* feat: enhance image upload validation across the application
* Patch improvements.
* refactor: streamline avatar upload error handling in updateProfile handler
* refactor: extract image validation logic into a separate module for reuse in BannerUploader and ImageUploader
* fix: reset file input value on validation failure in image uploaders
* fix: update localization key for image file upload error message
* fix: update HTML content validation in image uploader to check for additional byte
* Code Quality improvements
* add : unit tests.
* fix : fixing some more issues.
* fix : some import fixes
* fix : fixing type-check issues
* fix : some more import fixes.
* fix : removing Duplicate max-file-size constant
* refactor: enhance base64 validation with regex pattern
* refactor: centralize MAX_IMAGE_FILE_SIZE and fix SVG checks.
* fix : some toast fixes.
* fixing the size of the banner.
* fix: update accepted image formats in BannerUploader and ImageUploader components
* fix
* coderabbit suggestions addressed.
* addressed coderrabit comment
* refactor: implement generic i18n error messages with interpolation
- Add generic 'unsupported_file_type' translation key with {{type}} interpolation
- Replace hardcoded file type error messages with reusable i18n pattern
- Update imageValidation interfaces to support errorKey and errorParams
- Refactor server-side and client-side validation to use new pattern
- Remove individual translation keys for each file type (PDF, HTML, Script, ZIP, Executable)
- Add new translation keys for other validation errors (SVG, base64, empty data, etc.)
- Type-safe error handling with proper interpolation support
Benefits:
- Single reusable translation pattern reduces duplication
- Easier to maintain and localize
- Consistent error messaging across file types
* feat: add MAX_BANNER_SIZE constant and update file size validation
- Add MAX_BANNER_SIZE constant (5MB) to shared constants file
- Update BannerUploader to use shared constant instead of inline value
- Update ImageUploader to handle new errorKey/errorParams pattern
- Maintain backward compatibility with existing error handling
Note: Pre-existing linting warnings in constants.ts and BannerUploader.tsx
are unrelated to these changes and were present before this refactor.
* adressed volnei's suggestions.
* test: update image validation tests for new errorKey/errorParams pattern
- Update all dangerous file type tests to expect errorKey and errorParams instead of hardcoded error messages
- Add comprehensive tests for new error format validation pattern
- Add tests for backward compatibility with error field
- Add tests for MAX_BANNER_SIZE constant integration
- Verify that unsupported file types now return generic 'unsupported_file_type' key with type interpolation
- Ensure all existing functionality continues to work with enhanced error handling
All 42 tests passing ✅
* test: update server-side image validation tests for new error format
- Update all dangerous file type tests to expect errorKey and errorParams
- Change hardcoded error messages to i18n keys (unsupported_file_type, svg_contains_dangerous_content, etc.)
- Update edge case tests to use new error keys (empty_image_data, invalid_base64_format, unrecognized_image_format)
- Add comprehensive tests for new error format validation pattern
- Add tests for backward compatibility with error field
- Verify that unsupported file types return generic 'unsupported_file_type' key with type interpolation
All 26 server-side tests passing ✅
Complements client-side test updates for complete test coverage
---------
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
Co-authored-by: unknown <adhabal2002@gmail.com>
- Use SameSite=None for HTTPS and SameSite=Lax for development
- Follows same pattern as reserveSlot handler for embed compatibility
- Fixes 403 errors when cancelling bookings in embedded forms
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-09-03 17:57:00 +00:00
sean-brydonGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Add isExternalLink: true property to admin_api menu item in organization settings
- Matches the same pattern used by the members page external link icon
- Leverages existing VerticalTabItem component support for external link icons
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* PBAC on team members page + org members page to use specific permissions with fallbacks
* Implement checks on edit sheet fetch to check for permisisons
* WIP permission fixes
* fix tests
* WIP
* fix edit mode perms
* fix remove and list view permissions
* fix add
* feat: add pbac permissions for impersonation (#23035)
* registery + migration + i18n
* UI for can impersonate
* impersonation backend
* remove permission from db query
* add missing prisma import
* add resend invitation and edit mode checks for delete/changeRole
* fix canChangeRole
* canChangeRole gate
* fix permission logic
* fix depends on
* push migration
* fix migration
* fix scoped advanced permissions
* use listMembers instead of invite proxy
* remove isOrgAdmin check to rely on pbac
* wait for session to load before navigating
* use event-types testId to ensure session loaded
* use profile page instead of eventTypes
* use correct roles
* fix wait for session
* correct orgs private isFallBackRoles
* set a timeout on waiting for session
* remove adminOrOwner check since its in fallpack
---------
Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
- Remove '@calcom/ui/*': ['../../packages/ui/components/*'] path mapping from apps/web/tsconfig.json
- Fix imports from '@calcom/ui/componentName' to '@calcom/ui/components/componentName' format
- Preserve direct exports like '@calcom/ui/classNames' and '@calcom/ui/styles'
- Update 200+ files across apps/web, packages/features, packages/app-store, and packages/ui
- Fix localStorage usage to use safe webstorage import
- Remove forbidden 'as any' type casting in favor of proper TypeScript types
- All changes verified to pass TypeScript compilation
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Revert "fix: remove fallback permssions on organization Id. (#22769)"
This reverts commit 30061c0d58.
