cc: gate on DB readiness + real healthchecks (start.sh has no set -e and wait-for-it passes mid-initdb)

- database: pg_isready healthcheck; calcom depends_on service_healthy - calcom: healthcheck probes /auth/login with redirects (upstream wget --spider / fails on 307)
cc: fix DB wiring — base compose hardcodes unicorn_user/magical_password and builds DATABASE_URL from raw creds (Prisma URL-parse crash with base64 pw)
2026-09-28 08:16:12 -07:00 · 2026-09-28 06:44:44 -07:00 · 2026-09-28 00:23:53 -07:00 · 2026-09-27 23:36:33 -07:00 · 2026-03-01 12:42:42 +00:00 · 2026-02-26 18:51:11 +00:00
2360 changed files with 69342 additions and 86321 deletions
@@ -0,0 +1,5 @@
+{
+  "env": {
+    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
+  }
+}
@@ -1,57 +0,0 @@
-# EAS Build ignore file for monorepo
-# Only upload the companion app folder
-
-# ===========================================
-# IGNORE EVERYTHING AT ROOT LEVEL
-# ===========================================
-/*
-
-# ===========================================
-# EXCEPT THE COMPANION APP
-# ===========================================
-!companion
-
-# ===========================================
-# BUT IGNORE THESE INSIDE COMPANION
-# ===========================================
-
-# Native folders - EAS generates these during builds (~2.1 GB)
-companion/ios
-companion/android
-
-# Dependencies - EAS installs these during builds (~1.6 GB)
-companion/node_modules
-
-# Expo build cache
-companion/.expo
-companion/dist
-companion/web-build
-
-# Metro
-companion/.metro-health-check*
-
-# WXT Chrome Extension outputs (not needed for mobile builds)
-companion/.output
-companion/.wxt
-companion/dev
-
-# Kotlin cache
-companion/.kotlin
-
-# Build artifacts
-companion/*.jks
-companion/*.p8
-companion/*.p12
-companion/*.key
-companion/*.mobileprovision
-
-# Debug logs
-companion/*.log
-
-# TypeScript build info
-companion/*.tsbuildinfo
-
-# Environment files
-companion/.env
-companion/.env.*
-!companion/.env.example
@@ -209,11 +209,13 @@ NEXT_PUBLIC_STRIPE_PREMIUM_PLAN_PRICE=
 NEXT_PUBLIC_IS_PREMIUM_NEW_PLAN=0
 NEXT_PUBLIC_STRIPE_PREMIUM_NEW_PLAN_PRICE=
 STRIPE_TEAM_MONTHLY_PRICE_ID=
+STRIPE_TEAM_ANNUAL_PRICE_ID=
 NEXT_PUBLIC_STRIPE_CREDITS_PRICE_ID=
 ORG_MONTHLY_CREDITS=
 STRIPE_TEAM_PRODUCT_ID=
 # It is a price ID in the product with id STRIPE_ORG_PRODUCT_ID
 STRIPE_ORG_MONTHLY_PRICE_ID=
+STRIPE_ORG_ANNUAL_PRICE_ID=
 STRIPE_ORG_PRODUCT_ID=
 # Used to pass trial days for orgs during the Stripe checkout session
 STRIPE_ORG_TRIAL_DAYS=
@@ -9,6 +9,7 @@
 /apps/web/lib/core/**/* @calcom/Foundation
 /apps/web/lib/booking.ts @calcom/Foundation
 /apps/web/lib/handleOrgRedirect.ts @calcom/Foundation
+/apps/web/modules/shell/Shell.tsx @calcom/Foundation
 /apps/web/proxy.ts @calcom/Foundation
 /deploy/**/* @calcom/Foundation
 /packages/app-store/applecalendar/**/* @calcom/Foundation
@@ -36,3 +37,11 @@
 /packages/trpc/server/routers/viewer/bookings/get.handler.ts @calcom/Foundation
 /packages/trpc/server/routers/viewer/slots/**/* @calcom/Foundation
 /packages/ui/**/* @calcom/Consumer @calcom/Foundation
+
+# Exclude test files from requiring foundation/consumer approval
+**/*.spec.*
+**/*.e2e.*
+**/*.e2e-spec.*
+**/*.test.*
+**/*.test-suite.*
+**/*.integration-test.*
@@ -1,120 +0,0 @@
---
-name: Companion (iOS/Android/Extension)
-about: Report bugs or request features for mobile apps and browser extension
-title: ""
-labels: ["companion", "🚨 needs approval"]
-assignees: ""
---
-
-### Issue Type
-
-<!--
-  Select one:
-  - Bug Report
-  - Feature Request
-->
-
- [ ] 🐛 Bug Report
- [ ] ✨ Feature Request
-
-### Platform
-
-<!--
-  Select all that apply:
-->
-
- [ ] 📱 iOS App
- [ ] 🤖 Android App
- [ ] 🧩 Browser Extension
-
-### Platform Details
-
-<!--
-  Fill in the details for your selected platform(s).
-  Delete sections that don't apply.
-->
-
-#### iOS
- **iOS Version**: (e.g., 17.2)
- **Device Model**: (e.g., iPhone 15 Pro)
- **App Version**: (e.g., 1.0.0)
-
-#### Android
- **Android Version**: (e.g., 14)
- **Device Model**: (e.g., Pixel 8)
- **App Version**: (e.g., 1.0.0)
-
-#### Browser Extension
- **Browser & Version**: (e.g., Chrome 120, Firefox 121)
- **Extension Version**: (e.g., 1.0.0)
-
---
-
-### Description
-
-<!--
-  Provide a clear and concise description of the issue or feature.
-->
-
-(Write your description here.)
-
-### Steps to Reproduce (Bug Reports Only)
-
-<!--
-  If this is a bug report, provide steps to reproduce the issue.
-  Delete this section for feature requests.
-->
-
-1. Go to...
-2. Click on...
-3. See error...
-
-### Expected Behavior
-
-<!--
-  What did you expect to happen?
-->
-
-(Describe what you expected.)
-
-### Actual Behavior (Bug Reports Only)
-
-<!--
-  What actually happened? Delete this section for feature requests.
-->
-
-(Describe what actually happened.)
-
-### Proposed Solution (Feature Requests Only)
-
-<!--
-  If this is a feature request, describe your proposed solution.
-  Delete this section for bug reports.
-->
-
-(Describe your proposed solution.)
-
-### Screenshots / Evidence
-
-<!--
-  Add screenshots, screen recordings, or console logs if applicable.
-  You can use tools like Bird Eats Bug for recordings.
-->
-
-(Attach evidence here.)
-
-### Additional Context
-
-<!--
-  Any other information that might be helpful.
-->
-
-(Add any additional context here.)
-
---
-
-##### House rules
-
- If this issue has a `🚨 needs approval` label, don't start coding yet. Wait until a core member approves the request by removing this label.
- Your ideas are invaluable! However, they undergo review to ensure alignment with the product's direction.
- Follow best practices in our [Contributor Docs](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
@@ -7,4 +7,11 @@ GET /v2/bookings/{bookingUid} added 'subschema #3, subschema #6' to the 'data' r
 POST /v2/bookings/{bookingUid}/cancel added 'subschema #3, subschema #6' to the 'data' response property 'oneOf' list for the response status '200'
 POST /v2/bookings/{bookingUid}/confirm added 'subschema #3, subschema #6' to the 'data' response property 'oneOf' list for the response status '200'
 POST /v2/bookings/{bookingUid}/decline added 'subschema #3, subschema #6' to the 'data' response property 'oneOf' list for the response status '200'
-POST /v2/bookings/{bookingUid}/guests added 'subschema #3, subschema #6' to the 'data' response property 'oneOf' list for the response status '200'
+POST /v2/bookings/{bookingUid}/guests added 'subschema #3, subschema #6' to the 'data' response property 'oneOf' list for the response status '200'
+DELETE /v2/event-types/{eventTypeId}/webhooks/{webhookId} added the new path request parameter 'webhookId'
+GET /v2/event-types/{eventTypeId}/webhooks/{webhookId} added the new path request parameter 'webhookId'
+DELETE /v2/oauth-clients/{clientId}/webhooks/{webhookId} added the new path request parameter 'webhookId'
+GET /v2/oauth-clients/{clientId}/webhooks/{webhookId} added the new path request parameter 'webhookId'
+DELETE /v2/teams/{teamId}/event-types/{eventTypeId}/webhooks/{webhookId} added the new path request parameter 'webhookId'
+GET /v2/teams/{teamId}/event-types/{eventTypeId}/webhooks/{webhookId} added the new path request parameter 'webhookId'
+GET /v2/webhooks/{webhookId} added the new path request parameter 'webhookId'
@@ -1,44 +0,0 @@
-name: Companion Builds
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-env:
-  EXPO_PUBLIC_CAL_API_KEY: ${{ secrets.CI_EXPO_PUBLIC_CAL_API_KEY || vars.CI_EXPO_PUBLIC_CAL_API_KEY || vars.EXPO_PUBLIC_CAL_API_KEY }}
-
-jobs:
-  build:
-    name: Build Companion App & Extension
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    timeout-minutes: 30
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: .github
-      - uses: ./.github/actions/cache-checkout
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
-        with:
-          bun-version: 1.3.0
-          cache: true
-          cache-dependency-path: companion/bun.lock
-
-      - name: Install dependencies
-        working-directory: companion
-        run: bun install --frozen-lockfile
-
-      - name: Build Expo web app
-        working-directory: companion
-        env:
-          EXPO_NO_TELEMETRY: 1
-          CI: true
-        run: bunx expo export --platform web
-
-      - name: Build browser extension
-        working-directory: companion
-        run: bun run ext:build
@@ -1,33 +0,0 @@
-name: Companion Lint
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  lint:
-    name: Lint Companion App
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: .github
-      - uses: ./.github/actions/cache-checkout
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
-        with:
-          bun-version: 1.3.0
-          cache: false
-
-      - name: Install dependencies
-        working-directory: companion
-        run: bun install --frozen-lockfile
-
-      - name: Run lint
-        working-directory: companion
-        run: bun run lint:all
@@ -1,34 +0,0 @@
-name: Companion Type Check
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  typecheck:
-    name: Type Check Companion App
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: .github
-      - uses: ./.github/actions/cache-checkout
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
-        with:
-          bun-version: 1.3.0
-          cache: true
-          cache-dependency-path: companion/bun.lock
-
-      - name: Install dependencies
-        working-directory: companion
-        run: bun install --frozen-lockfile
-
-      - name: Type check
-        working-directory: companion
-        run: bun run typecheck:all
@@ -167,7 +167,6 @@ jobs:
      pull-requests: read
    outputs:
      has-files-requiring-all-checks: ${{ steps.filter-exclusions.outputs.has-files-requiring-all-checks }}
-      has-companion: ${{ steps.filter-inclusions.outputs.has-companion }}
      has-api-v2-changes: ${{ steps.filter-inclusions.outputs.has-api-v2-changes }}
      has-prisma-changes: ${{ steps.filter-inclusions.outputs.has-prisma-changes }}
      has-agents-changes: ${{ steps.filter-inclusions.outputs.has-agents-changes }}
@@ -197,14 +196,13 @@ jobs:
          filters: |
            has-files-requiring-all-checks:
              - '**'
-              - '!companion/**'
              - '!.vscode/**'
              - '!**/*.md'
              - '!**/*.mdx'
              - '!.github/CODEOWNERS'
              - '!docs/**'
              - '!help/**'
-              - '!apps/web/public/static/locales/**/common.json'
+              - '!packages/i18n/locales/**/common.json'
              - '!i18n.lock'
      - name: Check for specific path changes
        uses: dorny/paths-filter@v3
@@ -213,8 +211,6 @@ jobs:
          filters: |
            has-agents-changes:
              - "agents/**"
-            has-companion:
-              - "companion/**"
            has-api-v2-changes:
              - "apps/api/v2/**"
              - "packages/platform-constants/**"
@@ -387,27 +383,6 @@ jobs:
    uses: ./.github/workflows/docs-build.yml
    secrets: inherit

-  build-companion:
-    name: Companion builds
-    needs: [prepare]
-    if: needs.prepare.outputs.has-companion == 'true'
-    uses: ./.github/workflows/companion-build.yml
-    secrets: inherit
-
-  typecheck-companion:
-    name: Type Checks
-    needs: [prepare]
-    if: needs.prepare.outputs.has-companion == 'true'
-    uses: ./.github/workflows/companion-typecheck.yml
-    secrets: inherit
-
-  lint-companion:
-    name: Linters
-    needs: [prepare]
-    if: needs.prepare.outputs.has-companion == 'true'
-    uses: ./.github/workflows/companion-lint.yml
-    secrets: inherit
-
  build:
    name: Production builds
    needs: [prepare]
@@ -489,9 +464,6 @@ jobs:
        build-api-v2,
        build-atoms,
        build-docs,
-        build-companion,
-        typecheck-companion,
-        lint-companion,
        setup-db,
        e2e,
        e2e-api-v2,
@@ -540,14 +512,6 @@ jobs:
              needs.e2e-app-store.result != 'success'
            )
          ) ||
-          (
-            needs.prepare.outputs.has-companion == 'true' &&
-            (
-              needs.build-companion.result != 'success' ||
-              needs.typecheck-companion.result != 'success' ||
-              needs.lint-companion.result != 'success'
-            )
-          ) ||
          (
            needs.prepare.outputs.has-agents-changes == 'true' &&
            needs.validate-agents-format.result != 'success'
@@ -12,6 +12,7 @@ permissions:

 jobs:
  sync:
+    if: false
    name: Sync to Devin Knowledge
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
@@ -108,6 +108,9 @@ packages/**/.yarn/ci-cache/
 .claude/plans/
 .claude/settings.local.json

+# Spec drafts (rough work, not ready for review)
+specs/**/_drafts/
+
 # trigger.dev
 .trigger
 agents/devin-knowledge.json
@@ -4,4 +4,10 @@ enableGlobalCache: false

 nodeLinker: node-modules

+# fast-xml-parser 4.4.1 via @boxyhq/saml-jackson → @aws-sdk/core@3.816.0 (transitive).
+# Only parses trusted AWS API responses, not user input. No practical attack vector.
+# Upstream fix pending: ory/polis (saml-jackson) has bumped to @aws-sdk@3.994.0 on main but hasn't released yet.
+npmAuditIgnoreAdvisories:
+  - "1113407"
+
 yarnPath: .yarn/releases/yarn-4.12.0.cjs
@@ -12,11 +12,12 @@ You are a senior Cal.com engineer working in a Yarn/Turbo monorepo. You prioriti
 - Create PRs in draft mode by default
 - Run `yarn type-check:ci --force` before concluding CI failures are unrelated to your changes
 - Import directly from source files, not barrel files (e.g., `@calcom/ui/components/button` not `@calcom/ui`)
- Add translations to `apps/web/public/static/locales/en/common.json` for all UI strings
+- Add translations to `packages/i18n/locales/en/common.json` for all UI strings
 - Use `date-fns` or native `Date` instead of Day.js when timezone awareness isn't needed
 - Put permission checks in `page.tsx`, never in `layout.tsx`
 - Use `ast-grep` for searching if available; otherwise use `rg` (ripgrep), then fall back to `grep`
 - Use Biome for formatting and linting
+- Only add code comments that explain **why**, not **what** — see [code comment guidelines](agents/rules/quality-code-comments.md)


 ## Don't
@@ -29,6 +30,7 @@ You are a senior Cal.com engineer working in a Yarn/Turbo monorepo. You prioriti
 - Never use barrel imports from index.ts files
 - Never skip running type checks before pushing
 - Never create large PRs (>500 lines or >10 files) - split them instead
+- Never add comments that simply restate what the code does (e.g., `// Get the user` above a `getUser()` call)

 ## PR Size Guidelines

@@ -124,7 +126,7 @@ packages/lib/                # Shared utilities
 - Routes: `apps/web/app/` (App Router)
 - Database schema: `packages/prisma/schema.prisma`
 - tRPC routers: `packages/trpc/server/routers/`
- Translations: `apps/web/public/static/locales/en/common.json`
+- Translations: `packages/i18n/locales/en/common.json`
 - Workflow constants: `packages/features/ee/workflows/lib/constants.ts`

 ## Tech Stack
@@ -224,6 +226,14 @@ import { ProfileRepository } from "@calcom/features/profile/repositories/Profile
 - Fix type errors before test failures - they're often the root cause
 - Run `yarn prisma generate` if you see missing enum/type errors

+## Spec-Driven Development (Opt-In)
+
+For complex features, you can use spec-driven development when explicitly requested.
+
+**To enable:** Tell the AI "use spec-driven development" or "follow the spec workflow"
+
+See [SPEC-WORKFLOW.md](SPEC-WORKFLOW.md) for the full workflow documentation.
+
 ## Extended Documentation

 For detailed information, see the `agents/` directory:
@@ -149,6 +149,13 @@ Here is what you need to be able to run Cal.com.
   - Duplicate `.env.example` to `.env`
   - Use `openssl rand -base64 32` to generate a key and add it under `NEXTAUTH_SECRET` in the `.env` file.
   - Use `openssl rand -base64 24` to generate a key and add it under `CALENDSO_ENCRYPTION_KEY` in the `.env` file.
+     
+ > **Windows users:** Replace the `packages/prisma/.env` symlink with a real copy to avoid a Prisma error (`unexpected character / in variable name`):
+ >
+ > ```sh
+ > # Git Bash / WSL
+ > rm packages/prisma/.env && cp .env packages/prisma/.env
+ > ```

 5. Setup Node
   If your Node version does not meet the project's requirements as instructed by the docs, "nvm" (Node Version Manager) allows using Node at the version required by the project:
@@ -671,7 +678,7 @@ Certain versions may have trouble creating a user if the field `metadata` is emp

