chore: release v6.0.6

* init

* add tests

* fix type

* type fix

* fix

* fix tests

* fix test

.changeset/bitter-peas-pull.md

@@ -1,5 +0,0 @@
----
-"@calcom/atoms": minor
----
-
-Fix Booker atom verify email dialog infinite re-render when entering verification code

.changeset/happy-buckets-dance.md

@@ -1,5 +0,0 @@
----
-"@calcom/atoms": minor
----
-
-Refactor SettingsHeader to accept onBackButtonClick callback instead of using useRouter directly.

.changeset/little-rings-repeat.md

@@ -1,5 +0,0 @@
----
-"@calcom/atoms": minor
----
-
-Add defaultPhoneCountry prop to BookerPlatformWrapper with ISO 3166-1 alpha-2 type safety

.changeset/long-ties-obey.md

@@ -1,5 +0,0 @@
----
-"@calcom/atoms": patch
----
-
-This PR fixes the issue of connect atoms not working inside iframes. It also updates the atoms exports to include the `useAvailableSlots` hook.

.coderabbit.yaml

@@ -1,187 +0,0 @@
-language: en-US
-tone_instructions: ''
-early_access: false
-enable_free_tier: true
-reviews:
-  profile: chill
-  request_changes_workflow: false
-  high_level_summary: false
-  high_level_summary_placeholder: '@coderabbitai summary'
-  high_level_summary_in_walkthrough: false
-  auto_title_placeholder: '@coderabbitai'
-  auto_title_instructions: ''
-  review_status: true
-  commit_status: true
-  fail_commit_status: false
-  collapse_walkthrough: false
-  changed_files_summary: false
-  sequence_diagrams: false
-  estimate_code_review_effort: false
-  assess_linked_issues: true
-  related_issues: false
-  related_prs: true
-  suggested_labels: false
-  auto_apply_labels: false
-  suggested_reviewers: false
-  auto_assign_reviewers: false
-  poem: false
-  labeling_instructions: []
-  path_filters: 
-    - '!**/node_modules/**'
-    - '!**/dist/**'
-    - '!**/build/**' 
-    - '!**/.next/**'
-  path_instructions:
-    - path: "**/*.{ts,tsx,js,jsx}"
-      instructions: "Flag default exports and encourage named exports. Named exports provide better tree-shaking, easier refactoring, and clearer imports. Exempt main components like pages, layouts, and components that serve as the primary export of a module."
-  abort_on_close: true
-  disable_cache: false
-  auto_review:
-    enabled: true
-    auto_incremental_review: true
-    ignore_title_keywords: []
-    labels: []
-    drafts: false
-    base_branches: []
-  finishing_touches:
-    docstrings:
-      enabled: true
-    unit_tests:
-      enabled: true
-  pre_merge_checks:
-    docstrings:
-      mode: warning
-      threshold: 80
-    title:
-      mode: warning
-      requirements: ''
-    description:
-      mode: warning
-    issue_assessment:
-      mode: warning
-  tools:
-    ast-grep:
-      rule_dirs: []
-      util_dirs: []
-      essential_rules: true
-      packages: []
-    shellcheck:
-      enabled: true
-    ruff:
-      enabled: true
-    markdownlint:
-      enabled: true
-    github-checks:
-      enabled: true
-      timeout_ms: 180000
-    languagetool:
-      enabled: true
-      enabled_rules: []
-      disabled_rules: []
-      enabled_categories: []
-      disabled_categories: []
-      enabled_only: false
-      level: default
-    biome:
-      enabled: true
-    hadolint:
-      enabled: true
-    swiftlint:
-      enabled: true
-    phpstan:
-      enabled: true
-      level: default
-    phpmd:
-      enabled: true
-    phpcs:
-      enabled: true
-    golangci-lint:
-      enabled: true
-    yamllint:
-      enabled: true
-    gitleaks:
-      enabled: true
-    checkov:
-      enabled: true
-    detekt:
-      enabled: true
-    eslint:
-      enabled: true
-    flake8:
-      enabled: true
-    rubocop:
-      enabled: true
-    buf:
-      enabled: true
-    regal:
-      enabled: true
-    actionlint:
-      enabled: true
-    pmd:
-      enabled: true
-    cppcheck:
-      enabled: true
-    semgrep:
-      enabled: true
-    circleci:
-      enabled: true
-    clippy:
-      enabled: true
-    sqlfluff:
-      enabled: true
-    prismaLint:
-      enabled: true
-    pylint:
-      enabled: true
-    oxc:
-      enabled: true
-    shopifyThemeCheck:
-      enabled: true
-    luacheck:
-      enabled: true
-    brakeman:
-      enabled: true
-    dotenvLint:
-      enabled: true
-    htmlhint:
-      enabled: true
-    checkmake:
-      enabled: true
-    osvScanner:
-      enabled: true
-chat:
-  art: true
-  auto_reply: true
-  integrations:
-    jira:
-      usage: auto
-    linear:
-      usage: auto
-knowledge_base:
-  opt_out: false
-  web_search:
-    enabled: true
-  code_guidelines:
-    enabled: true
-    filePatterns: []
-  learnings:
-    scope: auto
-  issues:
-    scope: auto
-  jira:
-    usage: auto
-    project_keys: []
-  linear:
-    usage: auto
-    team_keys: []
-  pull_requests:
-    scope: auto
-  mcp:
-    usage: auto
-    disabled_servers: []
-code_generation:
-  docstrings:
-    language: en-US
-    path_instructions: []
-  unit_tests:
-    path_instructions: []

.env.example

@@ -127,6 +127,14 @@ NEXT_PUBLIC_HELPSCOUT_KEY=
 NEXT_PUBLIC_FRESHCHAT_TOKEN=
 NEXT_PUBLIC_FRESHCHAT_HOST=
 
+# For holiday feature:
+# Step-by-step: Get a Google Calendar API Key
+# 1. Go to Google Cloud Console: https://console.cloud.google.com/
+# 2. Select or Create a Project
+# 3. Enable Google Calendar API (APIs & Services → Library , Search for Google Calendar API)
+# 4. Create the API Key (APIs & Services → Credentials)
+GOOGLE_CALENDAR_API_KEY=
+
 # Google OAuth credentials
 # To enable Login with Google you need to:
 # 1. Set `GOOGLE_API_CREDENTIALS` below
@@ -501,4 +509,7 @@ SEED_PLATFORM_OAUTH_CLIENT_SECRET=
 ENABLE_ASYNC_TASKER="false" # set to "true" to enable
 TRIGGER_SECRET_KEY=
 TRIGGER_API_URL=https://api.trigger.dev
-TRIGGER_DEV_PROJECT_REF=
+TRIGGER_DEV_PROJECT_REF=
+
+GOOGLE_ADS_ENABLED=1      # To enable Google Ads tracking (gclid)
+LINKEDIN_ADS_ENABLED=1    # To enable LinkedIn Ads tracking (li_fat_id)

.gitattributes

@@ -0,0 +1,4 @@
+/.yarn/**            linguist-vendored
+/.yarn/releases/*    binary
+/.yarn/plugins/**/*  binary
+/.pnp.*              binary linguist-generated

.github/CODEOWNERS

@@ -7,7 +7,7 @@
 /apps/web/lib/core/**/* @calcom/Foundation
 /apps/web/lib/booking.ts @calcom/Foundation
 /apps/web/lib/handleOrgRedirect.ts @calcom/Foundation
-/apps/web/middleware.ts @calcom/Foundation
+/apps/web/proxy.ts @calcom/Foundation
 /deploy/**/* @calcom/Foundation
 /packages/app-store/applecalendar/**/* @calcom/Foundation
 /packages/app-store/caldavcalendar/**/* @calcom/Foundation
@@ -28,7 +28,7 @@
 /packages/features/bookings/lib/getLuckyUser.ts @calcom/Foundation
 /packages/features/schedules/lib/slots.ts @calcom/Foundation
 /packages/platform/atoms/**/*WebWrapper.tsx @calcom/Consumer
-/packages/platform/**/* @calcom/Platform @calcom/Foundation
+/packages/platform/**/* @calcom/Consumer @calcom/Foundation
 /packages/prisma/**/* @calcom/Foundation
 /packages/trpc/server/routers/viewer/bookings/confirm.handler.ts @calcom/Foundation
 /packages/trpc/server/routers/viewer/bookings/get.handler.ts @calcom/Foundation

.github/actions/cache-build/action.yml

@@ -7,29 +7,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Cache production build
-      uses: buildjet/cache@v4
-      id: cache-build
-      env:
-        # WARN: Don't touch this cache key. Currently github.sha refers to the latest commit in main
-        # and not the branch that's attempting to merge to main, which causes CI errors when merged
-        # to main.
-        # TODO: Fix this problem if intending to modify this cache key.
-        cache-name: prod-build
-        key-1: ${{ inputs.node_version }}-${{ hashFiles('yarn.lock') }}
-        key-2: ${{ hashFiles('apps/**/**.[jt]s', 'apps/**/**.[jt]sx', 'packages/**/**.[jt]s', 'packages/**/**.[jt]sx', '!**/node_modules') }}
-        key-3: ${{ github.event.pull_request.number || github.ref }}
-        key-4: ${{ github.sha }}
-        key-5: ${{ github.event.pull_request.head.sha }}
-      with:
-        path: |
-          ${{ github.workspace }}/apps/web/.next
-          ${{ github.workspace }}/apps/web/public/embed
-          **/.turbo/**
-          **/dist/**
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}-${{ env.key-5 }}
     - run: |
         export NODE_OPTIONS="--max_old_space_size=8192"
         yarn build
-      if: steps.cache-build.outputs.cache-hit != 'true'
       shell: bash

.github/actions/cache-db/action.yml

@@ -7,6 +7,10 @@ inputs:
   path:
     required: false
     default: "backups/backup.sql"
+  COMMIT_SHA:
+    required: false
+    default: ""
+    description: "Commit SHA to include in cache key (passed from workflow)"
 runs:
   using: "composite"
   steps:
@@ -17,7 +21,7 @@ runs:
         cache-name: cache-db
         key-1: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
         key-2: ${{ github.event.pull_request.number || github.ref }}
-        key-3: ${{ github.event.pull_request.head.sha }}
+        key-3: ${{ inputs.COMMIT_SHA || github.event.pull_request.head.sha || github.sha }}
         DATABASE_URL: ${{ inputs.DATABASE_URL }}
         DATABASE_DIRECT_URL: ${{ inputs.DATABASE_URL }}
         E2E_TEST_CALCOM_QA_EMAIL: ${{ inputs.E2E_TEST_CALCOM_QA_EMAIL }}

.github/actions/docker-build-and-test/action.yml

@@ -34,6 +34,10 @@ inputs:
     description: "Whether to push the built image"
     required: false
     default: "false"
+  use-as-latest:
+    description: "Publish as latest"
+    required: false
+    default: "false"
 
 runs:
   using: "composite"
@@ -61,7 +65,7 @@ runs:
           docker.io/calcom/cal.com
           ghcr.io/calcom/cal.com
         flavor: |
-          latest=${{ !github.event.release.prerelease }}
+          latest=${{ !github.event.release.prerelease && inputs.use-as-latest == 'true' }}
           suffix=${{ inputs.platform-suffix }}
 
     - name: Copy env

.github/actions/yarn-playwright-install/action.yml

@@ -17,5 +17,6 @@ runs:
           ${{ github.workspace }}/node_modules/playwright
         key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
     - name: Yarn playwright install
+      if: steps.playwright-cache.outputs.cache-hit != 'true'
       shell: bash
       run: yarn playwright install --with-deps

.github/oasdiff-err-ignore.txt

@@ -1,2 +1,4 @@
 GET /v2/event-types/{eventTypeId} added to the 'data' response property 'oneOf' list for the response status '200'
 GET /v2/event-types/{eventTypeId} added '#/components/schemas/EventTypeOutput_2024_06_14, #/components/schemas/TeamEventTypeOutput_2024_06_14' to the 'data' response property 'oneOf' list for the response status '200'
+GET /v2/bookings/{bookingUid}/recordings added the new required 'header' request parameter 'Authorization'
+GET /v2/bookings/{bookingUid}/transcripts added the new required 'header' request parameter 'Authorization'

.github/workflows/all-checks.yml

@@ -24,6 +24,11 @@ jobs:
     uses: ./.github/workflows/unit-tests.yml
     secrets: inherit
 
+  api-v2-unit-test:
+    name: Tests
+    uses: ./.github/workflows/api-v2-unit-tests.yml
+    secrets: inherit
+
   build-api-v1:
     name: Production builds
     uses: ./.github/workflows/api-v1-production-build.yml
@@ -75,7 +80,7 @@ jobs:
     secrets: inherit
 
   required:
-    needs: [lint, type-check, unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
+    needs: [lint, type-check, unit-test, api-v2-unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
     if: always()
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:

.github/workflows/api-v2-unit-tests.yml

@@ -0,0 +1,21 @@
+name: API v2 Unit
+on:
+  workflow_call:
+env:
+  LINGO_DOT_DEV_API_KEY: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
+permissions:
+  contents: read
+jobs:
+  test:
+    name: API v2 Unit
+    timeout-minutes: 20
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - name: Run API v2 unit tests
+        working-directory: apps/api/v2
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          yarn workspace @calcom/platform-libraries build && yarn test

.github/workflows/atoms-production-build.yml

@@ -37,5 +37,5 @@ jobs:
           export NODE_OPTIONS="--max_old_space_size=8192"
           rm -rf packages/platform/atoms/node_modules
           yarn install
-          yarn workspace @calcom/atoms run build
+          yarn workspace @calcom/atoms run build-npm
         shell: bash

.github/workflows/check-api-v2-breaking-changes.yml

@@ -0,0 +1,53 @@
+name: Check API v2 breaking changes
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  API_KEY_PREFIX: ${{ secrets.CI_API_KEY_PREFIX }}
+  API_PORT: ${{ vars.CI_API_V2_PORT }}
+  API_URL: "http://localhost"
+  CALCOM_LICENSE_KEY: ${{ secrets.CI_CALCOM_LICENSE_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_READ_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_WRITE_URL: ${{ secrets.CI_DATABASE_URL }}
+  JWT_SECRET: ${{ secrets.CI_JWT_SECRET }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NODE_ENV: ${{ vars.CI_NODE_ENV }}
+  NODE_OPTIONS: --max-old-space-size=4096
+  REDIS_URL: "redis://localhost:6379"
+  STRIPE_API_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  WEB_APP_URL: "https://app.cal.com"
+
+jobs:
+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    timeout-minutes: 10
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+
+      - name: Generate Swagger
+        working-directory: apps/api/v2
+        run: yarn generate-swagger
+
+      - name: Check API v2 breaking changes
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" -w /work \
+            tufin/oasdiff:latest \
+            breaking \
+            https://raw.githubusercontent.com/calcom/cal.com/refs/heads/main/docs/api-reference/v2/openapi.json \
+            docs/api-reference/v2/openapi.json \
+            --fail-on ERR \
+            --err-ignore .github/oasdiff-err-ignore.txt

.github/workflows/check-types.yml

@@ -3,6 +3,8 @@ on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 permissions:
   contents: read
 jobs:

.github/workflows/cleanup-report.yml

@@ -11,12 +11,20 @@ jobs:
   cleanup-report:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
           repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Set Git User
         run: |

.github/workflows/cleanup.yml

@@ -22,12 +22,20 @@ jobs:
       # Contains all reports for deleted branch
       BRANCH_REPORTS_DIR: reports/${{ github.event.ref }}
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |

.github/workflows/companion-build.yml

@@ -0,0 +1,42 @@
+name: Companion Builds
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  EXPO_PUBLIC_CAL_API_KEY: ${{ secrets.CI_EXPO_PUBLIC_CAL_API_KEY || vars.CI_EXPO_PUBLIC_CAL_API_KEY || vars.EXPO_PUBLIC_CAL_API_KEY }}
+
+jobs:
+  build:
+    name: Build Companion App & Extension
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: 1.3.0
+          cache: true
+          cache-dependency-path: companion/bun.lock
+
+      - name: Install dependencies
+        working-directory: companion
+        run: bun install --frozen-lockfile
+
+      - name: Build Expo web app
+        working-directory: companion
+        env:
+          EXPO_NO_TELEMETRY: 1
+          CI: true
+        run: bunx expo export --platform web
+
+      - name: Build browser extension
+        working-directory: companion
+        run: bun run ext:build

.github/workflows/cron-scheduleSMSReminders.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-scheduleSMSReminders:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/workflows/scheduleSMSReminders \
+          curl ${{ env.APP_URL_EU }}/api/cron/workflows/scheduleSMSReminders \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
+        run: |
+          curl ${{ env.APP_URL_US }}/api/cron/workflows/scheduleSMSReminders \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
             -sSf

.github/workflows/cron-scheduleWhatsappReminders.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-scheduleWhatsappReminders:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/workflows/scheduleWhatsappReminders \
+          curl ${{ env.APP_URL_EU }}/api/cron/workflows/scheduleWhatsappReminders \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
+        run: |
+          curl ${{ env.APP_URL_US }}/api/cron/workflows/scheduleWhatsappReminders \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
             -sSf

.github/workflows/cron-webhooks-triggers.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-webhookTriggers:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/webhookTriggers \
+          curl ${{ env.APP_URL_US }}/api/cron/webhookTriggers \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
-            --fail
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
+            -sSf
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
+        run: |
+          curl ${{ env.APP_URL_EU }}/api/cron/webhookTriggers \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf

.github/workflows/draft-release.yml

@@ -17,13 +17,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/e2e-api-v2.yml

@@ -30,7 +30,7 @@ env:
 jobs:
   e2e:
     timeout-minutes: 20
-    name: E2E API v2
+    name: E2E API v2 (${{ matrix.shard }}/${{ strategy.job-total }})
     runs-on: buildjet-16vcpu-ubuntu-2204
     services:
       postgres:
@@ -63,6 +63,8 @@ jobs:
           --health-retries 5
     strategy:
       fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: docker/login-action@v3
         with:
@@ -73,32 +75,17 @@ jobs:
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
 
-      - name: Generate Swagger
-        working-directory: apps/api/v2
-        run: yarn generate-swagger
-
-      - name: Check breaking changes
-        run: |
-          docker run --rm \
-            -v "$PWD:/work" -w /work \
-            tufin/oasdiff:latest \
-            breaking \
-            https://raw.githubusercontent.com/calcom/cal.com/refs/heads/main/docs/api-reference/v2/openapi.json \
-            docs/api-reference/v2/openapi.json \
-            --fail-on ERR \
-            --err-ignore .github/oasdiff-err-ignore.txt
-
       - name: Run Tests
         working-directory: apps/api/v2
         run: |
-          yarn workspace @calcom/platform-libraries build && yarn test:e2e
+          yarn test:e2e --shard=${{ matrix.shard }}/${{ strategy.job-total }}
           EXIT_CODE=$?
-          echo "yarn workspace @calcom/platform-libraries build && yarn test:e2e command exit code: $EXIT_CODE"
+          echo "yarn test:e2e --shard=${{ matrix.shard }}/${{ strategy.job-total }} command exit code: $EXIT_CODE"
           exit $EXIT_CODE
 
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: test-results-api-v2
+          name: test-results-api-v2-shard-${{ matrix.shard }}
           path: test-results

.github/workflows/e2e-report.yml

@@ -0,0 +1,212 @@
+name: E2E Report
+
+on:
+  workflow_run:
+    workflows: ["PR Update"]
+    types:
+      - completed
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'The PR number to generate report for'
+        required: true
+        type: string
+
+jobs:
+  get-pr-info:
+    name: Get PR Info
+    runs-on: ubuntu-latest
+    # For workflow_run: only run if the triggering workflow failed
+    # For workflow_dispatch: always run (inputs are provided manually)
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'failure' }}
+    permissions:
+      actions: read
+      pull-requests: read
+    outputs:
+      pr-number: ${{ steps.get-info.outputs.pr-number }}
+      head-branch: ${{ steps.get-info.outputs.head-branch }}
+      has-blob-reports: ${{ steps.get-info.outputs.has-blob-reports }}
+      source-run-id: ${{ steps.get-info.outputs.source-run-id }}
+      source-run-number: ${{ steps.get-info.outputs.source-run-number }}
+      source-run-attempt: ${{ steps.get-info.outputs.source-run-attempt }}
+      source-head-sha: ${{ steps.get-info.outputs.source-head-sha }}
+    steps:
+      - name: Get PR and run info
+        id: get-info
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const isDispatch = context.eventName === 'workflow_dispatch';
+            
+            if (isDispatch) {
+              // For workflow_dispatch: look up everything from PR number
+              const prNumber = context.payload.inputs.pr_number;
+              console.log('Looking up PR:', prNumber);
+              
+              // Get PR details
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: parseInt(prNumber)
+              });
+              
+              const headSha = pr.head.sha;
+              const headBranch = pr.head.ref;
+              console.log('PR head SHA:', headSha);
+              console.log('PR head branch:', headBranch);
+              
+              // Find the "PR Update" workflow
+              const { data: workflows } = await github.rest.actions.listRepoWorkflows({
+                owner: context.repo.owner,
+                repo: context.repo.repo
+              });
+              const prUpdateWorkflow = workflows.workflows.find(w => w.name === 'PR Update');
+              if (!prUpdateWorkflow) {
+                core.setFailed('Could not find "PR Update" workflow');
+                return;
+              }
+              console.log('Found PR Update workflow ID:', prUpdateWorkflow.id);
+              
+              // Find the most recent completed run for this branch with blob-report artifacts
+              // We search by branch instead of SHA to handle cases where:
+              // 1. The PR was updated after E2E tests ran (artifacts exist for older SHA)
+              // 2. The current run for the SHA is still queued/in-progress
+              const { data: runs } = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: prUpdateWorkflow.id,
+                branch: headBranch,
+                status: 'completed',
+                per_page: 20
+              });
+              
+              console.log('Found', runs.workflow_runs.length, 'completed runs for branch', headBranch);
+              
+              // Find a run with blob-report artifacts
+              let selectedRun = null;
+              let hasBlobReports = false;
+              
+              for (const run of runs.workflow_runs) {
+                console.log('Checking run', run.id, 'conclusion:', run.conclusion);
+                
+                const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: run.id
+                });
+                
+                const blobReports = artifacts.artifacts.filter(a => a.name.startsWith('blob-report-'));
+                if (blobReports.length > 0) {
+                  console.log('Found run with blob reports:', run.id, 'artifacts:', blobReports.map(a => a.name));
+                  selectedRun = run;
+                  hasBlobReports = true;
+                  break;
+                }
+              }
+              
+              if (!selectedRun) {
+                console.log('No runs found with blob-report artifacts');
+                core.setOutput('pr-number', prNumber);
+                core.setOutput('head-branch', headBranch);
+                core.setOutput('source-head-sha', headSha);
+                core.setOutput('has-blob-reports', 'false');
+                core.setOutput('source-run-id', '');
+                core.setOutput('source-run-number', '');
+                core.setOutput('source-run-attempt', '');
+                return;
+              }
+              
+              core.setOutput('pr-number', prNumber);
+              core.setOutput('head-branch', headBranch);
+              core.setOutput('source-head-sha', headSha);
+              core.setOutput('source-run-id', selectedRun.id.toString());
+              core.setOutput('source-run-number', selectedRun.run_number.toString());
+              core.setOutput('source-run-attempt', selectedRun.run_attempt.toString());
+              core.setOutput('has-blob-reports', 'true');
+              return;
+            }
+            
+            // For workflow_run: extract from payload
+            const workflowRun = context.payload.workflow_run;
+            const headSha = workflowRun.head_sha;
+            const headBranch = workflowRun.head_branch;
+            
+            console.log('Head SHA:', headSha);
+            console.log('Head Branch:', headBranch);
+            
+            // Set source run info
+            core.setOutput('source-run-id', workflowRun.id.toString());
+            core.setOutput('source-run-number', workflowRun.run_number.toString());
+            core.setOutput('source-run-attempt', workflowRun.run_attempt.toString());
+            core.setOutput('source-head-sha', headSha);
+            
+            // Check for blob report artifacts
+            const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: workflowRun.id
+            });
+            
+            const blobReports = artifacts.artifacts.filter(a => a.name.startsWith('blob-report-'));
+            console.log('Found blob reports:', blobReports.map(a => a.name));
+            core.setOutput('has-blob-reports', blobReports.length > 0 ? 'true' : 'false');
+            
+            // Try to get PR number from workflow_run payload first
+            if (workflowRun.pull_requests && workflowRun.pull_requests.length > 0) {
+              const prNumber = workflowRun.pull_requests[0].number;
+              console.log('PR number from payload:', prNumber);
+              core.setOutput('pr-number', prNumber.toString());
+              core.setOutput('head-branch', headBranch);
+              return;
+            }
+            
+            // Fall back to API lookup
+            try {
+              const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                commit_sha: headSha
+              });
+              
+              if (prs.length === 0) {
+                console.log('No PRs found for commit');
+                core.setOutput('pr-number', '');
+                core.setOutput('head-branch', headBranch);
+                return;
+              }
+              
+              // Find open PR or use first one
+              const openPr = prs.find(pr => pr.state === 'open') || prs[0];
+              console.log('PR number from API:', openPr.number);
+              core.setOutput('pr-number', openPr.number.toString());
+              core.setOutput('head-branch', openPr.head.ref);
+            } catch (e) {
+              console.log('Error fetching PR:', e);
+              core.setOutput('pr-number', '');
+              core.setOutput('head-branch', headBranch);
+            }
+
+  merge-reports:
+    name: Merge reports
+    needs: [get-pr-info]
+    if: ${{ needs.get-pr-info.outputs.has-blob-reports == 'true' && needs.get-pr-info.outputs.pr-number != '' }}
+    uses: ./.github/workflows/merge-reports.yml
+    with:
+      source_run_id: ${{ needs.get-pr-info.outputs.source-run-id }}
+      source_run_number: ${{ needs.get-pr-info.outputs.source-run-number }}
+      source_run_attempt: ${{ needs.get-pr-info.outputs.source-run-attempt }}
+      source_head_sha: ${{ needs.get-pr-info.outputs.source-head-sha }}
+    # No secrets: inherit - merge-reports only needs the default GITHUB_TOKEN for artifact download
+
+  publish-report:
+    name: Publish HTML report
+    needs: [get-pr-info, merge-reports]
+    if: ${{ needs.get-pr-info.outputs.pr-number != '' }}
+    uses: ./.github/workflows/publish-report.yml
+    with:
+      head_branch: ${{ needs.get-pr-info.outputs.head-branch }}
+      source_run_id: ${{ needs.get-pr-info.outputs.source-run-id }}
+      source_run_number: ${{ needs.get-pr-info.outputs.source-run-number }}
+      source_run_attempt: ${{ needs.get-pr-info.outputs.source-run-attempt }}
+      pr_number: ${{ needs.get-pr-info.outputs.pr-number }}
+    secrets: inherit

