* feat: add api v2 endpoint to fetch all user schedules
* chore: update typing
* feat: custom hook to fetch all user schedules
* refactor: shift logic to transform schedules into function of its own
* init: list schedules atom
* feat: api endpoints for list schedules atom
* refactor: accept redirect url as prop
* fix: pass redirect url prop
* integrate list schedules atom with availability settings
* refactor: extract types to be reused in api v2 endpoints
* skip availability settings page for the time being until we have api v2 endpoints in prod
* feat: add docs for list schedules atom
* fixup
* export Schedule type
* make sure we always have a default schedule if user deletes his default schedule
* chore: implement code rabbit feedback
* chore: implement PR feedback
* fix: resolve merge conflicts
* fix: import path
* update platform libraries
* fix: type check
* resolve merge conflicts
* update atoms export
* update platform libraries schedule
* chore: arrange atoms in alphabetical order
* update atoms controller to include endpoints for list schedules atom
* add create atom scheule atom
* fix: invalidate schedules on new schedule creation
* chore: add changesets
* feat: add user-specific email verification setting
Add requiresBookerEmailVerification boolean field to User model that allows
users to protect their email from impersonation during bookings.
When enabled, anyone attempting to book using the protected user's email
address (as booker or guest) must complete email verification and be logged
in as that email owner.
Key changes:
- Add requiresBookerEmailVerification field to User schema
- Create settings toggle in /settings/my-account/general
- Update checkIfBookerEmailIsBlocked to check booker's account setting
- Update guest filtering in handleNewBooking and addGuests handlers
- Add i18n translations for new setting
- Check both primary and verified secondary emails
Additional fixes:
- Replace 'any' types with proper Prisma and zod types in user.ts
- Fix member role type in sessionMiddleware.ts
- Fix avatar URL generation bug in sessionMiddleware.ts
These type fixes were necessary to resolve pre-commit lint warnings that
were blocking the commit.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: address PR review comments
- Remove unrelated Watchlist index drops from migration
- Add missing Watchlist indexes to schema.prisma to fix drift
- Refactor checkIfBookerEmailIsBlocked to throw ErrorWithCode
- Move HttpError handling to handleNewBooking caller layer
Addresses review comments on PR #24298
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: move Prisma queries to UserRepository and remove unrelated Watchlist changes
- Add findByEmailWithEmailVerificationSetting method to UserRepository
- Add findManyByEmailsWithEmailVerificationSettings method to UserRepository
- Refactor checkIfUserEmailVerificationRequired handler to use UserRepository
- Refactor addGuests handler to use UserRepository
- Remove unrelated Watchlist schema indices (organizationId/isGlobal, source)
- Remove unrelated WatchlistAudit unique constraint on id
Addresses review comments on PR #24298
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: better error codes + use repo
* Updated db query with manully written one using UNION (#24430)
* fix: resolve usage of deprecated secondary email in return value
* fix: type errors from refactors
* fix: address CodeRabbit PR review comments
- Add NOT NULL constraint to requiresBookerEmailVerification migration
- Dedupe guest input by base email to handle plus-addressing correctly
- Compare attendees by base email instead of raw strings
- Send emails only to filtered uniqueGuests (not all guests)
- Improve error logging with actual error details
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: indices added by mistake
Co-authored-by: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com>
* chore: update label of setting
* fix: return matched email for guests
* chore: remove whitespace
* test: add comprehensive email verification tests
- Add 9 test scenarios covering user email verification setting
- Test main booker verification (logged in/out, with/without code)
- Test secondary email verification as main booker and guest
- Test guest filtering when verification is required
- Test plus-addressed email handling
- Test multiple guests with mixed verification requirements
- Test invalid verification code error handling
- Update bookingScenario helper to support requiresBookerEmailVerification and secondaryEmails
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: correct guest placement in test mock data
Move guests array from top-level booking data into responses object
to match expected structure in getBookingData.ts which looks for
responses.guests (line 74).