 ##### CLIENT_FETCH_ERROR

-If you experience this error, it may be the way the default Auth callback in the server is using the WEBAPP_URL as a base url. The container does not necessarily have access to the same DNS as your local machine, and therefor needs to be configured to resolve to itself. You may be able to correct this by configuring `NEXTAUTH_URL=http://localhost:3000/api/auth`, to help the backend loop back to itself.
+If you experience this error, it may be the way the default Auth callback in the server is using the WEBAPP_URL as a base url. The container does not necessarily have access to the same DNS as your local machine, and therefore needs to be configured to resolve to itself. You may be able to correct this by configuring `NEXTAUTH_URL=http://localhost:3000/api/auth`, to help the backend loop back to itself.

 ```
 docker-calcom-1  | @calcom/web:start: [next-auth][error][CLIENT_FETCH_ERROR]
@@ -767,11 +774,14 @@ Cal.com, Inc. is a commercial open source company, which means some parts of thi

 <img width="100%" src="https://repobeats.axiom.co/api/embed/6bfca2f20f39738048b6e70ca205efde46352c3d.svg" />

-<!-- CONTRIBUTING -->
-
 ## Contributing
+We ❤️ contributions! Whether it’s fixing a typo, improving documentation, or building new features, your help makes Cal.com better.

-Please see our [contributing guide](/CONTRIBUTING.md).
+- Check out our [Contributing Guide](./CONTRIBUTING.md) for detailed steps.
+- Join the discussion on [GitHub Discussions](https://github.com/calcom/cal.com/discussions) or our community channels.
+- Please follow our coding standards and commit message conventions to keep the project consistent.
+
+Even small improvements matter — thank you for helping us grow!

 ### Good First Issues

@@ -984,12 +994,6 @@ An example of good readme is [atoms readme](https://github.com/calcom/cal.com/bl
 1. Follow semantic versioning when using changesets.
 2. Mark breaking changes using `❗️Breaking change`

-<!-- LICENSE -->
-
-## License
-
-Distributed under the [AGPLv3 License](https://github.com/calcom/cal.com/blob/main/LICENSE). See `LICENSE` for more information.
-
 <!-- ACKNOWLEDGEMENTS -->

 ## Acknowledgements
@@ -0,0 +1,105 @@
+# Spec-Driven Development Workflow
+
+This workflow is **opt-in**. Use it when explicitly requested by saying "use spec-driven development" or "follow the spec workflow".
+
+## Design Documents
+
+The `specs/` folder contains design documents for features in development.
+
+Each spec follows this structure:
+
+```
+specs/{feature}/
+├── CLAUDE.md           # Feature-specific instructions (read this first)
+├── design.md           # The specification
+├── implementation.md   # Current status and what's done
+├── decisions.md        # Why decisions were made
+├── prompts.md          # Reusable prompts
+├── future-work.md      # What's deferred
+└── docs/               # Documentation with screenshots
+```
+
+**Workflow:**
+
+1. Read the spec's `CLAUDE.md` for specific instructions
+2. Read `design.md` to understand what we're building
+3. Check `implementation.md` for current status
+4. Find the relevant code in the codebase
+5. Implement in small pieces, update `implementation.md` after each
+
+---
+
+## When Implementing Features (Spec Mode)
+
+1. **Check for design doc** in `specs/` — if it exists, follow it
+2. **If no spec exists** — ask if you should create one first
+3. **Look at existing patterns** — find similar code and follow conventions
+4. **Update implementation.md** — mark what's done after each piece
+5. **Update decisions.md** — when choosing between approaches
+
+---
+
+## Creating a New Spec
+
+When user asks to build a new feature:
+
+1. Copy the template: `cp -r specs/_templates specs/{feature-name}`
+2. Explore the codebase to understand existing patterns
+3. Write `design.md` with technical spec
+4. Write `CLAUDE.md` with feature-specific instructions
+5. Initialize `implementation.md` with "not-started" status
+6. Ask user to review before implementing
+
+---
+
+## Updating Spec Files
+
+### implementation.md — After completing each piece:
+
+```markdown
+## Status: in-progress
+
+## Completed
+- [x] Database schema
+- [x] Migration file
+
+## In Progress
+- tRPC endpoints
+
+## Next Steps
+1. UI components
+2. Tests
+
+## Session Notes
+### 2024-01-15
+- Done: Added schema, created migration
+- Next: Implement tRPC router
+```
+
+### decisions.md — When choosing between approaches:
+
+```markdown
+## ADR-001: Use Separate Table for Custom Locations
+
+### Context
+Need to store user-defined locations.
+
+### Options
+1. JSON field — simpler, but harder to query
+2. Separate table — more flexible, better indexing
+
+### Decision
+Separate table for better querying.
+
+### Consequences
+- Need migration
+- Need new tRPC router
+```
+
+---
+
+## Don't (When Using Spec-Driven Development)
+
+- Don't implement features without checking for a design doc first
+- Don't skip updating implementation.md after completing work
+- Don't make architectural decisions without recording them in decisions.md
@@ -65,6 +65,7 @@
 - [patterns-factory-pattern](rules/patterns-factory-pattern.md) - Factory pattern
 - [patterns-workflow-triggers](rules/patterns-workflow-triggers.md) - Workflow implementation
 - [patterns-app-store](rules/patterns-app-store.md) - App store integration patterns
+- [patterns-trigger-dev](rules/patterns-trigger-dev.md) - Trigger.dev task implementation

 ### Culture

@@ -0,0 +1,193 @@
+---
+title: Prevent Circular Dependencies Between Packages
+impact: CRITICAL
+impactDescription: Prevents build failures, type errors, ensures honest implementation, and maintains clean dependency graph
+tags: architecture, dependencies, packages, imports, circular
+---
+
+## Prevent Circular Dependencies Between Packages
+
+**Impact: CRITICAL**
+
+Circular dependencies between packages cause build failures, type errors, and make the codebase unmaintainable. The dependency graph must be acyclic, with clear layers from low-level utilities up to high-level features.
+
+The dependency hierarchy (from lowest to highest):
+```
+packages/lib (lowest - no feature dependencies)
+  ↓
+packages/app-store
+  ↓
+packages/features
+  ↓
+packages/trpc
+  ↓
+apps/web (highest - can depend on all packages)
+```
+
+**Benefits:**
+- **Honest implementation**: The dependency graph accurately reflects what code depends on what, with no hidden or circular relationships that create false expectations
+- **Predictable behavior**: Code behaves as the dependency structure suggests - no surprises from circular imports
+- **Clear mental model**: Developers can reason about the system without tracking complex circular relationships
+- **Build reliability**: No circular dependency errors during compilation or bundling
+- **Easier testing**: Lower-level packages can be tested independently without pulling in the entire codebase
+
+### `packages/lib`
+
+**Rules:**
+1. No files in `packages/lib` import from `@calcom/app-store` or `../app-store/**`
+2. No files in `packages/lib` import from `@calcom/features` or `../features/**`
+3. No files in `packages/lib` import from `@calcom/trpc` or `../trpc/**`
+4. No files in `packages/lib` import from `@trpc/server`
+5. **BONUS:** No repository files allowed in `packages/lib` (repositories belong in features or app-store)
+
+**Incorrect:**
+
+```typescript
+// Bad - lib importing from features
+import { getBooking } from "@calcom/features/bookings";
+import { EventRepository } from "@calcom/features/events/repositories";
+
+// Bad - lib importing from app-store
+import { googleCalendarHandler } from "@calcom/app-store/googlecalendar";
+
+// Bad - lib importing from trpc
+import { router } from "@calcom/trpc/server/trpc";
+```
+
+**Correct:**
+
+```typescript
+// Good - lib only imports from other lib files or external packages
+import { logger } from "@calcom/lib/logger";
+import { prisma } from "@calcom/prisma";
+import type { User } from "@prisma/client";
+```
+
+### `packages/app-store`
+
+**Rules:**
+6. No files in `packages/app-store` import from `@calcom/features` or `../features/**`
+7. No files in `packages/app-store` import from `@calcom/trpc` or `../trpc/**`
+
+**Incorrect:**
+
+```typescript
+// Bad - app-store importing from features
+import { BookingService } from "@calcom/features/bookings/services";
+
+// Bad - app-store importing from trpc
+import { publicProcedure } from "@calcom/trpc/server/trpc";
+```
+
+**Correct:**
+
+```typescript
+// Good - app-store imports from lib and prisma
+import { logger } from "@calcom/lib/logger";
+import { prisma } from "@calcom/prisma";
+import type { Credential } from "@prisma/client";
+```
+
+### `packages/features`
+
+**Rules:**
+8. No files in `packages/features` import from `@calcom/trpc` or `../trpc/**`
+9. No files in `packages/features` import from `@calcom/web` or `@calcom/web/**`
+10. No files in `packages/features` import from `../../apps/web/**`
+
+**Incorrect:**
+
+```typescript
+// Bad - features importing from trpc
+import { router } from "@calcom/trpc/server/trpc";
+
+// Bad - features importing from web app
+import { getServerSession } from "@calcom/web/lib/auth";
+import { WebComponent } from "../../apps/web/components/WebComponent";
+```
+
+**Correct:**
+
+```typescript
+// Good - features import from lib, app-store, and prisma
+import { logger } from "@calcom/lib/logger";
+import { prisma } from "@calcom/prisma";
+import { googleCalendarHandler } from "@calcom/app-store/googlecalendar";
+```
+
+### `packages/trpc`
+
+**Rules:**
+11. No files in `packages/trpc` import from `../apps/web/**`
+
+**Incorrect:**
+
+```typescript
+// Bad - trpc importing from web app
+import { getServerSession } from "../../apps/web/lib/auth";
+```
+
+**Correct:**
+
+```typescript
+// Good - trpc imports from features, lib, and prisma
+import { BookingService } from "@calcom/features/bookings/services";
+import { logger } from "@calcom/lib/logger";
+import { prisma } from "@calcom/prisma";
+```
+
+### `packages/testing`
+
+**Rules:**
+12. No files in `packages/testing` import from `@calcom/web` or `@calcom/web/**`
+13. No files in `packages/testing` import from `@calcom/features` or `@calcom/features/**`
+14. No files in `packages/testing` import from `../../apps/web/**`
+15. No files in `packages/testing` import from `../features/**`
+
+**Incorrect:**
+
+```typescript
+// Bad - testing importing from web or features
+import { WebComponent } from "@calcom/web/components";
+import { BookingService } from "@calcom/features/bookings";
+```
+
+**Correct:**
+
+```typescript
+// Good - testing imports from lib and prisma
+import { prisma } from "@calcom/prisma";
+import { logger } from "@calcom/lib/logger";
+```
+
+### `packages/platform/atoms`
+
+**Rules:**
+16. No files in `packages/platform/atoms` import from `@calcom/trpc` or `@calcom/trpc/**`
+17. No files in `packages/platform/atoms` import from `../../trpc` or `../../trpc/**`
+18. No files in `packages/platform/atoms` import from `@calcom/web`
+
+**Incorrect:**
+
+```typescript
+// Bad - platform/atoms importing from trpc or web
+import { router } from "@calcom/trpc/server/trpc";
+import { trpc } from "../../trpc";
+import { WebComponent } from "@calcom/web";
+```
+
+**Correct:**
+
+```typescript
+// Good - platform/atoms imports from lib, features, and ui
+import { logger } from "@calcom/lib/logger";
+import { Button } from "@calcom/ui/components/button";
+import type { Booking } from "@calcom/features/bookings/types";
+```
+
+## Enforcement
+
+These rules should be enforced through:
+- ESLint rules that detect forbidden import paths
+- CI checks that fail on circular dependencies
+- Code review guidelines that flag violations
@@ -0,0 +1,240 @@
+---
+title: Trigger.dev Task Implementation
+impact: HIGH
+impactDescription: Consistent Trigger.dev patterns ensure reliable async task execution across web and API v2
+tags: trigger.dev, async, tasker, concurrency, cron, scheduled-tasks
+---
+
+# Trigger.dev Task Implementation
+
+Trigger.dev is the async task runner used in both `apps/web` and `apps/api/v2`. Tasks can be disabled via the `ENABLE_ASYNC_TASKER` env var (set to `"false"` to fall back to synchronous execution).
+
+## Tasker Architecture
+
+Every Trigger.dev feature follows the Tasker pattern with these layers:
+
+```
+packages/features/<domain>/lib/tasker/
+  types.ts                    # ITasker interface + payload types
+  <Domain>Tasker.ts           # Tasker subclass (dispatches async or sync)
+  <Domain>TriggerTasker.ts    # Async implementation (calls .trigger())
+  <Domain>SyncTasker.ts       # Sync fallback (executes inline)
+  <Domain>TaskService.ts      # Business logic consumed by both
+  trigger/
+    config.ts                 # Queue + retry + machine config
+    schema.ts                 # Zod payload schema
+    <task-name>.ts            # schemaTask definition
+```
+
+Reference implementation: `packages/features/calendars/lib/tasker/` — see `CalendarsTasker.ts` for the Tasker subclass pattern and `trigger/config.ts` for queue/retry/machine configuration
+
+## Creating a New Task
+
+### 1. Define the Zod schema for payload validation
+
+Always use `schemaTask` with a Zod schema for payload validation:
+
+```typescript
+// trigger/schema.ts
+import { z } from "zod";
+
+export const myTaskSchema = z.object({
+  userId: z.number(),
+});
+```
+
+### 2. Configure queue, retry, and machine
+
+See `packages/features/calendars/lib/tasker/trigger/config.ts` for a real example.
+
+```typescript
+// trigger/config.ts
+import { type schemaTask, queue } from "@trigger.dev/sdk";
+
+type MyTask = Pick<Parameters<typeof schemaTask>[0], "machine" | "retry" | "queue">;
+
+export const myQueue = queue({
+  name: "my-domain",
+  concurrencyLimit: 10,
+});
+
+export const myTaskConfig: MyTask = {
+  machine: "small-2x",
+  queue: myQueue,
+  retry: {
+    maxAttempts: 3,
+    factor: 2,
+    minTimeoutInMs: 60000,
+    maxTimeoutInMs: 300000,
+    randomize: true,
+    outOfMemory: {
+      machine: "medium-1x",
+    },
+  },
+};
+```
+
+### 3. Define the task using schemaTask
+
+```typescript
+// trigger/my-task.ts
+import { schemaTask, type TaskWithSchema } from "@trigger.dev/sdk";
+import type { z } from "zod";
+
+import { myTaskConfig } from "./config";
+import { myTaskSchema } from "./schema";
+
+export const MY_TASK_JOB_ID = "domain.my-task";
+
+export const myTask: TaskWithSchema<typeof MY_TASK_JOB_ID, typeof myTaskSchema> =
+  schemaTask({
+    id: MY_TASK_JOB_ID,
+    ...myTaskConfig,
+    schema: myTaskSchema,
+    run: async (payload: z.infer<typeof myTaskSchema>) => {
+      const { getMyService } = await import("@calcom/features/<domain>/di/<container>");
+      const service = getMyService();
+      await service.execute(payload);
+    },
+  });
+```
+
+### 4. For scheduled (cron) tasks, use `schedules.task`
+
+```typescript
+import { schedules } from "@trigger.dev/sdk";
+
+export const myScheduledTask = schedules.task({
+  id: "domain.my-scheduled-task",
+  ...myTaskConfig,
+  cron: {
+    pattern: "0 0 1 * *",
+    timezone: "UTC",
+  },
+  run: async (payload) => {
+    // task logic
+  },
+});
+```
+
+Reference: [Trigger.dev Scheduled Tasks](https://trigger.dev/docs/tasks/scheduled)
+
+## Concurrency Configuration
+
+Concurrency limits control how many task runs execute in parallel within a queue. Getting this right is critical for production stability.
+
+**How to estimate concurrency:**
+1. Analyze production logs for the number of requests per minute that will trigger the task (from both `apps/web` and `apps/api/v2`)
+2. Measure the average execution time of the task
+3. Factor in burst patterns (e.g., peak booking hours)
+
+**Guidelines:**
+- Time-sensitive tasks (emails, webhooks) need higher concurrency
+- Background jobs that are not time-sensitive can use lower concurrency
+- Start conservative and increase based on production metrics
+
+See `packages/features/calendars/lib/tasker/trigger/config.ts` (`concurrencyLimit: 10`) and `packages/features/webhooks/lib/tasker/trigger/config.ts` (`concurrencyLimit: 20`) for real examples of how concurrency is tuned per domain.
+
+Reference: [Trigger.dev Concurrency & Queues](https://trigger.dev/docs/queue-concurrency)
+
+## Local Development
+
+1. Set env vars:
+   ```
+   TRIGGER_SECRET_KEY=<your-trigger-secret>
+   TRIGGER_API_URL=https://api.trigger.dev
+   ENABLE_ASYNC_TASKER="true"
+   ```
+
+2. Run the Trigger.dev CLI from the features package:
+   ```bash
+   cd packages/features && npx trigger.dev@latest dev --analyze
+   ```
+
+3. Keep the CLI running while developing. Tasks appear in the Trigger.dev dashboard under **Tasks**.
+
+## Before Merging
+
+1. **Deploy to staging**: `cd packages/features && yarn deploy:trigger:staging`
+2. **Test on Trigger.dev dashboard**: Switch to staging environment and use the **Test** tab
+3. **Right-size machines**: Start with the smallest machine; increase only if you see `OutOfMemory` errors
+4. **Set retry with OOM handling**: Always include `outOfMemory` in retry config with a larger machine than the default
+5. **Set concurrency**: Analyze production request volume and task completion time to determine the appropriate `concurrencyLimit`
+6. **Cherry-pick caveat**: Cherry-picking does not redeploy Trigger.dev tasks. Only the `draft-release` CI action does. If cherry-picking a change that impacts Trigger.dev tasks, manually promote the new version in the Trigger.dev deployment dashboard after the fix is deployed
+
+## Common Mistakes
+
+**Using `task` instead of `schemaTask`:**
+
+```typescript
+// Bad - no payload validation
+import { task } from "@trigger.dev/sdk";
+export const myTask = task({
+  id: "my-task",
+  run: async (payload: any) => { ... },
+});
+
+// Good - validated payload with Zod
+import { schemaTask } from "@trigger.dev/sdk";
+export const myTask = schemaTask({
+  id: "my-task",
+  schema: myTaskSchema,
+  run: async (payload) => { ... },
+});
+```
+
+**Missing retry or queue config:**
+
+```typescript
+// Bad - no retry or queue, will use defaults
+export const myTask = schemaTask({
+  id: "my-task",
+  schema: myTaskSchema,
+  run: async (payload) => { ... },
+});
+
+// Good - explicit config from shared config file
+import { myTaskConfig } from "./config";
+
+export const myTask = schemaTask({
+  id: "my-task",
+  ...myTaskConfig,
+  schema: myTaskSchema,
+  run: async (payload) => { ... },
+});
+```
+
+**Importing eagerly inside task files instead of using dynamic imports:**
+
+```typescript
+// Bad - eager import of heavy modules at file scope
+import { MyService } from "@calcom/features/domain/service/MyService";
+
+export const myTask = schemaTask({
+  id: "my-task",
+  schema: myTaskSchema,
+  run: async (payload) => {
+    const service = new MyService();
+    await service.execute(payload);
+  },
+});
+
+// Good - dynamic import inside run function
+export const myTask = schemaTask({
+  id: "my-task",
+  schema: myTaskSchema,
+  run: async (payload) => {
+    const { getMyService } = await import("@calcom/features/domain/di/container");
+    const service = getMyService();
+    await service.execute(payload);
+  },
+});
+```
+
+## Key References
+
+- Trigger.dev docs: [Concurrency & Queues](https://trigger.dev/docs/queue-concurrency), [Scheduled Tasks](https://trigger.dev/docs/tasks/scheduled), [schemaTask](https://trigger.dev/docs/tasks/schemaTask)
+- Example taskers in the codebase:
+  - `packages/features/calendars/lib/tasker/` (standard pattern)
+  - `packages/features/webhooks/lib/tasker/` (webhook delivery)
+  - `packages/features/ee/billing/service/proration/tasker/` (scheduled cron task)
@@ -13,10 +13,13 @@ Keep comments limited and avoid obvious ones. Comments should explain "why" not

 ## When to Comment

- Complex business logic that isn't obvious from the code
+- Business decisions or domain logic that isn't obvious from the code
 - Workarounds or hacks with explanation of why they're needed
 - Non-obvious performance optimizations
 - Important security considerations
+- Troubleshooting context (e.g., why a particular approach was chosen after hitting issues)
+
+If none of these apply, skip the comment entirely. The function name, parameters, and return type should speak for themselves.

 ## When NOT to Comment

@@ -33,7 +33,7 @@ tags: reference, navigation, file-locations

 ## Translations

- English: `apps/web/public/static/locales/en/common.json`
+- English: `packages/i18n/locales/en/common.json`

 ## App Store

@@ -1,6 +1,19 @@
 ---
 name: calcom-api
 description: Interact with the Cal.com API v2 to manage scheduling, bookings, event types, availability, and calendars. Use this skill when building integrations that need to create or manage bookings, check availability, configure event types, or sync calendars with Cal.com's scheduling infrastructure.
+env:
+  CAL_API_KEY:
+    description: "Cal.com API key (prefixed with cal_live_ or cal_test_). Required for all API requests."
+    required: true
+  CAL_CLIENT_ID:
+    description: "OAuth client ID for platform integrations managing users on behalf of others. Sent as x-cal-client-id header."
+    required: false
+  CAL_SECRET_KEY:
+    description: "OAuth client secret for platform integrations. Sent as x-cal-secret-key header."
+    required: false
+  CAL_WEBHOOK_SECRET:
+    description: "Secret used to verify webhook payload signatures via X-Cal-Signature-256 header."
+    required: false
 ---

 # Cal.com API v2
@@ -14,6 +27,15 @@ All API requests should be made to:
 https://api.cal.com/v2
 ```

+## Required Credentials
+
+| Environment Variable | Required | Description |
+|---------------------|----------|-------------|
+| `CAL_API_KEY` | Yes | Cal.com API key (prefixed with `cal_live_` or `cal_test_`). Used as Bearer token for all API requests. Generate from Settings > Developer > API Keys. |
+| `CAL_CLIENT_ID` | No | OAuth client ID for platform integrations that manage users on behalf of others. Sent as `x-cal-client-id` header. |
+| `CAL_SECRET_KEY` | No | OAuth client secret for platform integrations. Sent as `x-cal-secret-key` header. |
+| `CAL_WEBHOOK_SECRET` | No | Secret for verifying webhook payload signatures via the `X-Cal-Signature-256` header. |
+
 ## Authentication

 All API requests require authentication via Bearer token:
@@ -1,10 +0,0 @@
-const path = require("node:path");
-const i18nConfig = require("@calcom/config/next-i18next.config");
-
-/** @type {import("next-i18next").UserConfig} */
-const config = {
-  ...i18nConfig,
-  localePath: path.resolve("../../web/public/static/locales"),
-};
-
-module.exports = config;
@@ -82,6 +82,7 @@ async function handler(req: NextApiRequest) {
  return await handleCancelBooking({
    bookingData: { id, allRemainingBookings, cancellationReason, cancelledBy },
    userId: req.userId,
+    actionSource: "API_V1",
  });
 }

@@ -1,7 +1,7 @@
 import type { NextApiRequest } from "next";

 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
-import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
+import { SelectedCalendarRepository } from "@calcom/features/selectedCalendar/repositories/SelectedCalendarRepository";

 import { selectedCalendarIdSchema } from "~/lib/validations/selected-calendar";

@@ -1,7 +1,7 @@
 import type { NextApiRequest } from "next";

 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
-import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
+import { SelectedCalendarRepository } from "@calcom/features/selectedCalendar/repositories/SelectedCalendarRepository";

 import { schemaSelectedCalendarPublic, selectedCalendarIdSchema } from "~/lib/validations/selected-calendar";

@@ -2,8 +2,8 @@ import type { NextApiRequest } from "next";

 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
-import type { UpdateArguments } from "@calcom/lib/server/repository/selectedCalendar";
-import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
+import type { UpdateArguments } from "@calcom/features/selectedCalendar/repositories/SelectedCalendarRepository";
+import { SelectedCalendarRepository } from "@calcom/features/selectedCalendar/repositories/SelectedCalendarRepository";
 import prisma from "@calcom/prisma";
 import type { Prisma } from "@calcom/prisma/client";

@@ -2,8 +2,8 @@ import type { NextApiRequest } from "next";

 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
-import type { FindManyArgs } from "@calcom/lib/server/repository/selectedCalendar";
-import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
+import type { FindManyArgs } from "@calcom/features/selectedCalendar/repositories/SelectedCalendarRepository";
+import { SelectedCalendarRepository } from "@calcom/features/selectedCalendar/repositories/SelectedCalendarRepository";

 import { schemaSelectedCalendarPublic } from "~/lib/validations/selected-calendar";
 import { schemaQuerySingleOrMultipleUserIds } from "~/lib/validations/shared/queryUserId";
@@ -2,7 +2,7 @@ import type { NextApiRequest } from "next";

 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
-import { SelectedCalendarRepository } from "@calcom/lib/server/repository/selectedCalendar";
+import { SelectedCalendarRepository } from "@calcom/features/selectedCalendar/repositories/SelectedCalendarRepository";
 import prisma from "@calcom/prisma";
 import type { Prisma } from "@calcom/prisma/client";

@@ -1,4 +1,3 @@
-// TODO: Fix tests (These test were never running due to the vitest workspace config)
 import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";

 import type { Request, Response } from "express";
@@ -174,7 +173,7 @@ vi.mock("@calcom/features/ee/workflows/lib/getAllWorkflowsFromEventType", () =>
  getAllWorkflowsFromEventType: vi.fn().mockResolvedValue([]),
 }));

-vi.mock("@calcom/lib/server/i18n", () => {
+vi.mock("@calcom/i18n/server", () => {
  const mockT = (key: string, options?: any) => {
    if (key === "event_between_users") {
      return `${options?.eventName} between ${options?.host} and ${options?.attendeeName}`;
@@ -14,7 +14,7 @@ import handler from "../../../pages/api/users/_post";
 type CustomNextApiRequest = NextApiRequest & Request;
 type CustomNextApiResponse = NextApiResponse & Response;

-vi.mock("@calcom/lib/server/i18n", () => {
+vi.mock("@calcom/i18n/server", () => {
  return {
    getTranslation: (key: string) => {
      return () => key;
@@ -1 +1 @@
-export const TRIGGER_VERSION = '20260205.1';
+export const TRIGGER_VERSION = '20260216.1';
@@ -27,7 +27,7 @@ CALENDSO_ENCRYPTION_KEY="Lmqy57DlHKPvwwrtkwjL/8QtxJWxC/OV"
 # Service Account Encryption Key for encrypting/decrypting service account keys
 CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY="LDBFYLEVICRZBYQZUZCSTZRJFZUKZMEI"
 # url to redis instance running in Docker and used to cache data. Redis is setup in apps/api/v2/docker-compose.yaml
-REDIS_URL="rediss://localhost:6379"
+REDIS_URL="redis://localhost:6379"

