
-        return await this.googleCalendarService.connect(authorization, req, redir ?? "");
+        return await this.googleCalendarService.connect(authorization, req, redir ?? "", isDryRun);
       default:
         throw new BadRequestException(
           "Invalid calendar type, available calendars are: ",
@@ -171,7 +175,7 @@ export class CalendarsController {
   @Get("/:calendar/save")
   @HttpCode(HttpStatus.OK)
   @Redirect(undefined, 301)
-  @ApiOperation({ summary: "Save an oAuth calendar credentials" })
+  @ApiOperation({ summary: "Save Google or Outlook calendar credentials" })
   async save(
     @Query("state") state: string,
     @Query("code") code: string,
@@ -179,18 +183,30 @@ export class CalendarsController {
   ): Promise<{ url: string }> {
     // state params contains our user access token
     const stateParams = new URLSearchParams(state);
-    const { accessToken, origin, redir } = z
-      .object({ accessToken: z.string(), origin: z.string(), redir: z.string().nullish().optional() })
+    const { accessToken, origin, redir, isDryRun } = z
+      .object({
+        accessToken: z.string(),
+        origin: z.string(),
+        redir: z.string().nullish().optional(),
+        isDryRun: z.string().nullish().optional(),
+      })
       .parse({
         accessToken: stateParams.get("accessToken"),
         origin: stateParams.get("origin"),
         redir: stateParams.get("redir"),
+        isDryRun: stateParams.get("isDryRun"),
       });
     switch (calendar) {
       case OFFICE_365_CALENDAR:
-        return await this.outlookService.save(code, accessToken, origin, redir ?? "");
+        return await this.outlookService.save(code, accessToken, origin, redir ?? "", isDryRun === "true");
       case GOOGLE_CALENDAR:
-        return await this.googleCalendarService.save(code, accessToken, origin, redir ?? "");
+        return await this.googleCalendarService.save(
+          code,
+          accessToken,
+          origin,
+          redir ?? "",
+          isDryRun === "true"
+        );
       default:
         throw new BadRequestException(
           "Invalid calendar type, available calendars are: ",
@@ -207,11 +223,11 @@ export class CalendarsController {
   @UseGuards(ApiAuthGuard)
   @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @Post("/:calendar/credentials")
-  @ApiOperation({ summary: "Sync credentials" })
+  @ApiOperation({ summary: "Save Apple calendar credentials" })
   async syncCredentials(
     @GetUser() user: User,
     @Param("calendar") calendar: string,
-    @Body() body: { username: string; password: string }
+    @Body() body: CreateCalendarCredentialsInput
   ): Promise<{ status: string }> {
     const { username, password } = body;
 

apps/api/v2/src/ee/calendars/services/apple-calendar.service.ts

@@ -60,8 +60,9 @@ export class AppleCalendarService implements CredentialSyncCalendarApp {
   }
 
   async saveCalendarCredentials(userId: number, userEmail: string, username: string, password: string) {
-    if (username.length <= 1 || password.length <= 1)
+    if (!username || !password || username.length <= 1 || password.length <= 1) {
       throw new BadRequestException(`Username or password cannot be empty`);
+    }
 
     const existingAppleCalendarCredentials = await this.credentialRepository.getAllUserCredentialsByTypeAndId(
       APPLE_CALENDAR_TYPE,
@@ -118,6 +119,7 @@ export class AppleCalendarService implements CredentialSyncCalendarApp {
         teamId: null,
         appId: APPLE_CALENDAR_ID,
         invalid: false,
+        delegationCredentialId: null,
       };
 
       const dav = new CalendarService({

apps/api/v2/src/ee/calendars/services/gcal.service.ts

@@ -39,31 +39,38 @@ export class GoogleCalendarService implements OAuthCalendarApp {
   async connect(
     authorization: string,
     req: Request,
-    redir?: string
+    redir?: string,
+    isDryRun?: boolean
   ): Promise<{ status: typeof SUCCESS_STATUS; data: { authUrl: string } }> {
     const accessToken = authorization.replace("Bearer ", "");
     const origin = req.get("origin") ?? req.get("host");
-    const redirectUrl = await this.getCalendarRedirectUrl(accessToken, origin ?? "", redir);
+    const redirectUrl = await this.getCalendarRedirectUrl(accessToken, origin ?? "", redir, isDryRun);
 
     return { status: SUCCESS_STATUS, data: { authUrl: redirectUrl } };
   }
 
-  async save(code: string, accessToken: string, origin: string, redir?: string): Promise<{ url: string }> {
-    return await this.saveCalendarCredentialsAndRedirect(code, accessToken, origin, redir);
+  async save(
+    code: string,
+    accessToken: string,
+    origin: string,
+    redir?: string,
+    isDryRun?: boolean
+  ): Promise<{ url: string }> {
+    return await this.saveCalendarCredentialsAndRedirect(code, accessToken, origin, redir, isDryRun);
   }
 
   async check(userId: number): Promise<{ status: typeof SUCCESS_STATUS }> {
     return await this.checkIfCalendarConnected(userId);
   }
 
-  async getCalendarRedirectUrl(accessToken: string, origin: string, redir?: string) {
+  async getCalendarRedirectUrl(accessToken: string, origin: string, redir?: string, isDryRun?: boolean) {
     const oAuth2Client = await this.getOAuthClient(this.redirectUri);
 
     const authUrl = oAuth2Client.generateAuthUrl({
       access_type: "offline",
       scope: CALENDAR_SCOPES,
       prompt: "consent",
-      state: `accessToken=${accessToken}&origin=${origin}&redir=${redir ?? ""}`,
+      state: `accessToken=${accessToken}&origin=${origin}&redir=${redir ?? ""}&isDryRun=${isDryRun}`,
     });
 
     return authUrl;
@@ -115,7 +122,8 @@ export class GoogleCalendarService implements OAuthCalendarApp {
     code: string,
     accessToken: string,
     origin: string,
-    redir?: string
+    redir?: string,
+    isDryRun?: boolean
   ) {
     // User chose not to authorize your app or didn't authorize your app
     // redirect directly without oauth code
@@ -123,6 +131,11 @@ export class GoogleCalendarService implements OAuthCalendarApp {
       return { url: redir || origin };
     }
 
+    // if isDryRun is true we know its a dry run so we just redirect straight away
+    if (isDryRun) {
+      return { url: redir || origin };
+    }
+
     const parsedCode = z.string().parse(code);
 
     const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);

apps/api/v2/src/ee/calendars/services/ics-feed.service.ts

@@ -35,6 +35,7 @@ export class IcsFeedService implements ICSFeedCalendarApp {
       teamId: null,
       appId: ICS_CALENDAR,
       invalid: false,
+      delegationCredentialId: null,
     };
 
     try {

apps/api/v2/src/ee/calendars/services/outlook.service.ts

@@ -33,24 +33,31 @@ export class OutlookService implements OAuthCalendarApp {
   async connect(
     authorization: string,
     req: Request,
-    redir?: string
+    redir?: string,
+    isDryRun?: boolean
   ): Promise<{ status: typeof SUCCESS_STATUS; data: { authUrl: string } }> {
     const accessToken = authorization.replace("Bearer ", "");
     const origin = req.get("origin") ?? req.get("host");
-    const redirectUrl = await await this.getCalendarRedirectUrl(accessToken, origin ?? "", redir);
+    const redirectUrl = await this.getCalendarRedirectUrl(accessToken, origin ?? "", redir, isDryRun);
 
     return { status: SUCCESS_STATUS, data: { authUrl: redirectUrl } };
   }
 
-  async save(code: string, accessToken: string, origin: string, redir?: string): Promise<{ url: string }> {
-    return await this.saveCalendarCredentialsAndRedirect(code, accessToken, origin, redir);
+  async save(
+    code: string,
+    accessToken: string,
+    origin: string,
+    redir?: string,
+    isDryRun?: boolean
+  ): Promise<{ url: string }> {
+    return await this.saveCalendarCredentialsAndRedirect(code, accessToken, origin, redir, isDryRun);
   }
 
   async check(userId: number): Promise<{ status: typeof SUCCESS_STATUS }> {
     return await this.checkIfCalendarConnected(userId);
   }
 