Fixes three failing tests:
- should filter out guest that requires verification
- should filter out secondary email with verification when added as guest
- should filter only guests requiring verification from multiple guests
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Rodrigo Ehlers <rodrigoehlers@outlook.com>
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
Co-authored-by: Rodrigo Ehlers <rodrigo@chatbyte.ai>
Co-authored-by: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com>
* Add subscription start, trial end, and end dates to db
* Add subscription start, trial end, and end date to db
* Write subscription start date on new team subscriptions
* Write subscription start date for new orgs
* Fix typo in stripe billing service file (billling -> billing)
* Use `StripeBillingService.extractSubscriptionDates`
* Remove comments
* Address comment
* Fix typo in file import
* Fix typo in file import
* Add missing SubscriptionStatus enum values
- Add INCOMPLETE, INCOMPLETE_EXPIRED, UNPAID, PAUSED enum values
- These values are referenced in stripe-billing-service.ts status mapping
- Fixes type errors in billing-related code
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add 5 new workflow triggers for booking events
- Add BOOKING_REJECTED, BOOKING_REQUESTED, BOOKING_PAYMENT_INITIATED, BOOKING_PAID, BOOKING_NO_SHOW_UPDATED to WorkflowTriggerEvents enum
- Update workflow constants to include new trigger options
- Implement workflow trigger logic for booking rejected and requested events
- Add translations for new workflow triggers following {enum}_trigger format
- Generate updated Prisma types for new schema changes
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* fix: type check, remove as any
* feat: add workflow trigger for BOOKING_REQUESTED in handleNewBooking.ts
- Add WorkflowTriggerEvents import to handleNewBooking.ts
- Implement workflow trigger logic for BOOKING_REQUESTED in else block
- Filter workflows by BOOKING_REQUESTED trigger and call scheduleWorkflowReminders
- Use proper calendar event object construction without type casting
- Add error handling for workflow reminder scheduling
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* fix: resolve type errors in workflow trigger implementations
- Add proper database includes for user information in handleConfirmation.ts
- Fix ExtendedCalendarEvent type structure with correct hosts mapping
- Add missing properties to calendar event objects in handleMarkNoShow.ts
- Ensure all workflow triggers follow proper type patterns
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* feat: add workflow test configurations for new booking triggers
- Add workflow configurations for BOOKING_REQUESTED and BOOKING_PAYMENT_INITIATED in fresh-booking.test.ts
- Add workflow configuration for BOOKING_REJECTED in confirm.handler.test.ts
- Enable previously skipped confirm.handler.test.ts
- Remove workflow test assertions temporarily until triggers are fully functional
- Maintain webhook test coverage while adding workflow test infrastructure
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* fix: add missing mockSuccessfulVideoMeetingCreation import to confirm.handler.test.ts
- Import mockSuccessfulVideoMeetingCreation from bookingScenario utils
- Add mock call to BOOKING_REJECTED workflow test case
- Resolves ReferenceError that was causing unit test CI failure
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* add new triggers
* refactor: improve _scheduleWorkflowReminders readability and add missing booking trigger events
- Extract complex conditional logic into helper functions (isImmediateTrigger, isTimeBased, shouldProcessWorkflow)
- Add missing workflow trigger events with immediate execution logic
- Update test workflows to use different actions (EMAIL_ATTENDEE, SMS_ATTENDEE) for better differentiation
- Fix translation function mock in confirm.handler.test.ts using mockNoTranslations utility
- Maintain existing functionality while improving code maintainability
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* only show customt emplate for form triggers
* filter outside scheduleWorkflowReminder
* fix type check
* chore: add more tests
* test: add comprehensive unit tests for handleMarkNoShow with webhook and workflow coverage
- Create handleMarkNoShow.test.ts following confirm.handler.test.ts pattern
- Add expectBookingNoShowUpdatedWebhookToHaveBeenFired utility function
- Test both webhook and workflow triggers for BOOKING_NO_SHOW_UPDATED
- Cover attendee/host no-show scenarios, multiple attendees, and error cases
- All 6 unit tests pass with proper mocking of external dependencies
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* Revert "test: add comprehensive unit tests for handleMarkNoShow with webhook and workflow coverage"
This reverts commit 764299220279f0c012392dec24d3150246bfc4ad.