Removes the manage permission concept and fallback logic to simplify
permission checking back to direct role-based checks.
* remove manage from workflows
* fix type error and remove manage from components
* Various fixes
* Remove tooltip
* another string change
* Fix width of custom event name modal to prevent overflow
* Booking questions fixes
* minor string fix
* checkbox alignment
* padding in reassign dialog
* fix: update FormBuilder tests for checkbox UI changes
- Updated test utilities to work with CheckboxField instead of BooleanToggleGroupField
- Fixed badge expectations to check for 'optional' instead of 'required'
- Updated dialog interaction methods to use checkbox.checked instead of button text
- All 13 FormBuilder tests now pass successfully
Fixes failing tests in PR #22727 caused by UI changes from toggle buttons to checkboxes for required field selection.
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: amit@cal.com <samit91848@gmail.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
* feat: implement default filter segments for data tables
- Add defaultSegmentId column to UserFilterSegmentPreference table
- Support mixed segment ID types (number for user segments, string for default segments)
- Add DefaultFilterSegment and CombinedFilterSegment types
- Update useSegments hook to handle default segments with date range recalculation
- Modify FilterSegmentSelect to group and display default segments separately
- Add default segments to bookings view (My Bookings, Upcoming Bookings)
- Prevent editing/deleting of default segments in SaveFilterSegmentButton
- Update DataTableProvider to support defaultSegments prop
- Update parsers and repository to handle mixed segment ID types
Implements frontend-only default segments as specified in the requirements.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* chore: update ESLint dependencies to resolve configuration issues
- Update eslint-config-next and @typescript-eslint packages to latest versions
- Fix dependency compatibility issues that were blocking pre-commit hooks
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* revert eslint change
* some changes
* refactor: implement discriminated union for segment types
- Update SegmentIdentifier to use discriminated union with 'custom' vs 'default' types
- Refactor setSegmentId to accept object parameters: { id: string; type: 'default' } | { id: number; type: 'custom' }
- Update type definitions with DefaultFilterSegment, CustomFilterSegment, and CombinedFilterSegment
- Modify useSegments hook to handle new segment type structure
- Update FilterSegmentSelect component to work with discriminated unions
- Refactor database preference handling to store segment type alongside ID
- Add proper type safety throughout the data flow
- Remove description property from DefaultFilterSegment type
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: update unit test to expect discriminated union format for preferredSegmentId
The test was expecting preferredSegmentId to be a number, but after the discriminated union refactor it now returns { id: number, type: 'custom' } for custom segments. Updated the assertion to use toEqual() for deep object comparison.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: correct SegmentIdentifier type to exclude undefined
- Remove null from SegmentIdentifier type definition since null/undefined indicate absence of identifier
- Update DataTableProvider and useSegments to handle SegmentIdentifier | null properly
- Fix type safety while maintaining discriminated union functionality
- Ensure setAndPersistSegmentId accepts null values for clearing segments
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* remove unused segment
* a little update
* feat: add default- prefix to default segment IDs for clearer type identification
- Update 'my_bookings' to 'default-my_bookings'
- Update 'upcoming-bookings' to 'default-upcoming-bookings'
- Makes it easier to verify segment type by looking at the ID string
- Maintains all existing discriminated union functionality
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: rename segment types from default/custom to system/user for better semantics
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: update unit test to expect 'user' type instead of 'custom' in discriminated union
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: complete type renaming from default/custom to system/user across all component files
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: update segment ID prefix from default- to system- to match type naming
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* remove unused segment
* some fixes
* revert schema change
* rename defaultSegmentId to systemSegmentId
* renaming
* fix save button
* remove as any
* clean up prisma migrations
* type fixes
* many fixes
* remove icon property
* fix infinite rendering
* fix race condition
* re-visiting useSegments implementation WIP
* extract useElementByClassName
* add e2e tests
* fix a bug that the created segment was not selected automatically
* add useSegments to /insights and fix e2e test
* fix type error
* fix type error
* apply feedback
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Fix membership deletion handling and add tests
* fixes
* revert api-v2 specific changes
* Add more tests
* refactor: Move removeMember function into TeamService as private static methods
- Moved removeMember and all related helper functions from separate file into TeamService class
- Made all functions private static methods instead of exporting them
- Deleted the original removeMember.ts file since it's no longer needed
- Updated imports to use the new location
- All integration tests pass successfully
* refactor: Rename memberId to userId in TeamService methods
- Renamed memberId parameter to userId in removeMember private method
- Renamed memberIds parameter to userIds in removeMembers public method
- Updated all calls to removeMembers to use userIds instead of memberIds
- Parameter names now accurately reflect that they are user IDs, not membership IDs
* test: add service unit tests and simplify e2e tests for membership deletion
- Add unit tests for membership deletion services
- Remove redundant deletion behavior tests from controllers
- Keep only happy path tests in e2e controller tests
- Fix unused imports and variables
* package.json version
* fix unit teswtes
* No specs file
* fix unit tests
* fix: Add platform-libraries build step to E2E API v2 workflow
The E2E API v2 tests were failing with TypeScript compilation errors because
TeamService imports from @calcom/platform-libraries require the package to be
built first to generate the dist/ folder with compiled exports.