-  async getCalendarRedirectUrl(accessToken: string, origin: string, redir?: string) {
+  async getCalendarRedirectUrl(accessToken: string, origin: string, redir?: string, isDryRun?: boolean) {
     const { client_id } = await this.calendarsService.getAppKeys(OFFICE_365_CALENDAR_ID);
 
     const scopes = ["User.Read", "Calendars.Read", "Calendars.ReadWrite", "offline_access"];
@@ -60,7 +67,7 @@ export class OutlookService implements OAuthCalendarApp {
       client_id,
       prompt: "select_account",
       redirect_uri: this.redirectUri,
-      state: `accessToken=${accessToken}&origin=${origin}&redir=${redir ?? ""}`,
+      state: `accessToken=${accessToken}&origin=${origin}&redir=${redir ?? ""}&isDryRun=${isDryRun}`,
     };
 
     const query = stringify(params);
@@ -148,13 +155,19 @@ export class OutlookService implements OAuthCalendarApp {
     code: string,
     accessToken: string,
     origin: string,
-    redir?: string
+    redir?: string,
+    isDryRun?: boolean
   ) {
     // if code is not defined, user denied to authorize office 365 app, just redirect straight away
     if (!code || code === "undefined") {
       return { url: redir || origin };
     }
 
+    // if isDryRun is true we know its a dry run so we just redirect straight away
+    if (isDryRun) {
+      return { url: redir || origin };
+    }
+
     const parsedCode = z.string().parse(code);
 
     const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);

apps/api/v2/src/ee/event-types/event-types_2024_06_14/constants/constants.ts

@@ -1,4 +1,4 @@
-import { OrganizerIntegrationLocation } from "@calcom/lib";
+import { OrganizerIntegrationLocation } from "@calcom/lib/event-types/transformers/internal/locations";
 
 type BaseEventType = {
   length: number;

apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts

@@ -490,6 +490,7 @@ describe("Event types Endpoints", () => {
         requiresBookerEmailVerification: false,
         hideCalendarNotes: false,
         hideCalendarEventDetails: false,
+        hideOrganizerEmail: false,
         lockTimeZoneToggleOnBookingPage: true,
         color: {
           darkThemeHex: "#292929",
@@ -529,6 +530,7 @@ describe("Event types Endpoints", () => {
 
           expect(createdEventType.hideCalendarNotes).toEqual(body.hideCalendarNotes);
           expect(createdEventType.hideCalendarEventDetails).toEqual(body.hideCalendarEventDetails);
+          expect(createdEventType.hideOrganizerEmail).toEqual(body.hideOrganizerEmail);
           expect(createdEventType.lockTimeZoneToggleOnBookingPage).toEqual(
             body.lockTimeZoneToggleOnBookingPage
           );
@@ -610,6 +612,7 @@ describe("Event types Endpoints", () => {
       );
       expect(fetchedEventType.hideCalendarNotes).toEqual(eventType.hideCalendarNotes);
       expect(fetchedEventType.hideCalendarEventDetails).toEqual(eventType.hideCalendarEventDetails);
+      expect(fetchedEventType.hideOrganizerEmail).toEqual(eventType.hideOrganizerEmail);
       expect(fetchedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
         eventType.lockTimeZoneToggleOnBookingPage
       );
@@ -1009,6 +1012,7 @@ describe("Event types Endpoints", () => {
         requiresBookerEmailVerification: true,
         hideCalendarNotes: true,
         hideCalendarEventDetails: true,
+        hideOrganizerEmail: true,
         lockTimeZoneToggleOnBookingPage: true,
         color: {
           darkThemeHex: "#292929",
@@ -1073,6 +1077,7 @@ describe("Event types Endpoints", () => {
           );
           expect(updatedEventType.hideCalendarNotes).toEqual(body.hideCalendarNotes);
           expect(updatedEventType.hideCalendarEventDetails).toEqual(body.hideCalendarEventDetails);
+          expect(updatedEventType.hideOrganizerEmail).toEqual(body.hideOrganizerEmail);
           expect(updatedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
             body.lockTimeZoneToggleOnBookingPage
           );
@@ -1093,6 +1098,7 @@ describe("Event types Endpoints", () => {
           eventType.requiresBookerEmailVerification = updatedEventType.requiresBookerEmailVerification;
           eventType.hideCalendarNotes = updatedEventType.hideCalendarNotes;
           eventType.hideCalendarEventDetails = updatedEventType.hideCalendarEventDetails;
+          eventType.hideOrganizerEmail = updatedEventType.hideOrganizerEmail;
           eventType.lockTimeZoneToggleOnBookingPage = updatedEventType.lockTimeZoneToggleOnBookingPage;
           eventType.color = updatedEventType.color;
           eventType.bookingFields = updatedEventType.bookingFields;
@@ -1163,6 +1169,7 @@ describe("Event types Endpoints", () => {
       );
       expect(fetchedEventType.hideCalendarNotes).toEqual(eventType.hideCalendarNotes);
       expect(fetchedEventType.hideCalendarEventDetails).toEqual(eventType.hideCalendarEventDetails);
+      expect(fetchedEventType.hideOrganizerEmail).toEqual(eventType.hideOrganizerEmail);
       expect(fetchedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
         eventType.lockTimeZoneToggleOnBookingPage
       );
@@ -1204,6 +1211,7 @@ describe("Event types Endpoints", () => {
       );
       expect(fetchedEventType.hideCalendarNotes).toEqual(eventType.hideCalendarNotes);
       expect(fetchedEventType.hideCalendarEventDetails).toEqual(eventType.hideCalendarEventDetails);
+      expect(fetchedEventType.hideOrganizerEmail).toEqual(eventType.hideOrganizerEmail);
       expect(fetchedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
         eventType.lockTimeZoneToggleOnBookingPage
       );
@@ -1420,7 +1428,6 @@ describe("Event types Endpoints", () => {
           {
             name: "location",
             type: "radioInput",
-            label: "",
             sources: [{ id: "default", type: "default", label: "Default" }],
             editable: "system",
             required: false,
@@ -1550,7 +1557,6 @@ describe("Event types Endpoints", () => {
           {
             name: "location",
             type: "radioInput",
-            label: "",
             sources: [{ id: "default", type: "default", label: "Default" }],
             editable: "system",
             required: false,
@@ -1775,6 +1781,68 @@ describe("Event types Endpoints", () => {
         });
     });
 
+    describe("creating event type with input of another event type output", () => {
+      let firstCreatedEventType: EventTypeOutput_2024_06_14;
+      let secondCreatedEventType: EventTypeOutput_2024_06_14;
+
+      it("should create first event type", async () => {
+        const body: CreateEventTypeInput_2024_06_14 = {
+          title: "first created coding class",
+          slug: "first-created-coding-class",
+          lengthInMinutes: 60,
+          locations: [
+            {
+              type: "address",
+              address: "via volturno 10, Roma",
+              public: true,
+            },
+          ],
+        };
+
+        return request(app.getHttpServer())
+          .post("/api/v2/event-types")
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+          .send(body)
+          .expect(201)
+          .then(async (response) => {
+            const responseBody: ApiSuccessResponse<EventTypeOutput_2024_06_14> = response.body;
+            const createdEventType = responseBody.data;
+            expect(createdEventType).toHaveProperty("id");
+            expect(createdEventType.title).toEqual(body.title);
+            expect(createdEventType.locations).toEqual(body.locations);
+            firstCreatedEventType = responseBody.data;
+          });
+      });
+
+      it("should create second event type using first as input", async () => {
+        const body = {
+          ...firstCreatedEventType,
+          title: "second created coding class",
+          slug: "second-created-coding-class",
+        };
+
+        return request(app.getHttpServer())
+          .post("/api/v2/event-types")
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+          .send(body)
+          .expect(201)
+          .then(async (response) => {
+            const responseBody: ApiSuccessResponse<EventTypeOutput_2024_06_14> = response.body;
+            const createdEventType = responseBody.data;
+            expect(createdEventType).toHaveProperty("id");
+            expect(createdEventType.title).toEqual(body.title);
+            secondCreatedEventType = responseBody.data;
+
+            const { id, title, slug, ...restFirst } = firstCreatedEventType;
+            const { id: id2, title: title2, slug: slug2, ...restSecond } = secondCreatedEventType;
+            expect(restFirst).toEqual(restSecond);
+            expect(id2).not.toEqual(id);
+            expect(title2).not.toEqual(title);
+            expect(slug2).not.toEqual(slug);
+          });
+      });
+    });
+
     afterAll(async () => {
       await oauthClientRepositoryFixture.delete(oAuthClient.id);
       await teamRepositoryFixture.delete(organization.id);

apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.module.ts

@@ -8,7 +8,6 @@ import { InputEventTypesService_2024_06_14 } from "@/ee/event-types/event-types_
 import { OutputEventTypesService_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/services/output-event-types.service";
 import { SchedulesRepository_2024_06_11 } from "@/ee/schedules/schedules_2024_06_11/schedules.repository";
 import { AppsRepository } from "@/modules/apps/apps.repository";
-import { ConferencingModule } from "@/modules/conferencing/conferencing.module";
 import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
 import { MembershipsModule } from "@/modules/memberships/memberships.module";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
@@ -19,7 +18,7 @@ import { UsersRepository } from "@/modules/users/users.repository";
 import { Module } from "@nestjs/common";
 
 @Module({
-  imports: [PrismaModule, MembershipsModule, TokensModule, SelectedCalendarsModule, ConferencingModule],
+  imports: [PrismaModule, MembershipsModule, TokensModule, SelectedCalendarsModule],
   providers: [
     EventTypesRepository_2024_06_14,
     EventTypesService_2024_06_14,

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/input-event-types.service.ts

@@ -5,6 +5,9 @@ import { ConferencingService } from "@/modules/conferencing/services/conferencin
 import { UserWithProfile } from "@/modules/users/users.repository";
 import { Injectable, BadRequestException } from "@nestjs/common";
 
+import { CONFERENCING_APPS } from "@calcom/platform-constants";
+import { getUsersCredentials } from "@calcom/platform-libraries";
+import { getApps } from "@calcom/platform-libraries/app-store";
 import {
   transformBookingFieldsApiToInternal,
   transformLocationsApiToInternal,
@@ -50,8 +53,7 @@ interface ValidationContext {
 export class InputEventTypesService_2024_06_14 {
   constructor(
     private readonly eventTypesRepository: EventTypesRepository_2024_06_14,
-    private readonly calendarsService: CalendarsService,
-    private readonly conferencingService: ConferencingService
+    private readonly calendarsService: CalendarsService
   ) {}
 
   async transformAndValidateCreateEventTypeInput(
@@ -104,13 +106,6 @@ export class InputEventTypesService_2024_06_14 {
   }
 
   transformInputCreateEventType(inputEventType: CreateEventTypeInput_2024_06_14) {
-    const defaultLocations: CreateEventTypeInput_2024_06_14["locations"] = [
-      {
-        type: "integration",
-        integration: "cal-video",
-      },
-    ];
-
     const {
       lengthInMinutes,
       lengthInMinutesOptions,
@@ -130,10 +125,11 @@ export class InputEventTypesService_2024_06_14 {
     } = inputEventType;
     const confirmationPolicyTransformed = this.transformInputConfirmationPolicy(confirmationPolicy);
 
+    const locationsTransformed = locations?.length ? this.transformInputLocations(locations) : undefined;
     const eventType = {
       ...rest,
       length: lengthInMinutes,
-      locations: this.transformInputLocations(locations || defaultLocations),
+      locations: locationsTransformed,
       bookingFields: this.transformInputBookingFields(bookingFields),
       bookingLimits: bookingLimitsCount ? this.transformInputIntervalLimits(bookingLimitsCount) : undefined,
       durationLimits: bookingLimitsDuration
@@ -228,6 +224,7 @@ export class InputEventTypesService_2024_06_14 {
     const systemCustomNameField = systemCustomFields?.find((field) => field.type === "name");
     const systemCustomEmailField = systemCustomFields?.find((field) => field.type === "email");
     const systemCustomTitleField = systemCustomFields?.find((field) => field.name === "title");
+    const systemCustomLocationField = systemCustomFields?.find((field) => field.name === "location");
     const systemCustomNotesField = systemCustomFields?.find((field) => field.name === "notes");
     const systemCustomGuestsField = systemCustomFields?.find((field) => field.name === "guests");
     const systemCustomRescheduleReasonField = systemCustomFields?.find(
@@ -237,7 +234,7 @@ export class InputEventTypesService_2024_06_14 {
     const defaultFieldsBefore: (SystemField | CustomField)[] = [
       systemCustomNameField || systemBeforeFieldName,
       systemCustomEmailField || systemBeforeFieldEmail,
-      systemBeforeFieldLocation,
+      systemCustomLocationField || systemBeforeFieldLocation,
     ];
 
     const defaultFieldsAfter = [
@@ -278,7 +275,8 @@ export class InputEventTypesService_2024_06_14 {
       field.name !== "title" &&
       field.name !== "notes" &&
       field.name !== "guests" &&
-      field.name !== "rescheduleReason"
+      field.name !== "rescheduleReason" &&
+      field.name !== "location"
     );
   }
 
@@ -463,10 +461,32 @@ export class InputEventTypesService_2024_06_14 {
         if (location.type === "integration") {
           // cal-video is global, so we can skip this check
           if (location.integration !== "cal-video") {
-            await this.conferencingService.checkAppIsValidAndConnected(user, location.integration);
+            await this.checkAppIsValidAndConnected(user, location.integration);
           }
         }
       }) ?? []
     );
   }
+
+  async checkAppIsValidAndConnected(user: UserWithProfile, appSlug: string) {
+    const conferencingApps = ["google-meet", "office365-video", "zoom"];
+    if (!conferencingApps.includes(appSlug)) {
+      throw new BadRequestException("Invalid app, available apps are: ", conferencingApps.join(", "));
+    }
+
+    if (appSlug === "office365-video") {
+      appSlug = "msteams";
+    }
+
+    const credentials = await getUsersCredentials(user);
+
+    const foundApp = getApps(credentials, true).filter((app) => app.slug === appSlug)[0];
+
+    const appLocation = foundApp?.appData?.location;
+
+    if (!foundApp || !appLocation) {
+      throw new BadRequestException(`${appSlug} not connected.`);
+    }
+    return foundApp.credential;
+  }
 }

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts

@@ -87,6 +87,7 @@ type Input = Pick<
   | "destinationCalendar"
   | "useEventTypeDestinationCalendarEmail"
   | "hideCalendarEventDetails"
+  | "hideOrganizerEmail"
 >;
 
 @Injectable()
@@ -123,6 +124,7 @@ export class OutputEventTypesService_2024_06_14 {
       seatsShowAttendees,
       useEventTypeDestinationCalendarEmail,
       hideCalendarEventDetails,
+      hideOrganizerEmail,
     } = databaseEventType;
 
     const locations = this.transformLocations(databaseEventType.locations);
@@ -197,6 +199,7 @@ export class OutputEventTypesService_2024_06_14 {
       destinationCalendar,
       useDestinationCalendarEmail: useEventTypeDestinationCalendarEmail,
       hideCalendarEventDetails,
+      hideOrganizerEmail,
     };
   }
 

apps/api/v2/src/ee/gcal/gcal.controller.ts

@@ -9,8 +9,6 @@ import { Permissions } from "@/modules/auth/decorators/permissions/permissions.d
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
 import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
 import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
-import { SelectedCalendarsRepository } from "@/modules/selected-calendars/selected-calendars.repository";
-import { TokensRepository } from "@/modules/tokens/tokens.repository";
 import {
   BadRequestException,
   Controller,
@@ -48,8 +46,6 @@ export class GcalController {
 
   constructor(
     private readonly credentialRepository: CredentialsRepository,
-    private readonly tokensRepository: TokensRepository,
-    private readonly selectedCalendarsRepository: SelectedCalendarsRepository,
     private readonly config: ConfigService,
     private readonly gcalService: GCalService,
     private readonly calendarsService: CalendarsService

apps/api/v2/src/ee/me/me.module.ts

@@ -1,11 +1,12 @@
 import { MeController } from "@/ee/me/me.controller";
 import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
+import { OAuthClientModule } from "@/modules/oauth-clients/oauth-client.module";
 import { TokensModule } from "@/modules/tokens/tokens.module";
 import { UsersModule } from "@/modules/users/users.module";
 import { Module } from "@nestjs/common";
 