 # KEEP THIS EMPTY, DISABLE SENTRY CLIENT INSIDE OF LIBRARIES USED BY APIv2
 NEXT_PUBLIC_SENTRY_DSN=
@@ -1,11 +0,0 @@
-/* eslint-disable @typescript-eslint/no-var-requires */
-const path = require("node:path");
-const i18nConfig = require("@calcom/config/next-i18next.config");
-
-/** @type {import("next-i18next").UserConfig} */
-const config = {
-  ...i18nConfig,
-  localePath: path.resolve("../../web/public/static/locales"),
-};
-
-module.exports = config;
@@ -62,7 +62,7 @@
    "@sentry/node": "9.46.0",
    "@sentry/profiling-node": "9.46.0",
    "@snyk/protect": "latest",
-    "axios": "1.13.2",
+    "axios": "1.13.5",
    "body-parser": "1.20.3",
    "bull": "4.15.1",
    "class-transformer": "0.5.1",
@@ -13,6 +13,7 @@ import { RedirectsMiddleware } from "@/middleware/app.redirects.middleware";
 import { RewriterMiddleware } from "@/middleware/app.rewrites.middleware";
 import { JsonBodyMiddleware } from "@/middleware/body/json.body.middleware";
 import { RawBodyMiddleware } from "@/middleware/body/raw.body.middleware";
+import { UrlencodedBodyMiddleware } from "@/middleware/body/urlencoded.body.middleware";
 import { ResponseInterceptor } from "@/middleware/request-ids/request-id.interceptor";
 import { RequestIdMiddleware } from "@/middleware/request-ids/request-id.middleware";
 import { AuthModule } from "@/modules/auth/auth.module";
@@ -100,6 +101,17 @@ export class AppModule implements NestModule {
          method: RequestMethod.POST,
        }
      )
+      .apply(UrlencodedBodyMiddleware)
+      .forRoutes(
+        {
+          path: "/v2/auth/oauth2/token",
+          method: RequestMethod.POST,
+        },
+        {
+          path: "/api/v2/auth/oauth2/token",
+          method: RequestMethod.POST,
+        }
+      )
      .apply(JsonBodyMiddleware)
      .forRoutes("*")
      .apply(RequestIdMiddleware)
@@ -14,7 +14,7 @@ import {
  handleCancelBooking,
  handleMarkNoShow,
 } from "@calcom/platform-libraries";
-import { type InstantBookingCreateResult } from "@calcom/platform-libraries/bookings";
+import { type InstantBookingCreateResult, makeUserActor } from "@calcom/platform-libraries/bookings";
 import { ErrorCode, HttpError } from "@calcom/platform-libraries/errors";
 import type { ApiResponse } from "@calcom/platform-types";
 import {
@@ -279,6 +279,7 @@ export class BookingsController_2024_04_15 {
          platformCancelUrl: bookingRequest.platformCancelUrl,
          platformRescheduleUrl: bookingRequest.platformRescheduleUrl,
          platformBookingUrl: bookingRequest.platformBookingUrl,
+          actionSource: "API_V2",
        });
        if (!res.onlyRemovedAttendee && res.isPlatformManagedUserBooking) {
          void (await this.billingService.cancelUsageByBookingUid(res.bookingUid));
@@ -314,7 +315,8 @@ export class BookingsController_2024_04_15 {
        attendees: body.attendees,
        noShowHost: body.noShowHost,
        userId: user.id,
-        userUuid: user.uuid,
+        actor: makeUserActor(user.uuid),
+        actionSource: "API_V2",
      });

      return { status: SUCCESS_STATUS, data: markNoShowResponse };
@@ -610,6 +612,10 @@ export class BookingsController_2024_04_15 {
      ...clone.body,
      noEmail: oAuthParams === undefined ? false : !oAuthParams.arePlatformEmailsEnabled,
      creationSource: CreationSource.API_V2,
+      metadata: {
+        ...(clone.body.metadata || {}),
+        ...(oAuthClientId && { platformClientId: oAuthClientId }),
+      },
    };
    if (oAuthClientId) {
      await this.setPlatformAttendeesEmails(clone.body, oAuthClientId);
@@ -1,9 +1,12 @@
+import { Module } from "@nestjs/common";
+import { BookingAttendeesController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/booking-attendees.controller";
 import { BookingGuestsController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/booking-guests.controller";
 import { BookingLocationController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/booking-location.controller";
 import { BookingsController_2024_08_13 } from "@/ee/bookings/2024-08-13/controllers/bookings.controller";
 import { BookingPbacGuard } from "@/ee/bookings/2024-08-13/guards/booking-pbac.guard";
 import { BookingReferencesRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/repositories/booking-references.repository";
 import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/repositories/bookings.repository";
+import { BookingAttendeesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-attendees.service";
 import { BookingGuestsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-guests.service";
 import { BookingLocationService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-location.service";
 import { BookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-references.service";
@@ -12,20 +15,22 @@ import { CalVideoOutputService } from "@/ee/bookings/2024-08-13/services/cal-vid
 import { CalVideoService } from "@/ee/bookings/2024-08-13/services/cal-video.service";
 import { ErrorsBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/errors.service";
 import { InputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/input.service";
-import { OutputBookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output-booking-references.service";
 import { OutputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output.service";
+import { OutputBookingReferencesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/output-booking-references.service";
 import { PlatformBookingsService } from "@/ee/bookings/shared/platform-bookings.service";
 import { CalendarsRepository } from "@/ee/calendars/calendars.repository";
-import { CalendarsCacheService } from "@/ee/calendars/services/calendars-cache.service";
 import { CalendarsService } from "@/ee/calendars/services/calendars.service";
+import { CalendarsCacheService } from "@/ee/calendars/services/calendars-cache.service";
 import { EventTypesModule_2024_04_15 } from "@/ee/event-types/event-types_2024_04_15/event-types.module";
 import { EventTypesModule_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.module";
 import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.repository";
 import { OutputEventTypesService_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/services/output-event-types.service";
 import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
+import { BookingEventHandlerModule } from "@/lib/modules/booking-event-handler.module";
 import { InstantBookingModule } from "@/lib/modules/instant-booking.module";
 import { RecurringBookingModule } from "@/lib/modules/recurring-booking.module";
 import { RegularBookingModule } from "@/lib/modules/regular-booking.module";
+import { PrismaFeaturesRepository } from "@/lib/repositories/prisma-features.repository";
 import { ApiKeysRepository } from "@/modules/api-keys/api-keys-repository";
 import { AppsRepository } from "@/modules/apps/apps.repository";
 import { BillingModule } from "@/modules/billing/billing.module";
@@ -49,8 +54,6 @@ import { TeamsModule } from "@/modules/teams/teams/teams.module";
 import { TokensModule } from "@/modules/tokens/tokens.module";
 import { TokensRepository } from "@/modules/tokens/tokens.repository";
 import { UsersModule } from "@/modules/users/users.module";
-import { Module } from "@nestjs/common";
-import { BookingEventHandlerModule } from "@/lib/modules/booking-event-handler.module";

@Module({
  imports: [
@@ -80,6 +83,7 @@ import { BookingEventHandlerModule } from "@/lib/modules/booking-event-handler.m
    OAuthClientRepository,
    OAuthClientUsersService,
    BookingsService_2024_08_13,
+    BookingAttendeesService_2024_08_13,
    BookingGuestsService_2024_08_13,
    InputBookingsService_2024_08_13,
    OutputBookingsService_2024_08_13,
@@ -105,9 +109,11 @@ import { BookingEventHandlerModule } from "@/lib/modules/booking-event-handler.m
    CalVideoOutputService,
    BookingPbacGuard,
    BookingLocationService_2024_08_13,
+    PrismaFeaturesRepository,
  ],
  controllers: [
    BookingsController_2024_08_13,
+    BookingAttendeesController_2024_08_13,
    BookingGuestsController_2024_08_13,
    BookingLocationController_2024_08_13,
  ],
@@ -0,0 +1,71 @@
+import { BOOKING_WRITE, SUCCESS_STATUS } from "@calcom/platform-constants";
+import { AddAttendeeInput_2024_08_13 } from "@calcom/platform-types";
+import { Body, Controller, HttpCode, HttpStatus, Param, Post, UseGuards } from "@nestjs/common";
+import { ApiHeader, ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { BookingPbacGuard } from "@/ee/bookings/2024-08-13/guards/booking-pbac.guard";
+import { BookingUidGuard } from "@/ee/bookings/2024-08-13/guards/booking-uid.guard";
+import { AddAttendeeOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/add-attendee.output";
+import { BookingAttendeesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-attendees.service";
+import { VERSION_2024_08_13, VERSION_2024_08_13_VALUE } from "@/lib/api-versions";
+import { API_KEY_OR_ACCESS_TOKEN_HEADER } from "@/lib/docs/headers";
+import { Throttle } from "@/lib/endpoint-throttler-decorator";
+import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
+import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
+
+@Controller({
+  path: "/v2/bookings/:bookingUid/attendees",
+  version: VERSION_2024_08_13_VALUE,
+})
+@UseGuards(PermissionsGuard)
+@DocsTags("Bookings / Attendees")
+@ApiHeader({
+  name: "cal-api-version",
+  description: `Must be set to ${VERSION_2024_08_13}. This header is required as this endpoint does not exist in older API versions.`,
+  example: VERSION_2024_08_13,
+  required: true,
+})
+export class BookingAttendeesController_2024_08_13 {
+  constructor(private readonly bookingAttendeesService: BookingAttendeesService_2024_08_13) {}
+
+  @Post("/")
+  @HttpCode(HttpStatus.CREATED)
+  @Permissions([BOOKING_WRITE])
+  @UseGuards(ApiAuthGuard, BookingUidGuard, BookingPbacGuard)
+  @Throttle({
+    limit: 5,
+    ttl: 60000,
+    blockDuration: 60000,
+    name: "booking_attendees_add",
+  })
+  @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
+  @ApiOperation({
+    summary: "Add an attendee to a booking",
+    description: `Add a new attendee to an existing booking by its UID.
+
+      **Side effects:**
+      - The booking's attendee list is updated in the database
+      - The calendar event is updated on connected calendars (Google Calendar, Outlook, etc.) to include the new attendee
+      - An email notification is sent to the new attendee with the booking details
+
+      **Permissions:**
+      - The authenticated user must be either the booking organizer, an existing attendee, or have the \`booking.update\` permission for the team
+
+      <Note>The cal-api-version header is required for this endpoint. Without it, the request will fail with a 404 error.</Note>
+      `,
+  })
+  async addAttendee(
+    @Param("bookingUid") bookingUid: string,
+    @Body() body: AddAttendeeInput_2024_08_13,
+    @GetUser() user: ApiAuthGuardUser
+  ): Promise<AddAttendeeOutput_2024_08_13> {
+    const attendee = await this.bookingAttendeesService.addAttendee(bookingUid, body, user);
+
+    return {
+      status: SUCCESS_STATUS,
+      data: attendee,
+    };
+  }
+}
@@ -0,0 +1,415 @@
+import { CAL_API_VERSION_HEADER, SUCCESS_STATUS, VERSION_2024_08_13 } from "@calcom/platform-constants";
+import {
+  AttendeeAddGuestsEmail,
+  AttendeeScheduledEmail,
+  OrganizerAddGuestsEmail,
+} from "@calcom/platform-libraries/emails";
+import type { BookingOutput_2024_08_13, CreateBookingInput_2024_08_13 } from "@calcom/platform-types";
+import type { Team, User } from "@calcom/prisma/client";
+import { INestApplication } from "@nestjs/common";
+import { NestExpressApplication } from "@nestjs/platform-express";
+import { Test } from "@nestjs/testing";
+import request from "supertest";
+import { BookingsRepositoryFixture } from "test/fixtures/repository/bookings.repository.fixture";
+import { EventTypesRepositoryFixture } from "test/fixtures/repository/event-types.repository.fixture";
+import { OAuthClientRepositoryFixture } from "test/fixtures/repository/oauth-client.repository.fixture";
+import { TeamRepositoryFixture } from "test/fixtures/repository/team.repository.fixture";
+import { TokensRepositoryFixture } from "test/fixtures/repository/tokens.repository.fixture";
+import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
+import { randomString } from "test/utils/randomString";
+import { mockThrottlerGuard } from "test/utils/withNoThrottler";
+import { AppModule } from "@/app.module";
+import { bootstrap } from "@/bootstrap";
+import { AddAttendeeOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/add-attendee.output";
+import { CreateBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/create-booking.output";
+import { CreateScheduleInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-schedule.input";
+import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
+import { SchedulesService_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/services/schedules.service";
+import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { UsersModule } from "@/modules/users/users.module";
+
+const attendeeAddGuestsEmailSpy = jest
+  .spyOn(AttendeeAddGuestsEmail.prototype, "getHtml")
+  .mockImplementation(() => Promise.resolve("<p>email</p>"));
+const organizerAddGuestsEmailSpy = jest
+  .spyOn(OrganizerAddGuestsEmail.prototype, "getHtml")
+  .mockImplementation(() => Promise.resolve("<p>email</p>"));
+const attendeeScheduledEmailSpy = jest
+  .spyOn(AttendeeScheduledEmail.prototype, "getHtml")
+  .mockImplementation(() => Promise.resolve("<p>email</p>"));
+
+type TestUser = {
+  user: User;
+  accessToken: string;
+  refreshToken: string;
+};
+
+type TestSetup = {
+  organizer: TestUser;
+  unrelatedUser: TestUser;
+  eventTypeId: number;
+  bookingUid: string;
+  bookingId: number;
+};
+
+describe("Bookings Endpoints 2024-08-13 add attendee", () => {
+  let app: INestApplication;
+  let organization: Team;
+
+  let userRepositoryFixture: UserRepositoryFixture;
+  let bookingsRepositoryFixture: BookingsRepositoryFixture;
+  let schedulesService: SchedulesService_2024_04_15;
+  let eventTypesRepositoryFixture: EventTypesRepositoryFixture;
+  let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
+  let teamRepositoryFixture: TeamRepositoryFixture;
+  let tokensRepositoryFixture: TokensRepositoryFixture;
+
+  let testSetup: TestSetup;
+
+  beforeAll(async () => {
+    mockThrottlerGuard();
+
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule, PrismaModule, UsersModule, SchedulesModule_2024_04_15],
+    })
+      .overrideGuard(PermissionsGuard)
+      .useValue({
+        canActivate: () => true,
+      })
+      .compile();
+
+    userRepositoryFixture = new UserRepositoryFixture(moduleRef);
+    bookingsRepositoryFixture = new BookingsRepositoryFixture(moduleRef);
+    eventTypesRepositoryFixture = new EventTypesRepositoryFixture(moduleRef);
+    oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
+    teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
+    schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
+    tokensRepositoryFixture = new TokensRepositoryFixture(moduleRef);
+
+    organization = await teamRepositoryFixture.create({
+      name: `add-attendee-2024-08-13-organization-${randomString()}`,
+    });
+
+    await setupTestData();
+
+    app = moduleRef.createNestApplication();
+    bootstrap(app as NestExpressApplication);
+
+    await app.init();
+  });
+
+  async function setupTestData() {
+    const oAuthClient = await createOAuthClient(organization.id, true);
+
+    const organizerUser = await userRepositoryFixture.create({
+      email: `add-attendee-2024-08-13-organizer-${randomString()}@api.com`,
+      platformOAuthClients: {
+        connect: { id: oAuthClient.id },
+      },
+    });
+
+    const unrelatedUserData = await userRepositoryFixture.create({
+      email: `add-attendee-2024-08-13-unrelated-${randomString()}@api.com`,
+      platformOAuthClients: {
+        connect: { id: oAuthClient.id },
+      },
+    });
+
+    const organizerTokens = await tokensRepositoryFixture.createTokens(organizerUser.id, oAuthClient.id);
+    const unrelatedUserTokens = await tokensRepositoryFixture.createTokens(
+      unrelatedUserData.id,
+      oAuthClient.id
+    );
+
+    const schedule: CreateScheduleInput_2024_04_15 = {
+      name: `add-attendee-2024-08-13-schedule-${randomString()}`,
+      timeZone: "Europe/Rome",
+      isDefault: true,
+    };
+    await schedulesService.createUserSchedule(organizerUser.id, schedule);
+
+    const eventType = await eventTypesRepositoryFixture.create(
+      {
+        title: `add-attendee-2024-08-13-event-type-${randomString()}`,
+        slug: `add-attendee-2024-08-13-event-type-${randomString()}`,
+        length: 60,
+      },
+      organizerUser.id
+    );
+
+    testSetup = {
+      organizer: {
+        user: organizerUser,
+        accessToken: organizerTokens.accessToken,
+        refreshToken: organizerTokens.refreshToken,
+      },
+      unrelatedUser: {
+        user: unrelatedUserData,
+        accessToken: unrelatedUserTokens.accessToken,
+        refreshToken: unrelatedUserTokens.refreshToken,
+      },
+      eventTypeId: eventType.id,
+      bookingUid: "",
+      bookingId: 0,
+    };
+  }
+
+  async function createOAuthClient(organizationId: number, emailsEnabled: boolean) {
+    const data = {
+      logo: "logo-url",
+      name: "name",
+      redirectUris: ["http://localhost:5555"],
+      permissions: 32,
+      areEmailsEnabled: emailsEnabled,
+    };
+    const secret = "secret";
+
+    const client = await oauthClientRepositoryFixture.create(organizationId, data, secret);
+    return client;
+  }
+
+  beforeEach(async () => {
+    attendeeAddGuestsEmailSpy.mockClear();
+    organizerAddGuestsEmailSpy.mockClear();
+    attendeeScheduledEmailSpy.mockClear();
+  });
+
+  describe("POST /v2/bookings/:bookingUid/attendees", () => {
+    beforeAll(async () => {
+      const createBookingBody: CreateBookingInput_2024_08_13 = {
+        start: new Date(Date.UTC(2030, 0, 10, 13, 0, 0)).toISOString(),
+        eventTypeId: testSetup.eventTypeId,
+        attendee: {
+          name: "Original Attendee",
+          email: "original.attendee@gmail.com",
+          timeZone: "Europe/Rome",
+          language: "it",
+        },
+        location: "https://meet.google.com/abc-def-ghi",
+        bookingFieldsResponses: {
+          customField: "customValue",
+        },
+        metadata: {
+          userId: "100",
+        },
+      };
+
+      const createBookingResponse = await request(app.getHttpServer())
+        .post("/v2/bookings")
+        .send(createBookingBody)
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .expect(201);
+
+      const createBookingResponseBody: CreateBookingOutput_2024_08_13 = createBookingResponse.body;
+      expect(createBookingResponseBody.status).toEqual(SUCCESS_STATUS);
+
+      if (!responseDataIsBooking(createBookingResponseBody.data)) {
+        throw new Error(
+          "Invalid response data - expected booking but received array of possibly recurring bookings"
+        );
+      }
+
+      testSetup.bookingUid = createBookingResponseBody.data.uid;
+      testSetup.bookingId = createBookingResponseBody.data.id;
+    });
+
+    describe("Authentication", () => {
+      it("should return 401 when adding attendee without authentication", async () => {
+        const addAttendeeBody = {
+          email: "unauthenticated.attendee@example.com",
+          name: "Unauthenticated Attendee",
+          timeZone: "Europe/London",
+        };
+
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13);
+
+        expect(response.status).toBe(401);
+      });
+    });
+
+    describe("Authorization", () => {
+      it("should allow booking organizer to add an attendee", async () => {
+        const addAttendeeBody = {
+          email: "new.attendee@example.com",
+          name: "New Attendee",
+          timeZone: "Europe/London",
+        };
+
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(201);
+
+        const responseBody: AddAttendeeOutput_2024_08_13 = response.body;
+        expect(responseBody.status).toEqual(SUCCESS_STATUS);
+        expect(responseBody.data).toBeDefined();
+        expect(responseBody.data.email).toEqual(addAttendeeBody.email);
+        expect(responseBody.data.name).toEqual(addAttendeeBody.name);
+        expect(responseBody.data.timeZone).toEqual(addAttendeeBody.timeZone);
+        expect(responseBody.data.bookingId).toEqual(testSetup.bookingId);
+        expect(responseBody.data.id).toBeDefined();
+      });
+
+      it("should return 403 when unrelated user tries to add attendee", async () => {
+        const addAttendeeBody = {
+          email: "unauthorized.attendee@example.com",
+          name: "Unauthorized Attendee",
+          timeZone: "America/New_York",
+        };
+
+        await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.unrelatedUser.accessToken}`)
+          .expect(403);
+      });
+    });
+
+    describe("Response format", () => {
+      it("should return attendee with correct structure", async () => {
+        const addAttendeeBody = {
+          email: "structure.test@example.com",
+          name: "Structure Test Attendee",
+          timeZone: "Asia/Tokyo",
+        };
+
+        const response = await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(201);
+
+        const responseBody: AddAttendeeOutput_2024_08_13 = response.body;
+
+        expect(responseBody).toHaveProperty("status", SUCCESS_STATUS);
+        expect(responseBody).toHaveProperty("data");
+        expect(responseBody.data).toHaveProperty("id");
+        expect(responseBody.data).toHaveProperty("bookingId");
+        expect(responseBody.data).toHaveProperty("name");
+        expect(responseBody.data).toHaveProperty("email");
+        expect(responseBody.data).toHaveProperty("timeZone");
+
+        expect(typeof responseBody.data.id).toBe("number");
+        expect(typeof responseBody.data.bookingId).toBe("number");
+        expect(typeof responseBody.data.name).toBe("string");
+        expect(typeof responseBody.data.email).toBe("string");
+        expect(typeof responseBody.data.timeZone).toBe("string");
+      });
+    });
+
+    describe("Validation", () => {
+      it("should return 400 when email is missing", async () => {
+        const addAttendeeBody = {
+          name: "No Email Attendee",
+          timeZone: "Europe/London",
+        };
+
+        await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(400);
+      });
+
+      it("should return 400 when email is invalid", async () => {
+        const addAttendeeBody = {
+          email: "invalid-email",
+          name: "Invalid Email Attendee",
+          timeZone: "Europe/London",
+        };
+
+        await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(400);
+      });
+
+      it("should return 400 when name is missing", async () => {
+        const addAttendeeBody = {
+          email: "no.name@example.com",
+          timeZone: "Europe/London",
+        };
+
+        await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(400);
+      });
+
+      it("should return 400 when timeZone is missing", async () => {
+        const addAttendeeBody = {
+          email: "no.timezone@example.com",
+          name: "No TimeZone Attendee",
+        };
+
+        await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(400);
+      });
+
+      it("should return 400 when timeZone is invalid", async () => {
+        const addAttendeeBody = {
+          email: "invalid.timezone@example.com",
+          name: "Invalid TimeZone Attendee",
+          timeZone: "Invalid/TimeZone",
+        };
+
+        await request(app.getHttpServer())
+          .post(`/v2/bookings/${testSetup.bookingUid}/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(400);
+      });
+
+      it("should return 403 when booking does not exist", async () => {
+        const addAttendeeBody = {
+          email: "nonexistent.booking@example.com",
+          name: "Nonexistent Booking Attendee",
+          timeZone: "Europe/London",
+        };
+
+        await request(app.getHttpServer())
+          .post(`/v2/bookings/non-existent-booking-uid/attendees`)
+          .send(addAttendeeBody)
+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
+          .expect(403);
+      });
+    });
+  });
+
+  afterAll(async () => {
+    await teamRepositoryFixture.delete(organization.id);
+
+    await userRepositoryFixture.deleteByEmail(testSetup.organizer.user.email);
+    await userRepositoryFixture.deleteByEmail(testSetup.unrelatedUser.user.email);
+
+    await bookingsRepositoryFixture.deleteAllBookings(
+      testSetup.organizer.user.id,
+      testSetup.organizer.user.email
+    );
+
+    await app.close();
+  });
+
+  function responseDataIsBooking(data: unknown): data is BookingOutput_2024_08_13 {
+    return !Array.isArray(data) && typeof data === "object" && data !== null && "id" in data;
+  }
+});
@@ -1053,7 +1053,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
            .set("Authorization", `Bearer ${apiKeyString}`)
            .expect(400);