This adds the same build step that was added to unit-tests.yml to resolve
the module resolution errors.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Making tests clearer and easier to undestand
* chore: bump platform libs
* chore: bump platform libs
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Co-authored-by: cal.com <morgan@cal.com>
* Add cal.eu to `IS_CALCOM`
* Create `getCalcomUrl` function
* Use `getCalcomURl` in generate metadata
* Use `getCalcomURl` in `buildCanonical`
* Linting fix
* fix: add authentication guard to /apps/installed routes
- Add session validation before making tRPC calls in server component
- Redirect unauthenticated users to /auth/login instead of throwing 500 errors
- Follows existing authentication patterns used throughout the codebase
- Fixes 500 error when accessing /apps/installed/calendar and other categories
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: Missing return; was that so hard, DevinAI?
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: rename getTemporaryOrgRedirect to handleOrgRedirect and prevent duplicate orgRedirection query parameter
* refactor: improve handleOrgRedirect test robustness with scenario-based mocking
- Replace brittle mockResolvedValue with mockImplementation that derives behavior from input
- Create createRedirectScenario function that sets up mocks based on actual query parameters
- Add expectRedirectUsesData helper to verify redirects use the correct data
- Add comprehensive mock verification tests to ensure different inputs return different outputs
- Ensure tests verify the actual usage of Prisma results, not just that Prisma was called
This prevents false positives where tests pass even if the code doesn't use the database results correctly.
* Fix bug with Private links redirecting an exposing users booking page URL
* Narrow the type to what is being used
---------
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* feat: add cron job to cleanup old queued form responses
- Add cleanup cron job for App_RoutingForms_QueuedFormResponse table
- Delete records with null actualResponseId older than 1 hour
- Schedule to run twice daily (every 12 hours) via vercel.json
- Follow existing cron job patterns for authentication and structure
Co-Authored-By: hariom@cal.com <hariom@cal.com>
* fix: correct date comparison logic to delete older records
- Change from lte to gte in createdAt comparison
- Now properly deletes records older than 1 hour
Co-Authored-By: hariom@cal.com <hariom@cal.com>
* refactor: move cleanup logic to routing forms lib and import in API endpoint
- Create cleanupExpiredQueuedFormResponses function in routing forms lib
- Update API endpoint to import and use the new cleanup function
- Follow established patterns for code organization in Cal.com
- Maintain same functionality and authentication logic
Co-Authored-By: hariom@cal.com <hariom@cal.com>
* refactor: move entire cron logic to routing-forms cron folder
- Create routing-forms/cron/queuedFormResponseCleanup.ts with complete handler
- Move authentication, HTTP handling, and database operations to routing-forms
- Update API endpoint to simply import and call the cron handler
- Remove old lib cleanup function
- Follow user's preferred organizational pattern
Co-Authored-By: hariom@cal.com <hariom@cal.com>
* fix: correct date comparison logic to delete records older than 1 hour
- Change from gte (greater than or equal) to lt (less than) cutoffTime
- Now properly deletes records where createdAt < cutoffTime (older than 1 hour)
- Previous logic was deleting newer records instead of older ones
Co-Authored-By: hariom@cal.com <hariom@cal.com>
* fixes
* refactor: reorganize queuedFormResponse into domain-driven structure
- Move repository and service files to routingForm/queuedFormResponse subdirectory
- Clean up unused methods and tests for better maintainability
- Fix import paths and type definitions
- Ensure all tests pass and maintain backward compatibility
* fix: align QueuedFormResponse interface types with Prisma schema
- Update actualResponseId type from string to number to match Prisma Int type
- Make updatedAt nullable (Date | null) to match Prisma DateTime? type
- Fix import path for QueuedFormResponseRepository interface
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: reorganize queuedFormResponse into domain-driven structure
- Move repository and service files to routingForm/queuedFormResponse subdirectory
- Clean up unused methods and tests for better maintainability
- Fix import paths and type definitions
- Ensure all tests pass and maintain backward compatibility
* test: add comprehensive where clause validation tests and missing test coverage
* chore: update cron schedule to weekly for 7-day retention period