 @Module({
-  imports: [UsersModule, SchedulesModule_2024_04_15, TokensModule],
+  imports: [UsersModule, SchedulesModule_2024_04_15, TokensModule, OAuthClientModule],
   controllers: [MeController],
 })
 export class MeModule {}

apps/api/v2/src/ee/platform-endpoints-module.ts

@@ -8,6 +8,7 @@ import { MeModule } from "@/ee/me/me.module";
 import { ProviderModule } from "@/ee/provider/provider.module";
 import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
 import { SchedulesModule_2024_06_11 } from "@/ee/schedules/schedules_2024_06_11/schedules.module";
+import { RoutingFormsModule } from "@/modules/routing-forms/routing-forms.module";
 import { SlotsModule_2024_04_15 } from "@/modules/slots/slots-2024-04-15/slots.module";
 import { SlotsModule_2024_09_04 } from "@/modules/slots/slots-2024-09-04/slots.module";
 import { TeamsEventTypesModule } from "@/modules/teams/event-types/teams-event-types.module";
@@ -33,6 +34,7 @@ import { Module } from "@nestjs/common";
     SlotsModule_2024_04_15,
     SlotsModule_2024_09_04,
     TeamsModule,
+    RoutingFormsModule,
   ],
 })
 export class PlatformEndpointsModule implements NestModule {

apps/api/v2/src/env.ts

@@ -38,6 +38,10 @@ export const getEnv = <K extends keyof Environment>(key: K, fallback?: Environme
   const value = process.env[key] as Environment[K] | undefined;
 
   if (value === undefined) {
+    // handle fallback falsy cases that should still be used as value
+    if (fallback === false || fallback === "" || fallback === 0) {
+      return fallback;
+    }
     if (fallback) {
       return fallback;
     }

apps/api/v2/src/instrument.ts

@@ -6,7 +6,7 @@ if (process.env.SENTRY_DSN) {
   // Ensure to call this before requiring any other modules!
   Sentry.init({
     dsn: getEnv("SENTRY_DSN"),
-    integrations: [nodeProfilingIntegration()],
+    integrations: [nodeProfilingIntegration(), Sentry.prismaIntegration()],
     // Performance Monitoring
     tracesSampleRate: getEnv("SENTRY_TRACES_SAMPLE_RATE") ?? 1.0, //  Capture 100% of the transactions
     // Set sampling rate for profiling - this is relative to tracesSampleRate

apps/api/v2/src/lib/endpoint-throttler-decorator.ts

@@ -0,0 +1,4 @@
+import { RateLimitType } from "@/lib/throttler-guard";
+import { Reflector } from "@nestjs/core";
+
+export const Throttle = Reflector.createDecorator<RateLimitType>();

apps/api/v2/src/lib/throttler-guard.ts

@@ -1,5 +1,6 @@
 import { getEnv } from "@/env";
 import { hashAPIKey, isApiKey, stripApiKey } from "@/lib/api-key";
+import { Throttle } from "@/lib/endpoint-throttler-decorator";
 import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { ThrottlerStorageRedisService } from "@nest-lab/throttler-storage-redis";
 import { Inject, Injectable, Logger, UnauthorizedException } from "@nestjs/common";
@@ -22,7 +23,7 @@ const rateLimitSchema = z.object({
   ttl: z.number(),
   blockDuration: z.number(),
 });
-type RateLimitType = z.infer<typeof rateLimitSchema>;
+export type RateLimitType = z.infer<typeof rateLimitSchema>;
 const rateLimitsSchema = z.array(rateLimitSchema);
 
 const sixtySecondsMs = 60 * 1000;
@@ -52,16 +53,21 @@ export class CustomThrottlerGuard extends ThrottlerGuard {
 
   protected async handleRequest(requestProps: ThrottlerRequest): Promise<boolean> {
     const { context } = requestProps;
-
+    const throttleOptions = this.reflector.get(Throttle, context.getHandler());
     const request = context.switchToHttp().getRequest<Request>();
+    const IP = request?.headers?.["cf-connecting-ip"] ?? request?.headers?.["CF-Connecting-IP"] ?? request.ip;
     const response = context.switchToHttp().getResponse<Response>();
     const tracker = await this.getTracker(request);
     this.logger.verbose(
       `Tracker "${tracker}" generated based on: Bearer token "${request.get(
         "Authorization"
-      )}", OAuth client ID "${request.get(X_CAL_CLIENT_ID)}" and IP "${request.ip}"`
+      )}", OAuth client ID "${request.get(X_CAL_CLIENT_ID)}" and IP "${IP}"`
     );
 
+    if (throttleOptions) {
+      return this.handleApiEndpointThrottle(tracker, throttleOptions, response);
+    }
+
     if (tracker.startsWith("api_key_")) {
       return this.handleApiKeyRequest(tracker, response);
     } else {
@@ -69,6 +75,15 @@ export class CustomThrottlerGuard extends ThrottlerGuard {
     }
   }
 
+  private async handleApiEndpointThrottle(tracker: string, options: RateLimitType, response: Response) {
+    const { isBlocked } = await this.incrementRateLimit(`${tracker}_${options.name}`, options, response);
+    if (isBlocked) {
+      throw new ThrottlerException("CustomThrottlerGuard - Too many requests. Please try again later.");
+    }
+
+    return true;
+  }
+
   private async handleApiKeyRequest(tracker: string, response: Response): Promise<boolean> {
     const rateLimits = await this.getRateLimitsForApiKeyTracker(tracker);
 
@@ -81,7 +96,7 @@ export class CustomThrottlerGuard extends ThrottlerGuard {
     }
 
     if (allLimitsBlocked) {
-      throw new ThrottlerException("Too many requests. Please try again later.");
+      throw new ThrottlerException("CustomThrottlerGuard - Too many requests. Please try again later.");
     }
 
     return true;
@@ -95,7 +110,7 @@ export class CustomThrottlerGuard extends ThrottlerGuard {
 
     const { isBlocked } = await this.incrementRateLimit(tracker, rateLimit, response);
     if (isBlocked) {
-      throw new ThrottlerException("Too many requests. Please try again later.");
+      throw new ThrottlerException("CustomThrottlerGuard - Too many requests. Please try again later.");
     }
 
     return true;
@@ -149,7 +164,7 @@ export class CustomThrottlerGuard extends ThrottlerGuard {
     });
 
     if (!apiKeyRecord) {
-      throw new UnauthorizedException("Invalid API Key");
+      throw new UnauthorizedException("CustomThrottlerGuard - Invalid API Key");
     }
 
     rateLimits = await this.dbRead.prisma.rateLimit.findMany({
@@ -209,6 +224,7 @@ export class CustomThrottlerGuard extends ThrottlerGuard {
 
   protected async getTracker(request: Request): Promise<string> {
     const authorizationHeader = request.get("Authorization")?.replace("Bearer ", "");
+    const IP = request?.headers?.["cf-connecting-ip"] ?? request?.headers?.["CF-Connecting-IP"] ?? request.ip;
 
     if (authorizationHeader) {
       const apiKeyPrefix = getEnv("API_KEY_PREFIX", "cal_");
@@ -223,8 +239,8 @@ export class CustomThrottlerGuard extends ThrottlerGuard {
       return `oauth_client_${oauthClientId}`;
     }
 