.github/workflows/e2e.yml

@@ -5,7 +5,6 @@ permissions:
   actions: write
   contents: read
 env:
-  NODE_OPTIONS: --max-old-space-size=4096
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
@@ -15,11 +14,11 @@ env:
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
-  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
   EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
   EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
   EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
   EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
   GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
   NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
   NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
@@ -30,6 +29,7 @@ env:
   NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
   NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
   NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  NODE_OPTIONS: --max-old-space-size=4096
   PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
   PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
   SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}

.github/workflows/i18n.yml

@@ -16,6 +16,14 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
@@ -23,7 +31,7 @@ jobs:
           cache: 'npm'
       - uses: lingodotdev/lingo.dev@main
         env:
-          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         with:
           api-key: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
           pull-request: true

.github/workflows/labeler.yml

@@ -15,18 +15,6 @@ jobs:
       - uses: actions/labeler@v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
-  team-labels:
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: equitybee/team-label-action@main
-        with:
-          repo-token: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN }}
-          organization-name: calcom
-          ignore-labels: "admin, app-store, ai, api, authentication, automated-testing, billing, bookings, caldav, calendar-apps, ci, console, crm-apps, dba, devops, docs, documentation, emails, embeds, event-types, i18n, impersonation, manual-testing, ui, performance, ops-stack, organizations, public-api, routing-forms, seats, self-hosted, sre, teams, webhooks, workflows, zapier"
   apply-labels-from-issue:
     runs-on: ubuntu-latest
 

.github/workflows/merge-reports.yml

@@ -1,17 +1,37 @@
 # https://playwright.dev/docs/test-sharding#merging-reports-from-multiple-shards
 on:
   workflow_call:
+    inputs:
+      source_run_id:
+        description: 'The run ID to download artifacts from (for workflow_run triggered calls)'
+        required: true
+        type: string
+      source_run_number:
+        description: 'The run number for artifact naming'
+        required: true
+        type: string
+      source_run_attempt:
+        description: 'The run attempt for artifact naming'
+        required: true
+        type: string
+      source_head_sha:
+        description: 'The head SHA to checkout for Playwright version consistency'
+        required: true
+        type: string
 jobs:
   merge-reports:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/actions/dangerous-git-checkout
+        with:
+          ref: ${{ inputs.source_head_sha }}
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
       - name: Download blob reports from GitHub Actions Artifacts
         uses: actions/download-artifact@v4
         with:
+          run-id: ${{ inputs.source_run_id }}
+          github-token: ${{ github.token }}
           path: all-blob-reports
           pattern: blob-report-*
           merge-multiple: true
@@ -20,6 +40,6 @@ jobs:
       - name: Upload HTML report
         uses: actions/upload-artifact@v4
         with:
-          name: html-report--attempt-${{ github.run_number }}-${{ github.run_attempt }}
+          name: html-report--attempt-${{ inputs.source_run_number }}-${{ inputs.source_run_attempt }}
           path: playwright-report
           retention-days: 14

.github/workflows/nextjs-bundle-analysis-annotation.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-build
       - name: Download base branch bundle stats
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@v6
         if: success()
         with:
           workflow: nextjs-bundle-analysis.yml

.github/workflows/post-release.yml

@@ -6,16 +6,27 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/pr.yml

@@ -2,10 +2,11 @@ name: PR Update
 
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened, labeled]
+    types: [opened, synchronize, reopened]
     branches:
       - main
       - gh-actions-test-branch
+
   workflow_dispatch:
 
 permissions:
@@ -17,49 +18,53 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  changes:
-    name: Detect changes
+  prepare:
+    name: Prepare
     runs-on: buildjet-2vcpu-ubuntu-2204
     permissions:
       pull-requests: read
     outputs:
       has-files-requiring-all-checks: ${{ steps.filter.outputs.has-files-requiring-all-checks }}
+      has_companion: ${{ steps.filter.outputs.has_companion }}
       commit-sha: ${{ steps.get_sha.outputs.commit-sha }}
+      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: dorny/paths-filter@v3
         id: filter
         with:
+          predicate-quantifier: "every"
           filters: |
             has-files-requiring-all-checks:
-              - "!(**.md|**.mdx|.github/CODEOWNERS|docs/**|help/**|apps/web/public/static/locales/**/common.json|i18n.lock)"
+              - '**'
+              - '!companion/**'
+              - '!**/*.md'
+              - '!**/*.mdx'
+              - '!.github/CODEOWNERS'
+              - '!docs/**'
+              - '!help/**'
+              - '!apps/web/public/static/locales/**/common.json'
+              - '!i18n.lock'
+            has_companion:
+              - "companion/**"
       - name: Get Latest Commit SHA
         id: get_sha
         run: |
           echo "commit-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-
-  check-label:
-    needs: [changes]
-    runs-on: buildjet-2vcpu-ubuntu-2204
-    name: Check for E2E label
-    permissions:
-      pull-requests: read
-    outputs:
-      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' && (github.event.action != 'labeled' || github.event.label.name == 'ready-for-e2e') }}
-    steps:
       - name: Check if PR exists with ready-for-e2e label for this SHA
         id: check-if-pr-has-label
         uses: actions/github-script@v7
         with:
           script: |
             let labels = [];
+            let prNumber = null;
 
             if (context.payload.pull_request) {
-              labels = context.payload.pull_request.labels;
+              prNumber = context.payload.pull_request.number;
             } else {
               try {
-                const sha = '${{ needs.changes.outputs.commit-sha }}';
+                const sha = '${{ steps.get_sha.outputs.commit-sha }}';
                 console.log('sha', sha);
                 const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
                   owner: context.repo.owner,
@@ -73,125 +78,172 @@ jobs:
                   return;
                 }
 
-                const pr = prs[0];
-                console.log(`PR number: ${pr.number}`);
-                console.log(`PR title: ${pr.title}`);
-                console.log(`PR state: ${pr.state}`);
-                console.log(`PR URL: ${pr.html_url}`);
-
-                labels = pr.labels;
+                prNumber = prs[0].number;
               }
               catch (e) {
                 core.setOutput('run-e2e', false);
                 console.log(e);
+                return;
               }
             }
 
+            // Always fetch fresh PR data to get current labels
+            // This avoids stale label data from event payloads
+            try {
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNumber
+              });
+
+              console.log(`PR number: ${pr.number}`);
+              console.log(`PR title: ${pr.title}`);
+              console.log(`PR state: ${pr.state}`);
+              console.log(`PR URL: ${pr.html_url}`);
+
+              labels = pr.labels;
+            }
+            catch (e) {
+              core.setOutput('run-e2e', false);
+              console.log(e);
+              return;
+            }
+
             const labelFound = labels.map(l => l.name).includes('ready-for-e2e');
             console.log('Found the label?', labelFound);
             core.setOutput('run-e2e', labelFound);
 
   deps:
     name: Install dependencies
-    needs: [changes, check-label]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/yarn-install.yml
 
   type-check:
     name: Type check
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/check-types.yml
     secrets: inherit
 
   lint:
     name: Linters
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/lint.yml
     secrets: inherit
 
   unit-test:
     name: Tests
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/unit-tests.yml
     secrets: inherit
 
+  api-v2-unit-test:
+    name: Tests
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/api-v2-unit-tests.yml
+    secrets: inherit
+
+  setup-db:
+    name: Setup Database
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/setup-db.yml
+    with:
+      COMMIT_SHA: ${{ needs.prepare.outputs.commit-sha }}
+    secrets: inherit
+
   build-api-v1:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v1-production-build.yml
     secrets: inherit
 
   build-api-v2:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v2-production-build.yml
     secrets: inherit
 
   build-atoms:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/atoms-production-build.yml
     secrets: inherit
 
   build-docs:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/docs-build.yml
     secrets: inherit
 
+  build-companion:
+    name: Companion builds
+    needs: [prepare]
+    if: needs.prepare.outputs.has_companion == 'true'
+    uses: ./.github/workflows/companion-build.yml
+    secrets: inherit
+
   build:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/production-build-without-database.yml
     secrets: inherit
 
   integration-test:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/integration-tests.yml
     secrets: inherit
 
   e2e:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e.yml
     secrets: inherit
 
+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    needs: [prepare, deps]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/check-api-v2-breaking-changes.yml
+    secrets: inherit
+
   e2e-api-v2:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-api-v2.yml
     secrets: inherit
 
   e2e-app-store:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-app-store.yml
     secrets: inherit
 
   e2e-embed:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed.yml
     secrets: inherit
 
   e2e-embed-react:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
@@ -201,58 +253,58 @@ jobs:
     uses: ./.github/workflows/nextjs-bundle-analysis.yml
     secrets: inherit
 
-  merge-reports:
-    name: Merge reports
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    needs: [changes, check-label, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
-    uses: ./.github/workflows/merge-reports.yml
-    secrets: inherit
-
-  publish-report:
-    name: Publish HTML report
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    needs: [changes, check-label, merge-reports]
-    uses: ./.github/workflows/publish-report.yml
-    secrets: inherit
-
-  cleanup-report:
-    name: Cleanup HTML report
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && (github.event.pull_request.merged == true || github.event.pull_request.state == 'closed') }}
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    needs: [changes, check-label, publish-report]
-    uses: ./.github/workflows/cleanup-report.yml
-    secrets: inherit
-
   required:
     needs:
       [
-        changes,
+        prepare,
         lint,
         type-check,
         unit-test,
+        api-v2-unit-test,
+        check-api-v2-breaking-changes,
         integration-test,
-        check-label,
         build,
         build-api-v1,
         build-api-v2,
         build-atoms,
         build-docs,
+        build-companion,
+        setup-db,
         e2e,
         e2e-api-v2,
         e2e-embed,
         e2e-embed-react,
-        e2e-app-store
+        e2e-app-store,
       ]
     if: always()
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:
       - name: fail if conditional jobs failed
-        if: needs.changes.outputs.has-files-requiring-all-checks == 'true' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled'))
         run: exit 1
+        if: |
+          (
+            needs.prepare.outputs.has-files-requiring-all-checks == 'true' &&
+            (
+            needs.lint.result != 'success' ||
+            needs.type-check.result != 'success' ||
+            needs.unit-test.result != 'success' ||
+            needs.api-v2-unit-test.result != 'success' ||
+            needs.check-api-v2-breaking-changes.result != 'success' ||
+              needs.build.result != 'success' ||
+              needs.build-api-v1.result != 'success' ||
+              needs.build-api-v2.result != 'success' ||
+              needs.build-atoms.result != 'success' ||
+              needs.build-docs.result != 'success' ||
+              needs.setup-db.result != 'success' ||
+              needs.integration-test.result != 'success' ||
+              needs.e2e.result != 'success' ||
+              needs.e2e-api-v2.result != 'success' ||
+              needs.e2e-embed.result != 'success' ||
+              needs.e2e-embed-react.result != 'success' ||
+              needs.e2e-app-store.result != 'success'
+            )
+          ) ||
+          (
+            needs.prepare.outputs.has_companion == 'true' &&
+            needs.build-companion.result != 'success'
+          )

.github/workflows/publish-report.yml

@@ -1,5 +1,26 @@
 on:
   workflow_call:
+    inputs:
+      head_branch:
+        description: 'The head branch name for report path'
+        required: true
+        type: string
+      source_run_id:
+        description: 'The source run ID for report path'
+        required: true
+        type: string
+      source_run_number:
+        description: 'The source run number for artifact naming and comment'
+        required: true
+        type: string
+      source_run_attempt:
+        description: 'The source run attempt for artifact naming and comment'
+        required: true
+        type: string
+      pr_number:
+        description: 'The PR number to post comment on'
+        required: true
+        type: string
 permissions:
   contents: write
   issues: write
@@ -10,15 +31,23 @@ jobs:
     continue-on-error: true
     env:
       # Unique URL path for each workflow run attempt
-      HTML_REPORT_URL_PATH: reports/${{ github.head_ref }}/${{ github.run_id }}/${{ github.run_attempt }}
-      BRANCH_REPORTS_DIR: reports/${{ github.head_ref }}
+      HTML_REPORT_URL_PATH: reports/${{ inputs.head_branch }}/${{ inputs.source_run_id }}/${{ inputs.source_run_attempt }}
+      BRANCH_REPORTS_DIR: reports/${{ inputs.head_branch }}
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
           repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |
@@ -37,11 +66,11 @@ jobs:
         run: |
           rm -rf $BRANCH_REPORTS_DIR
           git add .
-          git commit -m "workflow: remove all reports for branch ${{ github.head_ref }}"
+          git commit -m "workflow: remove all reports for branch ${{ inputs.head_branch }}"
       - name: Download zipped HTML report
         uses: actions/download-artifact@v4
         with:
-          name: html-report--attempt-${{ github.run_number }}-${{ github.run_attempt }}
+          name: html-report--attempt-${{ inputs.source_run_number }}-${{ inputs.source_run_attempt }}
           path: ${{ env.HTML_REPORT_URL_PATH }}
       - name: Push HTML Report
         timeout-minutes: 3
@@ -49,7 +78,7 @@ jobs:
         # this is necessary when this job running at least twice at the same time (e.g. through two pushes at the same time)
         run: |
           git add .
-          git commit -m "workflow: add HTML report for run-id ${{ github.run_id }} (attempt:  ${{ github.run_attempt }})"
+          git commit -m "workflow: add HTML report for run-id ${{ inputs.source_run_id }} (attempt:  ${{ inputs.source_run_attempt }})"
 
           while true; do
             git pull --rebase
@@ -74,18 +103,18 @@ jobs:
         uses: peter-evans/find-comment@v2
         id: fc
         with:
-          issue-number: ${{ github.event.pull_request.number }}
+          issue-number: ${{ inputs.pr_number }}
           comment-author: "github-actions[bot]"
           body-includes: <!-- GENERATED-E2E-RESULTS -->
       - name: Create comment
         if: steps.fc.outputs.comment-id == ''
         uses: peter-evans/create-or-update-comment@v3
         with:
-          issue-number: ${{ github.event.pull_request.number }}
+          issue-number: ${{ inputs.pr_number }}
           body: |
             <!-- GENERATED-E2E-RESULTS -->
             ## E2E results are ready!
-            - [Workflow #${{ github.run_number }}.${{ github.run_attempt }} latest results](${{ steps.url.outputs.link }})
+            - [Workflow #${{ inputs.source_run_number }}.${{ inputs.source_run_attempt }} latest results](${{ steps.url.outputs.link }})
       - name: Update comment
         if: steps.fc.outputs.comment-id != ''
         uses: peter-evans/create-or-update-comment@v3
@@ -95,4 +124,4 @@ jobs:
           body: |
             <!-- GENERATED-E2E-RESULTS -->
             ## E2E results are ready!
-            - [Workflow #${{ github.run_number }}.${{ github.run_attempt }} latest results](${{ steps.url.outputs.link }})
+            - [Workflow #${{ inputs.source_run_number }}.${{ inputs.source_run_attempt }} latest results](${{ steps.url.outputs.link }})

.github/workflows/release-docker.yaml

@@ -40,6 +40,7 @@ jobs:
           postgres-db: ${{ env.POSTGRES_DB }}
           database-host: ${{ env.DATABASE_HOST }}
           push-image: "true"
+          use-as-latest: "true"
 
       - name: Notify Slack on Success
         if: success()

.github/workflows/setup-db.yml

@@ -0,0 +1,54 @@
+name: Setup Database
+
+on:
+  workflow_call:
+    inputs:
+      COMMIT_SHA:
+        required: false
+        type: string
+        default: ""
+        description: "Commit SHA to include in cache key"
+
+permissions:
+  contents: read
+
+env:
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  E2E_TEST_CALCOM_QA_EMAIL: ${{ secrets.E2E_TEST_CALCOM_QA_EMAIL }}
+  E2E_TEST_CALCOM_QA_PASSWORD: ${{ secrets.E2E_TEST_CALCOM_QA_PASSWORD }}
+  E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ secrets.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+
+jobs:
+  setup-db:
+    name: Setup Database
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    timeout-minutes: 15
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - uses: ./.github/actions/cache-db
+        with:
+          COMMIT_SHA: ${{ inputs.COMMIT_SHA || github.sha }}

.github/workflows/unit-tests.yml

@@ -17,8 +17,3 @@ jobs:
       - run: yarn test -- --no-isolate
       # We could add different timezones here that we need to run our tests in
       - run: TZ=America/Los_Angeles yarn test -- --timeZoneDependentTestsOnly --no-isolate
-      - name: Run API v2 tests
-        working-directory: apps/api/v2
-        run: |
-          export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn workspace @calcom/platform-libraries build && yarn test

.husky/pre-commit

@@ -1,6 +1,3 @@
-#!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
-
 yarn lint-staged
 
 yarn app-store:build && git add packages/app-store/*.generated.*

.yarnrc.yml

@@ -1,11 +1,7 @@
+compressionLevel: mixed
+
+enableGlobalCache: false
+
 nodeLinker: node-modules
 
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
-  - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
-    spec: "@yarnpkg/plugin-workspace-tools"
-  - path: .yarn/plugins/@yarnpkg/plugin-version.cjs
-    spec: "@yarnpkg/plugin-version"
-
-yarnPath: .yarn/releases/yarn-3.4.1.cjs
+yarnPath: .yarn/releases/yarn-4.12.0.cjs

AGENTS.md

@@ -1,30 +1,213 @@
 # Cal.com Development Guide for AI Agents
 
-**📖 Complete documentation is in the [.agents/](.agents/) directory.**
+You are a senior Cal.com engineer working in a Yarn/Turbo monorepo. You prioritize type safety, security, and small, reviewable diffs.
 
-## Quick Reference
+## Do
 
-### Essential Commands
+- Use `select` instead of `include` in Prisma queries for performance and security
+- Use `import type { X }` for TypeScript type imports
+- Use early returns to reduce nesting: `if (!booking) return null;`
+- Use `ErrorWithCode` for errors in non-tRPC files (services, repositories, utilities); use `TRPCError` only in tRPC routers
+- Use conventional commits: `feat:`, `fix:`, `refactor:`
+- Create PRs in draft mode by default
+- Run `yarn type-check:ci --force` before concluding CI failures are unrelated to your changes
+- Import directly from source files, not barrel files (e.g., `@calcom/ui/components/button` not `@calcom/ui`)
+- Add translations to `apps/web/public/static/locales/en/common.json` for all UI strings
+- Use `date-fns` or native `Date` instead of Day.js when timezone awareness isn't needed
+- Put permission checks in `page.tsx`, never in `layout.tsx`
+- Use `ast-grep` for searching if available; otherwise use `rg` (ripgrep), then fall back to `grep`
 
-- `yarn dev` - Start development server
-- `yarn build` - Build all packages
-- `yarn lint:fix` - Lint and fix code
-- `yarn type-check` - TypeScript checking
-- `yarn test <filename> -- --integrationTestsOnly` - Run integration tests
-- `yarn e2e <filename> --grep "<testName>"` - Run specific E2E test
+## Don't
 
-## Tool Preferences
+- Never use `as any` - use proper type-safe solutions instead
+- Never expose `credential.key` field in API responses or queries
+- Never commit secrets or API keys
+- Never modify `*.generated.ts` files directly - they're created by app-store-cli
+- Never put business logic in repositories - that belongs in Services
+- Never use barrel imports from index.ts files
+- Never skip running type checks before pushing
+- Never create large PRs (>500 lines or >10 files) - split them instead
 
-### Search Tools Priority
+## Commands
 
-Use tools in this order of preference:
+### File-scoped (preferred for speed)
 
-1. **ast-grep** - For AST-based code searches (if available)
-2. **rg (ripgrep)** - For fast text searches
-3. **grep** - As fallback for text searches
+```bash
+# Type check - always run on changed files
+yarn type-check:ci --force
 
-## 📚 Detailed Documentation
+# Lint single file
+yarn eslint --fix path/to/file.tsx
 