* fix: add new workflow triggers to api/v2
* update swagger docs
* fix: e2e
* fix type check
* fix tests, add test for before after events
* fix unit tests
* revert confirm.handler.test
* fix: unit tests
* dummy form variables
* add routing forms to active on dropdown
* add migration file
* Ui fixes for variables dropdown
* remove other translation keys
* review fixes
* allow routing forms for activeOn
* use repository function to get routing forms
* remove unnecessary code
* adjust logic in update handler
* add triggers to api v2
* remvoe unused file
* rename to getAcitveOnOptions handler
* remove routingFormOptions handler
* clean up getActiveOnOptions
* refactor WorkflowService
* remove logs
* remove unused
* fix: type check
* fix: missed before after events for recurring
* fix: calendarEvent handleMarkNoShow
* fix error message
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* don't query disabled routing forms
* create tasker function
* add tasker code
* move isFormTrigger function
* small adjustments + todo comments
* remove email to host action for form triggers
* throw trpc error if email to host is added as step
* fix dialog on how to use form responses as variables
* remove add variable dropdown for form triggers
* remove form workfows in event workflows tab
* improvements for workflow logic on form submission
* review fixes
* base setup for seperate schedule functions (evt and form)
* add missing BOOKING_PAID workflow trigger
* fix pathname
* fix: test for BOOKING_REQUESTED
* fix activeOn ids
* pass hideBranding and smsReminderNumber
* adjustments to reminderScheduler
* create empty scheduelForForm functions
* pass locale and timezone with form user
* pass formData instead of responses
* pass timeFormat and locale
* reusable function for email sending and reminder creation
* implement scheduleEmailReminderForForm
* remove added editor field from merge conflict
* don't support cal.ai action with form triggers
* throw bad request if form trigger and cal.ai is combined
* add tests for scheduleFormWorkflows
* add form submission tests
* remove form response varibe info
* clean up workflow actions
* fixes for getting template options
* pass triggerType to getAllWorkflows
* move reusable logic to scheduleSMSReminder
* add formdata to param type
* type fixes for text reminder managers
* implement scheduleSMSReminderForForm
* fix import
* fix isAuthorizedToAddActiveOnIds
* disble whatsapp action
* implement triggerFormSubmittedNoEventWorkflow
* code clean up
* Merge branch 'devin/1755107037-add-workflow-triggers' into feat/routing-form-workflow-triggers
* fix type errors
* remove async from getSubmitterEmail
* fix type errors
* revert cal.ai changes
* fix type error
* add sublogger
* code clean up
* fix type errors
* remove label for attendee whatsapp action
* code clean up
* fixes saving teams on org workflows
* fix type error
* code improvements for activeOn ids
* Revert "code improvements for activeOn ids"
This reverts commit 0a3590a4e2ce541b17d63483ad86ed458795a6a3.
* improve variable name
* fix unit tests
* small fixes
* type fixes
* remove unused translation keys
* fix merge conflict issues
* code clean up
* remove SMS action support
* remove more SMS code
* add missing imports
* set custom template for form action
* type fixes
* fix tasker endpoint
* fix duplicate check
* fix workfows.test.ts
* use repository funciton to getHideBranding
* code clean up
* fix hasDuplicateSubmission
* code clean up
* select only needed properties
* remove repository functions
* Revert "remove repository functions"
This reverts commit 7aa47b1c59c9abd7f964ebf26f746934c53a44f4.
* add scheduleWorkflows function
* Revert "add scheduleWorkflows function"
This reverts commit fe5db4fe3b65e2743c95475d585300cab98beed7.
* move type to /types
* Revert "move type to /types"
This reverts commit 91e0152154594b3772a801a426260068a8ccea54.
* revert changes causing type errors
* remove import
* remove unused import
* Revert "remove unused import"
This reverts commit 1916768c875ea5d0ac5598ccb8f9c796c5622dc9.
* revert changed from attempt to fix type errors
* pass object to gt all workflows
* fix isAuthorized check
* trigger filtering
* remove form submitted no event booked code
* remove form submitted no event from schema
* remove more code
* remove test
* fixes
* add getSubmitterEmail function
* add missing workflow DTOs
* small fixes
* use activeOnWithChildren
* fix active on when switching trigger type
* remove add variable dropdown
* add getAllWorkflowsFromRoutingForm to WorkflowService
* fix error caused by undefined evt
* fix type error
* fix type error
* fix tests
* code clean up
* remove console.log
* remove template text form from triggers
* add routing form repoditory function
* fix bug with key
* add missing trigger in update-workflow.input.ts
* ForEvt and ForForm function for aiPhoneCallManager
* chore: add support for form workflows on api v2
* fixup! chore: add support for form workflows on api v2
* use only repository functions in update handler
* move all prisma queries from list.handler
* review suggestions
* chore: handle workflows api v2
* chore: handle workflows api v2, split in 2 endpoints
* fix workflow step creation
* remove connect agent and fixes types
* add type to workflow
* chore: use workflow type in apiv2 WorkflowsOutputService
* update worklfow type on update
* chore: use workflow type in apiv2 WorkflowsOutputService
* fix template body for torm trigger
* some UI fixes for email subject/body
* resetting email body when changing form triggers
* use type field to query workflows
* clean up all old active on values
* remove responseId from all funciton calls
* remove undefined from updateTemplate