-    if (request.ip) {
-      return `ip_${request.ip}`;
+    if (IP) {
+      return `ip_${IP}`;
     }
 
     this.logger.verbose(`no tracker found: ${request.url}`);

apps/api/v2/src/modules/atoms/services/event-types-atom.service.ts

@@ -81,6 +81,10 @@ export class EventTypesAtomService {
       this.eventTypeService.checkUserOwnsEventType(user.id, eventType.eventType);
     }
 
+    // note (Lauris): don't show platform owner as one of the people that can be assigned to managed team event type
+    const onlyManagedTeamMembers = eventType.teamMembers.filter((user) => user.isPlatformManaged);
+    eventType.teamMembers = onlyManagedTeamMembers;
+
     return eventType;
   }
 

apps/api/v2/src/modules/auth/auth.module.ts

@@ -1,22 +1,16 @@
 import { ApiKeysModule } from "@/modules/api-keys/api-keys.module";
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
-import { PlatformPlanGuard } from "@/modules/auth/guards/billing/platform-plan.guard";
 import { NextAuthGuard } from "@/modules/auth/guards/next-auth/next-auth.guard";
-import { IsAdminAPIEnabledGuard } from "@/modules/auth/guards/organizations/is-admin-api-enabled.guard";
-import { IsOrgGuard } from "@/modules/auth/guards/organizations/is-org.guard";
-import { RolesGuard } from "@/modules/auth/guards/roles/roles.guard";
-import { IsTeamInOrg } from "@/modules/auth/guards/teams/is-team-in-org.guard";
 import { ApiAuthStrategy } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { NextAuthStrategy } from "@/modules/auth/strategies/next-auth/next-auth.strategy";
 import { DeploymentsModule } from "@/modules/deployments/deployments.module";
 import { MembershipsModule } from "@/modules/memberships/memberships.module";
 import { OAuthFlowService } from "@/modules/oauth-clients/services/oauth-flow.service";
-import { OrganizationsModule } from "@/modules/organizations/organizations.module";
 import { ProfilesModule } from "@/modules/profiles/profiles.module";
 import { RedisModule } from "@/modules/redis/redis.module";
 import { TokensModule } from "@/modules/tokens/tokens.module";
 import { UsersModule } from "@/modules/users/users.module";
-import { forwardRef, Module } from "@nestjs/common";
+import { Module } from "@nestjs/common";
 import { PassportModule } from "@nestjs/passport";
 
 @Module({
@@ -29,28 +23,8 @@ import { PassportModule } from "@nestjs/passport";
     TokensModule,
     DeploymentsModule,
     ProfilesModule,
-    forwardRef(() => OrganizationsModule),
-  ],
-  providers: [
-    NextAuthGuard,
-    NextAuthStrategy,
-    ApiAuthGuard,
-    ApiAuthStrategy,
-    OAuthFlowService,
-    IsTeamInOrg,
-    RolesGuard,
-    IsOrgGuard,
-    IsAdminAPIEnabledGuard,
-    PlatformPlanGuard,
-  ],
-  exports: [
-    NextAuthGuard,
-    ApiAuthGuard,
-    IsTeamInOrg,
-    RolesGuard,
-    IsOrgGuard,
-    IsAdminAPIEnabledGuard,
-    PlatformPlanGuard,
   ],
+  providers: [NextAuthGuard, NextAuthStrategy, ApiAuthGuard, ApiAuthStrategy, OAuthFlowService],
+  exports: [NextAuthGuard, ApiAuthGuard],
 })
 export class AuthModule {}

apps/api/v2/src/modules/auth/decorators/api-auth-guard-only-allow.decorator.ts

@@ -0,0 +1,5 @@
+import { Reflector } from "@nestjs/core";
+
+export type AllowedAuthMethod = "OAUTH_CLIENT_CREDENTIALS" | "API_KEY" | "ACCESS_TOKEN" | "NEXT_AUTH";
+
+export const ApiAuthGuardOnlyAllow = Reflector.createDecorator<AllowedAuthMethod[]>();

apps/api/v2/src/modules/auth/guards/api-auth/api-auth.guard.ts

@@ -1,7 +1,20 @@
+import { ExecutionContext, Inject } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
 import { AuthGuard } from "@nestjs/passport";
 
+import { ApiAuthGuardOnlyAllow } from "../../decorators/api-auth-guard-only-allow.decorator";
+
 export class ApiAuthGuard extends AuthGuard("api-auth") {
-  constructor() {
+  constructor(@Inject(Reflector) private readonly reflector: Reflector) {
     super();
   }
+
+  getRequest(context: ExecutionContext) {
+    const request = context.switchToHttp().getRequest();
+
+    const allowedMethods = this.reflector.get(ApiAuthGuardOnlyAllow, context.getHandler());
+    request.allowedAuthMethods = allowedMethods;
+
+    return request;
+  }
 }

apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.spec.ts

@@ -104,13 +104,6 @@ describe("PlatformPlanGuard", () => {
     await expect(guard.canActivate(mockContext)).resolves.toBe(true);
   });
 
-  it("should throw ForbiddenException if the result is cached as false in Redis", async () => {
-    jest.spyOn(reflector, "get").mockReturnValue("ESSENTIALS");
-    jest.spyOn(redisService.redis, "get").mockResolvedValue(JSON.stringify(false));
-
-    await expect(guard.canActivate(mockContext)).rejects.toThrow(ForbiddenException);
-  });
-
   function createMockExecutionContext(context: Record<string, string | object>): ExecutionContext {
     return createMock<ExecutionContext>({
       switchToHttp: () => ({

apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.ts

@@ -16,65 +16,63 @@ export class PlatformPlanGuard implements CanActivate {
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    const request = context.switchToHttp().getRequest<Request>();
-    const teamId = request.params.teamId as string;
-    const orgId = request.params.orgId as string;
-    const user = request.user as ApiAuthGuardUser;
     const minimumPlan = this.reflector.get(PlatformPlan, context.getHandler()) as PlatformPlanType;
-    const { canAccess } = await this.checkPlatformPlanAccess({ teamId, orgId, user, minimumPlan });
-    return canAccess;
+    if (!minimumPlan) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<Request>();
+    const orgId = request.params.orgId;
+    const user = request.user as ApiAuthGuardUser;
+    if (!user) {
+      throw new ForbiddenException("PlatformPlanGuard - No user associated with the request.");
+    }
+    if (!orgId) {
+      throw new ForbiddenException("PlatformPlanGuard - No organization associated with the request.");
+    }
+
+    return await this.checkPlatformPlanAccess(orgId, minimumPlan);
   }
 
-  async checkPlatformPlanAccess({
-    teamId,
-    orgId,
-    user,
-    minimumPlan,
-  }: {
-    teamId?: string;
-    orgId?: string;
-    user: ApiAuthGuardUser;
-    minimumPlan: PlatformPlanType;
-  }): Promise<{ canAccess: boolean }> {
-    const REDIS_CACHE_KEY = `apiv2:user:${user?.id ?? "none"}:org:${orgId ?? "none"}:team:${
-      teamId ?? "none"
-    }:guard:platformbilling:${minimumPlan}`;
-
-    const cachedAccess = JSON.parse((await this.redisService.redis.get(REDIS_CACHE_KEY)) ?? "false");
-
-    if (cachedAccess) {
-      return { canAccess: cachedAccess };
+  async checkPlatformPlanAccess(orgId: string, minimumPlan: PlatformPlanType) {
+    const REDIS_CACHE_KEY = `apiv2:org:${orgId}:guard:platformbilling:${minimumPlan}`;
+    const cachedValue = await this.redisService.redis.get(REDIS_CACHE_KEY);
+    if (cachedValue !== null) {
+      return cachedValue === "true";
     }
 
-    let canAccess = false;
+    const organization = await this.organizationsRepository.findByIdIncludeBilling(Number(orgId));
+    const isPlatform = organization?.isPlatform;
+    const hasSubscription = organization?.platformBilling?.subscriptionId;
 