-- **[.agents/README.md](.agents/README.md)** - Complete development guide
-- **[.agents/commands.md](.agents/commands.md)** - All build, test & dev commands
-- **[.agents/knowledge-base.md](.agents/knowledge-base.md)** - Knowledge base & best practices
+# Format single file  
+yarn prettier --write path/to/file.tsx
+
+# Unit test specific file
+yarn vitest run path/to/file.test.ts
+
+# Unit test specific file + specific test
+yarn vitest run path/to/file.test.ts --testNamePattern="specific test name"
+
+# Integration test specific file
+yarn test path/to/file.integration-test.ts -- --integrationTestsOnly
+
+# Integration test specific file + specific test
+yarn test path/to/file.integration-test.ts --testNamePattern="specific test name" -- --integrationTestsOnly
+
+# E2E test specific file
+PLAYWRIGHT_HEADLESS=1 yarn e2e path/to/file.e2e.ts
+
+# E2E test specific file + specific test
+PLAYWRIGHT_HEADLESS=1 yarn e2e path/to/file.e2e.ts --grep "specific test name"
+```
+
+### Project-wide (use sparingly)
+
+```bash
+# Development
+yarn dev              # Start dev server
+yarn dx               # Dev with database setup
+
+# Build & check
+yarn build            # Build all packages
+yarn lint:fix         # Lint and fix all
+yarn type-check       # Type check all
+
+# Tests (use TZ=UTC for consistency)
+TZ=UTC yarn test      # All unit tests
+yarn e2e              # All E2E tests
+
+# Database
+yarn prisma generate  # Regenerate types after schema changes
+yarn workspace @calcom/prisma db-migrate  # Run migrations
+```
+
+## Boundaries
+
+### Always do
+- Run type check on changed files before committing
+- Run relevant tests before pushing
+- Use `select` in Prisma queries
+- Follow conventional commits for PR titles
+
+### Ask first
+- Adding new dependencies
+- Schema changes to `packages/prisma/schema.prisma`
+- Changes affecting multiple packages
+- Deleting files
+- Running full build or E2E suites
+
+### Never do
+- Commit secrets, API keys, or `.env` files
+- Expose `credential.key` in any query
+- Use `as any` type casting
+- Force push or rebase shared branches
+- Modify generated files directly
+
+## Project Structure
+
+```
+apps/web/                    # Main Next.js application
+packages/prisma/             # Database schema (schema.prisma) and migrations
+packages/trpc/               # tRPC API layer (routers in server/routers/)
+packages/ui/                 # Shared UI components
+packages/features/           # Feature-specific code
+packages/app-store/          # Third-party integrations
+packages/lib/                # Shared utilities
+```
+
+### Key files
+- Routes: `apps/web/app/` (App Router)
+- Database schema: `packages/prisma/schema.prisma`
+- tRPC routers: `packages/trpc/server/routers/`
+- Translations: `apps/web/public/static/locales/en/common.json`
+- Workflow constants: `packages/features/ee/workflows/lib/constants.ts`
+
+## Tech Stack
+
+- **Framework**: Next.js 13+ (App Router in some areas)
+- **Language**: TypeScript (strict)
+- **Database**: PostgreSQL with Prisma ORM
+- **API**: tRPC for type-safe APIs
+- **Auth**: NextAuth.js
+- **Styling**: Tailwind CSS
+- **Testing**: Vitest (unit), Playwright (E2E)
+- **i18n**: next-i18next
+
+## Code Examples
+
+### Good error handling
+
+```typescript
+// Good - Descriptive error with context
+throw new Error(`Unable to create booking: User ${userId} has no available time slots for ${date}`);
+
+// Bad - Generic error
+throw new Error("Booking failed");
+```
+
+For which error class to use (`ErrorWithCode` vs `TRPCError`) and concrete examples, see [Error Types in knowledge-base.md](agents/knowledge-base.md#error-types).
+
+### Good Prisma query
+
+```typescript
+// Good - Use select for performance and security
+const booking = await prisma.booking.findFirst({
+  select: {
+    id: true,
+    title: true,
+    user: {
+      select: {
+        id: true,
+        name: true,
+        email: true,
+      }
+    }
+  }
+});
+
+// Bad - Include fetches all fields including sensitive ones
+const booking = await prisma.booking.findFirst({
+  include: { user: true }
+});
+```
+
+### Good imports
+
+```typescript
+// Good - Type imports and direct paths
+import type { User } from "@prisma/client";
+import { Button } from "@calcom/ui/components/button";
+
+// Bad - Regular import for types, barrel imports
+import { User } from "@prisma/client";
+import { Button } from "@calcom/ui";
+```
+
+## PR Checklist
+
+- [ ] Title follows conventional commits: `feat(scope): description`
+- [ ] Type check passes: `yarn type-check:ci --force`
+- [ ] Lint passes: `yarn lint:fix`
+- [ ] Relevant tests pass
+- [ ] Diff is small and focused (<500 lines, <10 files)
+- [ ] No secrets or API keys committed
+- [ ] UI strings added to translation files
+- [ ] Created as draft PR
+
+## When Stuck
+
+- Ask a clarifying question before making large speculative changes
+- Propose a short plan for complex tasks
+- Open a draft PR with notes if unsure about approach
+- Fix type errors before test failures - they're often the root cause
+- Run `yarn prisma generate` if you see missing enum/type errors
+
+## Extended Documentation
+
+For detailed information, see the `agents/` directory:
+
+- **[agents/README.md](agents/README.md)** - Architecture overview and patterns
+- **[agents/commands.md](agents/commands.md)** - Complete command reference
+- **[agents/knowledge-base.md](agents/knowledge-base.md)** - Domain knowledge and best practices
+- **[agents/coding-standards.md](agents/coding-standards.md)** - Coding standards with examples

Dockerfile

@@ -10,7 +10,7 @@ ARG CALCOM_TELEMETRY_DISABLED
 ARG DATABASE_URL
 ARG NEXTAUTH_SECRET=secret
 ARG CALENDSO_ENCRYPTION_KEY=secret
-ARG MAX_OLD_SPACE_SIZE=4096
+ARG MAX_OLD_SPACE_SIZE=6144
 ARG NEXT_PUBLIC_API_V2_URL
 ARG CSP_POLICY
 
@@ -77,6 +77,9 @@ RUN scripts/replace-placeholder.sh http://NEXT_PUBLIC_WEBAPP_URL_PLACEHOLDER ${N
 FROM node:20 AS runner
 
 WORKDIR /calcom
+
+RUN apt-get update && apt-get install -y --no-install-recommends netcat-openbsd wget && rm -rf /var/lib/apt/lists/*
+
 COPY --from=builder-two /calcom ./
 ARG NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
 ENV NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL \

README.md

@@ -836,12 +836,12 @@ following
 
 1. Open [HubSpot Developer](https://developer.hubspot.com/) and sign into your account, or create a new one.
 2. From within the home of the Developer account page, go to "Manage apps".
-3. Click "Create app" button top right.
+3. Click "Create legacy app" button top right and select public app.
 4. Fill in any information you want in the "App info" tab
 5. Go to tab "Auth"
 6. Now copy the Client ID and Client Secret to your `.env` file into the `HUBSPOT_CLIENT_ID` and `HUBSPOT_CLIENT_SECRET` fields.
 7. Set the Redirect URL for OAuth `<Cal.com URL>/api/integrations/hubspot/callback` replacing Cal.com URL with the URI at which your application runs.
-8. In the "Scopes" section at the bottom of the page, make sure you select "Read" and "Write" for scope called `crm.objects.contacts`
+8. In the "Scopes" section at the bottom of the page, make sure you select "Read" and "Write" for scopes called `crm.objects.contacts` and `crm.lists`.
 9. Click the "Save" button at the bottom footer.
 10. You're good to go. Now you can see any booking in Cal.com created as a meeting in HubSpot for your contacts.
 

agents/coding-standards.md

@@ -27,6 +27,12 @@ import { User } from "@prisma/client";
 
 - Use React children and context instead of passing props through multiple components
 
+### ORM and Types
+
+- Never import `@calcom/prisma/client` in features, services, UI, or handlers.
+- Use repository DTOs or domain types instead.
+- See "Repository + DTO Pattern and Method Conventions" in the knowledge base for details and examples.
+
 ### Security Rules
 
 ```typescript

agents/commands.md

@@ -28,11 +28,17 @@
 
 - `yarn test` - Run unit tests (vitest)
 - `yarn test <filename>` - Run tests for specific file
-- `yarn test <filename> -- --integrationTestsOnly` - Run integration tests for specific file
-- `yarn test <filename> -t "<testName>" -- --integrationTestsOnly` - Run specific test by name
+- `yarn test <filename> -t "<testName>"` - Run specific test by name for specific file
 - `yarn tdd` - Run tests in watch mode
 - `yarn test:ui` - Run tests with UI interface
 
+### Integration Tests
+
+- `yarn test -- --integrationTestsOnly` - Run integration tests (vitest)
+- `yarn test <filename> -- --integrationTestsOnly` - Run integration tests for specific file
+- `yarn test <filename> -t "<testName>" -- --integrationTestsOnly` - Run specific integration test by name for specific file
+
+
 ### End-to-End Tests
 
 - `yarn e2e` - Run end-to-end tests (Playwright)

agents/knowledge-base.md

@@ -225,16 +225,86 @@ throw new Error("Booking failed");
 
 ### Error Types
 
+Use `ErrorWithCode` for files that are not directly coupled to tRPC. The tRPC package has a middleware called `errorConversionMiddleware` that automatically converts `ErrorWithCode` instances into `TRPCError` instances.
+
 ```typescript
-// ✅ Good - Use proper error classes
+// ✅ Good - Use ErrorWithCode in non-tRPC files (services, repositories, utilities)
+import { ErrorCode } from "@calcom/lib/errorCodes";
+import { ErrorWithCode } from "@calcom/lib/errors";
+
+// Option 1: Using constructor with ErrorCode enum
+throw new ErrorWithCode(ErrorCode.BookingNotFound, "Booking not found");
+
+// Option 2: Using the Factory pattern for common HTTP errors
+throw ErrorWithCode.Factory.Forbidden("You don't have permission to view this");
+throw ErrorWithCode.Factory.NotFound("Resource not found");
+throw ErrorWithCode.Factory.BadRequest("Invalid input");
+
+// ✅ Good - Use TRPCError only in tRPC routers/procedures
 import { TRPCError } from "@trpc/server";
 