-          expect(response.body.message).toEqual("Cancellation reason is required when you are the host");
+          expect(response.body.message).toEqual("Cancellation reason is required");
        });

        it("should cancel seated booking", async () => {
@@ -515,7 +515,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
              expect(updatedAtDate?.getTime()).toBeGreaterThanOrEqual(beforeCreate.getTime());
              expect(updatedAtDate?.getTime()).toBeLessThanOrEqual(afterCreate.getTime());

-              expect(data.metadata).toEqual(body.metadata);
+              expect(data.metadata).toEqual({...body.metadata, platformClientId: oAuthClient.id});
              createdBooking = data;
            } else {
              throw new Error(
@@ -2115,7 +2115,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
              expect(updatedAtDate?.getTime()).toBeGreaterThanOrEqual(beforeCreate.getTime());
              expect(updatedAtDate?.getTime()).toBeLessThanOrEqual(afterCreate.getTime());

-              expect(data.metadata).toEqual(body.metadata);
+              expect(data.metadata).toEqual({...body.metadata, platformClientId: oAuthClient.id});
              createdBooking = data;
            } else {
              throw new Error(
@@ -2662,16 +2662,22 @@ describe("Bookings Endpoints 2024-08-13", () => {
    });

    describe("calendar events", () => {
+      // Type assertion to access private methods for test spying
+      const eventManagerProto = EventManager.prototype as unknown as Record<
+        "createAllCalendarEvents" | "createAllCRMEvents",
+        (...args: unknown[]) => Promise<unknown[]>
+      >;
+
      beforeEach(() => {
        jest.restoreAllMocks();
        jest
          .spyOn(EventManager.prototype, "create")
          .mockImplementation(() => Promise.resolve({ results: [], referencesToCreate: [] }));
        jest
-          .spyOn(EventManager.prototype, "createAllCalendarEvents")
+          .spyOn(eventManagerProto, "createAllCalendarEvents")
          .mockImplementation(() => Promise.resolve([]));
        jest
-          .spyOn(EventManager.prototype, "createAllCRMEvents")
+          .spyOn(eventManagerProto, "createAllCRMEvents")
          .mockImplementation(() => Promise.resolve([]));
      });

@@ -2843,8 +2849,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
                const data: BookingOutput_2024_08_13 = responseBody.data;
                expect(data.id).toBeDefined();
                expect(data.uid).toBeDefined();
-                expect(EventManager.prototype.createAllCalendarEvents).toHaveBeenCalledTimes(0);
-                expect(EventManager.prototype.createAllCRMEvents).toHaveBeenCalledTimes(0);
+                expect(eventManagerProto.createAllCalendarEvents).toHaveBeenCalledTimes(0);
+                expect(eventManagerProto.createAllCRMEvents).toHaveBeenCalledTimes(0);
              } else {
                throw new Error(
                  "Invalid response data - expected booking but received array of possibly recurring bookings"
@@ -2874,8 +2880,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
              const responseBody: CreateBookingOutput_2024_08_13 = response.body;
              expect(responseBody.status).toEqual(SUCCESS_STATUS);
              expect(responseBody.data).toBeDefined();
-              expect(EventManager.prototype.createAllCalendarEvents).toHaveBeenCalledTimes(0);
-              expect(EventManager.prototype.createAllCRMEvents).toHaveBeenCalledTimes(0);
+              expect(eventManagerProto.createAllCalendarEvents).toHaveBeenCalledTimes(0);
+              expect(eventManagerProto.createAllCRMEvents).toHaveBeenCalledTimes(0);
            });
        });

@@ -2909,8 +2915,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
                  const data: BookingOutput_2024_08_13 = responseBody.data;
                  expect(data.id).toBeDefined();
                  expect(data.uid).toBeDefined();
-                  expect(EventManager.prototype.createAllCalendarEvents).toHaveBeenCalledTimes(0);
-                  expect(EventManager.prototype.createAllCRMEvents).toHaveBeenCalledTimes(0);
+                  expect(eventManagerProto.createAllCalendarEvents).toHaveBeenCalledTimes(0);
+                  expect(eventManagerProto.createAllCRMEvents).toHaveBeenCalledTimes(0);
                  bookingThatRequiresConfirmationUid = data.uid;
                } else {
                  throw new Error(
@@ -2935,8 +2941,8 @@ describe("Bookings Endpoints 2024-08-13", () => {
                  const data: BookingOutput_2024_08_13 = responseBody.data;
                  expect(data.id).toBeDefined();
                  expect(data.uid).toBeDefined();
-                  expect(EventManager.prototype.createAllCalendarEvents).toHaveBeenCalledTimes(0);
-                  expect(EventManager.prototype.createAllCRMEvents).toHaveBeenCalledTimes(0);
+                  expect(eventManagerProto.createAllCalendarEvents).toHaveBeenCalledTimes(0);
+                  expect(eventManagerProto.createAllCRMEvents).toHaveBeenCalledTimes(0);
                } else {
                  throw new Error(
                    "Invalid response data - expected booking but received array of possibly recurring bookings"
@@ -0,0 +1,28 @@
+import { ERROR_STATUS, SUCCESS_STATUS } from "@calcom/platform-constants";
+import { BookingAttendee } from "@calcom/platform-types";
+import { ApiProperty } from "@nestjs/swagger";
+import { Expose, Type } from "class-transformer";
+import { IsEnum, IsNumber, ValidateNested } from "class-validator";
+
+export class BookingAttendeeOutput_2024_08_13 extends BookingAttendee {
+  @ApiProperty({ type: Number, example: 251 })
+  @IsNumber()
+  @Expose()
+  id!: number;
+
+  @ApiProperty({ type: Number, example: 313 })
+  @IsNumber()
+  @Expose()
+  bookingId!: number;
+}
+
+export class AddAttendeeOutput_2024_08_13 {
+  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+
+  @ApiProperty({ type: BookingAttendeeOutput_2024_08_13 })
+  @ValidateNested()
+  @Type(() => BookingAttendeeOutput_2024_08_13)
+  data!: BookingAttendeeOutput_2024_08_13;
+}
@@ -0,0 +1,76 @@
+import { BookingAttendeesService } from "@calcom/platform-libraries/bookings";
+import type { AddAttendeeInput_2024_08_13 } from "@calcom/platform-types";
+import { HttpException, Injectable, NotFoundException } from "@nestjs/common";
+import { plainToClass } from "class-transformer";
+import { BookingAttendeeOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/add-attendee.output";
+import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/repositories/bookings.repository";
+import { PlatformBookingsService } from "@/ee/bookings/shared/platform-bookings.service";
+import type { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
+
+@Injectable()
+export class BookingAttendeesService_2024_08_13 {
+  private bookingAttendeesService: BookingAttendeesService;
+
+  constructor(
+    private readonly bookingsRepository: BookingsRepository_2024_08_13,
+    private readonly platformBookingsService: PlatformBookingsService
+  ) {
+    this.bookingAttendeesService = new BookingAttendeesService();
+  }
+
+  async addAttendee(
+    bookingUid: string,
+    input: AddAttendeeInput_2024_08_13,
+    user: ApiAuthGuardUser
+  ): Promise<BookingAttendeeOutput_2024_08_13> {
+    const booking = await this.bookingsRepository.getByUidWithEventType(bookingUid);
+    if (!booking) {
+      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);
+    }
+
+    const platformClientParams = booking.eventTypeId
+      ? await this.platformBookingsService.getOAuthClientParams(booking.eventTypeId)
+      : undefined;
+
+    const emailsEnabled = platformClientParams ? platformClientParams.arePlatformEmailsEnabled : true;
+
+    const createdAttendee = await this.bookingAttendeesService.addAttendee({
+      bookingId: booking.id,
+      attendee: {
+        email: input.email,
+        name: input.name,
+        timeZone: input.timeZone,
+        phoneNumber: input.phoneNumber,
+        language: input.language,
+      },
+      user: {
+        id: user.id,
+        email: user.email,
+        organizationId: user.organizationId,
+        uuid: user.uuid,
+      },
+      emailsEnabled,
+      actionSource: "API_V2",
+    });
+
+    return plainToClass(
+      BookingAttendeeOutput_2024_08_13,
+      {
+        id: createdAttendee.id,
+        bookingId: createdAttendee.bookingId,
+        name: createdAttendee.name,
+        email: createdAttendee.email,
+        displayEmail: this.getDisplayEmail(createdAttendee.email),
+        timeZone: createdAttendee.timeZone,
+        language: createdAttendee.locale ?? undefined,
+        absent: false,
+        phoneNumber: createdAttendee.phoneNumber ?? undefined,
+      },
+      { strategy: "excludeAll" }
+    );
+  }
+
+  private getDisplayEmail(email: string): string {
+    return email.replace(/\+[a-zA-Z0-9]{25}/, "");
+  }
+}
@@ -10,6 +10,7 @@ import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/reposito
 import { BookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/bookings.service";
 import { InputBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/input.service";
 import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.repository";
+import { PrismaFeaturesRepository } from "@/lib/repositories/prisma-features.repository";
 import { BookingEventHandlerService } from "@/lib/services/booking-event-handler.service";
 import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { EventTypeAccessService } from "@/modules/event-types/services/event-type-access.service";
@@ -26,7 +27,8 @@ export class BookingLocationService_2024_08_13 {
    private readonly inputService: InputBookingsService_2024_08_13,
    private readonly eventTypesRepository: EventTypesRepository_2024_06_14,
    private readonly eventTypeAccessService: EventTypeAccessService,
-    private readonly bookingEventHandlerService: BookingEventHandlerService
+    private readonly bookingEventHandlerService: BookingEventHandlerService,
+    private readonly featuresRepository: PrismaFeaturesRepository
  ) {}

  async updateBookingLocation(
@@ -99,10 +101,15 @@ export class BookingLocationService_2024_08_13 {
      responses: updatedBookingResponses,
    });

+    const organizationId = existingBookingHost.organizationId ?? null;
+    const isBookingAuditEnabled = organizationId
+      ? await this.featuresRepository.checkIfTeamHasFeature(organizationId, "booking-audit")
+      : false;
+
    await this.bookingEventHandlerService.onLocationChanged({
      bookingUid: existingBooking.uid,
      actor: makeUserActor(user.uuid),
-      organizationId: existingBookingHost.organizationId ?? null,
+      organizationId,
      source: "API_V2",
      auditData: {
        location: {
@@ -110,6 +117,7 @@ export class BookingLocationService_2024_08_13 {
          new: bookingLocation,
        },
      },
+      isBookingAuditEnabled,
    });

    return this.bookingsService.getBooking(updatedBooking.uid, user);
@@ -1005,7 +1005,7 @@ export class BookingsService_2024_08_13 {
    bookingUid: string,
    bookingOwnerId: number,
    body: MarkAbsentBookingInput_2024_08_13,
-    userUuid?: string
+    userUuid: string
  ) {
    const bodyTransformed = this.inputService.transformInputMarkAbsentBooking(body);
    const bookingBefore = await this.bookingsRepository.getByUid(bookingUid);
@@ -1034,6 +1034,8 @@ export class BookingsService_2024_08_13 {
      userId: bookingOwnerId,
      userUuid,
      platformClientParams,
+      actor: makeUserActor(userUuid),
+      actionSource: "API_V2",
    });

    const booking = await this.bookingsRepository.getByUidWithAttendeesAndUserAndEvent(bookingUid);
@@ -190,7 +190,10 @@ export class InputBookingsService_2024_08_13 {
      eventTypeId: inputBooking.eventTypeId,
      timeZone: inputBooking.attendee.timeZone,
      language: inputBooking.attendee.language || "en",
-      metadata: inputBooking.metadata || {},
+      metadata: {
+        ...(inputBooking.metadata || {}),
+        ...(platformClientId && { platformClientId }),
+      },
      hasHashedBookingLink: false,
      guests,
      verificationCode: inputBooking.emailVerificationCode,
@@ -7,8 +7,10 @@ import { Scope } from "@nestjs/common";
 import { BookingAuditProducerService } from "@/lib/services/booking-audit-producer.service";
 import { HashedLinkService } from "@/lib/services/hashed-link.service";
 import { TaskerService } from "@/lib/services/tasker.service";
+import { PrismaFeaturesRepository } from "@/lib/repositories/prisma-features.repository";
+import { PrismaWorkerModule } from "@/modules/prisma/prisma-worker.module";
@Module({
-  imports: [RegularBookingModule],
+  imports: [RegularBookingModule, PrismaWorkerModule],
  providers: [
    RecurringBookingService,
    BookingEventHandlerService,
@@ -24,6 +26,8 @@ import { TaskerService } from "@/lib/services/tasker.service";
    BookingAuditProducerService,
    TaskerService,
    /** Required by BookingEventHandlerService - Ends **/
+    /** Required by RecurringBookingService **/
+    PrismaFeaturesRepository,
  ],
  exports: [RecurringBookingService],
 })
@@ -21,6 +21,10 @@ import { TaskerService } from "@/lib/services/tasker.service";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
 import { Module, Scope } from "@nestjs/common";

+import { getWebhookProducer } from "@calcom/platform-libraries/bookings";
+
+import { WEBHOOK_PRODUCER } from "./regular-booking.tokens";
+
@Module({
  imports: [PrismaModule],
  providers: [
@@ -37,6 +41,10 @@ import { Module, Scope } from "@nestjs/common";
      },
      scope: Scope.TRANSIENT,
    },
+    {
+      provide: WEBHOOK_PRODUCER,
+      useFactory: () => getWebhookProducer(),
+    },
    BookingAuditProducerService,
    BookingEventHandlerService,
    CheckBookingAndDurationLimitsService,
@@ -51,6 +59,6 @@ import { Module, Scope } from "@nestjs/common";
    TaskerService,
    RegularBookingService,
  ],
-  exports: [RegularBookingService],
+  exports: [RegularBookingService, WEBHOOK_PRODUCER],
 })
 export class RegularBookingModule {}
@@ -0,0 +1,8 @@
+/**
+ * Injection token for IWebhookProducerService.
+ * Used to bridge the Cal.com DI container into NestJS.
+ *
+ * Defined in a separate file to avoid a circular import between
+ * regular-booking.module.ts and regular-booking.service.ts.
+ */
+export const WEBHOOK_PRODUCER = "WEBHOOK_PRODUCER";
@@ -1,9 +1,14 @@
+import type { OAuth2Tokens } from "@calcom/platform-libraries";
+import { OAuthService as BaseOAuthService } from "@calcom/platform-libraries";
+import { Injectable } from "@nestjs/common";
 import { PrismaAccessCodeRepository } from "@/lib/repositories/prisma-access-code.repository";
 import { PrismaOAuthClientRepository } from "@/lib/repositories/prisma-oauth-client.repository";
 import { PrismaTeamRepository } from "@/lib/repositories/prisma-team.repository";
-import { Injectable } from "@nestjs/common";
-
-import { OAuthService as BaseOAuthService } from "@calcom/platform-libraries";
+import type { OAuth2ExchangeInput } from "@/modules/auth/oauth2/inputs/exchange.input";
+import { OAuth2ExchangeConfidentialInput } from "@/modules/auth/oauth2/inputs/exchange.input";
+import type { OAuth2RefreshInput } from "@/modules/auth/oauth2/inputs/refresh.input";
+import { OAuth2RefreshConfidentialInput } from "@/modules/auth/oauth2/inputs/refresh.input";
+import type { OAuth2TokenInput } from "@/modules/auth/oauth2/inputs/token.input.pipe";

@Injectable()
 export class OAuthService extends BaseOAuthService {
@@ -18,4 +23,32 @@ export class OAuthService extends BaseOAuthService {
      teamsRepository: teamsRepository,
    });
  }
+
+  async handleTokenRequest(clientId: string, body: OAuth2TokenInput): Promise<OAuth2Tokens> {
+    switch (body.grant_type) {
+      case "authorization_code":
+        return this.exchangeAuthorizationCode(clientId, body);
+      case "refresh_token":
+        return this.refreshToken(clientId, body);
+    }
+  }
+
+  private async exchangeAuthorizationCode(
+    clientId: string,
+    body: OAuth2ExchangeInput
+  ): Promise<OAuth2Tokens> {
+    if (body instanceof OAuth2ExchangeConfidentialInput) {
+      return this.exchangeCodeForTokens(clientId, body.code, body.client_secret, body.redirect_uri);
+    }
+
+    return this.exchangeCodeForTokens(clientId, body.code, undefined, body.redirect_uri, body.code_verifier);
+  }
+
+  private async refreshToken(clientId: string, body: OAuth2RefreshInput): Promise<OAuth2Tokens> {
+    if (body instanceof OAuth2RefreshConfidentialInput) {
+      return this.refreshAccessToken(clientId, body.refresh_token, body.client_secret);
+    }
+
+    return this.refreshAccessToken(clientId, body.refresh_token);
+  }
 }
@@ -1,5 +1,6 @@
 import { RegularBookingService } from "@/lib/services/regular-booking.service";
 import { BookingEventHandlerService } from "@/lib/services/booking-event-handler.service";
+import { PrismaFeaturesRepository } from "@/lib/repositories/prisma-features.repository";
 import { Injectable } from "@nestjs/common";

 import { RecurringBookingService as BaseRecurringBookingService } from "@calcom/platform-libraries/bookings";
@@ -8,11 +9,13 @@ import { RecurringBookingService as BaseRecurringBookingService } from "@calcom/
 export class RecurringBookingService extends BaseRecurringBookingService {
  constructor(
    regularBookingService: RegularBookingService,
-    bookingEventHandler: BookingEventHandlerService
+    bookingEventHandler: BookingEventHandlerService,
+    featuresRepository: PrismaFeaturesRepository
  ) {
    super({
      regularBookingService,
      bookingEventHandler,
+      featuresRepository,
    });
  }
 }
@@ -1,3 +1,10 @@
+import {
+  RegularBookingService as BaseRegularBookingService,
+  type IWebhookProducerService,
+} from "@calcom/platform-libraries/bookings";
+import type { PrismaClient } from "@calcom/prisma";
+import { Inject, Injectable } from "@nestjs/common";
+import { WEBHOOK_PRODUCER } from "@/lib/modules/regular-booking.tokens";
 import { PrismaBookingRepository } from "@/lib/repositories/prisma-booking.repository";
 import { PrismaFeaturesRepository } from "@/lib/repositories/prisma-features.repository";
 import { PrismaUserRepository } from "@/lib/repositories/prisma-user.repository";
@@ -7,10 +14,6 @@ import { HashedLinkService } from "@/lib/services/hashed-link.service";
 import { LuckyUserService } from "@/lib/services/lucky-user.service";
 import { BookingEmailAndSmsTasker } from "@/lib/services/tasker/booking-emails-sms-tasker.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
-import { Injectable } from "@nestjs/common";
-
-import { RegularBookingService as BaseRegularBookingService } from "@calcom/platform-libraries/bookings";
-import type { PrismaClient } from "@calcom/prisma";

@Injectable()
 export class RegularBookingService extends BaseRegularBookingService {
@@ -23,7 +26,8 @@ export class RegularBookingService extends BaseRegularBookingService {
    userRepository: PrismaUserRepository,
    bookingEmailAndSmsTasker: BookingEmailAndSmsTasker,
    featuresRepository: PrismaFeaturesRepository,
-    bookingEventHandler: BookingEventHandlerService
+    bookingEventHandler: BookingEventHandlerService,
+    @Inject(WEBHOOK_PRODUCER) webhookProducer: IWebhookProducerService
  ) {
    super({
      checkBookingAndDurationLimitsService,
@@ -35,6 +39,7 @@ export class RegularBookingService extends BaseRegularBookingService {
      bookingEmailAndSmsTasker,
      featuresRepository,
      bookingEventHandler,
+      webhookProducer,
    });
  }
 }
@@ -1,7 +1,6 @@
+import { getTasker, type Tasker } from "@calcom/platform-libraries/tasker";
 import { Injectable } from "@nestjs/common";

-import { getTasker, type Tasker } from "@calcom/platform-libraries";
-
@Injectable()
 export class TaskerService {
  private readonly tasker: Tasker;
@@ -14,5 +13,3 @@ export class TaskerService {
    return this.tasker;
  }
 }
-
-
@@ -0,0 +1,10 @@
+import { Injectable, NestMiddleware } from "@nestjs/common";
+import { urlencoded } from "body-parser";
+import type { Request, Response } from "express";
+
+@Injectable()
+export class UrlencodedBodyMiddleware implements NestMiddleware {
+  use(req: Request, res: Response, next: () => any): void {
+    urlencoded({ extended: true })(req, res, next);
+  }
+}
@@ -1,3 +1,20 @@
+import { ERROR_STATUS, SUCCESS_STATUS } from "@calcom/platform-constants";
+import type { UpdateEventTypeReturn } from "@calcom/platform-libraries/event-types";
+import { listWithTeamHandler, PublicEventType } from "@calcom/platform-libraries/event-types";
+import { ApiResponse } from "@calcom/platform-types";
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  ParseIntPipe,
+  Patch,
+  Query,
+  UseGuards,
+  VERSION_NEUTRAL,
+  Version,
+} from "@nestjs/common";
+import { ApiExcludeController as DocsExcludeController, ApiTags as DocsTags } from "@nestjs/swagger";
 import { GetEventTypePublicOutput } from "@/ee/event-types/event-types_2024_04_15/outputs/get-event-type-public.output";
 import { API_VERSIONS_VALUES } from "@/lib/api-versions";
 import {
@@ -16,24 +33,6 @@ import { IsOrgGuard } from "@/modules/auth/guards/organizations/is-org.guard";
 import { RolesGuard } from "@/modules/auth/guards/roles/roles.guard";
 import { IsTeamInOrg } from "@/modules/auth/guards/teams/is-team-in-org.guard";
 import { UserWithProfile } from "@/modules/users/users.repository";
-import {
-  Controller,
-  Get,
-  Param,
-  ParseIntPipe,
-  UseGuards,
-  Version,
-  VERSION_NEUTRAL,
-  Patch,
-  Body,
-  Query,
-} from "@nestjs/common";
-import { ApiTags as DocsTags, ApiExcludeController as DocsExcludeController } from "@nestjs/swagger";
-
-import { ERROR_STATUS, SUCCESS_STATUS } from "@calcom/platform-constants";
-import type { UpdateEventTypeReturn } from "@calcom/platform-libraries/event-types";
-import { PublicEventType } from "@calcom/platform-libraries/event-types";
-import { ApiResponse } from "@calcom/platform-types";