-    if (user && orgId) {
-      const team = await this.organizationsRepository.findByIdIncludeBilling(Number(orgId));
-      const isPlatform = team?.isPlatform;
-      const hasSubscription = team?.platformBilling?.subscriptionId;
-
-      if (!team) {
-        canAccess = false;
-      } else if (!isPlatform) {
-        canAccess = true;
-      } else if (!hasSubscription) {
-        canAccess = false;
-      } else {
-        canAccess = hasMinimumPlan({
-          currentPlan: team.platformBilling?.plan as PlatformPlanType,
-          minimumPlan: minimumPlan,
-          plans: ["FREE", "STARTER", "ESSENTIALS", "SCALE", "ENTERPRISE"],
-        });
-      }
+    if (!organization) {
+      throw new ForbiddenException(`PlatformPlanGuard - No organization found with id=${orgId}.`);
+    }
+    if (!isPlatform) {
+      await this.redisService.redis.set(REDIS_CACHE_KEY, "true", "EX", 300);
+      return true;
+    }
+    if (!hasSubscription) {
+      throw new ForbiddenException(
+        `PlatformPlanGuard - No platform subscription found for organization with id=${orgId}.`
+      );
+    }
+    if (
+      !hasMinimumPlan({
+        currentPlan: organization.platformBilling?.plan as PlatformPlanType,
+        minimumPlan: minimumPlan,
+        plans: ["FREE", "STARTER", "ESSENTIALS", "SCALE", "ENTERPRISE"],
+      })
+    ) {
+      throw new ForbiddenException(
+        `PlatformPlanGuard - organization with id=${orgId} does not have required plan for this operation. Minimum plan is ${minimumPlan} while the organization has ${
+          organization.platformBilling?.plan || "undefined"
+        }.`
+      );
     }
 
-    await this.redisService.redis.set(REDIS_CACHE_KEY, String(canAccess), "EX", 300);
-    if (canAccess) {
-      return { canAccess };
-    }
-    throw new ForbiddenException(
-      `Platform plan - you do not have required plan for this operation. Minimum plan is ${minimumPlan}.`
-    );
+    await this.redisService.redis.set(REDIS_CACHE_KEY, "true", "EX", 300);
+    return true;
   }
 }
 
@@ -90,7 +88,7 @@ export function hasMinimumPlan(props: HasMinimumPlanProp): boolean {
 
   if (currentPlanIndex === -1 || minimumPlanIndex === -1) {
     throw new Error(
-      `Invalid platform billing plan provided. Current plan: ${props.currentPlan}, Minimum plan: ${props.minimumPlan}`
+      `PlatformPlanGuard - Invalid platform billing plan provided. Current plan: ${props.currentPlan}, Minimum plan: ${props.minimumPlan}`
     );
   }
 

apps/api/v2/src/modules/auth/guards/memberships/is-membership-in-org.guard.ts

@@ -20,11 +20,11 @@ export class IsMembershipInOrg implements CanActivate {
     const orgId: string = request.params.orgId;
 
     if (!orgId) {
-      throw new ForbiddenException("No org id found in request params.");
+      throw new ForbiddenException("IsMembershipInOrg - No org id found in request params.");
     }
 
     if (!membershipId) {
-      throw new ForbiddenException("No membership id found in request params.");
+      throw new ForbiddenException("IsMembershipInOrg - No membership id found in request params.");
     }
 
     const membership = await this.organizationsMembershipRepository.findOrgMembership(
@@ -33,7 +33,7 @@ export class IsMembershipInOrg implements CanActivate {
     );
 
     if (!membership) {
-      throw new NotFoundException(`Membership (${membershipId}) not found.`);
+      throw new NotFoundException(`IsMembershipInOrg - Membership (${membershipId}) not found.`);
     }
 
     request.membership = membership;

apps/api/v2/src/modules/auth/guards/optional-api-auth/optional-api-auth.guard.ts

@@ -4,7 +4,7 @@ import { NO_AUTH_PROVIDED_MESSAGE } from "@/modules/auth/strategies/api-auth/api
 export class OptionalApiAuthGuard extends ApiAuthGuard {
   handleRequest(error: Error, user: any) {
     // note(Lauris): optional means that auth is not required but if it is invalid then still throw error.
-    const noAuthProvided = error && error.message === NO_AUTH_PROVIDED_MESSAGE;
+    const noAuthProvided = error && error.message.includes(NO_AUTH_PROVIDED_MESSAGE);
     if (user || noAuthProvided || !error) {
       return user || null;
     } else {

apps/api/v2/src/modules/auth/guards/organizations/is-admin-api-enabled.guard.ts

@@ -22,14 +22,19 @@ export class IsAdminAPIEnabledGuard implements CanActivate {
     const organizationId: string = request.params.orgId;
 
     if (!organizationId) {
-      throw new ForbiddenException("No organization id found in request params.");
+      throw new ForbiddenException("IsAdminAPIEnabledGuard - No organization id found in request params.");
     }
 
     const { canAccess, organization } = await this.checkAdminAPIEnabled(organizationId);
     if (organization) {
       request.organization = organization;
     }
-    return canAccess;
+    if (!canAccess) {
+      throw new ForbiddenException(
+        `IsAdminAPIEnabledGuard - Organization with id=${organizationId} does not have Admin API access. Please contact https://cal.com/sales to upgrade.`
+      );
+    }
+    return true;
   }
 
   async checkAdminAPIEnabled(
@@ -57,18 +62,21 @@ export class IsAdminAPIEnabledGuard implements CanActivate {
       );
       if (!adminAPIAccessIsEnabledInOrg) {
         throw new ForbiddenException(
-          `Organization does not have Admin API access, please contact https://cal.com/sales to upgrade`
+          `IsAdminAPIEnabledGuard - Organization does not have Admin API access, please contact https://cal.com/sales to upgrade`
         );
       }
     }
     canAccess = true;
-    org &&
-      (await this.redisService.redis.set(
+
+    if (org && canAccess) {
+      await this.redisService.redis.set(
         REDIS_CACHE_KEY,
         JSON.stringify({ org: org, canAccess } satisfies CachedData),
         "EX",
         300
-      ));
+      );
+    }
+
     return { canAccess, organization: org };
   }
 }

apps/api/v2/src/modules/auth/guards/organizations/is-managed-org-in-manager-org.guard.ts

@@ -1,11 +1,5 @@
 import { ManagedOrganizationsRepository } from "@/modules/organizations/organizations/managed-organizations.repository";
-import {
-  Injectable,
-  CanActivate,
-  ExecutionContext,
-  ForbiddenException,
-  NotFoundException,
-} from "@nestjs/common";
+import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from "@nestjs/common";
 import { Request } from "express";
 
 import { Team } from "@calcom/prisma/client";
@@ -20,11 +14,11 @@ export class IsManagedOrgInManagerOrg implements CanActivate {
     const managerOrgId: string = request.params.orgId;
 
     if (!managerOrgId) {
-      throw new ForbiddenException("No manager org id found in request params.");
+      throw new ForbiddenException("IsManagedOrgInManagerOrg - No manager org id found in request params.");
     }
 
     if (!managedOrgId) {
-      throw new ForbiddenException("No managed org id found in request params.");
+      throw new ForbiddenException("IsManagedOrgInManagerOrg - No managed org id found in request params.");
     }
 
     const managedOrganization = await this.managedOrganizationsRepository.getByManagerManagedIds(
@@ -33,8 +27,8 @@ export class IsManagedOrgInManagerOrg implements CanActivate {
     );
 
     if (!managedOrganization) {
-      throw new NotFoundException(
-        `Managed organization with id=${managedOrgId} within manager organization with id=${managerOrgId} not found.`
+      throw new ForbiddenException(
+        `IsManagedOrgInManagerOrg - Managed organization with id=${managedOrgId} is not owned by manager organization with id=${managerOrgId}.`
       );
     }
 

apps/api/v2/src/modules/auth/guards/organizations/is-org.guard.ts

@@ -22,7 +22,7 @@ export class IsOrgGuard implements CanActivate {
     const organizationId: string = request.params.orgId;
 
     if (!organizationId) {
-      throw new ForbiddenException("No organization id found in request params.");
+      throw new ForbiddenException("IsOrgGuard - No organization id found in request params.");
     }
 
     const { canAccess, org } = await this.checkOrgAccess(organizationId);
@@ -31,7 +31,13 @@ export class IsOrgGuard implements CanActivate {
       request.organization = org;
     }
 