 throw new TRPCError({
   code: "BAD_REQUEST",
   message: "Invalid booking time slot",
 });
+
+// ❌ Bad - Using TRPCError in non-tRPC files
+import { TRPCError } from "@trpc/server";
+// Don't use TRPCError in services, repositories, or utility files
 ```
 
+### packages/features Import Restrictions
+
+Files in `packages/features/**` should NOT import from `@calcom/trpc`. This keeps the features package decoupled from the tRPC layer, making the code more reusable and testable. Use `ErrorWithCode` for error handling in these files, and let the tRPC middleware handle the conversion.
+
+**Architecture: packages/features vs apps/web/modules**
+
+The `packages/features` package should contain only framework-agnostic code:
+- Repositories (data access layer)
+- Services (business logic)
+- Core utilities and helpers
+- Types and interfaces
+
+Web-specific code, particularly anything that uses tRPC, should live in `apps/web/modules/...`. This includes:
+- React hooks that use tRPC queries/mutations
+- tRPC-specific utilities
+- Web-only UI components that depend on tRPC
+
+**Example:**
+
+If you have a feature called `feature-opt-in`:
+
+```
+packages/features/feature-opt-in/
+├── repository/
+│   └── FeatureOptInRepository.ts    # Data access - OK here
+├── service/
+│   └── FeatureOptInService.ts       # Business logic - OK here
+└── types.ts                          # Types - OK here
+
+apps/web/modules/feature-opt-in/
+└── hooks/
+    └── useFeatureOptIn.ts           # tRPC hook - MUST be here, not in packages/features
+```
+
+```typescript
+// ❌ Bad - tRPC hook in packages/features
+// packages/features/feature-opt-in/hooks/useFeatureOptIn.ts
+import { trpc } from "@calcom/trpc/react";
+export function useFeatureOptIn() {
+  return trpc.viewer.featureOptIn.useQuery();
+}
+
+// ✅ Good - tRPC hook in apps/web/modules
+// apps/web/modules/feature-opt-in/hooks/useFeatureOptIn.ts
+import { trpc } from "@calcom/trpc/react";
+export function useFeatureOptIn() {
+  return trpc.viewer.featureOptIn.useQuery();
+}
+```
+
+This separation ensures that `packages/features` remains portable and can be used by other apps (like `apps/api/v2`) without pulling in web-specific dependencies like tRPC React hooks.
+
 ## Basic Performance Guidelines
 
 - Aim for O(n) or O(n log n) complexity, avoid O(n²)
@@ -306,9 +376,54 @@ import { Button } from "@calcom/ui/components/button";
 - **Tests**: Same as source file + `.test.ts` or `.spec.ts`
 - **Avoid**: Dot-suffixes like `.service.ts`, `.repository.ts` (except for tests, types, specs)
 
-## Repository Method Conventions
+## Repository + DTO Pattern and Method Conventions
 
-Repositories should follow consistent naming and design patterns to promote reusability and maintainability.
+We use a Repository + DTO pattern to isolate Prisma and the database from business logic. Repositories are the only layer that talks to Prisma and database models. All services, tRPC handlers, API controllers, workflows, and UI should depend on DTOs or domain types, not Prisma types.
+
+DTOs (Data Transfer Objects) are simple TypeScript types or interfaces that represent our domain data in an ORM-agnostic way and are returned from repositories.
+
+### Why this pattern?
+
+- **Prevent type leaks**: Prisma type changes stay inside repositories instead of breaking services, handlers, and UI across dozens of files.
+- **Enable safe refactors**: Business logic works against stable DTOs, so you can change storage details without touching higher layers.
+- **Keep ORM swappable**: If we ever change ORM, only repository implementations change; services and handlers stay the same.
+
+### What not to do: tight Prisma coupling in business logic
+
+Do not import Prisma types in business logic. Prisma types belong only in the data access layer.
+
+```typescript
+// ❌ Bad – business logic depends on Prisma
+import type { Webhook } from "@calcom/prisma/client";
+export function sendPayload(webhook: Webhook) { /* ... */ }
+
+// ✅ Good – business logic depends on DTO + repository
+export interface WebhookDTO { id: string; url: string; }
+export interface IWebhookRepository { findById(id: string): Promise<WebhookDTO | null>; }
+export async function sendPayload(repo: IWebhookRepository, id: string) {
+  const webhook = await repo.findById(id);
+  // ...
+}
+```
+
+### DTOs in repositories
+
+Repositories should expose DTOs from their public methods and keep Prisma types internal. Inside the repository, use `Prisma.*GetPayload` and map rows to DTOs. The public methods should only return DTOs, never Prisma models.
+
+```typescript
+// DTO – ORM-agnostic type exported from the repository module
+export interface BookingDTO {
+  id: string;
+  userId: number;
+  startTime: Date;
+  status: "PENDING" | "CONFIRMED" | "CANCELLED";
+}
+```
+
+### Prisma boundaries
+
+- **Allowed**: `packages/prisma`, repository implementations (`packages/features/**/repositories/*Repository.ts`), and low-level data access infrastructure.
+- **Not allowed**: `packages/features/**` business logic (non-repository), `packages/trpc/**` handlers, `apps/web/**`, `apps/api/v2/**` services/controllers, and workflow/webhook/service layers.
 
 ### Method Naming Rules
 

apps/api/package.json

@@ -10,9 +10,9 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "connect": "^3.7.0",
-    "http": "^0.0.1-security",
-    "http-proxy-middleware": "^2.0.6"
+    "connect": "3.7.0",
+    "http": "0.0.1-security",
+    "http-proxy-middleware": "2.0.9"
   },
   "devDependencies": {
     "@calcom/eslint-config": "workspace:*"

apps/api/v1/lib/helpers/verifyApiKey.test.ts

@@ -11,9 +11,9 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { ILicenseKeyService } from "@calcom/ee/common/server/LicenseKeyService";
 import LicenseKeyService, { LicenseKeySingleton } from "@calcom/ee/common/server/LicenseKeyService";
-import { PrismaApiKeyRepository } from "@calcom/lib/server/repository/PrismaApiKeyRepository";
-import type { IDeploymentRepository } from "@calcom/lib/server/repository/deployment.interface";
-import { ApiKeyService } from "@calcom/lib/server/service/ApiKeyService";
+import { PrismaApiKeyRepository } from "@calcom/features/ee/api-keys/repositories/PrismaApiKeyRepository";
+import { ApiKeyService } from "@calcom/features/ee/api-keys/services/ApiKeyService";
+import type { IDeploymentRepository } from "@calcom/features/ee/deployment/repositories/IDeploymentRepository";
 import { UserPermissionRole } from "@calcom/prisma/enums";
 
 import { isAdminGuard } from "../utils/isAdmin";
@@ -21,11 +21,11 @@ import { isLockedOrBlocked } from "../utils/isLockedOrBlocked";
 import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 import { verifyApiKey } from "./verifyApiKey";
 
-vi.mock("@calcom/lib/server/service/ApiKeyService", () => ({
+vi.mock("@calcom/features/ee/api-keys/services/ApiKeyService", () => ({
   ApiKeyService: vi.fn(),
 }));
 
-vi.mock("@calcom/lib/server/repository/PrismaApiKeyRepository", () => ({
+vi.mock("@calcom/features/ee/api-keys/repositories/PrismaApiKeyRepository", () => ({
   PrismaApiKeyRepository: vi.fn(),
 }));
 

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -2,10 +2,10 @@ import type { NextMiddleware } from "next-api-middleware";
 
 import { LicenseKeySingleton } from "@calcom/ee/common/server/LicenseKeyService";
 import { hashAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
+import { PrismaApiKeyRepository } from "@calcom/features/ee/api-keys/repositories/PrismaApiKeyRepository";
+import { ApiKeyService } from "@calcom/features/ee/api-keys/services/ApiKeyService";
+import { DeploymentRepository } from "@calcom/features/ee/deployment/repositories/DeploymentRepository";
 import { IS_PRODUCTION } from "@calcom/lib/constants";
-import { PrismaApiKeyRepository } from "@calcom/lib/server/repository/PrismaApiKeyRepository";
-import { DeploymentRepository } from "@calcom/lib/server/repository/deployment";
-import { ApiKeyService } from "@calcom/lib/server/service/ApiKeyService";
 import { prisma } from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";

apps/api/v1/lib/validations/booking.ts

@@ -128,7 +128,7 @@ export const schemaBookingReadPublic = Booking.extend({
   title: true,
   startTime: true,
   endTime: true,
-  timeZone: true,
+  // Note: timeZone is not a field on Booking model - it's in nested attendees/user objects
   attendees: true,
   user: true,
   eventType: true,

apps/api/v1/lib/validations/destination-calendar.ts

@@ -2,11 +2,11 @@ import { z } from "zod";
 
 import { DestinationCalendarSchema } from "@calcom/prisma/zod/modelSchema/DestinationCalendarSchema";
 
+// Note: bookingId is not a field on DestinationCalendar model in Prisma schema
 export const schemaDestinationCalendarBaseBodyParams = DestinationCalendarSchema.pick({
   integration: true,
   externalId: true,
   eventTypeId: true,
-  bookingId: true,
   userId: true,
 }).partial();
 
@@ -38,11 +38,11 @@ export const schemaDestinationCalendarEditBodyParams = schemaDestinationCalendar
   schemaDestinationCalendarEditParams
 );
 
+// Note: bookingId is not a field on DestinationCalendar model in Prisma schema
 export const schemaDestinationCalendarReadPublic = DestinationCalendarSchema.pick({
   id: true,
   integration: true,
   externalId: true,
   eventTypeId: true,
-  bookingId: true,
   userId: true,
 });

apps/api/v1/lib/validations/user.ts

@@ -151,6 +151,7 @@ export const schemaUserCreateBodyParams = schemaUserBaseBodyParams
   .strict();
 
 // @note: These are the values that are always returned when reading a user
+// Note: We pick avatarUrl from the Prisma schema and extend with avatar for API v1 backward compatibility
 export const schemaUserReadPublic = UserSchema.pick({
   id: true,
   username: true,
@@ -158,7 +159,7 @@ export const schemaUserReadPublic = UserSchema.pick({
   email: true,
   emailVerified: true,
   bio: true,
-  avatar: true,
+  avatarUrl: true,
   timeZone: true,
   weekStart: true,
   endTime: true,
@@ -176,6 +177,9 @@ export const schemaUserReadPublic = UserSchema.pick({
   verified: true,
   invitedTo: true,
   role: true,
+}).extend({
+  // API v1 backward compatibility: expose avatarUrl as avatar
+  avatar: UserSchema.shape.avatarUrl,
 });
 
 export const schemaUsersReadPublic = z.array(schemaUserReadPublic);

apps/api/v1/lib/validations/webhook.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { WEBHOOK_TRIGGER_EVENTS } from "@calcom/features/webhooks/lib/constants";
+import { WebhookVersion } from "@calcom/features/webhooks/lib/interface/IWebhookRepository";
 import { WebhookSchema } from "@calcom/prisma/zod/modelSchema/WebhookSchema";
 
 const schemaWebhookBaseBodyParams = WebhookSchema.pick({
@@ -21,6 +22,7 @@ export const schemaWebhookCreateParams = z
     eventTypeId: z.number().optional(),
     userId: z.number().optional(),
     secret: z.string().optional().nullable(),
+    version: z.nativeEnum(WebhookVersion).optional(),
     // API shouldn't mess with Apps webhooks yet (ie. Zapier)
     // appId: z.string().optional().nullable(),
   })
@@ -33,6 +35,7 @@ export const schemaWebhookEditBodyParams = schemaWebhookBaseBodyParams
     z.object({
       eventTriggers: z.enum(WEBHOOK_TRIGGER_EVENTS).array().optional(),
       secret: z.string().optional().nullable(),
+      version: z.nativeEnum(WebhookVersion).optional(),
     })
   )
   .partial()
@@ -44,6 +47,7 @@ export const schemaWebhookReadPublic = WebhookSchema.pick({
   eventTypeId: true,
   payloadTemplate: true,
   eventTriggers: true,
+  version: true,
   // FIXME: We have some invalid urls saved in the DB
   // subscriberUrl: true,
   /** @todo: find out how to properly add back and validate those. */

apps/api/v1/next.config.js

@@ -1,3 +1,4 @@
+/* eslint-disable */
 const { withAxiom } = require("next-axiom");
 const { withSentryConfig } = require("@sentry/nextjs");
 const { PrismaPlugin } = require("@prisma/nextjs-monorepo-workaround-plugin");
@@ -6,6 +7,7 @@ const plugins = [withAxiom];
 
 /** @type {import("next").NextConfig} */
 const nextConfig = {
+  turbopack: {},
   transpilePackages: [
     "@calcom/app-store",
     "@calcom/dayjs",
@@ -94,7 +96,7 @@ const nextConfig = {
   },
 };
 
-if (!!process.env.NEXT_PUBLIC_SENTRY_DSN) {
+if (process.env.NEXT_PUBLIC_SENTRY_DSN) {
   plugins.push((nextConfig) =>
     withSentryConfig(nextConfig, {
       autoInstrumentServerFunctions: true,

apps/api/v1/package.json

@@ -21,7 +21,8 @@
     "@calcom/eslint-config": "workspace:*",
     "@calcom/tsconfig": "workspace:*",
     "@calcom/types": "workspace:*",
-    "node-mocks-http": "^1.11.0"
+    "node-mocks-http": "1.16.2",
+    "typescript": "5.9.2"
   },
   "dependencies": {
     "@calcom/app-store": "workspace:*",
@@ -31,18 +32,17 @@
     "@calcom/lib": "workspace:*",
     "@calcom/prisma": "workspace:*",
     "@calcom/trpc": "workspace:*",
-    "@prisma/nextjs-monorepo-workaround-plugin": "^6.16.1",
-    "@sentry/nextjs": "^9.15.0",
-    "bcryptjs": "^2.4.3",
-    "memory-cache": "^0.2.0",
-    "next": "^15.4.5",
-    "next-api-middleware": "^1.0.1",
-    "next-axiom": "^0.17.0",
-    "next-swagger-doc": "^0.3.6",
-    "next-validations": "^0.2.0",
-    "typescript": "^5.9.0-beta",
-    "tzdata": "^1.0.30",
-    "uuid": "^8.3.2",
-    "zod": "^3.22.4"
+    "@prisma/nextjs-monorepo-workaround-plugin": "6.16.1",
+    "@sentry/nextjs": "9.15.0",
+    "bcryptjs": "2.4.3",
+    "memory-cache": "0.2.0",
+    "next": "16.1.0",
+    "next-api-middleware": "1.0.1",
+    "next-axiom": "0.17.0",
+    "next-swagger-doc": "0.3.6",
+    "next-validations": "0.2.1",
+    "tzdata": "1.0.40",
+    "uuid": "8.3.2",
+    "zod": "3.25.76"
   }
 }

apps/api/v1/proxy.ts

@@ -0,0 +1,21 @@
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+
+function proxy(_request: NextRequest) {
+  // Matcher guarantees the last segment is one of the blocked segments, so we can
+  // immediately return a 403 without further path checks.
+  return NextResponse.json({ message: "Forbidden" }, { status: 403 });
+}
+
+export const config = {
+  // The blocked segment is always the last part of the path, so we only need this matcher.
+  matcher: [
+    "/:path*/_get",
+    "/:path*/_post",
+    "/:path*/_patch",
+    "/:path*/_delete",
+    "/:path*/_auth-middleware",
+  ],
+};
+
+export default proxy;

apps/api/v1/test/lib/bookings/_post.test.ts

@@ -161,7 +161,7 @@ vi.mock("@calcom/features/ee/workflows/lib/getAllWorkflows", () => ({
   workflowSelect: {},
 }));
 
-vi.mock("@calcom/trpc/server/routers/viewer/workflows/util", () => ({
+vi.mock("@calcom/features/ee/workflows/lib/getAllWorkflowsFromEventType", () => ({
   getAllWorkflowsFromEventType: vi.fn().mockResolvedValue([]),
 }));
 

apps/api/v2/jest-e2e.ts

@@ -1,5 +1,22 @@
 import type { Config } from "jest";
 
+// Detect if sharding is being used by checking for --shard flag
+const isSharding = process.argv.some((arg) => arg.includes("--shard"));
+
+// For Jest e2e, we reduce parallelism when sharding in CI to improve test isolation
+// since tests share database state and can interfere with each other
+const getMaxWorkers = () => {
+  if (process.env.CI && isSharding) {
+    // In CI with sharding: reduce workers to improve test isolation
+    // Sharding already provides parallelism across shards (4 parallel jobs)
+    return 4;
+  }
+  // Local development or non-sharded: use more workers (similar to Playwright)
+  return 8;
+};
+
+const maxWorkers = getMaxWorkers();
+
 const config: Config = {
   preset: "ts-jest",
   moduleFileExtensions: ["js", "json", "ts"],
@@ -17,7 +34,7 @@ const config: Config = {
   setupFilesAfterEnv: ["<rootDir>/test/jest.setup-e2e.ts"],
   reporters: ["default", "jest-summarizing-reporter"],
   workerIdleMemoryLimit: "512MB",
-  maxWorkers: 8,
+  maxWorkers,
   testPathIgnorePatterns: ["/dist/", "/node_modules/"],
   transformIgnorePatterns: ["/dist/", "/node_modules/"],
 };

apps/api/v2/package.json

@@ -16,7 +16,7 @@
     "_dev:build:watch:enums": "yarn workspace @calcom/platform-enums build:watch",
     "_dev:build:watch:utils": "yarn workspace @calcom/platform-utils build:watch",
     "_dev:build:watch:types": "yarn workspace @calcom/platform-types build:watch",
-    "dev:build": "yarn workspace @calcom/platform-constants build && yarn workspace @calcom/platform-enums build && yarn workspace @calcom/platform-utils build && yarn workspace @calcom/platform-types build && yarn workspace @calcom/platform-libraries build",
+    "dev:build": "yarn workspace @calcom/platform-constants build && yarn workspace @calcom/platform-enums build && yarn workspace @calcom/platform-utils build && yarn workspace @calcom/platform-types build && yarn workspace @calcom/platform-libraries build && yarn workspace @calcom/trpc build:server",
     "dev": "yarn dev:build && ts-node scripts/docker-start.ts && yarn copy-swagger-module && yarn start --watch",
     "dev:no-docker": "yarn dev:build && yarn copy-swagger-module && yarn start --watch",
     "start:debug": "nest start --debug --watch",
@@ -36,83 +36,82 @@
     "snyk-protect": "snyk-protect"
   },
   "dependencies": {
-    "@axiomhq/winston": "^1.2.0",
+    "@axiomhq/winston": "1.2.0",
     "@calcom/platform-constants": "workspace:*",
     "@calcom/platform-enums": "workspace:*",
     "@calcom/platform-libraries": "workspace:*",
     "@calcom/platform-types": "workspace:*",
     "@calcom/platform-utils": "workspace:*",
     "@calcom/prisma": "workspace:*",
-    "@golevelup/ts-jest": "^0.4.0",
-    "@microsoft/microsoft-graph-types-beta": "^0.42.0-preview",
+    "@microsoft/microsoft-graph-types-beta": "0.42.0-preview",
     "@nest-lab/throttler-storage-redis": "1.0.0",
-    "@nestjs/axios": "^4.0.0",
-    "@nestjs/bull": "^10.1.1",
-    "@nestjs/common": "^10.0.0",
-    "@nestjs/config": "^3.1.1",
-    "@nestjs/core": "^10.0.0",
-    "@nestjs/jwt": "^10.2.0",
-    "@nestjs/passport": "^10.0.2",
-    "@nestjs/platform-express": "^10.0.0",
-    "@nestjs/swagger": "^7.3.0",
+    "@nestjs/axios": "4.0.0",
+    "@nestjs/bull": "10.1.1",
+    "@nestjs/common": "10.4.20",
+    "@nestjs/config": "3.2.0",
+    "@nestjs/core": "10.4.20",
+    "@nestjs/jwt": "10.2.0",
+    "@nestjs/passport": "10.0.3",
+    "@nestjs/platform-express": "10.4.20",
+    "@nestjs/swagger": "7.3.0",
     "@nestjs/throttler": "6.2.1",
-    "@sentry/nestjs": "^9.15.0",
-    "@sentry/node": "^9.15.0",
-    "@sentry/profiling-node": "^9.15.0",
+    "@sentry/nestjs": "9.46.0",
+    "@sentry/node": "9.46.0",
+    "@sentry/profiling-node": "9.46.0",
     "@snyk/protect": "latest",
-    "body-parser": "^1.20.2",
-    "bull": "^4.12.4",
-    "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.0",
-    "concurrently": "^9.1.2",
-    "cookie-parser": "^1.4.6",
-    "dotenv": "^16.3.1",
-    "fs-extra": "^11.2.0",
-    "googleapis": "^84.0.0",
-    "helmet": "^7.1.0",
-    "ioredis": "^5.3.2",
-    "jsforce": "^1.11.0",
-    "lodash": "^4.17.21",
-    "luxon": "^3.4.4",
-    "nest-winston": "^1.9.4",
-    "next-auth": "^4.22.1",
-    "passport": "^0.7.0",
-    "passport-jwt": "^4.0.1",
-    "qs-stringify": "^1.2.1",
-    "querystring": "^0.2.1",
-    "reflect-metadata": "^0.1.13",
-    "rxjs": "^7.8.1",
-    "stripe": "^15.3.0",
-    "uuid": "^8.3.2",
-    "winston": "^3.13.0",
-    "winston-transport": "^4.7.0",
-    "zod": "^3.22.4"
+    "axios": "1.13.2",
+    "body-parser": "1.20.2",
+    "bull": "4.15.1",
+    "class-transformer": "0.5.1",
+    "class-validator": "0.14.3",
+    "cookie-parser": "1.4.6",
+    "dotenv": "16.6.1",
+    "fs-extra": "11.3.2",
+    "googleapis": "84.0.0",
+    "helmet": "7.1.0",
+    "ioredis": "5.3.2",
+    "lodash": "4.17.21",
+    "luxon": "3.4.4",
+    "nest-winston": "1.9.4",
+    "passport": "0.7.0",
+    "passport-jwt": "4.0.1",
+    "qs-stringify": "1.2.1",
+    "querystring": "0.2.1",
+    "reflect-metadata": "0.1.14",
+    "rxjs": "7.8.2",
+    "stripe": "15.4.0",
+    "uuid": "8.3.2",
+    "winston": "3.17.0",
+    "winston-transport": "4.9.0",
+    "zod": "3.25.76"
   },
   "devDependencies": {
     "@calcom/eslint-config": "workspace:*",
-    "@nestjs/cli": "^10.0.0",
-    "@nestjs/schematics": "^10.0.0",
-    "@nestjs/testing": "^10.0.0",
-    "@types/cookie-parser": "^1.4.6",
-    "@types/express": "^4.17.21",
-    "@types/fs-extra": "^11.0.4",
-    "@types/jest": "^29.5.10",
-    "@types/luxon": "^3.3.7",
-    "@types/passport-jwt": "^3.0.13",
-    "@types/supertest": "^2.0.12",
-    "@typescript-eslint/eslint-plugin": "^6",
-    "@typescript-eslint/parser": "^6",
-    "jest": "^29.7.0",
-    "jest-date-mock": "^1.0.10",
-    "node-mocks-http": "^1.16.2",
-    "prettier": "^2.8.6",
-    "source-map-support": "^0.5.21",
-    "supertest": "^6.3.3",
-    "ts-jest": "^29.1.1",
-    "ts-loader": "^9.4.3",
-    "ts-node": "^10.9.1",
-    "tsconfig-paths": "^4.1.0",
-    "typescript": "^5.9.0-beta"
+    "@golevelup/ts-jest": "0.4.0",
+    "@nestjs/cli": "10.3.2",
+    "@nestjs/schematics": "10.1.1",
+    "@nestjs/testing": "10.4.20",
+    "@types/cookie-parser": "1.4.7",
+    "@types/express": "4.17.21",
+    "@types/fs-extra": "11.0.4",
+    "@types/jest": "29.5.12",
+    "@types/luxon": "3.4.2",
+    "@types/passport-jwt": "3.0.13",
+    "@types/supertest": "2.0.16",
+    "@typescript-eslint/eslint-plugin": "6.21.0",
+    "@typescript-eslint/parser": "6.21.0",
+    "concurrently": "9.1.2",
+    "jest": "29.7.0",
+    "jest-date-mock": "1.0.10",
+    "node-mocks-http": "1.16.2",
+    "prettier": "2.8.7",
+    "source-map-support": "0.5.21",
+    "supertest": "6.3.4",
+    "ts-jest": "29.1.4",
+    "ts-loader": "9.5.1",
+    "ts-node": "10.9.2",
+    "tsconfig-paths": "4.2.0",
+    "typescript": "5.9.2"
   },
   "prisma": {
     "schema": "../../../packages/prisma/schema.prisma"

apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts

@@ -125,7 +125,7 @@ export class BookingsController_2024_04_15 {
     private readonly instantBookingCreateService: InstantBookingCreateService,
     private readonly eventTypeRepository: PrismaEventTypeRepository,
     private readonly teamRepository: PrismaTeamRepository
-  ) {}
+  ) { }
 
   @Get("/")
   @UseGuards(ApiAuthGuard)
@@ -270,6 +270,7 @@ export class BookingsController_2024_04_15 {
         const res = await handleCancelBooking({
           bookingData: bookingRequest.body,
           userId: bookingRequest.userId,
+          userUuid: bookingRequest.userUuid,
           arePlatformEmailsEnabled: bookingRequest.arePlatformEmailsEnabled,
           platformClientId: bookingRequest.platformClientId,
           platformCancelUrl: bookingRequest.platformCancelUrl,
@@ -300,7 +301,7 @@ export class BookingsController_2024_04_15 {
   @Permissions([BOOKING_WRITE])
   @UseGuards(ApiAuthGuard)
   async markNoShow(
-    @GetUser("id") userId: number,
+    @GetUser() user: UserWithProfile,
     @Body() body: MarkNoShowInput_2024_04_15,
     @Param("bookingUid") bookingUid: string
   ): Promise<MarkNoShowOutput_2024_04_15> {
@@ -309,7 +310,8 @@ export class BookingsController_2024_04_15 {
         bookingUid: bookingUid,
         attendees: body.attendees,
         noShowHost: body.noShowHost,
-        userId,
+        userId: user.id,
+        userUuid: user.uuid,
       });
 
       return { status: SUCCESS_STATUS, data: markNoShowResponse };
@@ -378,7 +380,7 @@ export class BookingsController_2024_04_15 {
   ): Promise<ApiResponse<InstantBookingCreateResult>> {
     const oAuthClientId =
       clientId?.toString() || (await this.getOAuthClientIdFromEventType(body.eventTypeId));
-    req.userId = (await this.getOwnerId(req)) ?? -1;
+    req.userId = (await this.getOwner(req))?.id ?? -1;
     try {
       const bookingReq = await this.createNextApiBookingRequest(req, oAuthClientId, undefined, isEmbed);
       const instantMeeting = await this.instantBookingCreateService.createBooking({
@@ -405,30 +407,45 @@ export class BookingsController_2024_04_15 {
     throw new InternalServerErrorException("Could not create instant booking.");
   }
 
-  private async getOwnerId(req: Request): Promise<number | undefined> {
+  private async getOwner(req: Request): Promise<{ id: number; uuid: string } | null> {
     try {
       const bearerToken = req.get("Authorization")?.replace("Bearer ", "");
-      if (bearerToken) {
-        if (isApiKey(bearerToken, this.config.get<string>("api.apiKeyPrefix") ?? "cal_")) {
-          const strippedApiKey = stripApiKey(bearerToken, this.config.get<string>("api.keyPrefix"));
-          const apiKeyHash = sha256Hash(strippedApiKey);
-          const keyData = await this.apiKeyRepository.getApiKeyFromHash(apiKeyHash);
-          return keyData?.userId;
-        } else {
-          // Access Token
-          const ownerId = await this.oAuthFlowService.getOwnerId(bearerToken);
-          return ownerId;
-        }
+      if (!bearerToken) {
+        return null;
       }
+
+      let ownerId: number | null = null;
+
+      if (isApiKey(bearerToken, this.config.get<string>("api.apiKeyPrefix") ?? "cal_")) {
+        const strippedApiKey = stripApiKey(bearerToken, this.config.get<string>("api.keyPrefix"));
+        const apiKeyHash = sha256Hash(strippedApiKey);
+        const keyData = await this.apiKeyRepository.getApiKeyFromHash(apiKeyHash);
+        ownerId = keyData?.userId ?? null;
+      } else {
+        // Access Token
+        ownerId = await this.oAuthFlowService.getOwnerId(bearerToken);
+      }
+
+      if (!ownerId) {
+        return null;
+      }
+
+      const user = await this.usersRepository.findById(ownerId);
+      if (!user) {
+        return null;
+      }
+
+      return { id: user.id, uuid: user.uuid };
     } catch (err) {
       this.logger.error(err);
+      return null;
     }
   }
 
-  private async getOwnerIdRescheduledBooking(
+  private async getOwnerRescheduledBooking(
     request: Request,
     platformClientId?: string
-  ): Promise<number | undefined> {
+  ): Promise<{ id: number; uuid: string } | null> {
     if (
       platformClientId &&
       request.body.rescheduledBy &&
@@ -440,13 +457,15 @@ export class BookingsController_2024_04_15 {
       );
     }
 
-    if (request.body.rescheduledBy) {
-      if (request.body.rescheduledBy !== request.body.responses.email) {
-        return (await this.usersRepository.findByEmail(request.body.rescheduledBy))?.id;
+    if (request.body.rescheduledBy && request.body.rescheduledBy !== request.body.responses.email) {
+      const user = await this.usersRepository.findByEmail(request.body.rescheduledBy);
+      if (!user) {
+        return null;
       }
+      return { id: user.id, uuid: user.uuid };
     }
 
-    return undefined;
+    return null;
   }
 
   private async getOAuthClientIdFromEventType(eventTypeId: number): Promise<string | undefined> {
@@ -498,7 +517,8 @@ export class BookingsController_2024_04_15 {
       }
     }
 
-    const userId = await this.getOwnerId(req);
+    const owner = await this.getOwner(req);
+    const userId = owner?.id;
 
     if (!userId) {
       throw new UnauthorizedException(
@@ -561,12 +581,16 @@ export class BookingsController_2024_04_15 {
     oAuthClientId?: string,
     platformBookingLocation?: string,
     isEmbed?: string
-  ): Promise<NextApiRequest & { userId?: number } & OAuthRequestParams> {
+  ): Promise<NextApiRequest & { userId?: number; userUuid?: string } & OAuthRequestParams> {
     const requestId = req.get("X-Request-Id");
     const clone = { ...req };
-    const userId = clone.body.rescheduleUid
-      ? await this.getOwnerIdRescheduledBooking(req, oAuthClientId)
-      : await this.getOwnerId(req);
+    const owner = clone.body.rescheduleUid
+      ? await this.getOwnerRescheduledBooking(req, oAuthClientId)
+      : await this.getOwner(req);
+
+    const userId = owner?.id;
+    const userUuid = owner?.uuid;
+
     const oAuthParams = oAuthClientId