 /*
 Event-types endpoints for atoms, split from AtomsController for clarity and maintainability.
@@ -49,6 +48,17 @@ These endpoints should not be recommended for use by third party and are exclude
 export class AtomsEventTypesController {
  constructor(private readonly eventTypesService: EventTypesAtomService) {}

+  @Get("/event-types/list-with-team")
+  @Version(VERSION_NEUTRAL)
+  @UseGuards(ApiAuthGuard)
+  async listEventTypesWithTeam(@GetUser() user: UserWithProfile): Promise<ApiResponse<unknown>> {
+    const eventTypes = await listWithTeamHandler({ ctx: { user } });
+    return {
+      status: SUCCESS_STATUS,
+      data: eventTypes,
+    };
+  }
+
  @Get("/event-types/:eventSlug/public")
  async getPublicEventType(
    @Param("eventSlug") eventSlug: string,
@@ -73,6 +73,21 @@ export class AtomsSchedulesController {
    };
  }

+  @Get("/schedules/event-type/:eventSlug")
+  @Version(VERSION_NEUTRAL)
+  @UseGuards(ApiAuthGuard)
+  @Permissions([SCHEDULE_READ])
+  async getScheduleByEventSlug(
+    @GetUser() user: UserWithProfile,
+    @Param("eventSlug") eventSlug: string
+  ): Promise<ApiResponse<unknown>> {
+    const schedule = await this.schedulesService.getScheduleByEventSlug(user, eventSlug);
+    return {
+      status: SUCCESS_STATUS,
+      data: schedule,
+    };
+  }
+
  @Get("/schedules/all")
  @Version(VERSION_NEUTRAL)
  @UseGuards(ApiAuthGuard)
@@ -1,3 +1,4 @@
+import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { UsersRepository } from "@/modules/users/users.repository";
 import { UserWithProfile } from "@/modules/users/users.repository";
@@ -5,6 +6,7 @@ import { Logger } from "@nestjs/common";
 import { Injectable } from "@nestjs/common";

 import { ScheduleRepository, UpdateScheduleResponse } from "@calcom/platform-libraries/schedules";
+import { getScheduleByEventSlugHandler } from "@calcom/platform-libraries/schedules";
 import { updateSchedule } from "@calcom/platform-libraries/schedules";
 import { UpdateAtomScheduleDto } from "@calcom/platform-types";
 import type { PrismaClient } from "@calcom/prisma";
@@ -15,6 +17,7 @@ export class SchedulesAtomsService {

  constructor(
    private readonly usersRepository: UsersRepository,
+    private readonly dbRead: PrismaReadService,
    private readonly dbWrite: PrismaWriteService
  ) {}

@@ -42,6 +45,13 @@ export class SchedulesAtomsService {
    });
  }

+  async getScheduleByEventSlug(user: UserWithProfile, eventSlug: string) {
+    return getScheduleByEventSlugHandler({
+      ctx: { user, prisma: this.dbRead.prisma as unknown as PrismaClient },
+      input: { eventSlug },
+    });
+  }
+
  async updateUserSchedule({
    input,
    user,
@@ -1,11 +1,12 @@
 import { generateSecret } from "@calcom/platform-libraries";
 import type { Membership, Team, User } from "@calcom/prisma/client";
-import { AccessScope, OAuthClientType } from "@calcom/prisma/enums";
-import { INestApplication } from "@nestjs/common";
-import { NestExpressApplication } from "@nestjs/platform-express";
-import { Test, TestingModule } from "@nestjs/testing";
-import { getToken } from "next-auth/jwt";
+import { AccessScope, OAuthClientStatus, OAuthClientType } from "@calcom/prisma/enums";
+import type { INestApplication } from "@nestjs/common";
+import type { NestExpressApplication } from "@nestjs/platform-express";
+import type { TestingModule } from "@nestjs/testing";
+import { Test } from "@nestjs/testing";
 import request from "supertest";
+import { ApiKeysRepositoryFixture } from "test/fixtures/repository/api-keys.repository.fixture";
 import { MembershipRepositoryFixture } from "test/fixtures/repository/membership.repository.fixture";
 import { OAuth2ClientRepositoryFixture } from "test/fixtures/repository/oauth2-client.repository.fixture";
 import { TeamRepositoryFixture } from "test/fixtures/repository/team.repository.fixture";
@@ -16,24 +17,21 @@ import { bootstrap } from "@/bootstrap";
 import { HttpExceptionFilter } from "@/filters/http-exception.filter";
 import { PrismaExceptionFilter } from "@/filters/prisma-exception.filter";
 import { ZodExceptionFilter } from "@/filters/zod-exception.filter";
+import { OAuthService } from "@/lib/services/oauth.service";
 import { AuthModule } from "@/modules/auth/auth.module";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
 import { UsersModule } from "@/modules/users/users.module";

-// Mock next-auth/jwt getToken for ApiAuthStrategy NEXT_AUTH authentication
+// Mock next-auth/jwt getToken so the NextAuth fallback in ApiAuthStrategy doesn't crash in tests
 jest.mock("next-auth/jwt", () => ({
-  getToken: jest.fn(),
+  getToken: jest.fn().mockResolvedValue(null),
 }));
-const mockGetToken = getToken as jest.MockedFunction<typeof getToken>;

 describe("OAuth2 Controller Endpoints", () => {
  describe("User Not Authenticated", () => {
    let appWithoutAuth: INestApplication;

    beforeAll(async () => {
-      // Mock getToken to return null for unauthenticated tests
-      mockGetToken.mockResolvedValue(null);
-
      const moduleRef = await Test.createTestingModule({
        providers: [PrismaExceptionFilter, HttpExceptionFilter, ZodExceptionFilter],
        imports: [AppModule, UsersModule, AuthModule, PrismaModule],
@@ -49,12 +47,16 @@ describe("OAuth2 Controller Endpoints", () => {
        .expect(401);
    });

-    it("POST /v2/auth/oauth2/clients/:clientId/authorize should return 401 without auth", () => {
+    it("POST /v2/auth/oauth2/token should return 401 without auth", () => {
      return request(appWithoutAuth.getHttpServer())
-        .post("/api/v2/auth/oauth2/clients/test-client-id/authorize")
+        .post("/api/v2/auth/oauth2/token")
+        .type("form")
        .send({
-          redirectUri: "https://example.com/callback",
-          scopes: ["READ_BOOKING"],
+          client_id: "test-client-id",
+          grant_type: "authorization_code",
+          code: "test-code",
+          client_secret: "test-secret",
+          redirect_uri: "https://example.com/callback",
        })
        .expect(401);
    });
@@ -64,33 +66,47 @@ describe("OAuth2 Controller Endpoints", () => {
    });
  });

-  describe("User Authenticated", () => {
+  describe("User Authenticated (non-owner)", () => {
    let app: INestApplication;
    let moduleRef: TestingModule;

    let userRepositoryFixture: UserRepositoryFixture;
    let teamRepositoryFixture: TeamRepositoryFixture;
    let membershipRepositoryFixture: MembershipRepositoryFixture;
+    let apiKeysRepositoryFixture: ApiKeysRepositoryFixture;
    let oAuthClientFixture: OAuth2ClientRepositoryFixture;
+    let oAuthService: OAuthService;

-    let user: User;
+    let clientOwner: User;
+    let authenticatedUser: User;
    let team: Team;
    let membership: Membership;
    let oAuthClient: { clientId: string };
-    let authorizationCode: string;
+    let apiKeyString: string;
    let refreshToken: string;

    const testClientId = `test-oauth-client-${randomString()}`;
    const testClientSecret = "test-secret-123";
    const testRedirectUri = "https://example.com/callback";

+    /** Generate an authorization code directly via the service (bypasses HTTP layer). */
+    async function generateAuthCode(
+      scopes: AccessScope[] = [AccessScope.READ_BOOKING],
+      teamSlug?: string
+    ): Promise<string> {
+      const result = await oAuthService.generateAuthorizationCode(
+        testClientId,
+        authenticatedUser.id,
+        testRedirectUri,
+        scopes,
+        undefined,
+        teamSlug ?? team.slug
+      );
+      const redirectUrl = new URL(result.redirectUrl);
+      return redirectUrl.searchParams.get("code") as string;
+    }
+
    beforeAll(async () => {
-      const userEmail = `oauth2-e2e-user-${randomString()}@api.com`;
-
-      // Mock getToken to return the user email for authenticated tests
-      // This is needed because ApiAuthGuard uses ApiAuthStrategy which calls getToken from next-auth/jwt
-      mockGetToken.mockResolvedValue({ email: userEmail });
-
      moduleRef = await Test.createTestingModule({
        providers: [PrismaExceptionFilter, HttpExceptionFilter, ZodExceptionFilter],
        imports: [AppModule, UsersModule, AuthModule, PrismaModule],
@@ -103,19 +119,28 @@ describe("OAuth2 Controller Endpoints", () => {
      userRepositoryFixture = new UserRepositoryFixture(moduleRef);
      teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
      membershipRepositoryFixture = new MembershipRepositoryFixture(moduleRef);
+      apiKeysRepositoryFixture = new ApiKeysRepositoryFixture(moduleRef);
      oAuthClientFixture = new OAuth2ClientRepositoryFixture(moduleRef);
+      oAuthService = moduleRef.get(OAuthService);

-      user = await userRepositoryFixture.create({
-        email: userEmail,
+      clientOwner = await userRepositoryFixture.create({
+        email: `oauth2-e2e-owner-${randomString()}@api.com`,
      });

+      authenticatedUser = await userRepositoryFixture.create({
+        email: `oauth2-e2e-user-${randomString()}@api.com`,
+      });
+
+      const { keyString } = await apiKeysRepositoryFixture.createApiKey(authenticatedUser.id, null);
+      apiKeyString = keyString;
+
      team = await teamRepositoryFixture.create({
        name: `oauth2-e2e-team-${randomString()}`,
        slug: `oauth2-e2e-team-${randomString()}`,
      });

      membership = await membershipRepositoryFixture.create({
-        user: { connect: { id: user.id } },
+        user: { connect: { id: authenticatedUser.id } },
        team: { connect: { id: team.id } },
        role: "OWNER",
        accepted: true,
@@ -128,180 +153,285 @@ describe("OAuth2 Controller Endpoints", () => {
        redirectUri: testRedirectUri,
        clientSecret: hashedSecret,
        clientType: OAuthClientType.CONFIDENTIAL,
+        userId: clientOwner.id,
      });
    });

    describe("GET /api/v2/auth/oauth2/clients/:clientId", () => {
-      it("should return OAuth client info for valid client ID", async () => {
-        const response = await request(app.getHttpServer())
-          .get(`/api/v2/auth/oauth2/clients/${testClientId}`)
-          .expect(200);
+      describe("Positive tests", () => {
+        it("should return OAuth client info for valid client ID", async () => {
+          const response = await request(app.getHttpServer())
+            .get(`/api/v2/auth/oauth2/clients/${testClientId}`)
+            .set({ Authorization: `Bearer cal_test_${apiKeyString}` })
+            .expect(200);

-        expect(response.body.status).toBe("success");
-        expect(response.body.data.id).toBe(testClientId);
-        expect(response.body.data.name).toBe("Test OAuth Client");
-        expect(response.body.data.redirectUri).toBe(testRedirectUri);
-        expect(response.body.data.type).toBe(OAuthClientType.CONFIDENTIAL);
-        expect(response.body.data.clientSecret).toBeUndefined();
+          expect(response.body.status).toBe("success");
+          expect(response.body.data.client_id).toBe(testClientId);
+          expect(response.body.data.name).toBe("Test OAuth Client");
+          expect(response.body.data.redirect_uri).toBe(testRedirectUri);
+          expect(response.body.data.client_type).toBe(OAuthClientType.CONFIDENTIAL);
+          expect(response.body.data.client_secret).toBeUndefined();
+        });
      });

-      it("should return 404 for non-existent client ID", async () => {
-        await request(app.getHttpServer())
-          .get("/api/v2/auth/oauth2/clients/non-existent-client-id")
-          .expect(404);
+      describe("Negative tests", () => {
+        it("should return 404 for non-existent client ID", async () => {
+          await request(app.getHttpServer())
+            .get("/api/v2/auth/oauth2/clients/non-existent-client-id")
+            .set({ Authorization: `Bearer cal_test_${apiKeyString}` })
+            .expect(404);
+        });
      });
    });

-    describe("POST /api/v2/auth/oauth2/clients/:clientId/authorize", () => {
-      it("should redirect with authorization code for valid request", async () => {
-        const response = await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/authorize`)
-          .send({
-            redirectUri: testRedirectUri,
-            scopes: [AccessScope.READ_BOOKING, AccessScope.READ_PROFILE],
-            teamSlug: team.slug,
-            state: "test-state-123",
-          })
-          .expect(303);
+    describe("POST /api/v2/auth/oauth2/token (authorization_code grant)", () => {
+      describe("Positive tests", () => {
+        it("should exchange authorization code for tokens", async () => {
+          const authorizationCode = await generateAuthCode([
+            AccessScope.READ_BOOKING,
+            AccessScope.READ_PROFILE,
+          ]);

-        expect(response.headers.location).toBeDefined();
-        const redirectUrl = new URL(response.headers.location);
-        expect(redirectUrl.origin + redirectUrl.pathname).toBe(testRedirectUri);
-        expect(redirectUrl.searchParams.get("code")).toBeDefined();
-        expect(redirectUrl.searchParams.get("state")).toBe("test-state-123");
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "authorization_code",
+              code: authorizationCode,
+              client_secret: testClientSecret,
+              redirect_uri: testRedirectUri,
+            })
+            .expect(200);

-        authorizationCode = redirectUrl.searchParams.get("code") as string;
+          expect(response.body.access_token).toBeDefined();
+          expect(response.body.refresh_token).toBeDefined();
+          expect(response.body.token_type).toBe("bearer");
+          expect(response.body.expires_in).toBe(1800);
+          expect(response.headers["cache-control"]).toBe("no-store");
+          expect(response.headers["pragma"]).toBe("no-cache");
+
+          refreshToken = response.body.refresh_token;
+        });
+
+        it("should exchange authorization code for tokens with JSON body", async () => {
+          const code = await generateAuthCode();
+
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .send({
+              client_id: testClientId,
+              grant_type: "authorization_code",
+              code,
+              client_secret: testClientSecret,
+              redirect_uri: testRedirectUri,
+            })
+            .expect(200);
+
+          expect(response.body.access_token).toBeDefined();
+          expect(response.body.refresh_token).toBeDefined();
+          expect(response.body.token_type).toBe("bearer");
+        });
+
+        it("should exchange authorization code for tokens with application/x-www-form-urlencoded body", async () => {
+          const code = await generateAuthCode();
+
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "authorization_code",
+              code,
+              client_secret: testClientSecret,
+              redirect_uri: testRedirectUri,
+            })
+            .expect(200);
+
+          expect(response.body.access_token).toBeDefined();
+          expect(response.body.refresh_token).toBeDefined();
+          expect(response.body.token_type).toBe("bearer");
+          expect(response.body.expires_in).toBe(1800);
+        });
      });

-      it("should redirect with error for invalid client ID", async () => {
-        await request(app.getHttpServer())
-          .post("/api/v2/auth/oauth2/clients/invalid-client-id/authorize")
-          .send({
-            redirectUri: testRedirectUri,
-            scopes: [AccessScope.READ_BOOKING],
-          })
-          .expect(404);
-      });
+      describe("Negative tests", () => {
+        it("should return 400 with RFC 6749 error for invalid/used authorization code", async () => {
+          const code = await generateAuthCode();

-      it("should redirect with error for invalid team slug", async () => {
-        const response = await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/authorize`)
-          .send({
-            redirectUri: testRedirectUri,
-            scopes: [AccessScope.READ_BOOKING],
-            teamSlug: "non-existent-team-slug",
-            state: "test-state-456",
-          })
-          .expect(303);
+          // Use the code once
+          await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "authorization_code",
+              code,
+              client_secret: testClientSecret,
+              redirect_uri: testRedirectUri,
+            })
+            .expect(200);

-        expect(response.headers.location).toBeDefined();
-        const redirectUrl = new URL(response.headers.location);
-        expect(redirectUrl.searchParams.get("error")).toBe("access_denied");
-        expect(redirectUrl.searchParams.get("state")).toBe("test-state-456");
-      });
+          // Try to use the same code again
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "authorization_code",
+              code,
+              client_secret: testClientSecret,
+              redirect_uri: testRedirectUri,
+            })
+            .expect(400);

-      it("should throw error 400 for mismatched redirect URI", async () => {
-        await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/authorize`)
-          .send({
-            redirectUri: "https://wrong-domain.com/callback",
-            scopes: [AccessScope.READ_BOOKING],
-            state: "test-state-789",
-          })
-          .expect(400);
+          expect(response.body.error).toBe("invalid_grant");
+          expect(response.body.error_description).toBe("code_invalid_or_expired");
+        });
+
+        it("should return 401 for invalid client secret", async () => {
+          const code = await generateAuthCode();
+
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "authorization_code",
+              code,
+              client_secret: "wrong-secret",
+              redirect_uri: testRedirectUri,
+            })
+            .expect(401);
+
+          expect(response.body.error).toBe("invalid_client");
+          expect(response.body.error_description).toBe("invalid_client_credentials");
+        });
+
+        it("should return 400 for invalid grant type", async () => {
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "invalid_grant",
+              code: "some-code",
+              redirect_uri: testRedirectUri,
+            })
+            .expect(400);
+
+          expect(response.body.error).toBe("invalid_request");
+          expect(response.body.error_description).toBe(
+            "grant_type must be 'authorization_code' or 'refresh_token'"
+          );
+        });
+
+        it("should return 401 with RFC 6749 error for non-existent client_id", async () => {
+          const code = await generateAuthCode();
+
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: "non-existent-client-id",
+              grant_type: "authorization_code",
+              code,
+              client_secret: testClientSecret,
+              redirect_uri: testRedirectUri,
+            })
+            .expect(401);
+
+          expect(response.body.error).toBe("invalid_client");
+          expect(response.body.error_description).toBe("client_not_found");
+        });
+
+        it("should return 400 with RFC 6749 error when client_id is missing", async () => {
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              grant_type: "authorization_code",
+              code: "some-code",
+              client_secret: testClientSecret,
+              redirect_uri: testRedirectUri,
+            })
+            .expect(400);
+
+          expect(response.body.error).toBe("invalid_request");
+          expect(response.body.error_description).toBe("client_id is required");
+        });
      });
    });

-    describe("POST /api/v2/auth/oauth2/clients/:clientId/exchange", () => {
-      it("should exchange authorization code for tokens", async () => {
-        const response = await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/exchange`)
-          .send({
-            code: authorizationCode,
-            clientSecret: testClientSecret,
-            redirectUri: testRedirectUri,
-          })
-          .expect(200);
+    describe("POST /api/v2/auth/oauth2/token (refresh_token grant)", () => {
+      describe("Positive tests", () => {
+        it("should refresh access token with valid refresh token", async () => {
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "refresh_token",
+              refresh_token: refreshToken,
+              client_secret: testClientSecret,
+            })
+            .expect(200);

-        expect(response.body.status).toBe("success");
-        expect(response.body.data.access_token).toBeDefined();
-        expect(response.body.data.refresh_token).toBeDefined();
-        expect(response.body.data.token_type).toBe("bearer");
-        expect(response.body.data.expires_in).toBe(1800);
-
-        refreshToken = response.body.data.refresh_token;
+          expect(response.body.access_token).toBeDefined();
+          expect(response.body.refresh_token).toBeDefined();
+          expect(response.body.token_type).toBe("bearer");
+          expect(response.body.expires_in).toBe(1800);
+        });
      });

-      it("should return 400 for invalid/used authorization code", async () => {
-        await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/exchange`)
-          .send({
-            code: authorizationCode,
-            clientSecret: testClientSecret,
-            redirectUri: testRedirectUri,
-          })
-          .expect(400);
-      });
+      describe("Negative tests", () => {
+        it("should return 400 with RFC 6749 error for invalid refresh token", async () => {
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "refresh_token",
+              refresh_token: "invalid-refresh-token",
+              client_secret: testClientSecret,
+            })
+            .expect(400);

-      it("should return 401 for invalid client secret", async () => {
-        const newAuthResponse = await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/authorize`)
-          .send({
-            redirectUri: testRedirectUri,
-            scopes: [AccessScope.READ_BOOKING],
-            teamSlug: team.slug,
-          })
-          .expect(303);
+          expect(response.body.error).toBe("invalid_grant");
+          expect(response.body.error_description).toBe("invalid_refresh_token");
+        });

-        const newRedirectUrl = new URL(newAuthResponse.headers.location);
-        const newAuthCode = newRedirectUrl.searchParams.get("code") as string;
+        it("should return 401 for invalid client secret", async () => {
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: testClientId,
+              grant_type: "refresh_token",
+              refresh_token: refreshToken,
+              client_secret: "wrong-secret",
+            })
+            .expect(401);

-        await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/exchange`)
-          .send({
-            code: newAuthCode,
-            clientSecret: "wrong-secret",
-            redirectUri: testRedirectUri,
-          })
-          .expect(401);
-      });
-    });
+          expect(response.body.error).toBe("invalid_client");
+          expect(response.body.error_description).toBe("invalid_client_credentials");
+        });

-    describe("POST /api/v2/auth/oauth2/clients/:clientId/refresh", () => {
-      it("should refresh access token with valid refresh token", async () => {
-        const response = await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/refresh`)
-          .send({
-            refreshToken: refreshToken,
-            clientSecret: testClientSecret,
-          })
-          .expect(200);
+        it("should return 401 with RFC 6749 error for non-existent client_id", async () => {
+          const response = await request(app.getHttpServer())
+            .post("/api/v2/auth/oauth2/token")
+            .type("form")
+            .send({
+              client_id: "wrong-client-id",
+              grant_type: "refresh_token",
+              refresh_token: refreshToken,
+              client_secret: testClientSecret,
+            })
+            .expect(401);

-        expect(response.body.status).toBe("success");
-        expect(response.body.data.access_token).toBeDefined();
-        expect(response.body.data.refresh_token).toBeDefined();
-        expect(response.body.data.token_type).toBe("bearer");
-        expect(response.body.data.expires_in).toBe(1800);
-      });
-
-      it("should return 400 for invalid refresh token", async () => {
-        await request(app.getHttpServer())
-          .post(`/api/v2/auth/oauth2/clients/${testClientId}/refresh`)
-          .send({
-            refreshToken: "invalid-refresh-token",
-            clientSecret: testClientSecret,
-          })
-          .expect(400);
-      });
-
-      it("should return 401 for wrong client ID with valid refresh token", async () => {
-        await request(app.getHttpServer())
-          .post("/api/v2/auth/oauth2/clients/wrong-client-id/refresh")
-          .send({
-            refreshToken: refreshToken,
-            clientSecret: testClientSecret,
-          })
-          .expect(401);
+          expect(response.body.error).toBe("invalid_client");
+          expect(response.body.error_description).toBe("client_not_found");
+        });
      });
    });