* refactor: split routing form and event-type workflows code
* refactor: split routing form and event-type workflows code
* fix template text when adding action
* chore: don't rename WorkflowActivationDto to avoid ci blocking
* refine update schedule to use only allowed actions
* fix type error
* don't allow whatsapp action with form trigger
* fix type error
* return early if activeOn array is empty
* fix: from step type in BaseFormWorkflowStepDto
* fixup! fix: from step type in BaseFormWorkflowStepDto
* move all prisma calls to repository (service/workflows.ts)
* use FORM_TRIGGER_WORKFLOW_EVENTS for form queries
* use userRepository
* use FORM_TRIGGER_WORKFLOW_EVENTS in isFormTrigger
* code clean up
* code clean up
* add back trpc import
* fix agent repository functions
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: amit@cal.com <samit91848@gmail.com>
Co-authored-by: Amit Sharma <74371312+Amit91848@users.noreply.github.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
Co-authored-by: Benny Joo <sldisek783@gmail.com>
Co-authored-by: cal.com <morgan@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* WIP UI for opt in pbac
* Remove header
* Opt in plus route invaldiation
* Use dialog upgrade tip approach
* Add i18n + animation
* Format
* Address @designer man feedback
* Fix type errors
* Add i18n to opt in view settings header + add comments for svg
* remvoe comments
* New permission function
* Update permission check service to have fall backs
Update event type create permission procedure to also have org heigharchy
* Update get eventType handler to use new procedure
* Type check
* Type fix
* Update packages/features/pbac/lib/event-type-permissions.ts
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Fix type errorr
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix: provide meetingStartTime for test preview to prevent RR timestamp error
When Round Robin timestamp basis is set to START_TIME, the system requires
a meeting start time to calculate the interval for load balancing. Test
Preview doesn't have a real meeting time since it's just simulating the
routing logic.
This fix provides the current time (new Date()) as the meetingStartTime
when calling getOrderedListOfLuckyUsers in test preview mode. This allows
the Round Robin calculation to proceed using the current interval for
realistic ordering while still being in preview mode.
Fixes the 'Meeting start time is required' error that occurs when users
click Test Preview on routing forms with Round Robin timestamp basis set
to START_TIME.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* add comment
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-10-09 08:58:57 +00:00
Hariom BalharaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add usernameInOrg field to webhook organizer payload for organization users
- Add usernameInOrg field to CalendarEventBuilder organizer interface
- Update handleNewBooking to pass organizerOrganizationProfile.username as usernameInOrg
- Include usernameInOrg in webhook payload generation (sendPayload.ts)
- Add webhook form variable for usernameInOrg with translation
- Update Person type to include usernameInOrg field
- Add test case for organization user webhook verification
- Maintain backward compatibility by keeping existing username field unchanged
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* feat: add usernameInOrg to additional webhook sending locations
- Update handleCancelBooking.ts to include usernameInOrg in organizer payload
- Update confirm.handler.ts to include usernameInOrg for booking confirmations
- Update getBooking.ts to include usernameInOrg in payment-related webhooks
- Maintain backward compatibility with existing username field
- All webhook sending locations now include organization profile username
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fixes
* Add subteam event test for usernameInOrg
* fix eslitn issues
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: aalow team with slug for diff cases
* addressed review
* fix type error
* update test
* addressed review
* fix test
* Update team.ts
---------
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
* feat: auto-accept team invitations for existing users
- Change email button text from 'View Invitation' to 'Accept Invite'
- Implement auto-accept flow when clicking email CTA
- Update TeamService.inviteMemberByToken to support auto-acceptance
- Add new autoAcceptInvite tRPC endpoint for handling auto-acceptance
- Update invitation link generation to include autoAccept parameter
- Handle both team and organization invitation scenarios
- Maintain payment/billing flow integration with TeamBilling.updateQuantity
- Preserve backward compatibility with existing manual flow
- Update all locale files with new 'Accept Invite' button text
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* revert: locale changes except English
- Keep only English 'Accept Invite' translation
- Revert all other locale files to original 'View Invitation' translations
- Maintain core auto-accept invitation functionality
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* simplify: remove autoAccept parameter and make auto-acceptance default
- Remove autoAccept parameter from TeamService.inviteMemberByToken
- Always auto-accept invitations for existing users clicking email links
- Remove autoAccept logic from teams server-page.tsx
- Remove autoAccept=true from invitation URLs
- Delete autoAcceptInvite handler and schema files
- Remove autoAcceptInvite endpoint from tRPC router
- Simplify invitation flow to match new user pattern
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* test: update teamService test to expect auto-accepted memberships