       ? await this.getOAuthClientsParams(oAuthClientId, this.transformToBoolean(isEmbed))
       : DEFAULT_PLATFORM_PARAMS;
@@ -577,7 +601,7 @@ export class BookingsController_2024_04_15 {
       oAuthClientId,
       ...oAuthParams,
     });
-    Object.assign(clone, { userId, ...oAuthParams, platformBookingLocation });
+    Object.assign(clone, { userId, userUuid, ...oAuthParams, platformBookingLocation });
     clone.body = {
       ...clone.body,
       noEmail: !oAuthParams.arePlatformEmailsEnabled,
@@ -586,7 +610,7 @@ export class BookingsController_2024_04_15 {
     if (oAuthClientId) {
       await this.setPlatformAttendeesEmails(clone.body, oAuthClientId);
     }
-    return clone as unknown as NextApiRequest & { userId?: number } & OAuthRequestParams;
+    return clone as unknown as NextApiRequest & { userId?: number; userUuid?: string } & OAuthRequestParams;
   }
 
   async setPlatformAttendeesEmails(
@@ -612,9 +636,12 @@ export class BookingsController_2024_04_15 {
     oAuthClientId?: string,
     platformBookingLocation?: string,
     isEmbed?: string
-  ): Promise<NextApiRequest & { userId?: number } & OAuthRequestParams> {
+  ): Promise<NextApiRequest & { userId?: number; userUuid?: string } & OAuthRequestParams> {
     const clone = { ...req };
-    const userId = (await this.getOwnerId(req)) ?? -1;
+    const owner = await this.getOwner(req);
+    const userId = owner?.id ?? -1;
+    const userUuid = owner?.uuid;
+
     const oAuthParams = oAuthClientId
       ? await this.getOAuthClientsParams(oAuthClientId, this.transformToBoolean(isEmbed))
       : DEFAULT_PLATFORM_PARAMS;
@@ -628,6 +655,7 @@ export class BookingsController_2024_04_15 {
     });
     Object.assign(clone, {
       userId,
+      userUuid,
       ...oAuthParams,
       platformBookingLocation,
       noEmail: !oAuthParams.arePlatformEmailsEnabled,
@@ -636,7 +664,7 @@ export class BookingsController_2024_04_15 {
     if (oAuthClientId) {
       await this.setPlatformAttendeesEmails(clone.body, oAuthClientId);
     }
-    return clone as unknown as NextApiRequest & { userId?: number } & OAuthRequestParams;
+    return clone as unknown as NextApiRequest & { userId?: number; userUuid?: string } & OAuthRequestParams;
   }
 
   private handleBookingErrors(

apps/api/v2/src/ee/bookings/2024-04-15/inputs/create-booking.input.ts

@@ -11,6 +11,7 @@ import {
   ValidateNested,
   isEmail,
   Validate,
+  IsInt,
 } from "class-validator";
 import { ValidationOptions, registerDecorator } from "class-validator";
 
@@ -26,7 +27,7 @@ function ValidateBookingName(validationOptions?: ValidationOptions) {
       propertyName: propertyName,
       options: validationOptions,
       validator: {
-        validate(value: any) {
+        validate(value: string | Record<string, string>): boolean {
           if (typeof value === "string") {
             return value.trim().length > 0;
           }
@@ -226,4 +227,16 @@ export class CreateBookingInput_2024_04_15 {
   @IsOptional()
   @ApiPropertyOptional()
   crmOwnerRecordType?: string;
+
+  /* @ApiPropertyOptional({
+    type: [Number],
+    description:
+      "For round robin event types, filter available hosts to only consider the specified subset of host user IDs. This allows you to book with specific hosts within a round robin event type.",
+    example: [1, 2, 3],
+  }) */
+  @ApiHideProperty()
+  @IsOptional()
+  @IsArray()
+  @IsInt({ each: true })
+  rrHostSubsetIds?: number[];
 }

apps/api/v2/src/ee/bookings/2024-08-13/bookings.module.ts

@@ -1,10 +1,14 @@
 import { BookingGuestsController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/booking-guests.controller";
+import { BookingLocationController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/booking-location.controller";
 import { BookingsController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/bookings.controller";
+import { BookingPbacGuard } from "@/ee/bookings/2024-08-13/guards/booking-pbac.guard";
 import { BookingReferencesRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/repositories/booking-references.repository";
 import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/repositories/bookings.repository";
 import { BookingGuestsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-guests.service";
+import { BookingLocationService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-location.service";
 import { BookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-references.service";
 import { BookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/bookings.service";
+import { CalVideoOutputService } from "@/ee/bookings/2024-08-13/services/cal-video.output.service";
 import { CalVideoService } from "@/ee/bookings/2024-08-13/services/cal-video.service";
 import { ErrorsBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/errors.service";
 import { InputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/input.service";
@@ -96,8 +100,15 @@ import { Module } from "@nestjs/common";
     BookingReferencesService_2024_08_13,
     BookingReferencesRepository_2024_08_13,
     CalVideoService,
+    CalVideoOutputService,
+    BookingPbacGuard,
+    BookingLocationService_2024_08_13,
+  ],
+  controllers: [
+    BookingsController_2024_08_13,
+    BookingGuestsController_2024_08_13,
+    BookingLocationController_2024_08_13,
   ],
-  controllers: [BookingsController_2024_08_13, BookingGuestsController_2024_08_13],
   exports: [InputBookingsService_2024_08_13, OutputBookingsService_2024_08_13, BookingsService_2024_08_13],
 })
 export class BookingsModule_2024_08_13 {}

apps/api/v2/src/ee/bookings/2024-08-13/controllers/booking-location.controller.ts

@@ -0,0 +1,57 @@
+import { BookingUidGuard } from "@/ee/bookings/2024-08-13/guards/booking-uid.guard";
+import { UpdateBookingLocationOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/update-location.output";
+import { BookingLocationService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-location.service";
+import { VERSION_2024_08_13_VALUE, VERSION_2024_08_13 } from "@/lib/api-versions";
+import { API_KEY_OR_ACCESS_TOKEN_HEADER } from "@/lib/docs/headers";
+import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
+import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
+import { Controller, Patch, Logger, Body, UseGuards, Param, HttpCode, HttpStatus } from "@nestjs/common";
+import { ApiOperation, ApiTags as DocsTags, ApiHeader } from "@nestjs/swagger";
+
+import { BOOKING_WRITE, SUCCESS_STATUS } from "@calcom/platform-constants";
+import { UpdateBookingLocationInput_2024_08_13 } from "@calcom/platform-types";
+
+@Controller({
+  path: "/v2/bookings/:bookingUid/location",
+  version: VERSION_2024_08_13_VALUE,
+})
+@UseGuards(PermissionsGuard)
+@DocsTags("Bookings")
+@ApiHeader({
+  name: "cal-api-version",
+  description: `Must be set to ${VERSION_2024_08_13}. This header is required as this endpoint does not exist in older API versions.`,
+  example: VERSION_2024_08_13,
+  required: true,
+})
+export class BookingLocationController_2024_08_13 {
+  private readonly logger = new Logger("BookingLocationController_2024_08_13");
+
+  constructor(private readonly bookingLocationService: BookingLocationService_2024_08_13) {}
+
+  @Patch("/")
+  @HttpCode(HttpStatus.OK)
+  @Permissions([BOOKING_WRITE])
+  @UseGuards(ApiAuthGuard, BookingUidGuard)
+  @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
+  @ApiOperation({
+    summary: "Update booking location for an existing booking",
+    description: `**Current Limitation:** Updating a booking location will update the location in Cal.com, but the corresponding Calendar event will not be updated automatically. The old location will persist in the Calendar event. This is a known limitation that will be addressed in a future update.
+    
+    <Note>The cal-api-version header is required for this endpoint. Without it, the request will fail with a 404 error.</Note>`,
+  })
+  async updateBookingLocation(
+    @Param("bookingUid") bookingUid: string,
+    @Body() body: UpdateBookingLocationInput_2024_08_13,
+    @GetUser() user: ApiAuthGuardUser
+  ): Promise<UpdateBookingLocationOutput_2024_08_13> {
+    const booking = await this.bookingLocationService.updateBookingLocation(bookingUid, body, user);
+
+    return {
+      status: SUCCESS_STATUS,
+      data: booking,
+    };
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/controllers/bookings.controller.ts

@@ -1,3 +1,4 @@
+import { BookingPbacGuard } from "@/ee/bookings/2024-08-13/guards/booking-pbac.guard";
 import { BookingUidGuard } from "@/ee/bookings/2024-08-13/guards/booking-uid.guard";
 import { BookingReferencesFilterInput_2024_08_13 } from "@/ee/bookings/2024-08-13/inputs/booking-references-filter.input";
 import { BookingReferencesOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/booking-references.output";
@@ -23,6 +24,7 @@ import {
   GetOptionalUser,
 } from "@/modules/auth/decorators/get-optional-user/get-optional-user.decorator";
 import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { Pbac } from "@/modules/auth/decorators/pbac/pbac.decorator";
 import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
 import { OptionalApiAuthGuard } from "@/modules/auth/guards/optional-api-auth/optional-api-auth.guard";
@@ -66,6 +68,7 @@ import {
   RescheduleSeatedBookingInput_2024_08_13,
   GetBookingRecordingsOutput,
   GetBookingTranscriptsOutput,
+  GetBookingVideoSessionsOutput,
 } from "@calcom/platform-types";
 import {
   CreateBookingInputPipe,
@@ -209,12 +212,16 @@ export class BookingsController_2024_08_13 {
   }
 
   @Get("/:bookingUid/recordings")
+  // @Pbac(["booking.readRecordings"])
+  @Permissions([BOOKING_READ])
   @UseGuards(BookingUidGuard)
+  // @UseGuards(ApiAuthGuard, BookingUidGuard, BookingPbacGuard)
+  @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @ApiOperation({
     summary: "Get all the recordings for the booking",
-    description: `Fetches all the recordings for the booking \`:bookingUid\`
+    description: `Fetches all the recordings for the booking \`:bookingUid\`. Requires authentication and proper authorization. Access is granted if you are the booking organizer, team admin or org admin/owner.
 
-    <Note>Please make sure to pass in the cal-api-version header value as mentioned in the Headers section. Not passing the correct value will default to an older version of this endpoint.</Note>
+    <Note>cal-api-version: \`2024-08-13\` is required in the request header.</Note>
     `,
   })
   async getBookingRecordings(@Param("bookingUid") bookingUid: string): Promise<GetBookingRecordingsOutput> {
@@ -223,11 +230,17 @@ export class BookingsController_2024_08_13 {
     return {
       status: SUCCESS_STATUS,
       data: recordings,
+      message:
+        "This endpoint will require authentication in a future release. Please update your integration to include valid credentials. See https://cal.com/docs/api-reference/v2/introduction#authentication for details.",
     };
   }
 
   @Get("/:bookingUid/transcripts")
+  // @Pbac(["booking.readRecordings"])
+  @Permissions([BOOKING_READ])
   @UseGuards(BookingUidGuard)
+  // @UseGuards(ApiAuthGuard, BookingUidGuard, BookingPbacGuard)
+  @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
   @ApiOperation({
     summary: "Get Cal Video real time transcript download links for the booking",
     description: `Fetches all the transcript download links for the booking \`:bookingUid\`
@@ -245,6 +258,8 @@ export class BookingsController_2024_08_13 {
     return {
       status: SUCCESS_STATUS,
       data: transcripts ?? [],
+      message:
+        "This endpoint will require authentication in a future release. Please update your integration to include valid credentials. See https://cal.com/docs/api-reference/v2/introduction#authentication for details.",
     };
   }
 
@@ -382,18 +397,18 @@ export class BookingsController_2024_08_13 {
     <Note>Please make sure to pass in the cal-api-version header value as mentioned in the Headers section. Not passing the correct value will default to an older version of this endpoint.</Note>
     `,
   })
-  async markNoShow(
-    @Param("bookingUid") bookingUid: string,
-    @Body() body: MarkAbsentBookingInput_2024_08_13,
-    @GetUser("id") ownerId: number
-  ): Promise<MarkAbsentBookingOutput_2024_08_13> {
-    const booking = await this.bookingsService.markAbsent(bookingUid, ownerId, body);
+    async markNoShow(
+      @Param("bookingUid") bookingUid: string,
+      @Body() body: MarkAbsentBookingInput_2024_08_13,
+      @GetUser() user: ApiAuthGuardUser
+    ): Promise<MarkAbsentBookingOutput_2024_08_13> {
+      const booking = await this.bookingsService.markAbsent(bookingUid, user.id, body, user.uuid);
 
-    return {
-      status: SUCCESS_STATUS,
-      data: booking,
-    };
-  }
+      return {
+        status: SUCCESS_STATUS,
+        data: booking,
+      };
+    }
 
   @Post("/:bookingUid/reassign")
   @HttpCode(HttpStatus.OK)
@@ -546,4 +561,25 @@ export class BookingsController_2024_08_13 {
       data: bookingReferences,
     };
   }
+
+  @Get("/:bookingUid/conferencing-sessions")
+  @HttpCode(HttpStatus.OK)
+  @Pbac(["booking.readRecordings"])
+  @Permissions([BOOKING_READ])
+  @UseGuards(ApiAuthGuard, BookingUidGuard, BookingPbacGuard)
+  @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
+  @ApiOperation({
+    summary: "Get Video Meeting Sessions. Only supported for Cal Video",
+    description: `Requires authentication and proper authorization. Access is granted if you are the booking organizer, team admin or org admin/owner.
+
+    <Note>cal-api-version: \`2024-08-13\` is required in the request header.</Note>`,
+  })
+  async getVideoSessions(@Param("bookingUid") bookingUid: string): Promise<GetBookingVideoSessionsOutput> {
+    const sessions = await this.calVideoService.getVideoSessions(bookingUid);
+
+    return {
+      status: SUCCESS_STATUS,
+      data: sessions,
+    };
+  }
 }

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/booking-access-auth.e2e-spec.ts

@@ -0,0 +1,245 @@
+import { bootstrap } from "@/app";
+import { AppModule } from "@/app.module";
+import { CalVideoService } from "@/ee/bookings/2024-08-13/services/cal-video.service";
+import { CreateScheduleInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-schedule.input";
+import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
+import { SchedulesService_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/services/schedules.service";
+import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { UsersModule } from "@/modules/users/users.module";
+import { INestApplication } from "@nestjs/common";
+import { NestExpressApplication } from "@nestjs/platform-express";
+import { Test } from "@nestjs/testing";
+import * as request from "supertest";
+import { ApiKeysRepositoryFixture } from "test/fixtures/repository/api-keys.repository.fixture";
+import { BookingsRepositoryFixture } from "test/fixtures/repository/bookings.repository.fixture";
+import { EventTypesRepositoryFixture } from "test/fixtures/repository/event-types.repository.fixture";
+import { OAuthClientRepositoryFixture } from "test/fixtures/repository/oauth-client.repository.fixture";
+import { OrganizationRepositoryFixture } from "test/fixtures/repository/organization.repository.fixture";
+import { TeamRepositoryFixture } from "test/fixtures/repository/team.repository.fixture";
+import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
+import { randomString } from "test/utils/randomString";
+
+import { CAL_API_VERSION_HEADER, SUCCESS_STATUS, VERSION_2024_08_13 } from "@calcom/platform-constants";
+import type { Booking, User, PlatformOAuthClient, Team } from "@calcom/prisma/client";
+
+describe("Bookings Endpoints 2024-08-13", () => {
+  describe("Booking access authorization", () => {
+    let app: INestApplication;
+    let organization: Team;
+
+    let userRepositoryFixture: UserRepositoryFixture;
+    let bookingsRepositoryFixture: BookingsRepositoryFixture;
+    let eventTypesRepositoryFixture: EventTypesRepositoryFixture;
+    let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
+    let organizationsRepositoryFixture: OrganizationRepositoryFixture;
+    let teamRepositoryFixture: TeamRepositoryFixture;
+    let apiKeysRepositoryFixture: ApiKeysRepositoryFixture;
+    let schedulesService: SchedulesService_2024_04_15;
+    let oAuthClient: PlatformOAuthClient;
+
+    const ownerEmail = `booking-access-auth-owner-${randomString()}@api.com`;
+    const unauthorizedEmail = `booking-access-auth-unauthorized-${randomString()}@api.com`;
+    let ownerUser: User;
+    let unauthorizedUser: User;
+    let ownerApiKey: string;
+    let unauthorizedApiKey: string;
+
+    let eventTypeId: number;
+    let testBooking: Booking;
+
+    beforeAll(async () => {
+      const moduleRef = await Test.createTestingModule({
+        imports: [AppModule, PrismaModule, UsersModule, SchedulesModule_2024_04_15],
+      })
+        .overrideGuard(PermissionsGuard)
+        .useValue({
+          canActivate: () => true,
+        })
+        .compile();
+
+      userRepositoryFixture = new UserRepositoryFixture(moduleRef);
+      bookingsRepositoryFixture = new BookingsRepositoryFixture(moduleRef);
+      eventTypesRepositoryFixture = new EventTypesRepositoryFixture(moduleRef);
+      oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
+      organizationsRepositoryFixture = new OrganizationRepositoryFixture(moduleRef);
+      teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
+      apiKeysRepositoryFixture = new ApiKeysRepositoryFixture(moduleRef);
+      schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
+
+      organization = await organizationsRepositoryFixture.create({
+        name: `booking-access-auth-organization-${randomString()}`,
+      });
+      oAuthClient = await createOAuthClient(organization.id);
+
+      ownerUser = await userRepositoryFixture.create({
+        email: ownerEmail,
+        locale: "en",
+        name: `booking-access-auth-owner-${randomString()}`,
+      });
+
+      unauthorizedUser = await userRepositoryFixture.create({
+        email: unauthorizedEmail,
+        locale: "en",
+        name: `booking-access-auth-unauthorized-${randomString()}`,
+      });
+
+      const { keyString: ownerKeyString } = await apiKeysRepositoryFixture.createApiKey(ownerUser.id, null);
+      ownerApiKey = `cal_test_${ownerKeyString}`;
+
+      const { keyString: unauthorizedKeyString } = await apiKeysRepositoryFixture.createApiKey(
+        unauthorizedUser.id,
+        null
+      );
+      unauthorizedApiKey = `cal_test_${unauthorizedKeyString}`;
+
+      const userSchedule: CreateScheduleInput_2024_04_15 = {
+        name: `booking-access-auth-schedule-${randomString()}`,
+        timeZone: "Europe/Rome",
+        isDefault: true,
+      };
+      await schedulesService.createUserSchedule(ownerUser.id, userSchedule);
+
+      const eventType = await eventTypesRepositoryFixture.create(
+        {
+          title: `booking-access-auth-event-type-${randomString()}`,
+          slug: `booking-access-auth-event-type-${randomString()}`,
+          length: 60,
+        },
+        ownerUser.id
+      );
+      eventTypeId = eventType.id;
+
+      testBooking = await bookingsRepositoryFixture.create({
+        uid: `booking-access-auth-booking-${randomString()}`,
+        title: "Test Booking for Access Auth",
+        description: "",
+        startTime: new Date(Date.UTC(2030, 0, 8, 10, 0, 0)),
+        endTime: new Date(Date.UTC(2030, 0, 8, 11, 0, 0)),
+        eventType: {
+          connect: {
+            id: eventTypeId,
+          },
+        },
+        user: {
+          connect: {
+            id: ownerUser.id,
+          },
+        },
+        metadata: {},
+        responses: {
+          name: "Test Attendee",
+          email: "attendee@example.com",
+        },
+        references: {
+          create: [
+            {
+              type: "daily_video",
+              uid: `daily-room-${randomString()}`,
+              meetingId: `daily-room-${randomString()}`,
+              meetingPassword: "test-password",
+              meetingUrl: `https://daily.co/test-room-${randomString()}`,
+            },
+          ],
+        },
+      });
+
+      app = moduleRef.createNestApplication();
+      bootstrap(app as NestExpressApplication);
+
+      await app.init();
+    });
+
+    async function createOAuthClient(organizationId: number) {
+      const data = {
+        logo: "logo-url",
+        name: "name",
+        redirectUris: ["http://localhost:5555"],
+        permissions: 32,
+      };
+      const secret = "secret";
+
+      const client = await oauthClientRepositoryFixture.create(organizationId, data, secret);
+      return client;
+    }
+
+    describe("GET /v2/bookings/:bookingUid/conferencing-sessions - Authorization", () => {
+      it("should allow booking organizer to access conferencing sessions", async () => {
+        const calVideoService = app.get(CalVideoService);
+        jest.spyOn(calVideoService, "getVideoSessions").mockResolvedValue([]);
+
+        const response = await request(app.getHttpServer())
+          .get(`/v2/bookings/${testBooking.uid}/conferencing-sessions`)
+          .set("Authorization", `Bearer ${ownerApiKey}`)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(200);
+
+        expect(response.body.status).toEqual(SUCCESS_STATUS);
+      });
+
+      it("should return 403 when unauthorized user tries to access conferencing sessions", async () => {
+        await request(app.getHttpServer())
+          .get(`/v2/bookings/${testBooking.uid}/conferencing-sessions`)
+          .set("Authorization", `Bearer ${unauthorizedApiKey}`)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(403);
+      });
+    });
+
+    // describe("GET /v2/bookings/:bookingUid/recordings - Authorization", () => {
+    //   it("should allow booking organizer to access recordings", async () => {
+    //     const calVideoService = app.get(CalVideoService);
+    //     jest.spyOn(calVideoService, "getRecordings").mockResolvedValue([]);
+
+    //     const response = await request(app.getHttpServer())
+    //       .get(`/v2/bookings/${testBooking.uid}/recordings`)
+    //       .set("Authorization", `Bearer ${ownerApiKey}`)
+    //       .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+    //       .expect(200);
+
+    //     expect(response.body.status).toEqual(SUCCESS_STATUS);
+    //   });
+
+    //   it("should return 403 when unauthorized user tries to access recordings", async () => {
+    //     await request(app.getHttpServer())
+    //       .get(`/v2/bookings/${testBooking.uid}/recordings`)
+    //       .set("Authorization", `Bearer ${unauthorizedApiKey}`)
+    //       .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+    //       .expect(403);
+    //   });
+    // });
+
+    // describe("GET /v2/bookings/:bookingUid/transcripts - Authorization", () => {
+    //   it("should allow booking organizer to access transcripts", async () => {
+    //     const calVideoService = app.get(CalVideoService);
+    //     jest.spyOn(calVideoService, "getTranscripts").mockResolvedValue([]);
+
+    //     const response = await request(app.getHttpServer())
+    //       .get(`/v2/bookings/${testBooking.uid}/transcripts`)
+    //       .set("Authorization", `Bearer ${ownerApiKey}`)
+    //       .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+    //       .expect(200);
+
+    //     expect(response.body.status).toEqual(SUCCESS_STATUS);
+    //   });
+
+    //   it("should return 403 when unauthorized user tries to access transcripts", async () => {
+    //     await request(app.getHttpServer())
+    //       .get(`/v2/bookings/${testBooking.uid}/transcripts`)
+    //       .set("Authorization", `Bearer ${unauthorizedApiKey}`)
+    //       .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+    //       .expect(403);
+    //   });
+    // });
+
+    afterAll(async () => {
+      await bookingsRepositoryFixture.deleteById(testBooking.id);
+      await eventTypesRepositoryFixture.delete(eventTypeId);
+      await userRepositoryFixture.deleteByEmail(ownerEmail);
+      await userRepositoryFixture.deleteByEmail(unauthorizedEmail);
+      await oauthClientRepositoryFixture.delete(oAuthClient.id);
+      await teamRepositoryFixture.delete(organization.id);
+      await app.close();
+    });
+  });
+});

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/emails/confirm-emails.e2e-spec.ts

@@ -16,9 +16,9 @@ import { BookingsRepositoryFixture } from "test/fixtures/repository/bookings.rep
 import { EventTypesRepositoryFixture } from "test/fixtures/repository/event-types.repository.fixture";
 import { OAuthClientRepositoryFixture } from "test/fixtures/repository/oauth-client.repository.fixture";
 import { TeamRepositoryFixture } from "test/fixtures/repository/team.repository.fixture";
+import { TokensRepositoryFixture } from "test/fixtures/repository/tokens.repository.fixture";
 import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
 import { randomString } from "test/utils/randomString";
-import { withApiAuth } from "test/utils/withApiAuth";
 
 import { CAL_API_VERSION_HEADER, SUCCESS_STATUS, VERSION_2024_08_13 } from "@calcom/platform-constants";
 import {
@@ -73,6 +73,7 @@ type EmailSetup = {
   eventTypeId: number;
   createdBookingUid: string;
   rescheduledBookingUid: string;
+  accessToken: string;
 };
 
 describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
@@ -85,6 +86,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
   let eventTypesRepositoryFixture: EventTypesRepositoryFixture;
   let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
   let teamRepositoryFixture: TeamRepositoryFixture;
+  let tokensRepositoryFixture: TokensRepositoryFixture;
 
   let emailsEnabledSetup: EmailSetup;
   let emailsDisabledSetup: EmailSetup;
@@ -94,12 +96,9 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
   const userEmailsDisabled = `confirm-emails-2024-08-13-user-${randomString()}@api.com`;
 
   beforeAll(async () => {
-    const moduleRef = await withApiAuth(
-      authEmail,
-      Test.createTestingModule({
-        imports: [AppModule, PrismaModule, UsersModule, SchedulesModule_2024_04_15],
-      })
-    )
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule, PrismaModule, UsersModule, SchedulesModule_2024_04_15],
+    })
       .overrideGuard(PermissionsGuard)
       .useValue({
         canActivate: () => true,
@@ -112,6 +111,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
     oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
     teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
     schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
+    tokensRepositoryFixture = new TokensRepositoryFixture(moduleRef);
 
     organization = await teamRepositoryFixture.create({
       name: `confirm-emails-2024-08-13-organization-${randomString()}`,
@@ -152,6 +152,8 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
       },
     });
 
+    const tokens = await tokensRepositoryFixture.createTokens(user.id, oAuthClientEmailsEnabled.id);
+
     const userSchedule: CreateScheduleInput_2024_04_15 = {
       name: `confirm-emails-2024-08-13-schedule-${randomString()}`,
       timeZone: "Europe/Rome",
@@ -174,6 +176,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
       eventTypeId: event.id,
       createdBookingUid: "",
       rescheduledBookingUid: "",
+      accessToken: tokens.accessToken,
     };
   }
 
@@ -188,6 +191,8 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
         },
       },
     });
+    const tokens = await tokensRepositoryFixture.createTokens(user.id, oAuthClientEmailsDisabled.id);
+
     const userSchedule: CreateScheduleInput_2024_04_15 = {