@@ -309,7 +439,238 @@ describe("OAuth2 Controller Endpoints", () => {
      await oAuthClientFixture.delete(oAuthClient.clientId);
      await membershipRepositoryFixture.delete(membership.id);
      await teamRepositoryFixture.delete(team.id);
-      await userRepositoryFixture.delete(user.id);
+      await userRepositoryFixture.delete(authenticatedUser.id);
+      await userRepositoryFixture.delete(clientOwner.id);
+      await app.close();
+    });
+  });
+
+  describe("Owner can use non-approved OAuth client", () => {
+    let app: INestApplication;
+    let moduleRef: TestingModule;
+
+    let userRepositoryFixture: UserRepositoryFixture;
+    let teamRepositoryFixture: TeamRepositoryFixture;
+    let membershipRepositoryFixture: MembershipRepositoryFixture;
+    let apiKeysRepositoryFixture: ApiKeysRepositoryFixture;
+    let oAuthClientFixture: OAuth2ClientRepositoryFixture;
+    let oAuthService: OAuthService;
+
+    let owner: User;
+    let team: Team;
+    let membership: Membership;
+    let pendingClient: { clientId: string };
+    let rejectedClient: { clientId: string };
+    let apiKeyString: string;
+
+    const pendingClientId = `test-pending-client-${randomString()}`;
+    const rejectedClientId = `test-rejected-client-${randomString()}`;
+    const testClientSecret = "test-secret-456";
+    const testRedirectUri = "https://example.com/callback";
+
+    /** Generate a user-scoped authorization code (no teamSlug) so the owner's userId is in the token. */
+    async function generateAuthCodeForClient(
+      clientId: string,
+      scopes: AccessScope[] = [AccessScope.READ_BOOKING]
+    ): Promise<string> {
+      const result = await oAuthService.generateAuthorizationCode(
+        clientId,
+        owner.id,
+        testRedirectUri,
+        scopes
+      );
+      const redirectUrl = new URL(result.redirectUrl);
+      return redirectUrl.searchParams.get("code") as string;
+    }
+
+    beforeAll(async () => {
+      moduleRef = await Test.createTestingModule({
+        providers: [PrismaExceptionFilter, HttpExceptionFilter, ZodExceptionFilter],
+        imports: [AppModule, UsersModule, AuthModule, PrismaModule],
+      }).compile();
+
+      app = moduleRef.createNestApplication();
+      bootstrap(app as NestExpressApplication);
+      await app.init();
+
+      userRepositoryFixture = new UserRepositoryFixture(moduleRef);
+      teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
+      membershipRepositoryFixture = new MembershipRepositoryFixture(moduleRef);
+      apiKeysRepositoryFixture = new ApiKeysRepositoryFixture(moduleRef);
+      oAuthClientFixture = new OAuth2ClientRepositoryFixture(moduleRef);
+      oAuthService = moduleRef.get(OAuthService);
+
+      owner = await userRepositoryFixture.create({
+        email: `oauth2-owner-e2e-${randomString()}@api.com`,
+      });
+
+      const { keyString } = await apiKeysRepositoryFixture.createApiKey(owner.id, null);
+      apiKeyString = keyString;
+
+      team = await teamRepositoryFixture.create({
+        name: `oauth2-owner-team-${randomString()}`,
+        slug: `oauth2-owner-team-${randomString()}`,
+      });
+
+      membership = await membershipRepositoryFixture.create({
+        user: { connect: { id: owner.id } },
+        team: { connect: { id: team.id } },
+        role: "OWNER",
+        accepted: true,
+      });
+
+      const [hashedSecret] = generateSecret(testClientSecret);
+
+      pendingClient = await oAuthClientFixture.create({
+        clientId: pendingClientId,
+        name: "Pending OAuth Client",
+        redirectUri: testRedirectUri,
+        clientSecret: hashedSecret,
+        clientType: OAuthClientType.CONFIDENTIAL,
+        status: OAuthClientStatus.PENDING,
+        userId: owner.id,
+      });
+
+      rejectedClient = await oAuthClientFixture.create({
+        clientId: rejectedClientId,
+        name: "Rejected OAuth Client",
+        redirectUri: testRedirectUri,
+        clientSecret: hashedSecret,
+        clientType: OAuthClientType.CONFIDENTIAL,
+        status: OAuthClientStatus.REJECTED,
+        userId: owner.id,
+      });
+    });
+
+    it("should return PENDING client info when authenticated as owner", async () => {
+      const response = await request(app.getHttpServer())
+        .get(`/api/v2/auth/oauth2/clients/${pendingClientId}`)
+        .set({ Authorization: `Bearer cal_test_${apiKeyString}` })
+        .expect(200);
+
+      expect(response.body.status).toBe("success");
+      expect(response.body.data.client_id).toBe(pendingClientId);
+      expect(response.body.data.name).toBe("Pending OAuth Client");
+    });
+
+    it("should exchange authorization code for tokens with PENDING client owned by user", async () => {
+      const code = await generateAuthCodeForClient(pendingClientId);
+
+      const response = await request(app.getHttpServer())
+        .post("/api/v2/auth/oauth2/token")
+        .type("form")
+        .send({
+          client_id: pendingClientId,
+          grant_type: "authorization_code",
+          code,
+          client_secret: testClientSecret,
+          redirect_uri: testRedirectUri,
+        })
+        .expect(200);
+
+      expect(response.body.access_token).toBeDefined();
+      expect(response.body.refresh_token).toBeDefined();
+      expect(response.body.token_type).toBe("bearer");
+    });
+
+    it("should refresh tokens with PENDING client owned by user", async () => {
+      const code = await generateAuthCodeForClient(pendingClientId);
+
+      const tokenResponse = await request(app.getHttpServer())
+        .post("/api/v2/auth/oauth2/token")
+        .type("form")
+        .send({
+          client_id: pendingClientId,
+          grant_type: "authorization_code",
+          code,
+          client_secret: testClientSecret,
+          redirect_uri: testRedirectUri,
+        })
+        .expect(200);
+
+      const response = await request(app.getHttpServer())
+        .post("/api/v2/auth/oauth2/token")
+        .type("form")
+        .send({
+          client_id: pendingClientId,
+          grant_type: "refresh_token",
+          refresh_token: tokenResponse.body.refresh_token,
+          client_secret: testClientSecret,
+        })
+        .expect(200);
+
+      expect(response.body.access_token).toBeDefined();
+      expect(response.body.refresh_token).toBeDefined();
+      expect(response.body.token_type).toBe("bearer");
+    });
+
+    it("should reject authorization code generation for REJECTED client even as owner", async () => {
+      await expect(generateAuthCodeForClient(rejectedClientId)).rejects.toThrow();
+    });
+
+    it("should reject token exchange when client becomes rejected", async () => {
+      const code = await generateAuthCodeForClient(pendingClientId);
+
+      await oAuthClientFixture.updateStatus(pendingClientId, OAuthClientStatus.REJECTED);
+
+      const response = await request(app.getHttpServer())
+        .post("/api/v2/auth/oauth2/token")
+        .type("form")
+        .send({
+          client_id: pendingClientId,
+          grant_type: "authorization_code",
+          code,
+          client_secret: testClientSecret,
+          redirect_uri: testRedirectUri,
+        })
+        .expect(401);
+
+      expect(response.body.error).toBe("unauthorized_client");
+      expect(response.body.error_description).toBe("client_rejected");
+
+      await oAuthClientFixture.updateStatus(pendingClientId, OAuthClientStatus.PENDING);
+    });
+
+    it("should reject token refresh when client becomes rejected", async () => {
+      const code = await generateAuthCodeForClient(pendingClientId);
+
+      const tokenResponse = await request(app.getHttpServer())
+        .post("/api/v2/auth/oauth2/token")
+        .type("form")
+        .send({
+          client_id: pendingClientId,
+          grant_type: "authorization_code",
+          code,
+          client_secret: testClientSecret,
+          redirect_uri: testRedirectUri,
+        })
+        .expect(200);
+
+      await oAuthClientFixture.updateStatus(pendingClientId, OAuthClientStatus.REJECTED);
+
+      const response = await request(app.getHttpServer())
+        .post("/api/v2/auth/oauth2/token")
+        .type("form")
+        .send({
+          client_id: pendingClientId,
+          grant_type: "refresh_token",
+          refresh_token: tokenResponse.body.refresh_token,
+          client_secret: testClientSecret,
+        })
+        .expect(401);
+
+      expect(response.body.error).toBe("unauthorized_client");
+      expect(response.body.error_description).toBe("client_rejected");
+
+      await oAuthClientFixture.updateStatus(pendingClientId, OAuthClientStatus.PENDING);
+    });
+
+    afterAll(async () => {
+      await oAuthClientFixture.delete(pendingClient.clientId);
+      await oAuthClientFixture.delete(rejectedClient.clientId);
+      await membershipRepositoryFixture.delete(membership.id);
+      await teamRepositoryFixture.delete(team.id);
+      await userRepositoryFixture.delete(owner.id);
      await app.close();
    });
  });
@@ -1,46 +1,48 @@
-import { API_VERSIONS_VALUES } from "@/lib/api-versions";
-import { OAuthService } from "@/lib/services/oauth.service";
-import { ApiAuthGuardOnlyAllow } from "@/modules/auth/decorators/api-auth-guard-only-allow.decorator";
-import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
-import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
-import { OAuth2AuthorizeInput } from "@/modules/auth/oauth2/inputs/authorize.input";
-import { OAuth2ExchangeInput } from "@/modules/auth/oauth2/inputs/exchange.input";
-import { OAuth2RefreshInput } from "@/modules/auth/oauth2/inputs/refresh.input";
-import { OAuth2ClientDto, OAuth2ClientResponseDto } from "@/modules/auth/oauth2/outputs/oauth2-client.output";
-import { OAuth2TokensDto, OAuth2TokensResponseDto } from "@/modules/auth/oauth2/outputs/oauth2-tokens.output";
+import { SUCCESS_STATUS } from "@calcom/platform-constants";
 import {
  Body,
  Controller,
  Get,
+  Header,
  HttpCode,
-  HttpException,
  HttpStatus,
-  InternalServerErrorException,
-  Logger,
  Param,
  Post,
-  Res,
+  UseFilters,
  UseGuards,
 } from "@nestjs/common";
-import { ApiExcludeController, ApiOperation, ApiTags } from "@nestjs/swagger";
+import { ApiBody, ApiExtraModels, ApiOperation, ApiTags, getSchemaPath } from "@nestjs/swagger";
 import { plainToInstance } from "class-transformer";
-import type { Response } from "express";
-
-import { SUCCESS_STATUS } from "@calcom/platform-constants";
-import { ErrorWithCode, getHttpStatusCode } from "@calcom/platform-libraries/errors";
+import { API_VERSIONS_VALUES } from "@/lib/api-versions";
+import { OAuthService } from "@/lib/services/oauth.service";
+import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import { OAuth2HttpExceptionFilter } from "@/modules/auth/oauth2/filters/oauth2-http-exception.filter";
+import {
+  OAuth2ExchangeConfidentialInput,
+  OAuth2ExchangePublicInput,
+} from "@/modules/auth/oauth2/inputs/exchange.input";
+import {
+  OAuth2RefreshConfidentialInput,
+  OAuth2RefreshPublicInput,
+} from "@/modules/auth/oauth2/inputs/refresh.input";
+import type { OAuth2TokenInput } from "@/modules/auth/oauth2/inputs/token.input.pipe";
+import { OAuth2TokenInputPipe } from "@/modules/auth/oauth2/inputs/token.input.pipe";
+import { OAuth2ClientDto, OAuth2ClientResponseDto } from "@/modules/auth/oauth2/outputs/oauth2-client.output";
+import { OAuth2TokensDto } from "@/modules/auth/oauth2/outputs/oauth2-tokens.output";
+import { OAuth2ErrorService } from "@/modules/auth/oauth2/services/oauth2-error.service";

@Controller({
-  path: "/v2/auth/oauth2/clients/:clientId",
+  path: "/v2/auth/oauth2",
  version: API_VERSIONS_VALUES,
 })
-@ApiExcludeController(true)
@ApiTags("OAuth2")
 export class OAuth2Controller {
-  private readonly logger = new Logger("OAuth2Controller");
+  constructor(
+    private readonly oAuthService: OAuthService,
+    private readonly errorHandler: OAuth2ErrorService
+  ) {}

-  constructor(private readonly oAuthService: OAuthService) {}
-
-  @Get("/")
+  @Get("/clients/:clientId")
  @HttpCode(HttpStatus.OK)
  @UseGuards(ApiAuthGuard)
  @ApiOperation({
@@ -55,114 +57,50 @@ export class OAuth2Controller {
        status: SUCCESS_STATUS,
        data: plainToInstance(OAuth2ClientDto, client, { strategy: "excludeAll" }),
      };
-    } catch (err: unknown) {
-      if (err instanceof ErrorWithCode) {
-        const statusCode = getHttpStatusCode(err);
-        throw new HttpException(err.message, statusCode);
-      }
-      this.logger.error(err);
-      throw new InternalServerErrorException("Could not get oAuthClient");
+    } catch (err) {
+      this.errorHandler.handleClientError(err, "Failed to retrieve OAuth client");
    }
  }

-  @Post("/authorize")
-  @UseGuards(ApiAuthGuard)
-  @ApiAuthGuardOnlyAllow(["NEXT_AUTH"])
+  @Post("/token")
+  @HttpCode(HttpStatus.OK)
  @ApiOperation({
-    summary: "Generate authorization code",
+    summary: "Exchange authorization code or refresh token for tokens",
    description:
-      "Generates an authorization code for the OAuth2 flow and redirects to the redirect URI with the code. Requires user authentication.",
+      "RFC 6749-compliant token endpoint. Pass client_id in the request body (Section 2.3.1). " +
+      "Use grant_type 'authorization_code' to exchange an auth code for tokens, or 'refresh_token' to refresh an access token. " +
+      "Accepts both application/x-www-form-urlencoded (standard per RFC 6749 Section 4.1.3) and application/json content types.",
  })
-  async authorize(
-    @Param("clientId") clientId: string,
-    @Body() body: OAuth2AuthorizeInput,
-    @GetUser("id") userId: number,
-    @Res() res: Response
-  ): Promise<void> {
+  @ApiBody({
+    schema: {
+      oneOf: [
+        { $ref: getSchemaPath(OAuth2ExchangeConfidentialInput) },
+        { $ref: getSchemaPath(OAuth2ExchangePublicInput) },
+        { $ref: getSchemaPath(OAuth2RefreshConfidentialInput) },
+        { $ref: getSchemaPath(OAuth2RefreshPublicInput) },
+      ],
+    },
+    description:
+      "Token request body. client_id is required. " +
+      "Accepts application/x-www-form-urlencoded (RFC 6749 standard) or application/json. " +
+      "Use grant_type 'authorization_code' with client_secret (confidential) or code_verifier (public/PKCE), or grant_type 'refresh_token' with client_secret (confidential) or just the refresh_token (public).",
+  })
+  @ApiExtraModels(
+    OAuth2ExchangeConfidentialInput,
+    OAuth2ExchangePublicInput,
+    OAuth2RefreshConfidentialInput,
+    OAuth2RefreshPublicInput
+  )
+  @UseFilters(OAuth2HttpExceptionFilter)
+  @Header("Cache-Control", "no-store")
+  @Header("Pragma", "no-cache")
+  async token(@Body(new OAuth2TokenInputPipe()) body: OAuth2TokenInput): Promise<OAuth2TokensDto> {
    try {
-      const client = await this.oAuthService.getClient(clientId);
-      const result = await this.oAuthService.generateAuthorizationCode(
-        client.clientId,
-        userId,
-        body.redirectUri,
-        body.scopes,
-        body.state,
-        body.teamSlug,
-        body.codeChallenge,
-        body.codeChallengeMethod
-      );
-      return res.redirect(303, result.redirectUrl);
-    } catch (err: unknown) {
-      if (err instanceof ErrorWithCode) {
-        if (err.message === "unauthorized_client" || err?.data?.["reason"] === "redirect_uri_mismatch") {
-          const statusCode = getHttpStatusCode(err);
-          throw new HttpException(err.message, statusCode);
-        }
-      }
-      const errorRedirectUrl = this.oAuthService.buildErrorRedirectUrl(body.redirectUri, err, body.state);
-      return res.redirect(303, errorRedirectUrl);
-    }
-  }
+      const tokens = await this.oAuthService.handleTokenRequest(body.client_id, body);

-  @Post("/exchange")
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({
-    summary: "Exchange authorization code for tokens",
-    description: "Exchanges an authorization code for access and refresh tokens",
-  })
-  async exchange(
-    @Param("clientId") clientId: string,
-    @Body() body: OAuth2ExchangeInput
-  ): Promise<OAuth2TokensResponseDto> {
-    try {
-      const tokens = await this.oAuthService.exchangeCodeForTokens(
-        clientId,
-        body.code,
-        body.clientSecret,
-        body.redirectUri,
-        body.codeVerifier
-      );
-      return {
-        status: SUCCESS_STATUS,
-        data: plainToInstance(OAuth2TokensDto, tokens, { strategy: "excludeAll" }),
-      };
-    } catch (err: unknown) {
-      if (err instanceof ErrorWithCode) {
-        const statusCode = getHttpStatusCode(err);
-        throw new HttpException(err.message, statusCode);
-      }
-      this.logger.error(err);
-      throw new InternalServerErrorException("Could not exchange code for tokens");
-    }
-  }
-
-  @Post("/refresh")
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({
-    summary: "Refresh access token",
-    description: "Refreshes an access token using a refresh token",
-  })
-  async refresh(
-    @Param("clientId") clientId: string,
-    @Body() body: OAuth2RefreshInput
-  ): Promise<OAuth2TokensResponseDto> {
-    try {
-      const tokens = await this.oAuthService.refreshAccessToken(
-        clientId,
-        body.refreshToken,
-        body.clientSecret
-      );
-      return {
-        status: SUCCESS_STATUS,
-        data: plainToInstance(OAuth2TokensDto, tokens, { strategy: "excludeAll" }),
-      };
-    } catch (err: unknown) {
-      if (err instanceof ErrorWithCode) {
-        const statusCode = getHttpStatusCode(err);
-        throw new HttpException(err.message, statusCode);
-      }
-      this.logger.error(err);
-      throw new InternalServerErrorException("Could not refresh tokens");
+      return plainToInstance(OAuth2TokensDto, tokens, { strategy: "excludeAll" });
+    } catch (err) {
+      this.errorHandler.handleTokenError(err);
    }
  }
 }
@@ -0,0 +1,33 @@
+import type { ArgumentsHost, ExceptionFilter } from "@nestjs/common";
+import { Catch, Logger } from "@nestjs/common";
+import type { Request, Response } from "express";
+import { extractUserContext } from "@/lib/extract-user-context";
+import { filterReqHeaders } from "@/lib/filterReqHeaders";
+import { OAuth2HttpException } from "@/modules/auth/oauth2/filters/oauth2-http.exception";
+
+@Catch(OAuth2HttpException)
+export class OAuth2HttpExceptionFilter implements ExceptionFilter<OAuth2HttpException> {
+  private readonly logger = new Logger("OAuth2HttpExceptionFilter");
+
+  catch(exception: OAuth2HttpException, host: ArgumentsHost) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+    const request = ctx.getRequest<Request>();
+    const requestId = request.headers["x-request-id"] ?? "unknown-request-id";
+    response.setHeader("X-Request-Id", requestId.toString());
+
+    const { userEmail: _userEmail, ...safeUserContext } = extractUserContext(request);
+    const { Authorization: _auth, ...safeHeaders } = filterReqHeaders(request.headers);
+    this.logger.error(`OAuth2 Http Exception: ${exception.oAuthErrorData.error}`, {
+      exception,
+      body: "[REDACTED]",
+      headers: safeHeaders,
+      url: request.url,
+      method: request.method,
+      requestId,
+      ...safeUserContext,
+    });
+
+    response.status(exception.getStatus()).json(exception.oAuthErrorData);
+  }
+}
@@ -0,0 +1,10 @@
+import { HttpException } from "@nestjs/common";
+
+export class OAuth2HttpException extends HttpException {
+  constructor(
+    public readonly oAuthErrorData: { error: string; error_description: string },
+    statusCode: number
+  ) {
+    super(oAuthErrorData, statusCode);
+  }
+}
@@ -0,0 +1,14 @@
+import type { ArgumentsHost, ExceptionFilter } from "@nestjs/common";
+import { Catch } from "@nestjs/common";
+import type { Response } from "express";
+import { OAuth2RedirectException } from "@/modules/auth/oauth2/filters/oauth2-redirect.exception";
+
+@Catch(OAuth2RedirectException)
+export class OAuth2RedirectExceptionFilter implements ExceptionFilter<OAuth2RedirectException> {
+  catch(exception: OAuth2RedirectException, host: ArgumentsHost) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+
+    response.redirect(303, exception.redirectUrl);
+  }
+}
@@ -0,0 +1,10 @@
+import { HttpException, HttpStatus } from "@nestjs/common";
+
+export class OAuth2RedirectException extends HttpException {
+  readonly redirectUrl: string;
+
+  constructor(redirectUrl: string) {
+    super("OAuth2 redirect", HttpStatus.SEE_OTHER);
+    this.redirectUrl = redirectUrl;
+  }
+}
@@ -1,8 +1,7 @@
+import { AccessScope } from "@calcom/prisma/enums";
 import { ApiHideProperty, ApiProperty } from "@nestjs/swagger";
 import { Equals, IsArray, IsEnum, IsOptional, IsString } from "class-validator";

-import { AccessScope } from "@calcom/prisma/enums";
-
 export class OAuth2AuthorizeInput {
  @ApiProperty({
    description:
@@ -10,7 +9,7 @@ export class OAuth2AuthorizeInput {
    example: "https://example.com/callback",
  })
  @IsString()
-  redirectUri!: string;
+  redirect_uri!: string;

  @ApiProperty({
    description: "OAuth state parameter for CSRF protection. Will be included in the redirect.",
@@ -36,7 +35,7 @@ export class OAuth2AuthorizeInput {
  })
  @IsOptional()
  @IsString()
-  teamSlug?: string;
+  team_slug?: string;

  @ApiProperty({
    description: "PKCE code challenge (required for public clients)",
@@ -44,10 +43,10 @@ export class OAuth2AuthorizeInput {
  })
  @IsOptional()
  @IsString()
-  codeChallenge?: string;
+  code_challenge?: string;