-    return canAccess;
+    if (!canAccess) {
+      throw new ForbiddenException(
+        `IsOrgGuard - provided organization id=${organizationId} does not represent any existing organization.`
+      );
+    }
+
+    return true;
   }
 
   async checkOrgAccess(organizationId: string): Promise<{ canAccess: boolean; org?: Team | null }> {
@@ -55,7 +61,7 @@ export class IsOrgGuard implements CanActivate {
       canAccess = true;
     }
 
-    if (org) {
+    if (org && canAccess) {
       await this.redisService.redis.set(
         REDIS_CACHE_KEY,
         JSON.stringify({ org, canAccess } satisfies CachedData),

apps/api/v2/src/modules/auth/guards/organizations/is-webhook-in-org.guard.ts

@@ -26,10 +26,10 @@ export class IsWebhookInOrg implements CanActivate {
     const organizationId: string = request.params.orgId;
 
     if (!organizationId) {
-      throw new ForbiddenException("No organization id found in request params.");
+      throw new ForbiddenException("IsWebhookInOrg - No organization id found in request params.");
     }
     if (!webhookId) {
-      throw new ForbiddenException("No webhook id found in request params.");
+      throw new ForbiddenException("IsWebhookInOrg - No webhook id found in request params.");
     }
 
     const REDIS_CACHE_KEY = `apiv2:org:${webhookId}:guard:isWebhookInOrg`;
@@ -53,7 +53,7 @@ export class IsWebhookInOrg implements CanActivate {
       if (isWebhookInOrg) canAccess = true;
     }
 
-    if (org) {
+    if (org && canAccess) {
       await this.redisService.redis.set(
         REDIS_CACHE_KEY,
         JSON.stringify({ org: org, canAccess } satisfies CachedData),
@@ -62,6 +62,12 @@ export class IsWebhookInOrg implements CanActivate {
       );
     }
 
-    return canAccess;
+    if (!canAccess) {
+      throw new ForbiddenException(
+        `IsWebhookInOrg - webhook with id=${webhookId} is not part of the organization with id=${organizationId}.`
+      );
+    }
+
+    return true;
   }
 }

apps/api/v2/src/modules/auth/guards/permissions/permissions.guard.spec.ts

@@ -1,4 +1,5 @@
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
+import { OAuthClientsOutputService } from "@/modules/oauth-clients/services/oauth-clients/oauth-clients-output.service";
 import { TokensRepository } from "@/modules/tokens/tokens.repository";
 import { createMock } from "@golevelup/ts-jest";
 import { ExecutionContext } from "@nestjs/common";
@@ -28,7 +29,21 @@ describe("PermissionsGuard", () => {
           }
         }),
       }),
-      createMock<OAuthClientRepository>()
+      createMock<OAuthClientRepository>(),
+      createMock<OAuthClientsOutputService>({
+        transformOAuthClientPermission: jest.fn().mockImplementation((permission: number) => {
+          switch (permission) {
+            case SCHEDULE_WRITE:
+              return "SCHEDULE_WRITE";
+            case SCHEDULE_READ:
+              return "SCHEDULE_READ";
+            case APPS_WRITE:
+              return "APPS_WRITE";
+            default:
+              return "UNKNOWN";
+          }
+        }),
+      })
     );
   });
 
@@ -36,13 +51,22 @@ describe("PermissionsGuard", () => {
     expect(guard).toBeDefined();
   });
 
+  function getMockOAuthClient(permissions: number) {
+    return {
+      id: "100",
+      permissions,
+    };
+  }
+
   describe("when access token is missing", () => {
     it("should return false", async () => {
       const mockContext = createMockExecutionContext({});
       jest.spyOn(reflector, "get").mockReturnValue([SCHEDULE_WRITE]);
-      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(0);
+      jest.spyOn(guard, "getOAuthClientByAccessToken").mockResolvedValue(getMockOAuthClient(0));
 
-      await expect(guard.canActivate(mockContext)).resolves.toBe(false);
+      await expect(guard.canActivate(mockContext)).rejects.toThrow(
+        "PermissionsGuard - no authentication provided. Provide either authorization bearer token containing managed user access token or oAuth client id in 'x-cal-client-id' header."
+      );
     });
   });
 
@@ -53,7 +77,9 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
+      jest
+        .spyOn(guard, "getOAuthClientByAccessToken")
+        .mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
 
@@ -64,7 +90,9 @@ describe("PermissionsGuard", () => {
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
       oAuthClientPermissions |= SCHEDULE_READ;
-      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
+      jest
+        .spyOn(guard, "getOAuthClientByAccessToken")
+        .mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
 
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
@@ -75,7 +103,9 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
+      jest
+        .spyOn(guard, "getOAuthClientByAccessToken")
+        .mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
 
@@ -85,9 +115,13 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= APPS_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
+      jest
+        .spyOn(guard, "getOAuthClientByAccessToken")
+        .mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
 
-      await expect(guard.canActivate(mockContext)).resolves.toBe(false);
+      await expect(guard.canActivate(mockContext)).rejects.toThrow(
+        "PermissionsGuard - oAuth client with id=100 does not have the required permissions=SCHEDULE_WRITE"
+      );
     });
 
     it("should return false for a missing permission", async () => {
@@ -96,9 +130,13 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
+      jest
+        .spyOn(guard, "getOAuthClientByAccessToken")
+        .mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
 
-      await expect(guard.canActivate(mockContext)).resolves.toBe(false);
+      await expect(guard.canActivate(mockContext)).rejects.toThrow(
+        "PermissionsGuard - oAuth client with id=100 does not have the required permissions=SCHEDULE_WRITE, SCHEDULE_READ"
+      );
     });
   });
 
@@ -109,7 +147,7 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientById").mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
 
@@ -120,7 +158,7 @@ describe("PermissionsGuard", () => {
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
       oAuthClientPermissions |= SCHEDULE_READ;
-      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientById").mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
 
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
@@ -131,7 +169,7 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientById").mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
 
@@ -141,9 +179,11 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= APPS_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientById").mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
 
-      await expect(guard.canActivate(mockContext)).resolves.toBe(false);
+      await expect(guard.canActivate(mockContext)).rejects.toThrow(
+        "PermissionsGuard - oAuth client with id=100 does not have the required permissions=SCHEDULE_WRITE"
+      );
     });
 
     it("should return false for a missing permission", async () => {
@@ -152,9 +192,11 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientById").mockResolvedValue(getMockOAuthClient(oAuthClientPermissions));
 
-      await expect(guard.canActivate(mockContext)).resolves.toBe(false);
+      await expect(guard.canActivate(mockContext)).rejects.toThrow(
+        "PermissionsGuard - oAuth client with id=100 does not have the required permissions=SCHEDULE_WRITE, SCHEDULE_READ"
+      );
     });
   });
 

apps/api/v2/src/modules/auth/guards/permissions/permissions.guard.ts

@@ -1,14 +1,16 @@
 import { isApiKey } from "@/lib/api-key";
 import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
+import { OAuthClientsOutputService } from "@/modules/oauth-clients/services/oauth-clients/oauth-clients-output.service";
 import { TokensRepository } from "@/modules/tokens/tokens.repository";
-import { Injectable, CanActivate, ExecutionContext } from "@nestjs/common";
+import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from "@nestjs/common";
 import { ConfigService } from "@nestjs/config";
 import { Reflector } from "@nestjs/core";
 import { getToken } from "next-auth/jwt";
 
 import { X_CAL_CLIENT_ID } from "@calcom/platform-constants";
 import { hasPermissions } from "@calcom/platform-utils";
+import { PlatformOAuthClient } from "@calcom/prisma/client";
 