       name: `confirm-emails-2024-08-13-schedule-${randomString()}`,
       timeZone: "Europe/Rome",
@@ -209,6 +214,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
       eventTypeId: event.id,
       createdBookingUid: "",
       rescheduledBookingUid: "",
+      accessToken: tokens.accessToken,
     };
   }
 
@@ -277,6 +283,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
       return request(app.getHttpServer())
         .post(`/v2/bookings/${emailsDisabledSetup.createdBookingUid}/confirm`)
         .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .set("Authorization", `Bearer ${emailsDisabledSetup.accessToken}`)
         .expect(200)
         .then(async (response) => {
           const responseBody: GetBookingOutput_2024_08_13 = response.body;
@@ -331,6 +338,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
       return request(app.getHttpServer())
         .post(`/v2/bookings/${emailsDisabledSetup.createdBookingUid}/decline`)
         .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .set("Authorization", `Bearer ${emailsDisabledSetup.accessToken}`)
         .expect(200)
         .then(async (response) => {
           const responseBody: GetBookingOutput_2024_08_13 = response.body;
@@ -391,6 +399,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
         return request(app.getHttpServer())
           .post(`/v2/bookings/${emailsEnabledSetup.createdBookingUid}/confirm`)
           .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${emailsEnabledSetup.accessToken}`)
           .expect(200)
           .then(async (response) => {
             const responseBody: GetBookingOutput_2024_08_13 = response.body;
@@ -508,6 +517,7 @@ describe("Bookings Endpoints 2024-08-13 confirm emails", () => {
         return request(app.getHttpServer())
           .post(`/v2/bookings/${emailsEnabledSetup.createdBookingUid}/decline`)
           .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${emailsEnabledSetup.accessToken}`)
           .expect(200)
           .then(async (response) => {
             const responseBody: GetBookingOutput_2024_08_13 = response.body;

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/team-bookings.e2e-spec.ts

@@ -64,12 +64,14 @@ describe("Bookings Endpoints 2024-08-13", () => {
 
     let team1EventTypeId: number;
     let team2EventTypeId: number;
+    let team2RREventTypeId: number;
     let phoneOnlyEventTypeId: number;
     let collectiveEventWithoutHostsId: number;
     let roundRobinEventWithoutHostsId: number;
 
     const team1EventTypeSlug = `team-bookings-event-type-${randomString()}`;
     const team2EventTypeSlug = `team-bookings-event-type-${randomString()}`;
+    const team2RREventTypeSlug = `team-bookings-rr-event-type-${randomString()}`;
     const phoneOnlyEventTypeSlug = `team-bookings-event-type-${randomString()}`;
 
     let phoneBasedBooking: BookingOutput_2024_08_13;
@@ -339,6 +341,50 @@ describe("Bookings Endpoints 2024-08-13", () => {
 
       team2EventTypeId = team2EventType.id;
 
+      const team2RREventType = await eventTypesRepositoryFixture.createTeamEventType({
+        schedulingType: "ROUND_ROBIN",
+        team: {
+          connect: { id: team2.id },
+        },
+        title: `team-bookings-2024-08-13-event-type-rr-${randomString()}`,
+        slug: team2RREventTypeSlug,
+        length: 60,
+        assignAllTeamMembers: true,
+        bookingFields: [],
+        locations: [],
+        rrHostSubsetEnabled: true,
+      });
+
+      team2RREventTypeId = team2RREventType.id;
+
+      await hostsRepositoryFixture.create({
+        isFixed: false,
+        user: {
+          connect: {
+            id: teamUser2.id,
+          },
+        },
+        eventType: {
+          connect: {
+            id: team2RREventType.id,
+          },
+        },
+      });
+
+      await hostsRepositoryFixture.create({
+        isFixed: true,
+        user: {
+          connect: {
+            id: teamUser.id,
+          },
+        },
+        eventType: {
+          connect: {
+            id: team2RREventType.id,
+          },
+        },
+      });
+
       await hostsRepositoryFixture.create({
         isFixed: true,
         user: {
@@ -603,6 +649,163 @@ describe("Bookings Endpoints 2024-08-13", () => {
             }
           });
       });
+
+      it("should create a team 2 RR booking and use rrHostSubsetIds to force teamUser2 as host ", async () => {
+        const body: CreateBookingInput_2024_08_13 = {
+          start: new Date(Date.UTC(2030, 0, 8, 12, 0, 0)).toISOString(),
+          eventTypeId: team2RREventTypeId,
+          attendee: {
+            name: "bob2",
+            email: "bob2@gmail.com",
+            timeZone: "Europe/Rome",
+            language: "it",
+          },
+          meetingUrl: "https://meet.google.com/abc-def-ghi",
+          rrHostSubsetIds: [teamUser2.id],
+        };
+
+        return request(app.getHttpServer())
+          .post("/v2/bookings")
+          .send(body)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(201)
+          .then(async (response) => {
+            const responseBody: CreateBookingOutput_2024_08_13 = response.body;
+            expect(responseBody.status).toEqual(SUCCESS_STATUS);
+            expect(responseBody.data).toBeDefined();
+            expect(responseDataIsBooking(responseBody.data)).toBe(true);
+
+            if (responseDataIsBooking(responseBody.data)) {
+              const data: BookingOutput_2024_08_13 = responseBody.data;
+              expect(data.id).toBeDefined();
+              expect(data.uid).toBeDefined();
+              expect(data.hosts.length).toEqual(1);
+              expect(data.hosts[0].id).toEqual(teamUser2.id);
+              expect(data.status).toEqual("accepted");
+              expect(data.start).toEqual(body.start);
+              expect(data.end).toEqual(new Date(Date.UTC(2030, 0, 8, 13, 0, 0)).toISOString());
+              expect(data.duration).toEqual(60);
+              expect(data.eventTypeId).toEqual(team2RREventTypeId);
+              expect(data.attendees.length).toEqual(1);
+              expect(data.attendees[0]).toEqual({
+                name: body.attendee.name,
+                email: body.attendee.email,
+                timeZone: body.attendee.timeZone,
+                language: body.attendee.language,
+                absent: false,
+              });
+              expect(data.meetingUrl).toEqual(body.meetingUrl);
+              expect(data.absentHost).toEqual(false);
+            } else {
+              throw new Error(
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
+              );
+            }
+          });
+      });
+
+      it("should create a team 2 RR booking and use rrHostSubsetIds to force teamUser as host ", async () => {
+        const body: CreateBookingInput_2024_08_13 = {
+          start: new Date(Date.UTC(2030, 0, 8, 12, 0, 0)).toISOString(),
+          eventTypeId: team2RREventTypeId,
+          attendee: {
+            name: "bob",
+            email: "bob@gmail.com",
+            timeZone: "Europe/Rome",
+            language: "it",
+          },
+          meetingUrl: "https://meet.google.com/abc-def-ghi",
+          rrHostSubsetIds: [teamUser.id],
+        };
+
+        return request(app.getHttpServer())
+          .post("/v2/bookings")
+          .send(body)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(201)
+          .then(async (response) => {
+            const responseBody: CreateBookingOutput_2024_08_13 = response.body;
+            expect(responseBody.status).toEqual(SUCCESS_STATUS);
+            expect(responseBody.data).toBeDefined();
+            expect(responseDataIsBooking(responseBody.data)).toBe(true);
+
+            if (responseDataIsBooking(responseBody.data)) {
+              const data: BookingOutput_2024_08_13 = responseBody.data;
+              expect(data.id).toBeDefined();
+              expect(data.uid).toBeDefined();
+              expect(data.hosts.length).toEqual(1);
+              expect(data.hosts[0].id).toEqual(teamUser.id);
+              expect(data.status).toEqual("accepted");
+              expect(data.start).toEqual(body.start);
+              expect(data.end).toEqual(new Date(Date.UTC(2030, 0, 8, 13, 0, 0)).toISOString());
+              expect(data.duration).toEqual(60);
+              expect(data.eventTypeId).toEqual(team2RREventTypeId);
+              expect(data.attendees.length).toEqual(1);
+              expect(data.attendees[0]).toEqual({
+                name: body.attendee.name,
+                email: body.attendee.email,
+                timeZone: body.attendee.timeZone,
+                language: body.attendee.language,
+                absent: false,
+              });
+              expect(data.meetingUrl).toEqual(body.meetingUrl);
+              expect(data.absentHost).toEqual(false);
+            } else {
+              throw new Error(
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
+              );
+            }
+          });
+      });
+
+      it("should create a team 2 RR booking and use rrHostSubsetIds to force teamUser and teamUser2 as host ", async () => {
+        const body: CreateBookingInput_2024_08_13 = {
+          start: new Date(Date.UTC(2030, 0, 8, 14, 0, 0)).toISOString(),
+          eventTypeId: team2RREventTypeId,
+          attendee: {
+            name: "bob",
+            email: "bob@gmail.com",
+            timeZone: "Europe/Rome",
+            language: "it",
+          },
+          meetingUrl: "https://meet.google.com/abc-def-ghi",
+          rrHostSubsetIds: [teamUser.id, teamUser2.id],
+        };
+
+        return request(app.getHttpServer())
+          .post("/v2/bookings")
+          .send(body)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(201)
+          .then(async (response) => {
+            const responseBody: CreateBookingOutput_2024_08_13 = response.body;
+            expect(responseBody.status).toEqual(SUCCESS_STATUS);
+            expect(responseBody.data).toBeDefined();
+            expect(responseDataIsBooking(responseBody.data)).toBe(true);
+
+            if (responseDataIsBooking(responseBody.data)) {
+              const data: BookingOutput_2024_08_13 = responseBody.data;
+              expect(data.id).toBeDefined();
+              expect(data.uid).toBeDefined();
+              expect(data.hosts.length).toEqual(1);
+              expect(data.hosts[0].id).toEqual(teamUser.id);
+              expect(data.status).toEqual("accepted");
+              expect(data.start).toEqual(body.start);
+              expect(data.end).toEqual(new Date(Date.UTC(2030, 0, 8, 15, 0, 0)).toISOString());
+              expect(data.duration).toEqual(60);
+              expect(data.eventTypeId).toEqual(team2RREventTypeId);
+              expect(data.attendees.length).toEqual(2);
+              expect(data.attendees.find((a) => a.email === body.attendee.email)).toBeDefined();
+              expect(data.attendees.find((a) => a.email === teamUser2.email)).toBeDefined();
+              expect(data.meetingUrl).toEqual(body.meetingUrl);
+              expect(data.absentHost).toEqual(false);
+            } else {
+              throw new Error(
+                "Invalid response data - expected booking but received array of possibly recurring bookings"
+              );
+            }
+          });
+      });
     });
 
     describe("get team bookings", () => {
@@ -639,7 +842,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               | RecurringBookingOutput_2024_08_13
               | GetSeatedBookingOutput_2024_08_13
             )[] = responseBody.data;
-            expect(data.length).toEqual(1);
+            expect(data.length).toEqual(3);
             expect(data[0].eventTypeId).toEqual(team2EventTypeId);
           });
       });
@@ -684,7 +887,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               | RecurringBookingOutput_2024_08_13
               | GetSeatedBookingOutput_2024_08_13
             )[] = responseBody.data;
-            expect(data.length).toEqual(3);
+            expect(data.length).toEqual(5);
             expect(data.find((booking) => booking.eventTypeId === team1EventTypeId)).toBeDefined();
             expect(data.find((booking) => booking.eventTypeId === team2EventTypeId)).toBeDefined();
           });
@@ -845,6 +1048,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
       await userRepositoryFixture.deleteByEmail(teamUser.email);
       await userRepositoryFixture.deleteByEmail(teamUserEmail2);
       await bookingsRepositoryFixture.deleteAllBookings(teamUser.id, teamUser.email);
+      await bookingsRepositoryFixture.deleteAllBookings(teamUser2.id, teamUser2.email);
       await app.close();
     });
   });

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/update-booking-location.e2e-spec.ts

@@ -0,0 +1,492 @@
+import { bootstrap } from "@/app";
+import { AppModule } from "@/app.module";
+import { UpdateBookingLocationOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/update-location.output";
+import { CreateScheduleInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-schedule.input";
+import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
+import { SchedulesService_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/services/schedules.service";
+import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { UsersModule } from "@/modules/users/users.module";
+import { INestApplication } from "@nestjs/common";
+import { NestExpressApplication } from "@nestjs/platform-express";
+import { Test } from "@nestjs/testing";
+import * as request from "supertest";
+import { BookingsRepositoryFixture } from "test/fixtures/repository/bookings.repository.fixture";
+import { EventTypesRepositoryFixture } from "test/fixtures/repository/event-types.repository.fixture";
+import { OAuthClientRepositoryFixture } from "test/fixtures/repository/oauth-client.repository.fixture";
+import { TeamRepositoryFixture } from "test/fixtures/repository/team.repository.fixture";
+import { TokensRepositoryFixture } from "test/fixtures/repository/tokens.repository.fixture";
+import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
+import { randomString } from "test/utils/randomString";
+
+import {
+  CAL_API_VERSION_HEADER,
+  ERROR_STATUS,
+  SUCCESS_STATUS,
+  VERSION_2024_08_13,
+} from "@calcom/platform-constants";
+import { UpdateBookingLocationInput_2024_08_13 } from "@calcom/platform-types";
+import type { BookingOutput_2024_08_13 } from "@calcom/platform-types";
+import { Booking } from "@calcom/prisma/client";
+import type { Team } from "@calcom/prisma/client";
+
+type TestUser = {
+  id: number;
+  accessToken: string;
+  refreshToken: string;
+  email: string;
+};
+
+type TestSetup = {
+  organizer: TestUser;
+  unrelatedUser: TestUser;
+  eventTypeId: number;
+};
+
+describe("Bookings Endpoints 2024-08-13 update booking location", () => {
+  let app: INestApplication;
+  let organization: Team;
+
+  let userRepositoryFixture: UserRepositoryFixture;
+  let bookingsRepositoryFixture: BookingsRepositoryFixture;
+  let schedulesService: SchedulesService_2024_04_15;
+  let eventTypesRepositoryFixture: EventTypesRepositoryFixture;
+  let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
+  let teamRepositoryFixture: TeamRepositoryFixture;
+  let tokensRepositoryFixture: TokensRepositoryFixture;
+
+  let testSetup: TestSetup;
+
+  beforeAll(async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule, PrismaModule, UsersModule, SchedulesModule_2024_04_15],
+    })
+      .overrideGuard(PermissionsGuard)
+      .useValue({
+        canActivate: () => true,
+      })
+      .compile();
+
+    userRepositoryFixture = new UserRepositoryFixture(moduleRef);
+    bookingsRepositoryFixture = new BookingsRepositoryFixture(moduleRef);
+    eventTypesRepositoryFixture = new EventTypesRepositoryFixture(moduleRef);
+    oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
+    teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
+    schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
+    tokensRepositoryFixture = new TokensRepositoryFixture(moduleRef);
+
+    organization = await teamRepositoryFixture.create({
+      name: `update-booking-location-organization-${randomString()}`,
+    });
+
+    await setupTestData();
+
+    app = moduleRef.createNestApplication();
+    bootstrap(app as NestExpressApplication);
+
+    await app.init();
+  });
+
+  describe("PATCH /v2/bookings/:bookingUid/location", () => {
+    it("should return 401 when updating location without authentication", async () => {
+      const { bookingUid } = await createBooking();
+
+      await request(app.getHttpServer())
+        .patch(`/v2/bookings/${bookingUid}/location`)
+        .send({ location: "https://unauthenticated.example.com" })
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .expect(401);
+    });
+
+    describe("can update booking with different locations", () => {
+      const address = "123 Main St";
+      const link = "https://cal.com/join/123456";
+      const phone = "+37121999999";
+
+      let booking: Booking;
+      let bookingId: number;
+      let bookingUid: string;
+      let eventTypeWithAllLocationsId: number;
+
+      beforeAll(async () => {
+        const createdEventType = await eventTypesRepositoryFixture.create(
+          {
+            title: "book using any location",
+            slug: `book-using-any-location-${randomString()}`,
+            length: 15,
+            locations: [
+              { type: "integrations:daily" },
+              { type: "inPerson", address: "123 Main St", displayLocationPublicly: true },
+              { type: "link", link: "https://cal.com/join/123456", displayLocationPublicly: true },
+              { type: "userPhone", hostPhoneNumber: "+37121999999", displayLocationPublicly: true },
+              { type: "attendeeInPerson" },
+              { type: "phone" },
+              { type: "somewhereElse" },
+            ],
+          },
+          testSetup.organizer.id
+        );
+
+        eventTypeWithAllLocationsId = createdEventType.id;
+
+        booking = await bookingsRepositoryFixture.create({
+          uid: `booking-uid-${randomString(10)}`,
+          title: "booking title",
+          startTime: "2048-08-14T09:00:00.000Z",
+          endTime: "2048-08-14T10:00:00.000Z",
+          eventType: {
+            connect: {
+              id: eventTypeWithAllLocationsId,
+            },
+          },
+          status: "ACCEPTED",
+          metadata: {},
+          responses: "null",
+          user: {
+            connect: {
+              id: testSetup.organizer.id,
+            },
+          },
+        });
+        bookingUid = booking.uid;
+        bookingId = booking.id;
+      });
+
+      it("can update location to type address", async () => {
+        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {
+          location: {
+            type: "address",
+            address: address,
+          },
+        };
+
+        const updatedBookingResponse = await request(app.getHttpServer())
+          .patch(`/v2/bookings/${bookingUid}/location`)
+          .send(updatedBookingBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(200);
+
+        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =
+          updatedBookingResponse.body;
+        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);
+        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {
+          throw new Error(
+            "Invalid response data - expected booking but received array of possibly recurring bookings"
+          );
+        }
+        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;
+        expect(updatedBooking).toHaveProperty("id");
+        expect(updatedBooking.location).toEqual(address);
+      });
+
+      it("can update location to type link", async () => {
+        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {
+          location: {
+            type: "link",
+            link: link,
+          },
+        };
+
+        const updatedBookingResponse = await request(app.getHttpServer())
+          .patch(`/v2/bookings/${bookingUid}/location`)
+          .send(updatedBookingBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(200);
+
+        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =
+          updatedBookingResponse.body;
+        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);
+        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {
+          throw new Error(
+            "Invalid response data - expected booking but received array of possibly recurring bookings"
+          );
+        }
+        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;
+        expect(updatedBooking).toHaveProperty("id");
+        expect(updatedBooking.location).toEqual(link);
+      });
+
+      it("can update location to type phone", async () => {
+        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {
+          location: {
+            type: "phone",
+            phone: phone,
+          },
+        };
+
+        const updatedBookingResponse = await request(app.getHttpServer())
+          .patch(`/v2/bookings/${bookingUid}/location`)
+          .send(updatedBookingBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(200);
+
+        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =
+          updatedBookingResponse.body;
+        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);
+        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {
+          throw new Error(
+            "Invalid response data - expected booking but received array of possibly recurring bookings"
+          );
+        }
+        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;
+        expect(updatedBooking).toHaveProperty("id");
+        expect(updatedBooking.location).toEqual(phone);
+      });
+
+      it("can update location to type attendeeAddress", async () => {
+        const attendeeAddress = "123 Example St, City, Valhalla";
+        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {
+          location: {
+            type: "attendeeAddress",
+            address: attendeeAddress,
+          },
+        };
+
+        const updatedBookingResponse = await request(app.getHttpServer())
+          .patch(`/v2/bookings/${bookingUid}/location`)
+          .send(updatedBookingBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(200);
+
+        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =
+          updatedBookingResponse.body;
+        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);
+        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {
+          throw new Error(
+            "Invalid response data - expected booking but received array of possibly recurring bookings"
+          );
+        }
+        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;
+        expect(updatedBooking).toHaveProperty("id");
+        expect(updatedBooking.location).toEqual(attendeeAddress);
+      });
+
+      it("can update location to type attendeePhone", async () => {
+        const attendeePhone = "+37120993151";
+        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {
+          location: {
+            type: "attendeePhone",
+            phone: attendeePhone,
+          },
+        };
+
+        const updatedBookingResponse = await request(app.getHttpServer())
+          .patch(`/v2/bookings/${bookingUid}/location`)
+          .send(updatedBookingBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(200);
+
+        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =
+          updatedBookingResponse.body;
+        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);
+        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {
+          throw new Error(
+            "Invalid response data - expected booking but received array of possibly recurring bookings"
+          );
+        }
+        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;
+        expect(updatedBooking).toHaveProperty("id");
+        expect(updatedBooking.location).toEqual(attendeePhone);
+      });
+
+      it("can update location to type attendeeDefined", async () => {
+        const attendeeDefinedLocation = "namek 100";
+        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {
+          location: {
+            type: "attendeeDefined",
+            location: attendeeDefinedLocation,
+          },
+        };
+
+        const updatedBookingResponse = await request(app.getHttpServer())
+          .patch(`/v2/bookings/${bookingUid}/location`)
+          .send(updatedBookingBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(200);
+
+        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =
+          updatedBookingResponse.body;
+        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);
+        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {
+          throw new Error(
+            "Invalid response data - expected booking but received array of possibly recurring bookings"
+          );
+        }
+        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;
+        expect(updatedBooking).toHaveProperty("id");
+        expect(updatedBooking.location).toEqual(attendeeDefinedLocation);
+      });
+
+      afterAll(async () => {
+        if (responseDataIsBooking(booking)) {
+          await bookingsRepositoryFixture.deleteById(bookingId);
+        } else {
+          throw new Error("Unexpected response data type");
+        }
+      });
+    });
+
+    it("should return booking unchanged when no location payload is provided", async () => {
+      const initialLocation = `https://initial-${randomString()}.example.com`;
+      const { bookingUid } = await createBooking(initialLocation);
+
+      const response = await request(app.getHttpServer())
+        .patch(`/v2/bookings/${bookingUid}/location`)
+        .send({})
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+        .expect(200);
+
+      const responseBody: UpdateBookingLocationOutput_2024_08_13 = response.body;
+      expect(responseBody.status).toEqual(SUCCESS_STATUS);
+      if (!responseDataIsBooking(responseBody.data)) {
+        throw new Error(
+          "Invalid response data - expected booking but received array of possibly recurring bookings"
+        );
+      }
+      expect(responseBody.data.location).toEqual(initialLocation);
+    });
+
+    it("should return 403 when unrelated user attempts to update booking location", async () => {
+      const { bookingUid } = await createBooking();
+
+      await request(app.getHttpServer())
+        .patch(`/v2/bookings/${bookingUid}/location`)
+        .send({ location: { type: "link", link: "https://non-organizer.example.com" } })
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .set("Authorization", `Bearer ${testSetup.unrelatedUser.accessToken}`)
+        .expect(403);
+    });
+
+    it("should return 400 when invalid location payload is provided", async () => {
+      const { bookingUid } = await createBooking();
+
+      const response = await request(app.getHttpServer())
+        .patch(`/v2/bookings/${bookingUid}/location`)
+        .send({ location: { type: "invalid-location-type" } })
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+        .expect(400);
+
+      expect(response.body.status).toEqual(ERROR_STATUS);
+    });
+  });
+
+  afterAll(async () => {
+    await teamRepositoryFixture.delete(organization.id);
+
+    await userRepositoryFixture.deleteByEmail(testSetup.organizer.email);
+    await userRepositoryFixture.deleteByEmail(testSetup.unrelatedUser.email);
+
+    await bookingsRepositoryFixture.deleteAllBookings(testSetup.organizer.id, testSetup.organizer.email);
+
+    await app.close();
+  });
+
+  async function setupTestData() {
+    const oAuthClient = await createOAuthClient(organization.id);