  @ApiHideProperty()
  @IsString()
  @Equals("S256")
-  codeChallengeMethod: string = "S256";
+  code_challenge_method: string = "S256";
 }
@@ -1,7 +1,23 @@
-import { ApiHideProperty, ApiProperty } from "@nestjs/swagger";
-import { Equals, IsOptional, IsString } from "class-validator";
+import { ApiProperty } from "@nestjs/swagger";
+import { Equals, IsString } from "class-validator";
+
+export class OAuth2ExchangeConfidentialInput {
+  @ApiProperty({
+    description: "The client identifier",
+    example: "my-client-id",
+  })
+  @IsString()
+  client_id!: string;
+
+  @ApiProperty({
+    description: "The grant type — must be 'authorization_code'",
+    example: "authorization_code",
+    enum: ["authorization_code"],
+  })
+  @IsString()
+  @Equals("authorization_code")
+  grant_type!: "authorization_code";

-export class OAuth2ExchangeInput {
  @ApiProperty({
    description: "The authorization code received from the authorize endpoint",
    example: "abc123",
@@ -10,30 +26,55 @@ export class OAuth2ExchangeInput {
  code!: string;

  @ApiProperty({
-    description: "The client secret (required for confidential clients)",
-    required: false,
+    description: "The redirect URI used in the authorization request",
+    example: "https://example.com/callback",
  })
-  @IsOptional()
  @IsString()
-  clientSecret?: string;
+  redirect_uri!: string;
+
+  @ApiProperty({
+    description: "The client secret for confidential clients",
+  })
+  @IsString()
+  client_secret!: string;
+}
+
+export class OAuth2ExchangePublicInput {
+  @ApiProperty({
+    description: "The client identifier",
+    example: "my-client-id",
+  })
+  @IsString()
+  client_id!: string;
+
+  @ApiProperty({
+    description: "The grant type — must be 'authorization_code'",
+    example: "authorization_code",
+    enum: ["authorization_code"],
+  })
+  @IsString()
+  @Equals("authorization_code")
+  grant_type!: "authorization_code";
+
+  @ApiProperty({
+    description: "The authorization code received from the authorize endpoint",
+    example: "abc123",
+  })
+  @IsString()
+  code!: string;

  @ApiProperty({
    description: "The redirect URI used in the authorization request",
    example: "https://example.com/callback",
  })
  @IsString()
-  redirectUri!: string;
-
-  @ApiHideProperty()
-  @IsString()
-  @Equals("authorization_code")
-  grantType: string = "authorization_code";
+  redirect_uri!: string;

  @ApiProperty({
-    description: "PKCE code verifier (required if code_challenge was used)",
-    required: false,
+    description: "PKCE code verifier (required for public clients that used code_challenge)",
  })
-  @IsOptional()
  @IsString()
-  codeVerifier?: string;
+  code_verifier!: string;
 }
+
+export type OAuth2ExchangeInput = OAuth2ExchangeConfidentialInput | OAuth2ExchangePublicInput;
@@ -1,24 +1,60 @@
-import { ApiHideProperty, ApiProperty } from "@nestjs/swagger";
-import { Equals, IsOptional, IsString } from "class-validator";
+import { ApiProperty } from "@nestjs/swagger";
+import { Equals, IsString } from "class-validator";
+
+export class OAuth2RefreshConfidentialInput {
+  @ApiProperty({
+    description: "The client identifier",
+    example: "my-client-id",
+  })
+  @IsString()
+  client_id!: string;
+
+  @ApiProperty({
+    description: "The grant type — must be 'refresh_token'",
+    example: "refresh_token",
+    enum: ["refresh_token"],
+  })
+  @IsString()
+  @Equals("refresh_token")
+  grant_type!: "refresh_token";

-export class OAuth2RefreshInput {
  @ApiProperty({
    description: "The refresh token",
    example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  })
  @IsString()
-  refreshToken!: string;
+  refresh_token!: string;

  @ApiProperty({
-    description: "The client secret (required for confidential clients)",
-    required: false,
+    description: "The client secret for confidential clients",
  })
-  @IsOptional()
  @IsString()
-  clientSecret?: string;
+  client_secret!: string;
+}

-  @ApiHideProperty()
+export class OAuth2RefreshPublicInput {
+  @ApiProperty({
+    description: "The client identifier",
+    example: "my-client-id",
+  })
+  @IsString()
+  client_id!: string;
+
+  @ApiProperty({
+    description: "The grant type — must be 'refresh_token'",
+    example: "refresh_token",
+    enum: ["refresh_token"],
+  })
  @IsString()
  @Equals("refresh_token")
-  grantType: string = "refresh_token";
+  grant_type!: "refresh_token";
+
+  @ApiProperty({
+    description: "The refresh token",
+    example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+  })
+  @IsString()
+  refresh_token!: string;
 }
+
+export type OAuth2RefreshInput = OAuth2RefreshConfidentialInput | OAuth2RefreshPublicInput;
@@ -0,0 +1,107 @@
+import type { PipeTransform } from "@nestjs/common";
+import { HttpStatus, Injectable } from "@nestjs/common";
+import { plainToClass } from "class-transformer";
+import type { ValidationError } from "class-validator";
+import { validateSync } from "class-validator";
+import { OAuth2ExchangeConfidentialInput, OAuth2ExchangePublicInput } from "./exchange.input";
+import { OAuth2RefreshConfidentialInput, OAuth2RefreshPublicInput } from "./refresh.input";
+import { OAuth2HttpException } from "@/modules/auth/oauth2/filters/oauth2-http.exception";
+
+export type OAuth2TokenInput =
+  | OAuth2ExchangeConfidentialInput
+  | OAuth2ExchangePublicInput
+  | OAuth2RefreshConfidentialInput
+  | OAuth2RefreshPublicInput;
+
+@Injectable()
+export class OAuth2TokenInputPipe implements PipeTransform {
+  // eslint-disable-next-line @typescript-eslint/no-empty-function
+  constructor() {}
+
+  transform(value: OAuth2TokenInput): OAuth2TokenInput {
+    if (!value) {
+      this.throwOAuthError("Body is required");
+    }
+    if (typeof value !== "object") {
+      this.throwOAuthError("Body should be an object");
+    }
+
+    const raw = value as unknown as Record<string, unknown>;
+
+    if (!raw.client_id || typeof raw.client_id !== "string") {
+      this.throwOAuthError("client_id is required");
+    }
+
+    const grantType = raw.grant_type;
+
+    if (grantType === "authorization_code") {
+      return this.validateExchange(value);
+    }
+
+    if (grantType === "refresh_token") {
+      return this.validateRefresh(value);
+    }
+
+    this.throwOAuthError("grant_type must be 'authorization_code' or 'refresh_token'");
+  }
+
+  private validateExchange(
+    value: OAuth2TokenInput
+  ): OAuth2ExchangeConfidentialInput | OAuth2ExchangePublicInput {
+    if (this.isConfidentialExchange(value)) {
+      return this.validate(OAuth2ExchangeConfidentialInput, value);
+    }
+    return this.validate(OAuth2ExchangePublicInput, value);
+  }
+
+  private validateRefresh(
+    value: OAuth2TokenInput
+  ): OAuth2RefreshConfidentialInput | OAuth2RefreshPublicInput {
+    if (this.isConfidentialRefresh(value)) {
+      return this.validate(OAuth2RefreshConfidentialInput, value);
+    }
+    return this.validate(OAuth2RefreshPublicInput, value);
+  }
+
+  private validate<T extends object>(cls: new () => T, value: OAuth2TokenInput): T {
+    const object = plainToClass(cls, value);
+
+    const errors = validateSync(object, {
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      skipMissingProperties: false,
+    });
+
+    if (errors.length > 0) {
+      this.throwOAuthError(this.formatErrors(errors));
+    }
+
+    return object;
+  }
+
+  private formatErrors(errors: ValidationError[]): string {
+    return errors
+      .map((err) => {
+        const constraints = err.constraints ? Object.values(err.constraints).join(", ") : "";
+        const childrenErrors =
+          err.children && err.children.length > 0 ? `${this.formatErrors(err.children)}` : "";
+        return `${err.property} property is wrong,${constraints} ${childrenErrors}`;
+      })
+      .join(", ");
+  }
+
+  private isConfidentialExchange(value: OAuth2TokenInput): value is OAuth2ExchangeConfidentialInput {
+    return "client_secret" in value;
+  }
+
+  private isConfidentialRefresh(value: OAuth2TokenInput): value is OAuth2RefreshConfidentialInput {
+    return "client_secret" in value;
+  }
+
+  private throwOAuthError(description: string): never {
+    throw new OAuth2HttpException(
+      { error: "invalid_request", error_description: description },
+      HttpStatus.BAD_REQUEST
+    );
+  }
+}
@@ -1,10 +1,12 @@
+import { Module } from "@nestjs/common";
 import { oAuthServiceModule } from "@/lib/modules/oauth.module";
 import { AtomsOAuth2Controller } from "@/modules/auth/oauth2/controllers/atoms-oauth2.controller";
 import { OAuth2Controller } from "@/modules/auth/oauth2/controllers/oauth2.controller";
-import { Module } from "@nestjs/common";
+import { OAuth2ErrorService } from "@/modules/auth/oauth2/services/oauth2-error.service";

@Module({
  imports: [oAuthServiceModule],
  controllers: [OAuth2Controller, AtomsOAuth2Controller],
+  providers: [OAuth2ErrorService],
 })
 export class OAuth2Module {}
@@ -1,10 +1,9 @@
+import { ERROR_STATUS, SUCCESS_STATUS } from "@calcom/platform-constants";
+import { OAuthClientType } from "@calcom/prisma/enums";
 import { ApiProperty } from "@nestjs/swagger";
 import { Expose, Type } from "class-transformer";
 import { IsBoolean, IsEnum, IsNotEmptyObject, IsOptional, IsString, ValidateNested } from "class-validator";

-import { SUCCESS_STATUS, ERROR_STATUS } from "@calcom/platform-constants";
-import { OAuthClientType } from "@calcom/prisma/enums";
-
 export class OAuth2ClientDto {
  @ApiProperty({
    description: "The OAuth client ID",
@@ -12,15 +11,15 @@ export class OAuth2ClientDto {
  })
  @IsString()
  @Expose({ name: "clientId" })
-  id!: string;
+  client_id!: string;

  @ApiProperty({
    description: "The redirect URI for the OAuth client",
    example: "https://example.com/callback",
  })
  @IsString()
-  @Expose()
-  redirectUri!: string;
+  @Expose({ name: "redirectUri" })
+  redirect_uri!: string;

  @ApiProperty({
    description: "The name of the OAuth client",
@@ -44,8 +43,8 @@ export class OAuth2ClientDto {
    example: false,
  })
  @IsBoolean()
-  @Expose()
-  isTrusted!: boolean;
+  @Expose({ name: "isTrusted" })
+  is_trusted!: boolean;

  @ApiProperty({
    description: "The type of OAuth client (CONFIDENTIAL or PUBLIC)",
@@ -54,7 +53,7 @@ export class OAuth2ClientDto {
  })
  @IsEnum(OAuthClientType)
  @Expose({ name: "clientType" })
-  type!: OAuthClientType;
+  client_type!: OAuthClientType;
 }

 export class OAuth2ClientResponseDto {
@@ -1,8 +1,6 @@
 import { ApiProperty } from "@nestjs/swagger";
-import { Expose, Type } from "class-transformer";
-import { IsEnum, IsNotEmptyObject, IsNumber, IsString, ValidateNested } from "class-validator";
-
-import { SUCCESS_STATUS, ERROR_STATUS } from "@calcom/platform-constants";
+import { Expose } from "class-transformer";
+import { IsNumber, IsString } from "class-validator";

 export class OAuth2TokensDto {
  @ApiProperty({
@@ -37,19 +35,3 @@ export class OAuth2TokensDto {
  @Expose({ name: "expiresIn" })
  expires_in!: number;
 }
-
-export class OAuth2TokensResponseDto {
-  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
-  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
-  @Expose()
-  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
-
-  @ApiProperty({
-    type: OAuth2TokensDto,
-  })
-  @IsNotEmptyObject()
-  @ValidateNested()
-  @Type(() => OAuth2TokensDto)
-  @Expose()
-  data!: OAuth2TokensDto;
-}
@@ -0,0 +1,72 @@
+import { ErrorWithCode, getHttpStatusCode } from "@calcom/platform-libraries/errors";
+import { HttpException, Injectable, InternalServerErrorException, Logger } from "@nestjs/common";
+import { OAuthService } from "@/lib/services/oauth.service";
+import { OAuth2HttpException } from "@/modules/auth/oauth2/filters/oauth2-http.exception";
+import { OAuth2RedirectException } from "@/modules/auth/oauth2/filters/oauth2-redirect.exception";
+
+const NON_REDIRECTABLE_REASONS = new Set([
+  "client_not_found",
+  "client_not_approved",
+  "redirect_uri_mismatch",
+]);
+
+@Injectable()
+export class OAuth2ErrorService {
+  private readonly logger = new Logger("OAuth2ErrorService");
+
+  constructor(private readonly oAuthService: OAuthService) {}
+
+  handleAuthorizeError(err: unknown, redirectUri: string, state?: string): never {
+    if (err instanceof ErrorWithCode) {
+      const reason = err.data?.["reason"] as string | undefined;
+
+      if (reason && NON_REDIRECTABLE_REASONS.has(reason)) {
+        const statusCode = getHttpStatusCode(err);
+        throw new OAuth2HttpException(
+          {
+            error: err.message,
+            error_description: reason,
+          },
+          statusCode
+        );
+      }
+    }
+
+    const errorRedirectUrl = this.oAuthService.buildErrorRedirectUrl(redirectUri, err, state);
+    throw new OAuth2RedirectException(errorRedirectUrl);
+  }
+
+  handleTokenError(err: unknown): never {
+    if (err instanceof ErrorWithCode) {
+      const statusCode = getHttpStatusCode(err);
+      const reason = err.data?.["reason"] as string | undefined;
+      throw new OAuth2HttpException(
+        {
+          error: err.message,
+          error_description: reason ?? err.message,
+        },
+        statusCode
+      );
+    }
+    this.logger.error(err);
+    throw new OAuth2HttpException(
+      {
+        error: "server_error",
+        error_description: "An unexpected error occurred",
+      },
+      500
+    );
+  }
+
+  handleClientError(err: unknown, fallbackMessage: string): never {
+    if (err instanceof ErrorWithCode) {
+      const statusCode = getHttpStatusCode(err);
+      if (statusCode >= 500) {
+        this.logger.error(err);
+      }
+      throw new HttpException(err.message, statusCode);
+    }
+    this.logger.error(err);
+    throw new InternalServerErrorException(fallbackMessage);
+  }
+}
@@ -1,3 +1,4 @@
+import { getActiveUserBillingService } from "@calcom/platform-libraries/organizations";
 import { getIncrementUsageIdempotencyKey, getIncrementUsageJobTag } from "@calcom/platform-libraries/tasker";
 import { InjectQueue } from "@nestjs/bull";
 import {
@@ -342,36 +343,13 @@ export class BillingService implements IBillingService, OnModuleDestroy {
    invoiceStart: Date,
    invoiceEnd: Date
  ): Promise<number> {
-    const managedUsersEmails =
-      await this.usersRepository.getOrgsManagedUserEmailsBySubscriptionId(subscriptionId);
-
-    if (!managedUsersEmails) return 0;
-
    if (!invoiceStart || !invoiceEnd) {
      this.logger.log("Invoice period start or end date is null");
      return 0;
    }

-    const activeManagedUserEmailsAsHost = await this.usersRepository.getActiveManagedUsersAsHost(
-      subscriptionId,
-      invoiceStart,
-      invoiceEnd
-    );
-
-    const activeHostEmails = activeManagedUserEmailsAsHost.map((email) => email.email);
-    const notActiveHostEmails = managedUsersEmails
-      .filter((email) => !activeHostEmails.includes(email.email))
-      .map((email) => email.email);
-
-    if (notActiveHostEmails.length === 0) return activeManagedUserEmailsAsHost.length;
-
-    const activeManagedUserEmailsAsAttendee = await this.usersRepository.getActiveManagedUsersAsAttendee(
-      notActiveHostEmails,
-      invoiceStart,
-      invoiceEnd
-    );
-
-    return activeManagedUserEmailsAsAttendee.length + activeManagedUserEmailsAsHost.length;
+    const activeUserBillingService = getActiveUserBillingService();
+    return activeUserBillingService.getActiveUserCountForPlatformOrg(subscriptionId, invoiceStart, invoiceEnd);
  }

  async updateStripeSubscriptionForTeam(teamId: number, plan: PlatformPlan): Promise<void> {
@@ -26,7 +26,7 @@ import {
  Patch,
  ParseIntPipe,
 } from "@nestjs/common";
-import { ApiHeader, ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { ApiHeader, ApiOperation, ApiParam, ApiTags as DocsTags } from "@nestjs/swagger";
 import { plainToClass } from "class-transformer";

 import { SUCCESS_STATUS } from "@calcom/platform-constants";
@@ -84,6 +84,7 @@ export class EventTypeWebhooksController {

  @Get("/:webhookId")
  @ApiOperation({ summary: "Get a webhook" })
+  @ApiParam({ name: "webhookId", type: String, required: true })
  async getEventTypeWebhook(@GetWebhook() webhook: Webhook): Promise<EventTypeWebhookOutputResponseDto> {
    return {
      status: SUCCESS_STATUS,
@@ -116,6 +117,7 @@ export class EventTypeWebhooksController {

  @Delete("/:webhookId")
  @ApiOperation({ summary: "Delete a webhook" })
+  @ApiParam({ name: "webhookId", type: String, required: true })
  async deleteEventTypeWebhook(@GetWebhook() webhook: Webhook): Promise<EventTypeWebhookOutputResponseDto> {
    await this.webhooksService.deleteWebhook(webhook.id);
    return {
@@ -3,7 +3,7 @@ import { MembershipRole } from "@calcom/platform-libraries";
 import { SkipTakePagination } from "@calcom/platform-types";
 import type { Webhook } from "@calcom/prisma/client";
 import { Body, Controller, Delete, Get, Param, Patch, Post, Query, UseGuards } from "@nestjs/common";
-import { ApiHeader, ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { ApiHeader, ApiOperation, ApiParam, ApiTags as DocsTags } from "@nestjs/swagger";
 import { plainToClass } from "class-transformer";
 import { API_VERSIONS_VALUES } from "@/lib/api-versions";
 import { MembershipRoles } from "@/modules/auth/decorators/roles/membership-roles.decorator";
@@ -94,6 +94,7 @@ export class OAuthClientWebhooksController {
    summary: "Get a webhook",
    description: `<Warning>These endpoints are deprecated and will be removed in the future.</Warning>`,
  })
+  @ApiParam({ name: "webhookId", type: String, required: true })
  @UseGuards(IsOAuthClientWebhookGuard)
  async getOAuthClientWebhook(@GetWebhook() webhook: Webhook): Promise<OAuthClientWebhookOutputResponseDto> {
    return {
@@ -135,6 +136,7 @@ export class OAuthClientWebhooksController {
    summary: "Delete a webhook",
    description: `<Warning>These endpoints are deprecated and will be removed in the future.</Warning>`,
  })
+  @ApiParam({ name: "webhookId", type: String, required: true })
  @UseGuards(IsOAuthClientWebhookGuard)
  async deleteOAuthClientWebhook(
    @GetWebhook() webhook: Webhook
@@ -139,7 +139,7 @@ describe("Organizations Delegation Credentials Endpoints", () => {
        data: {
          workspacePlatformId: workspacePlatform.id,
          organizationId: org.id,
-          domain: "@test-domain.com",
+          domain: "test-domain.com",
          serviceAccountKey: encryptedServiceAccountKey,
          enabled: false,
        },
@@ -194,7 +194,7 @@ describe("Organizations Delegation Credentials Endpoints", () => {
      expect(responseBody.status).toEqual(SUCCESS_STATUS);
      expect(responseBody.data.enabled).toEqual(true);

-      expect(ensureDefaultCalendarsSpy).toHaveBeenCalledWith(org.id, "@test-domain.com");
+      expect(ensureDefaultCalendarsSpy).toHaveBeenCalledWith(org.id, "test-domain.com");
    });

    it("should not call ensureDefaultCalendars when disabling delegation credentials", async () => {
@@ -37,7 +37,7 @@ export class OrganizationsDelegationCredentialRepository {
      },
      where: {
        organizationId: orgId,
-        user: { email: { endsWith: domain } },
+        user: { email: { endsWith: `@${domain}`, mode: "insensitive" } },
      },
    });
  }
@@ -172,7 +172,7 @@ describe("OrganizationsDelegationCredentialService", () => {

      await service.ensureDefaultCalendarsForUser(orgId, userId, userEmail);

-      expect(mockRepository.findEnabledByOrgIdAndDomain).toHaveBeenCalledWith(orgId, "@example.com");
+      expect(mockRepository.findEnabledByOrgIdAndDomain).toHaveBeenCalledWith(orgId, "example.com");
      expect(mockQueue.add).toHaveBeenCalledWith(
        DEFAULT_CALENDARS_JOB,
        { userId },
@@ -198,7 +198,7 @@ describe("OrganizationsDelegationCredentialService", () => {

      await service.ensureDefaultCalendarsForUser(orgId, userId, userEmail);

-      expect(mockRepository.findEnabledByOrgIdAndDomain).toHaveBeenCalledWith(orgId, "@example.com");
+      expect(mockRepository.findEnabledByOrgIdAndDomain).toHaveBeenCalledWith(orgId, "example.com");
      expect(mockQueue.add).not.toHaveBeenCalled();
    });

@@ -174,7 +174,7 @@ export class OrganizationsDelegationCredentialService {
        this.logger.warn(`Invalid email format for user ${userId}: missing domain`);
        return;
      }
-      const emailDomain = `@${emailParts[1]}`;
+      const emailDomain = emailParts[1];

      const delegationCredential =
        await this.organizationsDelegationCredentialRepository.findEnabledByOrgIdAndDomain(
@@ -1,6 +1,7 @@
 import { OrganizationsWebhooksRepository } from "@/modules/organizations/webhooks/organizations-webhooks.repository";
 import { UpdateWebhookInputDto } from "@/modules/webhooks/inputs/webhook.input";
 import { PipedInputWebhookType } from "@/modules/webhooks/pipes/WebhookInputPipe";
+import { validateWebhookUrl, validateWebhookUrlIfChanged } from "@/modules/webhooks/utils/validate-webhook-url";
 import { WebhooksRepository } from "@/modules/webhooks/webhooks.repository";
 import { ConflictException, Injectable, NotFoundException } from "@nestjs/common";