 @Injectable()
 export class PermissionsGuard implements CanActivate {
@@ -16,7 +18,8 @@ export class PermissionsGuard implements CanActivate {
     private reflector: Reflector,
     private tokensRepository: TokensRepository,
     private readonly config: ConfigService,
-    private readonly oAuthClientRepository: OAuthClientRepository
+    private readonly oAuthClientRepository: OAuthClientRepository,
+    private readonly oAuthClientsOutputService: OAuthClientsOutputService
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -27,42 +30,61 @@ export class PermissionsGuard implements CanActivate {
     }
 
     const request = context.switchToHttp().getRequest();
-    const authString = request.get("Authorization")?.replace("Bearer ", "");
+    const bearerToken = request.get("Authorization")?.replace("Bearer ", "");
     const nextAuthSecret = this.config.get("next.authSecret", { infer: true });
     const nextAuthToken = await getToken({ req: request, secret: nextAuthSecret });
     const oAuthClientId = request.params?.clientId || request.get(X_CAL_CLIENT_ID);
+    const apiKey = bearerToken && isApiKey(bearerToken, this.config.get("api.apiKeyPrefix") ?? "cal_");
 
-    if (nextAuthToken) {
+    // only check permissions for accessTokens attached to an oAuth Client or oAuth credentials, not for next token or api key
+    if (nextAuthToken || apiKey) {
       return true;
     }
 
-    if (!authString && !oAuthClientId) {
-      return false;
+    if (!bearerToken && !oAuthClientId) {
+      throw new ForbiddenException(
+        "PermissionsGuard - no authentication provided. Provide either authorization bearer token containing managed user access token or oAuth client id in 'x-cal-client-id' header."
+      );
     }
 
-    // only check permissions for accessTokens attached to an oAuth Client
-    if (isApiKey(authString, this.config.get("api.apiKeyPrefix") ?? "cal_")) {
-      return true;
+    const oAuthClient = bearerToken
+      ? await this.getOAuthClientByAccessToken(bearerToken)
+      : await this.getOAuthClientById(oAuthClientId);
+
+    const hasRequiredPermissions = hasPermissions(oAuthClient.permissions, [...requiredPermissions]);
+
+    if (!hasRequiredPermissions) {
+      throw new ForbiddenException(
+        `PermissionsGuard - oAuth client with id=${
+          oAuthClient.id
+        } does not have the required permissions=${requiredPermissions
+          .map((permission) => this.oAuthClientsOutputService.transformOAuthClientPermission(permission))
+          .join(
+            ", "
+          )}. Go to platform dashboard settings and add the required permissions to the oAuth client.`
+      );
     }
 
-    const oAuthClientPermissions = authString
-      ? await this.getOAuthClientPermissionsByAccessToken(authString)
-      : await this.getOAuthClientPermissionsById(oAuthClientId);
-
-    if (!oAuthClientPermissions) {
-      return false;
-    }
-
-    return hasPermissions(oAuthClientPermissions, [...requiredPermissions]);
+    return true;
   }
 
-  async getOAuthClientPermissionsByAccessToken(accessToken: string) {
+  async getOAuthClientByAccessToken(
+    accessToken: string
+  ): Promise<Pick<PlatformOAuthClient, "id" | "permissions">> {
     const oAuthClient = await this.tokensRepository.getAccessTokenClient(accessToken);
-    return oAuthClient?.permissions;
+    if (!oAuthClient) {
+      throw new ForbiddenException(
+        `PermissionsGuard - no oAuth client found for access token=${accessToken}`
+      );
+    }
+    return oAuthClient;
   }
 
-  async getOAuthClientPermissionsById(id: string) {
+  async getOAuthClientById(id: string): Promise<Pick<PlatformOAuthClient, "id" | "permissions">> {
     const oAuthClient = await this.oAuthClientRepository.getOAuthClient(id);
-    return oAuthClient?.permissions;
+    if (!oAuthClient) {
+      throw new ForbiddenException(`PermissionsGuard - no oAuth client found for client id=${id}`);
+    }
+    return oAuthClient;
   }
 }

apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts

@@ -25,8 +25,27 @@ export class RolesGuard implements CanActivate {
     const user = request.user as ApiAuthGuardUser;
     const allowedRole = this.reflector.get(Roles, context.getHandler());
     const { canAccess } = await this.checkUserRoleAccess(user, orgId, teamId, allowedRole);
-    return canAccess;
+
+    if (!canAccess) {
+      this.throwForbiddenError(user, orgId, teamId, allowedRole);
+    }
+
+    return true;
   }
+
+  throwForbiddenError(user: ApiAuthGuardUser, orgId: string, teamId: string, allowedRole: string) {
+    let errorMessage = `RolesGuard - user with id=${user.id} does not have the minimum required role=${allowedRole} within`;
+    if (orgId) {
+      errorMessage += ` organization with id=${orgId}`;
+    }
+    if (teamId) {
+      errorMessage += ` team with id=${teamId}`;
+    }
+    errorMessage += `.`;
+
+    throw new ForbiddenException(errorMessage);
+  }
+
   async checkUserRoleAccess(
     user: ApiAuthGuardUser,
     orgId: string,
@@ -67,7 +86,9 @@ export class RolesGuard implements CanActivate {
       const membership = await this.membershipRepository.findMembershipByOrgId(Number(orgId), user.id);
       if (!membership) {
         this.logger.log(`User (${user.id}) is not a member of the organization (${orgId}), denying access.`);
-        throw new ForbiddenException(`User is not a member of the organization.`);
+        throw new ForbiddenException(
+          `RolesGuard - User is not a member of the organization with id=${orgId}.`
+        );
       }
 
       if (ORG_ROLES.includes(allowedRole as unknown as (typeof ORG_ROLES)[number])) {
@@ -84,7 +105,7 @@ export class RolesGuard implements CanActivate {
       const membership = await this.membershipRepository.findMembershipByTeamId(Number(teamId), user.id);
       if (!membership) {
         this.logger.log(`User (${user.id}) is not a member of the team (${teamId}), denying access.`);
-        throw new ForbiddenException(`User is not a member of the team.`);
+        throw new ForbiddenException(`RolesGuard - User is not a member of the team with id=${teamId}.`);
       }
       if (TEAM_ROLES.includes(allowedRole as unknown as (typeof TEAM_ROLES)[number])) {
         canAccess = hasMinimumRole({
@@ -102,7 +123,7 @@ export class RolesGuard implements CanActivate {
 
       if (!orgMembership) {
         this.logger.log(`User (${user.id}) is not part of the organization (${orgId}), denying access.`);
-        throw new ForbiddenException(`User is not part of the organization.`);
+        throw new ForbiddenException(`RolesGuard - User is not part of the organization with id=${orgId}.`);
       }
 
       // if the role checked is a TEAM role
@@ -116,7 +137,7 @@ export class RolesGuard implements CanActivate {
               `User (${user.id}) is not part of the team (${teamId}) and/or, is not an admin nor an owner of the organization (${orgId}).`
             );
             throw new ForbiddenException(
-              "User is not part of the team and/or, is not an admin nor an owner of the organization."
+              `RolesGuard - User is not part of the team with id=${teamId} and/or, is not an admin nor an owner of the organization with id=${orgId}.`
             );
           }
 
@@ -138,7 +159,11 @@ export class RolesGuard implements CanActivate {
         });
       }
     }
-    await this.redisService.redis.set(REDIS_CACHE_KEY, String(canAccess), "EX", 300);
+
+    if (canAccess) {
+      await this.redisService.redis.set(REDIS_CACHE_KEY, String(canAccess), "EX", 300);
+    }
+
     return { canAccess };
   }
 }
@@ -165,7 +190,7 @@ export function hasMinimumRole(props: HasMinimumRoleProp): boolean {
 
   // minimum role given does not exist
   if (checkedRoleIndex === -1 || requiredRoleIndex === -1) {
-    throw new Error("Invalid role");
+    throw new Error("RolesGuard - Invalid role");
   }
 
   return checkedRoleIndex <= requiredRoleIndex;