+
+    const organizerUser = await userRepositoryFixture.create({
+      email: `update-booking-location-organizer-${randomString()}@api.com`,
+      platformOAuthClients: {
+        connect: { id: oAuthClient.id },
+      },
+    });
+
+    const unrelatedUser = await userRepositoryFixture.create({
+      email: `update-booking-location-unrelated-${randomString()}@api.com`,
+      platformOAuthClients: {
+        connect: { id: oAuthClient.id },
+      },
+    });
+
+    const organizerTokens = await tokensRepositoryFixture.createTokens(organizerUser.id, oAuthClient.id);
+    const unrelatedTokens = await tokensRepositoryFixture.createTokens(unrelatedUser.id, oAuthClient.id);
+
+    const userSchedule: CreateScheduleInput_2024_04_15 = {
+      name: `update-booking-location-schedule-${randomString()}`,
+      timeZone: "Europe/Rome",
+      isDefault: true,
+    };
+    await schedulesService.createUserSchedule(organizerUser.id, userSchedule);
+
+    const eventType = await eventTypesRepositoryFixture.create(
+      {
+        title: `update-booking-location-event-type-${randomString()}`,
+        slug: `update-booking-location-event-type-${randomString()}`,
+        length: 45,
+      },
+      organizerUser.id
+    );
+
+    testSetup = {
+      organizer: {
+        id: organizerUser.id,
+        email: organizerUser.email,
+        accessToken: organizerTokens.accessToken,
+        refreshToken: organizerTokens.refreshToken,
+      },
+      unrelatedUser: {
+        id: unrelatedUser.id,
+        email: unrelatedUser.email,
+        accessToken: unrelatedTokens.accessToken,
+        refreshToken: unrelatedTokens.refreshToken,
+      },
+      eventTypeId: eventType.id,
+    };
+  }
+
+  async function createOAuthClient(organizationId: number) {
+    const data = {
+      logo: "logo-url",
+      name: "name",
+      redirectUris: ["http://localhost:4444"],
+      permissions: 32,
+      areEmailsEnabled: true,
+    };
+    const secret = "secret";
+
+    return oauthClientRepositoryFixture.create(organizationId, data, secret);
+  }
+
+  async function createBooking(location?: string) {
+    const bookingLocation = location ?? `https://initial-${randomString()}.example.com`;
+    const bookingUid = `booking-uid-${randomString(10)}`;
+
+    await bookingsRepositoryFixture.create({
+      uid: bookingUid,
+      title: "booking title",
+      startTime: new Date(Date.UTC(2035, 0, 9, 13, 0, 0)).toISOString(),
+      endTime: new Date(Date.UTC(2035, 0, 9, 13, 45, 0)).toISOString(),
+      eventType: {
+        connect: {
+          id: testSetup.eventTypeId,
+        },
+      },
+      status: "ACCEPTED",
+      metadata: {},
+      responses: "null",
+      location: bookingLocation,
+      user: {
+        connect: {
+          id: testSetup.organizer.id,
+        },
+      },
+    });
+
+    return {
+      bookingUid,
+      location: bookingLocation,
+    };
+  }
+
+  function responseDataIsBooking(data: unknown): data is BookingOutput_2024_08_13 {
+    return !Array.isArray(data) && typeof data === "object" && data !== null && "id" in data;
+  }
+});

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/user-bookings.e2e-spec.ts

@@ -4,6 +4,7 @@ import { CancelBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs
 import { CreateBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/create-booking.output";
 import { MarkAbsentBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/mark-absent.output";
 import { RescheduleBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/reschedule-booking.output";
+import { CalVideoService } from "@/ee/bookings/2024-08-13/services/cal-video.service";
 import { CreateEventTypeOutput_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/outputs/create-event-type.output";
 import { CreateScheduleInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-schedule.input";
 import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
@@ -3078,6 +3079,102 @@ describe("Bookings Endpoints 2024-08-13", () => {
       );
     }
 
+    describe("Meeting sessions", () => {
+      it("should get cal video sessions for a booking", async () => {
+        const mockSessions = [
+          {
+            id: "session-123",
+            room: "daily-room-123",
+            start_time: 1678901234,
+            duration: 3600,
+            ongoing: false,
+            max_participants: 10,
+            participants: [
+              {
+                user_id: "user-1",
+                participant_id: "participant-1",
+                user_name: "John Doe",
+                join_time: 1678901234,
+                duration: 3600,
+              },
+            ],
+          },
+        ];
+
+        const booking = await bookingsRepositoryFixture.create({
+          uid: `test-video-session-${randomString()}`,
+          title: "Test Video Session Booking",
+          description: "",
+          startTime: new Date(Date.UTC(2030, 0, 8, 10, 0, 0)),
+          endTime: new Date(Date.UTC(2030, 0, 8, 11, 0, 0)),
+          eventType: {
+            connect: {
+              id: eventTypeId,
+            },
+          },
+          user: {
+            connect: {
+              id: user.id,
+            },
+          },
+          references: {
+            create: [
+              {
+                type: "daily_video",
+                uid: `daily-room-123-${randomString()}`,
+                meetingId: "daily-room-123",
+                meetingPassword: "test-password",
+                meetingUrl: "https://daily.co/daily-room-123",
+              },
+            ],
+          },
+        });
+
+        const calVideoService = app.get(CalVideoService);
+        jest
+          .spyOn(calVideoService, "getVideoSessions")
+          .mockResolvedValue([
+            {
+              id: mockSessions[0].id,
+              room: mockSessions[0].room,
+              startTime: mockSessions[0].start_time,
+              duration: mockSessions[0].duration,
+              ongoing: mockSessions[0].ongoing,
+              maxParticipants: mockSessions[0].max_participants,
+              participants: mockSessions[0].participants.map((p) => ({
+                userId: p.user_id,
+                userName: p.user_name,
+                joinTime: p.join_time,
+                duration: p.duration,
+              })),
+            },
+          ]);
+
+        const response = await request(app.getHttpServer())
+          .get(`/v2/bookings/${booking.uid}/conferencing-sessions`)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .expect(200);
+
+        expect(response.body.status).toEqual(SUCCESS_STATUS);
+        expect(response.body.data).toBeDefined();
+        expect(Array.isArray(response.body.data)).toBe(true);
+        expect(response.body.data.length).toBe(1);
+        expect(response.body.data[0].id).toEqual(mockSessions[0].id);
+        expect(response.body.data[0].room).toEqual(mockSessions[0].room);
+        expect(response.body.data[0].startTime).toEqual(mockSessions[0].start_time);
+        expect(response.body.data[0].duration).toEqual(mockSessions[0].duration);
+        expect(response.body.data[0].ongoing).toEqual(mockSessions[0].ongoing);
+        expect(response.body.data[0].maxParticipants).toEqual(mockSessions[0].max_participants);
+        expect(response.body.data[0].participants.length).toBe(1);
+        expect(response.body.data[0].participants[0].userId).toEqual(mockSessions[0].participants[0].user_id);
+        expect(response.body.data[0].participants[0].userName).toEqual(
+          mockSessions[0].participants[0].user_name
+        );
+
+        await bookingsRepositoryFixture.deleteById(booking.id);
+      });
+    });
+
     afterAll(async () => {
       await oauthClientRepositoryFixture.delete(oAuthClient.id);
       await teamRepositoryFixture.delete(organization.id);

apps/api/v2/src/ee/bookings/2024-08-13/guards/booking-pbac.guard.ts

@@ -0,0 +1,52 @@
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
+import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  UnauthorizedException,
+  BadRequestException,
+} from "@nestjs/common";
+import { Request } from "express";
+
+import { BookingAccessService } from "@calcom/platform-libraries";
+
+@Injectable()
+export class BookingPbacGuard implements CanActivate {
+  private bookingAccessService: BookingAccessService;
+
+  constructor(private readonly prismaReadService: PrismaReadService) {
+    this.bookingAccessService = new BookingAccessService(this.prismaReadService.prisma);
+  }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context
+      .switchToHttp()
+      .getRequest<Request & { user?: ApiAuthGuardUser; pbacAuthorizedRequest?: boolean }>();
+    const user = request.user;
+    const bookingUid = request.params.bookingUid;
+
+    if (!user) {
+      throw new UnauthorizedException();
+    }
+
+    if (!bookingUid) {
+      throw new BadRequestException("BookingPbacGuard - bookingUid is required");
+    }
+
+    const hasAccess = await this.bookingAccessService.doesUserIdHaveAccessToBooking({
+      userId: user.id,
+      bookingUid,
+    });
+
+    if (!hasAccess) {
+      throw new ForbiddenException(
+        `BookingPbacGuard - user with id=${user.id} does not have access to booking with uid=${bookingUid}`
+      );
+    }
+
+    request.pbacAuthorizedRequest = true;
+    return true;
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/outputs/update-location.output.ts

@@ -0,0 +1,3 @@
+import { GetBookingOutput_2024_08_13 } from "@calcom/platform-types";
+
+export class UpdateBookingLocationOutput_2024_08_13 extends GetBookingOutput_2024_08_13 {}

apps/api/v2/src/ee/bookings/2024-08-13/repositories/bookings.repository.ts

@@ -206,4 +206,14 @@ export class BookingsRepository_2024_08_13 {
       },
     });
   }
+
+  async updateBooking(bookingUid: string, body: Prisma.BookingUpdateInput) {
+    return this.dbWrite.prisma.booking.update({
+      where: {
+        uid: bookingUid,
+      },
+      data: body,
+      select: { uid: true },
+    });
+  }
 }

apps/api/v2/src/ee/bookings/2024-08-13/services/booking-location.service.ts

@@ -0,0 +1,118 @@
+import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/repositories/bookings.repository";
+import { BookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/bookings.service";
+import { InputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/input.service";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
+import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.repository";
+import { EventTypeAccessService } from "@/modules/event-types/services/event-type-access.service";
+import { UsersRepository } from "@/modules/users/users.repository";
+import { Injectable, Logger, NotFoundException, ForbiddenException } from "@nestjs/common";
+
+import type {
+  UpdateBookingLocationInput_2024_08_13,
+  BookingInputLocation_2024_08_13,
+  UpdateBookingInputLocation_2024_08_13,
+} from "@calcom/platform-types";
+import { Booking } from "@calcom/prisma/client";
+
+@Injectable()
+export class BookingLocationService_2024_08_13 {
+  private readonly logger = new Logger("BookingLocationService_2024_08_13");
+
+  constructor(
+    private readonly bookingsRepository: BookingsRepository_2024_08_13,
+    private readonly bookingsService: BookingsService_2024_08_13,
+    private readonly usersRepository: UsersRepository,
+    private readonly inputService: InputBookingsService_2024_08_13,
+    private readonly eventTypesRepository: EventTypesRepository_2024_06_14,
+    private readonly eventTypeAccessService: EventTypeAccessService
+  ) {}
+
+  async updateBookingLocation(
+    bookingUid: string,
+    input: UpdateBookingLocationInput_2024_08_13,
+    user: ApiAuthGuardUser
+  ) {
+    const existingBooking = await this.bookingsRepository.getByUidWithEventType(bookingUid);
+    if (!existingBooking) {
+      throw new NotFoundException(`Booking with uid=${bookingUid} not found`);
+    }
+
+    if (existingBooking.eventTypeId && existingBooking.eventType) {
+      const eventType = await this.eventTypesRepository.getEventTypeByIdWithOwnerAndTeam(
+        existingBooking.eventTypeId
+      );
+      if (eventType) {
+        const isAllowed = await this.eventTypeAccessService.userIsEventTypeAdminOrOwner(user, eventType);
+        if (!isAllowed) {
+          throw new ForbiddenException(
+            "User is not authorized to update this booking location. User must be the event type owner, host, team admin or owner, or org admin or owner."
+          );
+        }
+      }
+    }
+
+    const { location } = input;
+
+    if (location) {
+      return await this.updateLocation(existingBooking, location, user);
+    }
+
+    return this.bookingsService.getBooking(existingBooking.uid, user);
+  }
+
+  private async updateLocation(
+    existingBooking: Booking,
+    inputLocation: UpdateBookingInputLocation_2024_08_13,
+    user: ApiAuthGuardUser
+  ) {
+    const bookingUid = existingBooking.uid;
+    const bookingLocation = this.getLocationValue(inputLocation) ?? existingBooking.location;
+
+    if (!existingBooking.userId) {
+      throw new NotFoundException(`No user found for booking with uid=${bookingUid}`);
+    }
+
+    if (!existingBooking.eventTypeId) {
+      throw new NotFoundException(`No event type found for booking with uid=${bookingUid}`);
+    }
+
+    const existingBookingHost = await this.usersRepository.findById(existingBooking.userId);
+
+    if (!existingBookingHost) {
+      throw new NotFoundException(`No user found for booking with uid=${bookingUid}`);
+    }
+
+    const bookingFieldsLocation = this.inputService.transformLocation(
+      inputLocation as BookingInputLocation_2024_08_13
+    );
+
+    const responses = (existingBooking.responses || {}) as Record<string, unknown>;
+    const { location: _existingLocation, ...rest } = responses;
+
+    const updatedBookingResponses = { ...rest, location: bookingFieldsLocation };
+
+    const updatedBooking = await this.bookingsRepository.updateBooking(bookingUid, {
+      location: bookingLocation,
+      responses: updatedBookingResponses,
+    });
+
+    return this.bookingsService.getBooking(updatedBooking.uid, user);
+  }
+
+  private getLocationValue(loc: UpdateBookingInputLocation_2024_08_13): string | undefined {
+    if (loc.type === "address") return loc.address;
+    if (loc.type === "link") return loc.link;
+    if (loc.type === "phone") return loc.phone;
+    if (loc.type === "attendeeAddress") return loc.address;
+    if (loc.type === "attendeePhone") return loc.phone;
+    if (loc.type === "attendeeDefined") return loc.location;
+
+    this.logger.log(
+      `Booking location service getLocationValue - loc ${JSON.stringify(
+        loc
+      )} was passed but the type is not supported.`
+    );
+
+    return undefined;
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts

@@ -919,34 +919,40 @@ export class BookingsService_2024_08_13 {
     return await this.getBooking(recurringBookingUid, authUser);
   }
 
-  async markAbsent(bookingUid: string, bookingOwnerId: number, body: MarkAbsentBookingInput_2024_08_13) {
-    const bodyTransformed = this.inputService.transformInputMarkAbsentBooking(body);
-    const bookingBefore = await this.bookingsRepository.getByUid(bookingUid);
+    async markAbsent(
+      bookingUid: string,
+      bookingOwnerId: number,
+      body: MarkAbsentBookingInput_2024_08_13,
+      userUuid?: string
+    ) {
+      const bodyTransformed = this.inputService.transformInputMarkAbsentBooking(body);
+      const bookingBefore = await this.bookingsRepository.getByUid(bookingUid);
 
-    if (!bookingBefore) {
-      throw new NotFoundException(`Booking with uid=${bookingUid} not found.`);
-    }
+      if (!bookingBefore) {
+        throw new NotFoundException(`Booking with uid=${bookingUid} not found.`);
+      }
 
-    const nowUtc = DateTime.utc();
-    const bookingStartTimeUtc = DateTime.fromJSDate(bookingBefore.startTime, { zone: "utc" });
+      const nowUtc = DateTime.utc();
+      const bookingStartTimeUtc = DateTime.fromJSDate(bookingBefore.startTime, { zone: "utc" });
 
-    if (nowUtc < bookingStartTimeUtc) {
-      throw new BadRequestException(
-        `Bookings can only be marked as absent after their scheduled start time. Current time in UTC+0: ${nowUtc.toISO()}, Booking start time in UTC+0: ${bookingStartTimeUtc.toISO()}`
-      );
-    }
+      if (nowUtc < bookingStartTimeUtc) {
+        throw new BadRequestException(
+          `Bookings can only be marked as absent after their scheduled start time. Current time in UTC+0: ${nowUtc.toISO()}, Booking start time in UTC+0: ${bookingStartTimeUtc.toISO()}`
+        );
+      }
 
-    const platformClientParams = bookingBefore?.eventTypeId
-      ? await this.platformBookingsService.getOAuthClientParams(bookingBefore.eventTypeId)
-      : undefined;
+      const platformClientParams = bookingBefore?.eventTypeId
+        ? await this.platformBookingsService.getOAuthClientParams(bookingBefore.eventTypeId)
+        : undefined;
 
-    await handleMarkNoShow({
-      bookingUid,
-      attendees: bodyTransformed.attendees,
-      noShowHost: bodyTransformed.noShowHost,
-      userId: bookingOwnerId,
-      platformClientParams,
-    });
+      await handleMarkNoShow({
+        bookingUid,
+        attendees: bodyTransformed.attendees,
+        noShowHost: bodyTransformed.noShowHost,
+        userId: bookingOwnerId,
+        userUuid,
+        platformClientParams,
+      });
 
     const booking = await this.bookingsRepository.getByUidWithAttendeesAndUserAndEvent(bookingUid);
 

apps/api/v2/src/ee/bookings/2024-08-13/services/cal-video.output.service.ts

@@ -0,0 +1,23 @@
+import { Injectable } from "@nestjs/common";
+
+import type { CalMeetingSession } from "@calcom/platform-libraries/conferencing";
+
+@Injectable()
+export class CalVideoOutputService {
+  getOutputVideoSessions(sessions: CalMeetingSession[]) {
+    return sessions.map((session) => ({
+      id: session.id,
+      room: session.room,
+      startTime: session.start_time,
+      duration: session.duration,
+      ongoing: session.ongoing,
+      maxParticipants: session.max_participants,
+      participants: session.participants.map((participant) => ({
+        userId: participant.user_id,
+        userName: participant.user_name,
+        joinTime: participant.join_time,
+        duration: participant.duration,
+      })),
+    }));
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/services/cal-video.service.ts

@@ -1,11 +1,13 @@
 import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/repositories/bookings.repository";
-import { OutputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output.service";
+import { CalVideoOutputService } from "@/ee/bookings/2024-08-13/services/cal-video.output.service";
 import { Injectable, Logger, NotFoundException } from "@nestjs/common";
 
+import { CAL_VIDEO_TYPE } from "@calcom/platform-constants";
 import {
   getRecordingsOfCalVideoByRoomName,
   getAllTranscriptsAccessLinkFromRoomName,
   getDownloadLinkOfCalVideoByRecordingId,
+  getCalVideoMeetingSessionsByRoomName,
 } from "@calcom/platform-libraries/conferencing";
 
 @Injectable()
@@ -13,18 +15,23 @@ export class CalVideoService {
   private readonly logger = new Logger("CalVideoService");
   constructor(
     private readonly bookingsRepository: BookingsRepository_2024_08_13,
-    private readonly outputService: OutputBookingsService_2024_08_13
+    private readonly calVideoOutputService: CalVideoOutputService
   ) {}
 
+  private getVideoSessionsRoomName(references?: Array<{ type: string; meetingId?: string | null }>) {
+    return (
+      references?.filter((reference) => reference.type === CAL_VIDEO_TYPE)?.pop()?.meetingId ??
+      undefined
+    );
+  }
+
   async getRecordings(bookingUid: string) {
     const booking = await this.bookingsRepository.getByUidWithBookingReference(bookingUid);
     if (!booking) {
       throw new NotFoundException(`Booking with uid=${bookingUid} was not found in the database`);
     }
 
-    const roomName =
-      booking?.references?.filter((reference) => reference.type === "daily_video")?.pop()?.meetingId ??
-      undefined;
+    const roomName = this.getVideoSessionsRoomName(booking.references);
     if (!roomName) {
       throw new NotFoundException(`No Cal Video reference found with booking uid ${bookingUid}`);
     }
@@ -68,10 +75,7 @@ export class CalVideoService {
       throw new NotFoundException(`Booking with uid=${bookingUid} was not found in the database`);
     }
 
-    const roomName =
-      booking?.references?.filter((reference) => reference.type === "daily_video")?.pop()?.meetingId ??
-      undefined;
-
+    const roomName = this.getVideoSessionsRoomName(booking.references);
     if (!roomName) {
       throw new NotFoundException(`No Cal Video reference found with booking uid ${bookingUid}`);
     }
@@ -80,4 +84,19 @@ export class CalVideoService {
 
     return transcripts;
   }
+
+  async getVideoSessions(bookingUid: string) {
+    const booking = await this.bookingsRepository.getByUidWithBookingReference(bookingUid);
+    if (!booking) {
+      throw new NotFoundException(`Booking with uid=${bookingUid} was not found in the database`);
+    }
+
+    const roomName = this.getVideoSessionsRoomName(booking.references);
+    if (!roomName) {
+      throw new NotFoundException(`No Cal Video reference found with booking uid ${bookingUid}`);
+    }
+
+    const sessions = await getCalVideoMeetingSessionsByRoomName(roomName);
+    return this.calVideoOutputService.getOutputVideoSessions(sessions.data);
+  }
 }

apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts

@@ -188,6 +188,7 @@ export class InputBookingsService_2024_08_13 {
         location,
       },
       ...this.getRoutingFormData(inputBooking.routing),
+      rrHostSubsetIds: inputBooking.rrHostSubsetIds,
     };
   }
 
@@ -484,6 +485,7 @@ export class InputBookingsService_2024_08_13 {
         },
         schedulingType: eventType.schedulingType,
         ...this.getRoutingFormData(inputBooking.routing),
+        rrHostSubsetIds: inputBooking.rrHostSubsetIds,
       });
 
       switch (timeBetween) {

apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts

@@ -34,6 +34,7 @@ import { SchedulingType } from "@calcom/platform-libraries";
 import {
   BaseConfirmationPolicy_2024_06_14,
   TeamEventTypeOutput_2024_06_14,
+  supportedIntegrations,
   type ApiSuccessResponse,
   type CreateEventTypeInput_2024_06_14,
   type EventTypeOutput_2024_06_14,
@@ -640,9 +641,9 @@ describe("Event types Endpoints", () => {
       hiddenEventType = responseBody.data;
     });
 
-    it(`/GET/event-types by username`, async () => {
+    it(`/GET/event-types by username with sortCreatedAt=desc`, async () => {
       const response = await request(app.getHttpServer())
-        .get(`/api/v2/event-types?username=${user.username}`)
+        .get(`/api/v2/event-types?username=${user.username}&sortCreatedAt=desc`)
         .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
         .set("Authorization", `Bearer ${apiKeyString}`)
         .expect(200);
@@ -653,6 +654,12 @@ describe("Event types Endpoints", () => {
       expect(responseBody.data).toBeDefined();
       expect(responseBody.data?.length).toEqual(2);
 
+      // Verify ordering: event types are returned newest to oldest when sortCreatedAt=desc
+      // hiddenEventType was created after eventType, so it should have a higher ID and appear first
+      expect(responseBody.data[0].id).toBeGreaterThan(responseBody.data[1].id);
+      expect(responseBody.data[0].id).toEqual(hiddenEventType.id);
+      expect(responseBody.data[1].id).toEqual(eventType.id);
+
       const fetchedEventType = responseBody.data?.find((et) => et.id === eventType.id);
       const fetchedHiddenEventType = responseBody.data?.find((et) => et.id === hiddenEventType.id);
 
@@ -711,6 +718,46 @@ describe("Event types Endpoints", () => {
       expect(fetchedEventType?.hidden).toEqual(false);
     });
 
+    it(`/GET/event-types by username with sortCreatedAt=asc`, async () => {
+      const response = await request(app.getHttpServer())
+        .get(`/api/v2/event-types?username=${user.username}&sortCreatedAt=asc`)
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+        .set("Authorization", `Bearer ${apiKeyString}`)
+        .expect(200);
+
+      const responseBody: ApiSuccessResponse<EventTypeOutput_2024_06_14[]> = response.body;
+
+      expect(responseBody.status).toEqual(SUCCESS_STATUS);
+      expect(responseBody.data).toBeDefined();
+      expect(responseBody.data?.length).toEqual(2);
+
+      // Verify ordering: event types are returned oldest to newest when sortCreatedAt=asc
+      // eventType was created before hiddenEventType, so it should have a lower ID and appear first
+      expect(responseBody.data[0].id).toBeLessThan(responseBody.data[1].id);
+      expect(responseBody.data[0].id).toEqual(eventType.id);
+      expect(responseBody.data[1].id).toEqual(hiddenEventType.id);
+    });
+
+    it(`/GET/event-types by username without sortCreatedAt parameter`, async () => {
+      const response = await request(app.getHttpServer())
+        .get(`/api/v2/event-types?username=${user.username}`)
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+        .set("Authorization", `Bearer ${apiKeyString}`)
+        .expect(200);
+
+      const responseBody: ApiSuccessResponse<EventTypeOutput_2024_06_14[]> = response.body;
+
+      expect(responseBody.status).toEqual(SUCCESS_STATUS);
+      expect(responseBody.data).toBeDefined();
+      expect(responseBody.data?.length).toEqual(2);
+
+      // Without sortCreatedAt, no specific order is guaranteed
+      // Just verify both event types are present
+      const ids = responseBody.data.map((et) => et.id);
+      expect(ids).toContain(eventType.id);
+      expect(ids).toContain(hiddenEventType.id);
+    });
+
     it(`/GET/event-types by username should not return hidden event type if no auth provided`, async () => {
       const response = await request(app.getHttpServer())
         .get(`/api/v2/event-types?username=${user.username}`)
@@ -1439,6 +1486,7 @@ describe("Event types Endpoints", () => {
         locations: [],
         schedulingType: "COLLECTIVE",
         team: { connect: { id: team.id } },
+        rrHostSubsetEnabled: true,
       });
 
       return request(app.getHttpServer())
@@ -1451,6 +1499,7 @@ describe("Event types Endpoints", () => {
           expect(responseBody.status).toEqual(SUCCESS_STATUS);
           expect(responseBody.data.id).toEqual(teamEventType.id);
           expect(responseBody.data.teamId).toEqual(team.id);
+          expect(responseBody.data.rrHostSubsetEnabled).toEqual(true);
           await teamRepositoryFixture.delete(team.id);
         });
     });
@@ -2855,6 +2904,119 @@ describe("Event types Endpoints", () => {
         });
     });
 
+    it("should accept newly supported integration locations in input validation", async () => {
+      // Test that the API accepts various newly supported integrations by creating event types
+      // with these location types directly in the database and then retrieving them
+      // Note: Database uses underscores in integration types, API returns hyphens
+      const integrationTests = [
+        { internal: "integrations:jitsi", api: "jitsi" },
+        { internal: "integrations:whereby_video", api: "whereby-video" },
+        { internal: "integrations:huddle01", api: "huddle" },
+        { internal: "integrations:tandem", api: "tandem" },
+        { internal: "integrations:element-call_video", api: "element-call-video" },
+      ];
+
+      for (const { internal, api } of integrationTests) {
+        const eventTypeInput = {