@@ -12,6 +13,8 @@ export class OrganizationsWebhooksService {
  ) {}

  async createWebhook(orgId: number, body: PipedInputWebhookType) {
+    validateWebhookUrl(body.subscriberUrl);
+
    const existingWebhook = await this.organizationsWebhooksRepository.findWebhookByUrl(
      orgId,
      body.subscriberUrl
@@ -40,6 +43,8 @@ export class OrganizationsWebhooksService {
  }

  async updateWebhook(webhookId: string, body: UpdateWebhookInputDto) {
+    const existingSubscriberUrl = await this.webhooksRepository.getWebhookSubscriberUrl(webhookId);
+    validateWebhookUrlIfChanged(body.subscriberUrl, existingSubscriberUrl);
    return this.webhooksRepository.updateWebhook(webhookId, body);
  }
 }
@@ -515,7 +515,7 @@ describe("Slots 2024-04-15 Endpoints", () => {
    it("should do a booking for seated event and slot should show attendees count and bookingUid", async () => {
      const startTime = "2050-09-05T11:00:00.000Z";
      const booking = await bookingsRepositoryFixture.create({
-        uid: `booking-uid-${seatedEventTypeId}`,
+        uid: `booking-uid-seated-${seatedEventTypeId}-${randomString()}`,
        title: "booking title",
        startTime,
        endTime: "2050-09-05T12:00:00.000Z",
@@ -549,7 +549,7 @@ describe("Slots 2024-04-15 Endpoints", () => {
      });

      bookingSeatsRepositoryFixture.create({
-        referenceUid: "100",
+        referenceUid: `seat-${randomString()}`,
        data: {},
        booking: {
          connect: {
@@ -598,7 +598,7 @@ describe("Slots 2024-04-15 Endpoints", () => {
    it("should do a booking for seated event and slot should show attendees count and bookingUid in range format", async () => {
      const startTime = "2050-09-05T11:00:00.000Z";
      const booking = await bookingsRepositoryFixture.create({
-        uid: `booking-uid-${seatedEventTypeId}`,
+        uid: `booking-uid-seated-${seatedEventTypeId}-${randomString()}`,
        title: "booking title",
        startTime,
        endTime: "2050-09-05T12:00:00.000Z",
@@ -632,7 +632,7 @@ describe("Slots 2024-04-15 Endpoints", () => {
      });

      bookingSeatsRepositoryFixture.create({
-        referenceUid: "100",
+        referenceUid: `seat-${randomString()}`,
        data: {},
        booking: {
          connect: {
@@ -832,7 +832,7 @@ describe("Slots 2024-09-04 Endpoints", () => {
    it("should do a booking for seated event and slot should show attendees count and bookingUid", async () => {
      const startTime = "2050-09-05T11:00:00.000Z";
      const booking = await bookingsRepositoryFixture.create({
-        uid: `booking-uid-${seatedEventType.id}`,
+        uid: `booking-uid-seated-${seatedEventType.id}-${randomString()}`,
        title: "booking title",
        startTime,
        endTime: "2050-09-05T12:00:00.000Z",
@@ -866,7 +866,7 @@ describe("Slots 2024-09-04 Endpoints", () => {
      });

      bookingSeatsRepositoryFixture.create({
-        referenceUid: "100",
+        referenceUid: `seat-${randomString()}`,
        data: {},
        booking: {
          connect: {
@@ -961,7 +961,7 @@ describe("Slots 2024-09-04 Endpoints", () => {
    it("should do a booking for seated event and slot should show attendees count and bookingUid and return range format", async () => {
      const startTime = "2050-09-05T11:00:00.000Z";
      const booking = await bookingsRepositoryFixture.create({
-        uid: `booking-uid-${seatedEventType.id}`,
+        uid: `booking-uid-seated-range-${seatedEventType.id}-${randomString()}`,
        title: "booking title",
        startTime,
        endTime: "2050-09-05T12:00:00.000Z",
@@ -995,7 +995,7 @@ describe("Slots 2024-09-04 Endpoints", () => {
      });

      bookingSeatsRepositoryFixture.create({
-        referenceUid: "100",
+        referenceUid: `seat-${randomString()}`,
        data: {},
        booking: {
          connect: {
@@ -1348,7 +1348,8 @@ describe("Slots 2024-09-04 Endpoints", () => {
        advanceTo(newDate);

        const slotDuration = 60;
-        const slotStartTime = "2050-09-05T10:00:00.000Z";
+        // Use 2050-09-06 to avoid overlap with other tests that reserve 2050-09-05
+        const slotStartTime = "2050-09-06T09:00:00.000Z";
        const reserveResponse = await request(app.getHttpServer())
          .post(`/v2/slots/reservations`)
          .send({
@@ -1377,7 +1378,7 @@ describe("Slots 2024-09-04 Endpoints", () => {

        const response = await request(app.getHttpServer())
          .get(
-            `/v2/slots?eventTypeId=${variableLengthEventType.id}&start=2050-09-05&end=2050-09-09&duration=60`
+            `/v2/slots?eventTypeId=${variableLengthEventType.id}&start=2050-09-05&end=2050-09-10&duration=60`
          )
          .set(CAL_API_VERSION_HEADER, VERSION_2024_09_04)
          .expect(200);
@@ -1390,10 +1391,10 @@ describe("Slots 2024-09-04 Endpoints", () => {
        const days = Object.keys(slots);
        expect(days.length).toEqual(5);

-        const expectedSlotsUTC2050_09_05 = expectedSlotsUTC["2050-09-05"].filter(
+        const expectedSlotsUTC2050_09_06 = expectedSlotsUTC["2050-09-06"].filter(
          (slot) => slot.start !== slotStartTime
        );
-        expect(slots).toEqual({ ...expectedSlotsUTC, "2050-09-05": expectedSlotsUTC2050_09_05 });
+        expect(slots).toEqual({ ...expectedSlotsUTC, "2050-09-06": expectedSlotsUTC2050_09_06 });

        const dbSlot = await selectedSlotRepositoryFixture.getByUid(
          responseReservedVariableSlot.reservationUid
@@ -1409,7 +1410,7 @@ describe("Slots 2024-09-04 Endpoints", () => {
      });

      it("request slot contains already existing reserved slot", async () => {
-        // Try to reserve 9:45-12:45 when 10:00-11:00 is taken
+        // Try to reserve 8:45-11:45 when 09:00-10:00 on 2050-09-06 is taken
        const newSlotStart = DateTime.fromISO(responseReservedVariableSlot.slotStart)
          .minus({ minutes: 15 })
          .toISO();
@@ -13,7 +13,7 @@ import {
  Query,
  UseGuards,
 } from "@nestjs/common";
-import { ApiHeader, ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { ApiHeader, ApiOperation, ApiParam, ApiTags as DocsTags } from "@nestjs/swagger";
 import { plainToClass } from "class-transformer";
 import { API_VERSIONS_VALUES } from "@/lib/api-versions";
 import { API_KEY_HEADER } from "@/lib/docs/headers";
@@ -87,6 +87,7 @@ export class TeamsEventTypesWebhooksController {

  @Get("/:webhookId")
  @ApiOperation({ summary: "Get a webhook for a team event type" })
+  @ApiParam({ name: "webhookId", type: String, required: true })
  @Roles("TEAM_MEMBER")
  async getTeamEventTypeWebhook(@GetWebhook() webhook: Webhook): Promise<EventTypeWebhookOutputResponseDto> {
    return {
@@ -122,6 +123,7 @@ export class TeamsEventTypesWebhooksController {
  @Delete("/:webhookId")
  @Roles("TEAM_ADMIN")
  @ApiOperation({ summary: "Delete a webhook for a team event type" })
+  @ApiParam({ name: "webhookId", type: String, required: true })
  async deleteTeamEventTypeWebhook(
    @GetWebhook() webhook: Webhook
  ): Promise<EventTypeWebhookOutputResponseDto> {
@@ -16,7 +16,7 @@ import { WebhookOutputPipe } from "@/modules/webhooks/pipes/WebhookOutputPipe";
 import { UserWebhooksService } from "@/modules/webhooks/services/user-webhooks.service";
 import { WebhooksService } from "@/modules/webhooks/services/webhooks.service";
 import { Controller, Post, Body, UseGuards, Get, Param, Query, Delete, Patch } from "@nestjs/common";
-import { ApiHeader, ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { ApiHeader, ApiOperation, ApiParam, ApiTags as DocsTags } from "@nestjs/swagger";
 import { plainToClass } from "class-transformer";

 import { SUCCESS_STATUS } from "@calcom/platform-constants";
@@ -75,6 +75,7 @@ export class WebhooksController {

  @Get("/:webhookId")
  @ApiOperation({ summary: "Get a webhook" })
+  @ApiParam({ name: "webhookId", type: String, required: true })
  @UseGuards(IsUserWebhookGuard)
  async getWebhook(@GetWebhook() webhook: Webhook): Promise<UserWebhookOutputResponseDto> {
    return {
@@ -1,4 +1,5 @@
 import { PipedInputWebhookType } from "@/modules/webhooks/pipes/WebhookInputPipe";
+import { validateWebhookUrl } from "@/modules/webhooks/utils/validate-webhook-url";
 import { WebhooksRepository } from "@/modules/webhooks/webhooks.repository";
 import { BadRequestException, ConflictException, Injectable } from "@nestjs/common";

@@ -9,6 +10,8 @@ export class EventTypeWebhooksService {
  constructor(private readonly webhooksRepository: WebhooksRepository) {}

  async createEventTypeWebhook(eventTypeId: number, body: PipedInputWebhookType) {
+    validateWebhookUrl(body.subscriberUrl);
+
    if (body.eventTriggers.includes(WebhookTriggerEvents.DELEGATION_CREDENTIAL_ERROR)) {
      throw new BadRequestException(
        "DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks"
@@ -1,4 +1,5 @@
 import { PipedInputWebhookType } from "@/modules/webhooks/pipes/WebhookInputPipe";
+import { validateWebhookUrl } from "@/modules/webhooks/utils/validate-webhook-url";
 import { WebhooksRepository } from "@/modules/webhooks/webhooks.repository";
 import { ConflictException, Injectable } from "@nestjs/common";

@@ -7,6 +8,8 @@ export class OAuthClientWebhooksService {
  constructor(private readonly webhooksRepository: WebhooksRepository) {}

  async createOAuthClientWebhook(platformOAuthClientId: string, body: PipedInputWebhookType) {
+    validateWebhookUrl(body.subscriberUrl);
+
    const existingWebhook = await this.webhooksRepository.getOAuthClientWebhookByUrl(
      platformOAuthClientId,
      body.subscriberUrl
@@ -1,6 +1,7 @@
 import { WebhookTriggerEvents } from "@calcom/prisma/enums";
 import { BadRequestException, ConflictException, Injectable } from "@nestjs/common";
 import type { PipedInputWebhookType } from "@/modules/webhooks/pipes/WebhookInputPipe";
+import { validateWebhookUrl } from "@/modules/webhooks/utils/validate-webhook-url";
 import { WebhooksRepository } from "@/modules/webhooks/webhooks.repository";

@Injectable()
@@ -8,6 +9,8 @@ export class TeamEventTypeWebhooksService {
  constructor(private readonly webhooksRepository: WebhooksRepository) {}

  async createTeamEventTypeWebhook(eventTypeId: number, body: PipedInputWebhookType) {
+    validateWebhookUrl(body.subscriberUrl);
+
    if (body.eventTriggers.includes(WebhookTriggerEvents.DELEGATION_CREDENTIAL_ERROR)) {
      throw new BadRequestException(
        "DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks"
@@ -1,4 +1,5 @@
 import { PipedInputWebhookType } from "@/modules/webhooks/pipes/WebhookInputPipe";
+import { validateWebhookUrl } from "@/modules/webhooks/utils/validate-webhook-url";
 import { WebhooksRepository } from "@/modules/webhooks/webhooks.repository";
 import { BadRequestException, ConflictException, Injectable } from "@nestjs/common";

@@ -9,6 +10,8 @@ export class UserWebhooksService {
  constructor(private readonly webhooksRepository: WebhooksRepository) {}

  async createUserWebhook(userId: number, body: PipedInputWebhookType) {
+    validateWebhookUrl(body.subscriberUrl);
+
    if (body.eventTriggers.includes(WebhookTriggerEvents.DELEGATION_CREDENTIAL_ERROR)) {
      throw new BadRequestException(
        "DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks"
@@ -1,4 +1,5 @@
 import { UpdateWebhookInputDto } from "@/modules/webhooks/inputs/webhook.input";
+import { validateWebhookUrlIfChanged } from "@/modules/webhooks/utils/validate-webhook-url";
 import { WebhooksRepository } from "@/modules/webhooks/webhooks.repository";
 import { Injectable, NotFoundException } from "@nestjs/common";

@@ -7,6 +8,8 @@ export class WebhooksService {
  constructor(private readonly webhooksRepository: WebhooksRepository) {}

  async updateWebhook(webhookId: string, body: UpdateWebhookInputDto) {
+    const existingSubscriberUrl = await this.webhooksRepository.getWebhookSubscriberUrl(webhookId);
+    validateWebhookUrlIfChanged(body.subscriberUrl, existingSubscriberUrl);
    return this.webhooksRepository.updateWebhook(webhookId, body);
  }

@@ -0,0 +1,95 @@
+import { BadRequestException } from "@nestjs/common";
+
+// Mock the platform-libraries module
+const mockValidateUrlForSSRFSync: jest.Mock = jest.fn();
+jest.mock("@calcom/platform-libraries", () => ({
+  validateUrlForSSRFSync: (url: string) => mockValidateUrlForSSRFSync(url),
+}));
+
+import { validateWebhookUrl, validateWebhookUrlIfChanged } from "./validate-webhook-url";
+
+describe("validateWebhookUrl", () => {
+  beforeEach(() => {
+    mockValidateUrlForSSRFSync.mockReset();
+  });
+
+  it("does not throw when URL is valid", () => {
+    mockValidateUrlForSSRFSync.mockReturnValue({ isValid: true });
+
+    expect(() => validateWebhookUrl("https://example.com/webhook")).not.toThrow();
+    expect(mockValidateUrlForSSRFSync).toHaveBeenCalledWith("https://example.com/webhook");
+  });
+
+  it("throws BadRequestException when URL is invalid", () => {
+    mockValidateUrlForSSRFSync.mockReturnValue({ isValid: false, error: "Private IP address" });
+
+    expect(() => validateWebhookUrl("https://127.0.0.1/webhook")).toThrow(BadRequestException);
+    expect(() => validateWebhookUrl("https://127.0.0.1/webhook")).toThrow(
+      "Webhook URL is not allowed: Private IP address"
+    );
+  });
+
+  it("includes error message from validation result", () => {
+    mockValidateUrlForSSRFSync.mockReturnValue({ isValid: false, error: "Blocked hostname" });
+
+    expect(() => validateWebhookUrl("https://localhost/webhook")).toThrow(
+      "Webhook URL is not allowed: Blocked hostname"
+    );
+  });
+
+  it("handles validation result without error message", () => {
+    mockValidateUrlForSSRFSync.mockReturnValue({ isValid: false });
+
+    expect(() => validateWebhookUrl("invalid-url")).toThrow(
+      "Webhook URL is not allowed: undefined"
+    );
+  });
+});
+
+describe("validateWebhookUrlIfChanged", () => {
+  beforeEach(() => {
+    mockValidateUrlForSSRFSync.mockReset();
+  });
+
+  it("validates URL when it is different from existing", () => {
+    mockValidateUrlForSSRFSync.mockReturnValue({ isValid: true });
+
+    validateWebhookUrlIfChanged("https://new.com/webhook", "https://old.com/webhook");
+
+    expect(mockValidateUrlForSSRFSync).toHaveBeenCalledWith("https://new.com/webhook");
+  });
+
+  it("throws when new URL is different and invalid", () => {
+    mockValidateUrlForSSRFSync.mockReturnValue({ isValid: false, error: "Only HTTPS URLs are allowed" });
+
+    expect(() =>
+      validateWebhookUrlIfChanged("http://new.com/webhook", "https://old.com/webhook")
+    ).toThrow(BadRequestException);
+  });
+
+  it("does not validate when URL is unchanged", () => {
+    validateWebhookUrlIfChanged("https://same.com/webhook", "https://same.com/webhook");
+
+    expect(mockValidateUrlForSSRFSync).not.toHaveBeenCalled();
+  });
+
+  it("does not validate when new URL is undefined", () => {
+    validateWebhookUrlIfChanged(undefined, "https://existing.com/webhook");
+
+    expect(mockValidateUrlForSSRFSync).not.toHaveBeenCalled();
+  });
+
+  it("validates when existing URL is undefined and new URL is provided", () => {
+    mockValidateUrlForSSRFSync.mockReturnValue({ isValid: true });
+
+    validateWebhookUrlIfChanged("https://new.com/webhook", undefined);
+
+    expect(mockValidateUrlForSSRFSync).toHaveBeenCalledWith("https://new.com/webhook");
+  });
+
+  it("does not validate when both URLs are undefined", () => {
+    validateWebhookUrlIfChanged(undefined, undefined);
+
+    expect(mockValidateUrlForSSRFSync).not.toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,18 @@
+import { BadRequestException } from "@nestjs/common";
+import { validateUrlForSSRFSync } from "@calcom/platform-libraries";
+
+export function validateWebhookUrl(subscriberUrl: string): void {
+  const validation = validateUrlForSSRFSync(subscriberUrl);
+  if (!validation.isValid) {
+    throw new BadRequestException(`Webhook URL is not allowed: ${validation.error}`);
+  }
+}
+
+export function validateWebhookUrlIfChanged(
+  newSubscriberUrl: string | undefined,
+  existingSubscriberUrl: string | undefined
+): void {
+  if (newSubscriberUrl && newSubscriberUrl !== existingSubscriberUrl) {
+    validateWebhookUrl(newSubscriberUrl);
+  }
+}
@@ -49,6 +49,14 @@ export class WebhooksRepository {
    });
  }

+  async getWebhookSubscriberUrl(webhookId: string): Promise<string | undefined> {
+    const webhook = await this.dbRead.prisma.webhook.findFirst({
+      where: { id: webhookId },
+      select: { subscriberUrl: true },
+    });
+    return webhook?.subscriberUrl ?? undefined;
+  }
+
  async getUserWebhooksPaginated(userId: number, skip: number, take: number) {
    return this.dbRead.prisma.webhook.findMany({
      where: { userId },
@@ -114,7 +114,11 @@ export class WorkflowsRepository {
  ) {
    await updateWorkflow({
      ctx: {
-        user: { ...user, locale: user?.locale ?? "en" },
+        user: {
+          ...user,
+          locale: user?.locale ?? "en",
+          organizationId: user.profiles?.[0]?.organization?.id ?? null,
+        },
        prisma: this.dbWrite.prisma as unknown as PrismaClient,
      },
      input: data,
@@ -132,7 +136,11 @@ export class WorkflowsRepository {
  ) {
    await updateWorkflow({
      ctx: {
-        user: { ...user, locale: user?.locale ?? "en" },
+        user: {
+          ...user,
+          locale: user?.locale ?? "en",
+          organizationId: user.profiles?.[0]?.organization?.id ?? null,
+        },
        prisma: this.dbWrite.prisma as unknown as PrismaClient,
      },
      input: data,
@@ -1,8 +1,7 @@
+import { OAuthClientStatus, OAuthClientType } from "@calcom/prisma/enums";
+import { TestingModule } from "@nestjs/testing";
 import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
-import { TestingModule } from "@nestjs/testing";
-
-import { OAuthClientType } from "@calcom/prisma/enums";

 export class OAuth2ClientRepositoryFixture {
  private prismaReadClient: PrismaReadService["prisma"];
@@ -19,8 +18,10 @@ export class OAuth2ClientRepositoryFixture {
    redirectUri: string;
    clientSecret?: string;
    clientType?: OAuthClientType;
+    status?: OAuthClientStatus;
    logo?: string;
    isTrusted?: boolean;
+    userId?: number;
  }) {
    return this.prismaWriteClient.oAuthClient.create({
      data: {
@@ -29,12 +30,21 @@ export class OAuth2ClientRepositoryFixture {
        redirectUri: data.redirectUri,
        clientSecret: data.clientSecret,
        clientType: data.clientType || OAuthClientType.CONFIDENTIAL,
+        status: data.status || OAuthClientStatus.APPROVED,
        logo: data.logo,
        isTrusted: data.isTrusted || false,
+        ...(data.userId && { user: { connect: { id: data.userId } } }),
      },
    });
  }

+  async updateStatus(clientId: string, status: OAuthClientStatus) {
+    return this.prismaWriteClient.oAuthClient.update({
+      where: { clientId },
+      data: { status },
+    });
+  }
+
  async delete(clientId: string) {
    return this.prismaWriteClient.oAuthClient.delete({
      where: { clientId },
@@ -1 +1 @@
-export const TRIGGER_VERSION = '20260205.1';
+export const TRIGGER_VERSION = '20260216.1';
@@ -3,7 +3,7 @@ import withEmbedSsrAppDir from "app/WithEmbedSSR";
 import type { PageProps as ServerPageProps } from "app/_types";
 import { cookies, headers } from "next/headers";

-import { loadTranslations } from "@calcom/lib/server/i18n";
+import { loadTranslations } from "@calcom/i18n/server";

 import { buildLegacyCtx } from "@lib/buildLegacyCtx";

@@ -5,7 +5,7 @@ import { generateMeetingMetadata } from "app/_utils";
 import { headers, cookies } from "next/headers";

 import { getOrgFullOrigin } from "@calcom/features/ee/organizations/lib/orgDomains";
-import { loadTranslations } from "@calcom/lib/server/i18n";
+import { loadTranslations } from "@calcom/i18n/server";

 import { buildLegacyCtx, decodeParams } from "@lib/buildLegacyCtx";

@@ -3,7 +3,7 @@ import withEmbedSsrAppDir from "app/WithEmbedSSR";
 import type { PageProps as ServerPageProps } from "app/_types";
 import { cookies, headers } from "next/headers";

-import { loadTranslations } from "@calcom/lib/server/i18n";
+import { loadTranslations } from "@calcom/i18n/server";

 import { buildLegacyCtx } from "@lib/buildLegacyCtx";

@@ -5,7 +5,7 @@ import { _generateMetadata } from "app/_utils";
 import { cookies, headers } from "next/headers";

 import { getOrgFullOrigin } from "@calcom/features/ee/organizations/lib/orgDomains";
-import { loadTranslations } from "@calcom/lib/server/i18n";
+import { loadTranslations } from "@calcom/i18n/server";
 import { BookingStatus } from "@calcom/prisma/enums";

 import { buildLegacyCtx } from "@lib/buildLegacyCtx";
@@ -3,7 +3,7 @@ import withEmbedSsrAppDir from "app/WithEmbedSSR";
 import type { PageProps as ServerPageProps } from "app/_types";
 import { cookies, headers } from "next/headers";

-import { loadTranslations } from "@calcom/lib/server/i18n";
+import { loadTranslations } from "@calcom/i18n/server";

 import { buildLegacyCtx } from "@lib/buildLegacyCtx";
 import { getServerSideProps } from "@lib/org/[orgSlug]/[user]/[type]/getServerSideProps";
--- a/Show More
+++ b/Show More