* revert: restore 12-hour cron schedule for better batch management
* Add integration tests
* refactor: apply test data builder pattern to queuedFormResponse integration tests
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: hariom@cal.com <hariom@cal.com>
Co-authored-by: Hariom <hariombalhara@gmail.com>
* perf: use repository for webhooks list query & caching in /settings/developer/webhooks/... RSC
* fix type check
* invalidate cache on webhook list item actions
* fix review comment
* fix merge conflicts
* refactor: convert getShouldServeCache to CacheService with dependency injection
- Create CacheService class following AvailableSlotsService DI pattern
- Add FeaturesRepository and CacheService to DI tokens and modules
- Create cache container with proper dependency injection setup
- Update handleNewBooking.ts and slots/util.ts to use new service
- Maintain backward compatibility with error-throwing wrapper function
- Follow established service patterns for clean architecture
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* feat: inject CacheService into AvailableSlotsService via dependency injection
- Add cacheService to IAvailableSlotsService interface
- Update available-slots container to load cache modules
- Update available-slots module to inject CacheService dependency
- Replace direct getShouldServeCache call with injected service method
- Add CacheService import to util.ts for proper typing
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* chore: DI api v2 cache service
* refactor: convert FeaturesRepository to use factory pattern in DI
- Change from constructor injection to factory pattern to avoid PRISMA_CLIENT binding issues in tests
- FeaturesRepository now uses default prisma instance instead of DI injection
- Resolves test failures while maintaining DI container compatibility
- Tests reduced from 123+ failures to only 5 unrelated failures
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* revert: use direct FeaturesRepository instantiation in most usage points
- Revert getFeaturesRepository() calls back to new FeaturesRepository()
- Tests require direct instantiation for mocking compatibility
- Keep DI container for specific use cases that need dependency injection
- Resolves test failures while maintaining both DI and direct usage patterns
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: resolve FeaturesRepository DI container issues
- Update cache module to use factory pattern with proper ICacheService interface
- Remove featuresModule loading from cache and available-slots containers
- Use direct FeaturesRepository instantiation via getFeaturesRepository()
- Resolves 'No binding found for key: Symbol(FeaturesRepository)' errors
- Reduces test failures from 125 to 7 (remaining failures appear unrelated)
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: update all FeaturesRepository instantiations to include prisma parameter
- Add prisma parameter to all new FeaturesRepository() calls across the codebase
- Update API v2 services to match main repo interfaces
- Fix PrismaFeaturesRepository to implement IFeaturesRepository directly
- Update CacheService in API v2 to expose required dependencies and getShouldServeCache
- Implement CheckBookingLimitsService in API v2 with proper interface
- Resolves type assignment errors between API v2 and main repo implementations
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: add prisma parameter to remaining FeaturesRepository instantiations in apps/web/lib
- Update getServerSideProps files to pass prisma parameter to FeaturesRepository
- Ensures all FeaturesRepository instantiations follow the new constructor pattern
- Completes the refactoring to use direct instantiation with prisma parameter
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor clean and fix devin issues
* chore: bump platform libs
* chore: bump platform libs
* chore: bump platform libs
* chore: bump platform libs
* fix: missing di
* fix workflow test
* fix workflow test
* fix integration test
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: morgan@cal.com <morgan@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* feat: rename repository files to include Repository suffix
- Rename apiKey.ts to apiKeyRepository.ts
- Rename assignmentReason.ts to assignmentReasonRepository.ts
- Update all import statements to use new file names
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: rename repository files to PrismaRepository with Prisma prefix
- Rename apiKeyRepository.ts to PrismaApiKeyRepository.ts
- Rename assignmentReasonRepository.ts to PrismaAssignmentReasonRepository.ts
- Update class names to PrismaApiKeyRepository and PrismaAssignmentReasonRepository
- Update all import statements and usages across 3 files
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