+          title: `event type ${api}`,
+          description: "event type description",
+          length: 30,
+          hidden: false,
+          slug: `event-type-${api}`,
+          locations: [
+            {
+              type: internal,
+              link: `https://example.com/${api}/meeting`,
+            },
+          ],
+          schedulingType: SchedulingType.ROUND_ROBIN,
+          bookingFields: [],
+        };
+
+        const legacyEventType = await eventTypesRepositoryFixture.create(eventTypeInput, user.id);
+
+        const response = await request(app.getHttpServer())
+          .get(`/api/v2/event-types/${legacyEventType.id}`)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+          .expect(200);
+
+        const responseBody: ApiSuccessResponse<EventTypeOutput_2024_06_14> = response.body;
+        const fetchedEventType = responseBody.data;
+
+        // Verify the integration location is returned correctly
+        expect(fetchedEventType.locations).toHaveLength(1);
+        expect(fetchedEventType.locations[0]).toMatchObject({
+          type: "integration",
+          integration: api,
+        });
+
+        // Clean up
+        await eventTypesRepositoryFixture.delete(legacyEventType.id);
+      }
+    });
+
+    it("should reject with 400 if creating event type with unsupported integration location", async () => {
+      const createPayload = {
+        title: "Event with unsupported integration",
+        slug: "event-with-unsupported-integration",
+        lengthInMinutes: 30,
+        locations: [
+          {
+            type: "integration",
+            integration: "unsupported-integration",
+          },
+        ],
+      };
+
+      const response = await request(app.getHttpServer())
+        .post("/api/v2/event-types")
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+        .send(createPayload);
+
+      expect(response.status).toBe(400);
+      expect(response.body.error.message).toBe(
+        `Validation failed for integration location: integration must be one of the following values: ${supportedIntegrations.join(
+          ", "
+        )}`
+      );
+    });
+
+    it("should reject with 400 if patching event type with integration that user has not connected", async () => {
+      const createPayload = {
+        title: "Event for patch test",
+        slug: "event-patch-test-unconnected-integration",
+        lengthInMinutes: 30,
+      };
+
+      const createResponse = await request(app.getHttpServer())
+        .post("/api/v2/event-types")
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+        .send(createPayload)
+        .expect(201);
+
+      const createdEventType = createResponse.body.data;
+
+      const patchPayload = {
+        locations: [
+          {
+            type: "integration",
+            integration: "jitsi",
+          },
+        ],
+      };
+
+      const patchResponse = await request(app.getHttpServer())
+        .patch(`/api/v2/event-types/${createdEventType.id}`)
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14)
+        .send(patchPayload);
+
+      expect(patchResponse.status).toBe(400);
+      expect(patchResponse.body.error.message).toBe("jitsi not connected.");
+
+      // Cleanup
+      await eventTypesRepositoryFixture.delete(createdEventType.id);
+    });
+
     describe("EventType Hidden Property", () => {
       let createdEventTypeId: number;
 

apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.ts

@@ -155,6 +155,8 @@ export class EventTypesController_2024_06_14 {
     summary: "Get all event types",
     description: `Hidden event types are returned only if authentication is provided and it belongs to the event type owner.
       
+      Use the optional \`sortCreatedAt\` query parameter to order results by creation date (by ID). Accepts "asc" (oldest first) or "desc" (newest first). When not provided, no explicit ordering is applied.
+      
       <Note>Please make sure to pass in the cal-api-version header value as mentioned in the Headers section. Not passing the correct value will default to an older version of this endpoint.</Note>
       `,
   })

apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts

@@ -3,6 +3,7 @@ import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { Injectable } from "@nestjs/common";
 
+import type { SortOrderType } from "@calcom/platform-types";
 import type { Prisma } from "@calcom/prisma/client";
 
 @Injectable()
@@ -67,21 +68,23 @@ export class EventTypesRepository_2024_06_14 {
     });
   }
 
-  async getUserEventTypes(userId: number) {
+  async getUserEventTypes(userId: number, sortCreatedAt?: SortOrderType) {
     return this.dbRead.prisma.eventType.findMany({
       where: {
         userId,
       },
+      ...(sortCreatedAt && { orderBy: { id: sortCreatedAt } }),
       include: { users: true, schedule: true, destinationCalendar: true },
     });
   }
 
-  async getUserEventTypesPublic(userId: number) {
+  async getUserEventTypesPublic(userId: number, sortCreatedAt?: SortOrderType) {
     return this.dbRead.prisma.eventType.findMany({
       where: {
         userId,
         hidden: false,
       },
+      ...(sortCreatedAt && { orderBy: { id: sortCreatedAt } }),
       include: { users: true, schedule: true, destinationCalendar: true },
     });
   }

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts

@@ -22,7 +22,7 @@ import {
   getEventTypesPublic,
   EventTypesPublic,
 } from "@calcom/platform-libraries/event-types";
-import type { GetEventTypesQuery_2024_06_14 } from "@calcom/platform-types";
+import type { GetEventTypesQuery_2024_06_14, SortOrderType } from "@calcom/platform-types";
 import type { EventType } from "@calcom/prisma/client";
 
 @Injectable()
@@ -160,15 +160,16 @@ export class EventTypesService_2024_06_14 {
     orgSlug?: string;
     orgId?: number;
     authUser?: AuthOptionalUser;
+    sortCreatedAt?: SortOrderType;
   }) {
     const user = await this.usersRepository.findByUsername(params.username, params.orgSlug, params.orgId);
     if (!user) {
       return [];
     }
     if (params.authUser?.id !== user.id) {
-      return await this.getUserEventTypesPublic(user.id);
+      return await this.getUserEventTypesPublic(user.id, params.sortCreatedAt);
     }
-    return await this.getUserEventTypes(user.id);
+    return await this.getUserEventTypes(user.id, params.sortCreatedAt);
   }
 
   async getUserToCreateEvent(user: UserWithProfile) {
@@ -211,16 +212,16 @@ export class EventTypesService_2024_06_14 {
     };
   }
 
-  async getUserEventTypes(userId: number) {
-    const eventTypes = await this.eventTypesRepository.getUserEventTypes(userId);
+  async getUserEventTypes(userId: number, sortCreatedAt?: SortOrderType) {
+    const eventTypes = await this.eventTypesRepository.getUserEventTypes(userId, sortCreatedAt);
 
     return eventTypes.map((eventType) => {
       return { ownerId: userId, ...eventType };
     });
   }
 
-  async getUserEventTypesPublic(userId: number) {
-    const eventTypes = await this.eventTypesRepository.getUserEventTypesPublic(userId);
+  async getUserEventTypesPublic(userId: number, sortCreatedAt?: SortOrderType) {
+    const eventTypes = await this.eventTypesRepository.getUserEventTypesPublic(userId, sortCreatedAt);
 
     return eventTypes.map((eventType) => {
       return { ownerId: userId, ...eventType };
@@ -237,7 +238,7 @@ export class EventTypesService_2024_06_14 {
   }
 
   async getEventTypes(queryParams: GetEventTypesQuery_2024_06_14, authUser?: AuthOptionalUser) {
-    const { username, eventSlug, usernames, orgSlug, orgId } = queryParams;
+    const { username, eventSlug, usernames, orgSlug, orgId, sortCreatedAt } = queryParams;
     if (username && eventSlug) {
       const eventType = await this.getEventTypeByUsernameAndSlug({
         username,
@@ -255,6 +256,7 @@ export class EventTypesService_2024_06_14 {
         orgSlug,
         orgId,
         authUser,
+        sortCreatedAt,
       });
     }
 
@@ -264,7 +266,7 @@ export class EventTypesService_2024_06_14 {
     }
 
     if (authUser?.id) {
-      return await this.getUserEventTypes(authUser.id);
+      return await this.getUserEventTypes(authUser.id, sortCreatedAt);
     }
 
     return [];

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/input-event-types.service.ts

@@ -27,6 +27,7 @@ import {
 import { UserWithProfile } from "@/modules/users/users.repository";
 import { Injectable, BadRequestException } from "@nestjs/common";
 
+import { slugifyLenient } from "@calcom/platform-libraries";
 import { getApps, getUsersCredentialsIncludeServiceAccountKey } from "@calcom/platform-libraries/app-store";
 import {
   validateCustomEventName,
@@ -39,6 +40,7 @@ import {
   InputBookingField_2024_06_14,
   OutputUnknownLocation_2024_06_14,
   UpdateEventTypeInput_2024_06_14,
+  supportedIntegrations,
 } from "@calcom/platform-types";
 import { BookerLayouts } from "@calcom/prisma/zod-utils";
 
@@ -128,6 +130,7 @@ export class InputEventTypesService_2024_06_14 {
       useDestinationCalendarEmail,
       disableGuests,
       bookerActiveBookingsLimit,
+      slug,
       ...rest
     } = inputEventType;
     const confirmationPolicyTransformed = this.transformInputConfirmationPolicy(confirmationPolicy);
@@ -143,6 +146,8 @@ export class InputEventTypesService_2024_06_14 {
       ? this.transformInputBookerActiveBookingsLimit(bookerActiveBookingsLimit)
       : {};
 
+    const slugifiedSlug = slugifyLenient(slug);
+
     const metadata: EventTypeMetadata = {
       bookerLayouts: this.transformInputBookerLayouts(bookerLayouts),
       requiresConfirmationThreshold:
@@ -152,6 +157,7 @@ export class InputEventTypesService_2024_06_14 {
 
     const eventType = {
       ...rest,
+      slug: slugifiedSlug,
       length: lengthInMinutes,
       locations: locationsTransformed,
       bookingFields: this.transformInputBookingFields(effectiveBookingFields),
@@ -208,6 +214,7 @@ export class InputEventTypesService_2024_06_14 {
       useDestinationCalendarEmail,
       disableGuests,
       bookerActiveBookingsLimit,
+      slug,
       ...rest
     } = inputEventType;
     const eventTypeDb = await this.eventTypesRepository.getEventTypeWithMetaData(eventTypeId);
@@ -228,14 +235,21 @@ export class InputEventTypesService_2024_06_14 {
 
     const metadata: EventTypeMetadata = {
       ...metadataTransformed,
-      bookerLayouts: this.transformInputBookerLayouts(bookerLayouts),
-      requiresConfirmationThreshold:
-        confirmationPolicyTransformed?.requiresConfirmationThreshold ?? undefined,
-      multipleDuration: lengthInMinutesOptions,
+      ...(bookerLayouts !== undefined
+        ? { bookerLayouts: this.transformInputBookerLayouts(bookerLayouts) }
+        : {}),
+      ...(confirmationPolicy !== undefined
+        ? {
+            requiresConfirmationThreshold:
+              confirmationPolicyTransformed?.requiresConfirmationThreshold ?? undefined,
+          }
+        : {}),
+      ...(lengthInMinutesOptions !== undefined ? { multipleDuration: lengthInMinutesOptions } : {}),
     };
 
     const eventType = {
       ...rest,
+      ...(slug ? { slug: slugifyLenient(slug) } : {}),
       length: lengthInMinutes,
       locations: locations ? this.transformInputLocations(locations) : undefined,
       bookingFields: effectiveBookingFields
@@ -252,7 +266,7 @@ export class InputEventTypesService_2024_06_14 {
       requiresConfirmationWillBlockSlot:
         confirmationPolicyTransformed?.requiresConfirmationWillBlockSlot ?? undefined,
       eventTypeColor: this.transformInputEventTypeColor(color),
-      ...this.transformInputSeatOptions(seats),
+      ...(seats ? this.transformInputSeatOptions(seats) : { seatsPerTimeSlot: undefined }),
       eventName: customName,
       useEventTypeDestinationCalendarEmail: useDestinationCalendarEmail,
       ...maxActiveBookingsPerBooker,
@@ -542,14 +556,40 @@ export class InputEventTypesService_2024_06_14 {
   }
 
   async checkAppIsValidAndConnected(user: UserWithProfile, appSlug: string) {
-    const conferencingApps = ["google-meet", "office365-video", "zoom"];
+    const conferencingApps = supportedIntegrations as readonly string[];
     if (!conferencingApps.includes(appSlug)) {
       throw new BadRequestException("Invalid app, available apps are: ", conferencingApps.join(", "));
     }
 
-    if (appSlug === "office365-video") {
-      appSlug = "msteams";
-    }
+    // Map API integration names to actual app slugs
+    const slugMap: Record<string, string> = {
+      "office365-video": "msteams",
+      "facetime-video": "facetime",
+      "whereby-video": "whereby",
+      "whatsapp-video": "whatsapp",
+      "webex-video": "webex",
+      "telegram-video": "telegram",
+      "sylaps-video": "sylapsvideo",
+      "skype-video": "skype",
+      "sirius-video": "sirius_video",
+      "signal-video": "signal",
+      "shimmer-video": "shimmervideo",
+      "salesroom-video": "salesroom",
+      "roam-video": "roam",
+      "riverside-video": "riverside",
+      "ping-video": "ping",
+      "mirotalk-video": "mirotalk",
+      "jelly-video": "jelly",
+      "jelly-conferencing": "jelly",
+      "huddle": "huddle01",
+      "element-call-video": "element-call",
+      "eightxeight-video": "eightxeight",
+      "discord-video": "discord",
+      "demodesk-video": "demodesk",
+      "campfire-video": "campfire",
+    };
+
+    appSlug = slugMap[appSlug] || appSlug;
 
     const credentials = await getUsersCredentialsIncludeServiceAccountKey(user);
 

apps/api/v2/src/ee/schedules/schedules_2024_04_15/schedules.module.ts

@@ -1,6 +1,7 @@
 import { SchedulesController_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/controllers/schedules.controller";
 import { SchedulesRepository_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.repository";
 import { SchedulesService_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/services/schedules.service";
+import { PrismaScheduleRepository } from "@/lib/repositories/prisma-schedule.repository";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
 import { TokensModule } from "@/modules/tokens/tokens.module";
 import { UsersModule } from "@/modules/users/users.module";
@@ -8,7 +9,7 @@ import { Module } from "@nestjs/common";
 
 @Module({
   imports: [PrismaModule, UsersModule, TokensModule],
-  providers: [SchedulesRepository_2024_04_15, SchedulesService_2024_04_15],
+  providers: [SchedulesRepository_2024_04_15, SchedulesService_2024_04_15, PrismaScheduleRepository],
   controllers: [SchedulesController_2024_04_15],
   exports: [SchedulesService_2024_04_15, SchedulesRepository_2024_04_15],
 })

apps/api/v2/src/ee/schedules/schedules_2024_04_15/services/schedules.service.ts

@@ -1,12 +1,12 @@
 import { CreateAvailabilityInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-availability.input";
 import { CreateScheduleInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-schedule.input";
 import { SchedulesRepository_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.repository";
+import { PrismaScheduleRepository } from "@/lib/repositories/prisma-schedule.repository";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { UserWithProfile, UsersRepository } from "@/modules/users/users.repository";
 import { BadRequestException, ForbiddenException, Injectable, NotFoundException } from "@nestjs/common";
 
 import { updateSchedule } from "@calcom/platform-libraries/schedules";
-import { ScheduleRepository } from "@calcom/platform-libraries/schedules";
 import type { UpdateScheduleInput_2024_04_15 } from "@calcom/platform-types";
 import type { PrismaClient } from "@calcom/prisma";
 import type { Schedule } from "@calcom/prisma/client";
@@ -16,7 +16,8 @@ export class SchedulesService_2024_04_15 {
   constructor(
     private readonly schedulesRepository: SchedulesRepository_2024_04_15,
     private readonly usersRepository: UsersRepository,
-    private readonly dbWrite: PrismaWriteService
+    private readonly dbWrite: PrismaWriteService,
+    private readonly prismaScheduleRepository: PrismaScheduleRepository
   ) {}
 
   async createUserDefaultSchedule(userId: number, timeZone: string) {
@@ -53,8 +54,7 @@ export class SchedulesService_2024_04_15 {
     const user = await this.usersRepository.findById(userId);
 
     if (!user?.defaultScheduleId) return null;
-
-    return await ScheduleRepository.findDetailedScheduleById({
+    return await this.prismaScheduleRepository.findDetailedScheduleById({
       scheduleId: user.defaultScheduleId,
       isManagedEventType: undefined,
       userId,
@@ -70,7 +70,7 @@ export class SchedulesService_2024_04_15 {
       throw new NotFoundException(`User with ID=${userId} does not exist.`);
     }
 
-    const existingSchedule = await ScheduleRepository.findDetailedScheduleById({
+    const existingSchedule = await this.prismaScheduleRepository.findDetailedScheduleById({
       scheduleId: scheduleId,
       isManagedEventType: undefined,
       userId,
@@ -88,7 +88,11 @@ export class SchedulesService_2024_04_15 {
   }
 
   async getUserSchedules(userId: number, timeZone: string, defaultScheduleId: number | null) {
-    return ScheduleRepository.findManyDetailedScheduleByUserId({ userId, timeZone, defaultScheduleId });
+    return this.prismaScheduleRepository.findManyDetailedScheduleByUserId({
+      userId,
+      timeZone,
+      defaultScheduleId,
+    });
   }
 
   async updateUserSchedule(

apps/api/v2/src/lib/modules/available-slots.module.ts

@@ -1,6 +1,7 @@
 import { PrismaBookingRepository } from "@/lib/repositories/prisma-booking.repository";
 import { PrismaEventTypeRepository } from "@/lib/repositories/prisma-event-type.repository";
 import { PrismaFeaturesRepository } from "@/lib/repositories/prisma-features.repository";
+import { PrismaHolidayRepository } from "@/lib/repositories/prisma-holiday.repository";
 import { PrismaMembershipRepository } from "@/lib/repositories/prisma-membership.repository";
 import { PrismaOOORepository } from "@/lib/repositories/prisma-ooo.repository";
 import { PrismaRoutingFormResponseRepository } from "@/lib/repositories/prisma-routing-form-response.repository";
@@ -23,6 +24,7 @@ import { Module } from "@nestjs/common";
   imports: [PrismaWorkerModule],
   providers: [
     PrismaOOORepository,
+    PrismaHolidayRepository,
     PrismaScheduleRepository,
     PrismaBookingRepository,
     PrismaSelectedSlotRepository,

apps/api/v2/src/lib/modules/regular-booking.module.ts

@@ -5,6 +5,7 @@ import { PrismaFeaturesRepository } from "@/lib/repositories/prisma-features.rep
 import { PrismaHostRepository } from "@/lib/repositories/prisma-host.repository";
 import { PrismaOOORepository } from "@/lib/repositories/prisma-ooo.repository";
 import { PrismaUserRepository } from "@/lib/repositories/prisma-user.repository";
+import { BookingAuditProducerService } from "@/lib/services/booking-audit-producer.service";
 import { BookingEmailSmsService } from "@/lib/services/booking-emails-sms-service";
 import { BookingEventHandlerService } from "@/lib/services/booking-event-handler.service";
 import { CheckBookingAndDurationLimitsService } from "@/lib/services/check-booking-and-duration-limits.service";
@@ -16,6 +17,7 @@ import { BookingEmailAndSmsSyncTaskerService } from "@/lib/services/tasker/booki
 import { BookingEmailAndSmsTaskService } from "@/lib/services/tasker/booking-emails-sms-task.service";
 import { BookingEmailAndSmsTasker } from "@/lib/services/tasker/booking-emails-sms-tasker.service";
 import { BookingEmailAndSmsTriggerTaskerService } from "@/lib/services/tasker/booking-emails-sms-trigger-tasker.service";
+import { TaskerService } from "@/lib/services/tasker.service";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
 import { Module, Scope } from "@nestjs/common";
 
@@ -35,6 +37,7 @@ import { Module, Scope } from "@nestjs/common";
       },
       scope: Scope.TRANSIENT,
     },
+    BookingAuditProducerService,
     BookingEventHandlerService,
     CheckBookingAndDurationLimitsService,
     CheckBookingLimitsService,
@@ -45,6 +48,7 @@ import { Module, Scope } from "@nestjs/common";
     BookingEmailAndSmsSyncTaskerService,
     BookingEmailAndSmsTriggerTaskerService,
     BookingEmailAndSmsTasker,
+    TaskerService,
     RegularBookingService,
   ],
   exports: [RegularBookingService],

apps/api/v2/src/lib/repositories/prisma-holiday.repository.ts

@@ -0,0 +1,13 @@
+import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
+import { Injectable } from "@nestjs/common";
+
+import { PrismaHolidayRepository as PrismaHolidayRepositoryLib } from "@calcom/platform-libraries/repositories";
+import type { PrismaClient } from "@calcom/prisma";
+
+@Injectable()
+export class PrismaHolidayRepository extends PrismaHolidayRepositoryLib {
+  constructor(private readonly dbWrite: PrismaWriteService) {
+    super(dbWrite.prisma as unknown as PrismaClient);
+  }
+}
+

apps/api/v2/src/lib/services/booking-audit-producer.service.ts

@@ -0,0 +1,16 @@
+import { TaskerService } from "@/lib/services/tasker.service";
+import { Logger } from "@/lib/logger.bridge";
+import { Injectable } from "@nestjs/common";
+
+import { BookingAuditTaskerProducerService, getAuditActorRepository } from "@calcom/platform-libraries/bookings";
+
+@Injectable()
+export class BookingAuditProducerService extends BookingAuditTaskerProducerService {
+  constructor(taskerService: TaskerService, bridgeLogger: Logger) {
+    super({
+      tasker: taskerService.getTasker(),
+      log: bridgeLogger,
+      auditActorRepository: getAuditActorRepository(),
+    });
+  }
+}

apps/api/v2/src/lib/services/booking-event-handler.service.ts

@@ -4,14 +4,20 @@ import { BookingEventHandlerService as BaseBookingEventHandlerService } from "@c
 
 import { Logger } from "@/lib/logger.bridge";
 
+import { BookingAuditProducerService } from "./booking-audit-producer.service";
 import { HashedLinkService } from "./hashed-link.service";
 
 @Injectable()
 export class BookingEventHandlerService extends BaseBookingEventHandlerService {
-  constructor(hashedLinkService: HashedLinkService, bridgeLogger: Logger) {
+  constructor(
+    hashedLinkService: HashedLinkService,
+    bridgeLogger: Logger,
+    bookingAuditProducerService: BookingAuditProducerService
+  ) {
     super({
       log: bridgeLogger,
       hashedLinkService,
+      bookingAuditProducerService,
     });
   }
 }

apps/api/v2/src/lib/services/tasker.service.ts

@@ -0,0 +1,18 @@
+import { Injectable } from "@nestjs/common";
+
+import { getTasker, type Tasker } from "@calcom/platform-libraries";
+
+@Injectable()
+export class TaskerService {
+  private readonly tasker: Tasker;
+
+  constructor() {
+    this.tasker = getTasker();
+  }
+
+  getTasker(): Tasker {
+    return this.tasker;
+  }
+}
+
+

apps/api/v2/src/lib/services/user-availability.service.ts

@@ -1,5 +1,6 @@
 import { PrismaBookingRepository } from "@/lib/repositories/prisma-booking.repository";
 import { PrismaEventTypeRepository } from "@/lib/repositories/prisma-event-type.repository";
+import { PrismaHolidayRepository } from "@/lib/repositories/prisma-holiday.repository";
 import { PrismaOOORepository } from "@/lib/repositories/prisma-ooo.repository";
 import { RedisService } from "@/modules/redis/redis.service";
 import { Injectable } from "@nestjs/common";
@@ -12,13 +13,15 @@ export class UserAvailabilityService extends BaseUserAvailabilityService {
     oooRepoDependency: PrismaOOORepository,
     bookingRepository: PrismaBookingRepository,
     eventTypeRepository: PrismaEventTypeRepository,
-    redisService: RedisService
+    redisService: RedisService,
+    holidayRepository: PrismaHolidayRepository
   ) {
     super({
       oooRepo: oooRepoDependency,
       bookingRepo: bookingRepository,
       eventTypeRepo: eventTypeRepository,
       redisClient: redisService,
+      holidayRepo: holidayRepository,
     });
   }
 }

apps/api/v2/src/modules/atoms/services/schedules-atom.service.ts

@@ -32,8 +32,8 @@ export class SchedulesAtomsService {
     const user = await this.usersRepository.findById(userId);
 
     if (!user?.defaultScheduleId) return null;
-
-    return await ScheduleRepository.findDetailedScheduleById({
+    const scheduleRepo = new ScheduleRepository(this.dbWrite.prisma as unknown as PrismaClient);
+    return await scheduleRepo.findDetailedScheduleById({
       scheduleId: scheduleId ?? user.defaultScheduleId,
       isManagedEventType,
       userId,

apps/api/v2/src/modules/billing/billing.module.ts

@@ -2,6 +2,7 @@ import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/reposito
 import { BillingProcessor } from "@/modules/billing/billing.processor";
 import { BillingRepository } from "@/modules/billing/billing.repository";
 import { BillingController } from "@/modules/billing/controllers/billing.controller";
+import { IsUserInBillingOrg } from "@/modules/billing/guards/is-user-in-billing-org";
 import { BillingServiceCachingProxy } from "@/modules/billing/services/billing-service-caching-proxy";
 import { BillingConfigService } from "@/modules/billing/services/billing.config.service";
 import { BillingService } from "@/modules/billing/services/billing.service";
@@ -44,6 +45,7 @@ import { Module } from "@nestjs/common";
     ManagedOrganizationsBillingService,
     OAuthClientRepository,
     BookingsRepository_2024_08_13,
+    IsUserInBillingOrg,
   ],
   exports: [BillingService, BillingRepository, ManagedOrganizationsBillingService],
   controllers: [BillingController],

apps/api/v2/src/modules/billing/controllers/billing.controller.e2e-spec.ts

@@ -17,7 +17,7 @@ import { OrganizationRepositoryFixture } from "test/fixtures/repository/organiza
 import { ProfileRepositoryFixture } from "test/fixtures/repository/profiles.repository.fixture";
 import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
 import { randomString } from "test/utils/randomString";
-import { withNextAuth } from "test/utils/withNextAuth";
+import { withApiAuth } from "test/utils/withApiAuth";
 
 import type { Team, PlatformBilling } from "@calcom/prisma/client";
 
@@ -32,8 +32,10 @@ describe("Platform Billing Controller (e2e)", () => {
   let membershipsRepositoryFixture: MembershipRepositoryFixture;
   let platformBillingRepositoryFixture: PlatformBillingRepositoryFixture;
   let organization: Team;
+  let organization2: Team;
+
   beforeAll(async () => {
-    const moduleRef = await withNextAuth(
+    const moduleRef = await withApiAuth(
       userEmail,
       Test.createTestingModule({
         imports: [AppModule, PrismaModule, UsersModule, TokensModule],
@@ -49,6 +51,10 @@ describe("Platform Billing Controller (e2e)", () => {
       name: `billing-organization-${randomString()}`,
       isPlatform: true,
     });
+    organization2 = await organizationsRepositoryFixture.create({
+      name: `billing-organization-2-${randomString()}`,
+      isPlatform: true,
+    });
 
     user = await userRepositoryFixture.create({
       email: userEmail,
@@ -133,7 +139,7 @@ describe("Platform Billing Controller (e2e)", () => {
       });
   });
 
-  it("/billing/webhook (GET) should  get billing plan for org", () => {
+  it("/billing/:orgId/check (GET) should check billing plan for org", () => {
     return request(app.getHttpServer())
       .get(`/v2/billing/${organization.id}/check`)
       .expect(200)
@@ -143,6 +149,10 @@ describe("Platform Billing Controller (e2e)", () => {
       });
   });
 
+  it("/billing/:organizationId/check (GET) should not be able to check other org plan", () => {
+    return request(app.getHttpServer()).get(`/v2/billing/${organization2.id}/check`).expect(403);
+  });
+
   it("/billing/webhook (POST) failed payment should set billing free plan to overdue", () => {
     jest.spyOn(StripeService.prototype, "getStripe").mockImplementation(
       () =>