- Change expectation from accepted: false to accepted: true
- Update test description to reflect auto-accept behavior
- Fix TypeScript type casting to use Pick<TeamRepository, 'deleteById'>
- Aligns with new default auto-acceptance for team invitations
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* update
* Update utils.ts
* fix type error
* delete token
* add prisma transaction
* update
* update param
* test: fix mock objects in teamService tests with realistic data
- Fix duplicate property assignments in mock user objects
- Use proper email format (user@example.com) for email fields
- Use proper username format (testuser) for username fields
- Fix logic error in acceptInvitationByToken (|| to &&)
- Add autoAccept parameter to resendInvitation.handler.ts
- All 16 tests passing with proper TypeScript types
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* test: add e2e tests for team invitation auto-accept flow
- Add test for existing user auto-accepting team invitation via email link
- Add test for error handling when wrong user tries to use invitation link
- Verify proper user identity validation and database state changes
- Follow existing e2e test patterns with browser context isolation
- Fix ESLint warnings: replace conditional with assertion and remove unused browser parameter
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix
* fix
* fix: update team owner creation in e2e tests to include proper names
- Fix email subject mismatch in auto-accept invitation tests
- Team owners now created with explicit names instead of undefined
- Matches pattern used in other working team invitation tests
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: update organization invitation test helper to match new auto-accept link format
- Change expectExistingUserToBeInvitedToOrganization to look for 'teams?token' instead of 'settings/team'
- Fixes 'Invite link not found' error in organization booking e2e test
- Aligns with auto-accept invitation URL changes that use /teams?token= format
- Fix eslint disable comment for playwright rule
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* address coderrabit review
* fix failing test
* addressed review
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Add permission + migration for listMembersPrivate + depends on lsitMember
* Add legacy list members PBAC private logic
* Add checks in team pages + handler
* add list memeber checks for private orgs
* Add permision visibility scope to loading permissions
* getMembers handler
* fix fallback permission
* Verify private teams work with private org
* Apply suggestion from @eunjae-lee
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
* Remove and private scope function and add param to old
---------
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
* Fix update handler to not delete banner
* code cleanup
* add banner-upload.e2e
* fix: add slug fallback in banner-upload e2e test
- Use org.slug as fallback when requestedSlug is undefined
- Addresses GitHub comment about guarding against undefined slug
- Prevents test failures when requestedSlug is not set
- Fix ESLint warnings: remove unnecessary escape characters and unused variable
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* test: add banner preservation test for profile updates
- Verify that updating organization profile without banner changes preserves existing banner
- Ensures update handler doesn't overwrite banner when undefined is passed
- Addresses user request to test banner preservation during profile saves
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* remove banner e2e wip
---------
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: migrate TeamEventTypeForm to use PBAC instead of isTeamAdminOrOwner
- Replace isTeamAdminOrOwner prop with permissions.canCreateEventType
- Move permission checks to server-side using PermissionCheckService
- Use eventType.create permission string as specified in PBAC guide
- Update all parent components: CreateEventTypeDialog, event-types-view, CreateEventTypePlatformWrapper
- Follow existing PBAC patterns from event-types-listing-view.tsx
- Maintain backward compatibility with role-based fallback
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: implement proper server-side PBAC permission checks
- Add eventType.create permission checks to TRPC teams.get handler
- Add PBAC permission checks to platform /organizations/{orgId}/teams/me endpoint
- Update all three components to use server-side permission data instead of client-side async calls
- Add canCreateEventTypes property to platform team types
- Maintain backward compatibility with role-based fallbacks
- Remove unused imports and variables
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: update client components to use server-side PBAC permission data
- Update event-types-view.tsx to use team.canCreateEventTypes from server
- Update CreateEventTypeDialog.tsx to use team.canCreateEventTypes with fallback
- Update CreateEventTypePlatformWrapper.tsx to use team.canCreateEventTypes with fallback
- Remove hardcoded permission values and role-based checks
- Maintain backward compatibility with existing role-based logic as fallback
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* apply correct PBAC for event type creation
* revert unexpected changes
* clean up
* address feedback
* fix type error
* clean up
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add fallbackRoles parameter to getTeamIdsWithPermissions method
- Add fallbackRoles parameter to method signature in interface and implementation
- Implement second query for teams without PBAC where user has fallback roles
- Combine and deduplicate results from both PBAC-enabled and fallback role teams
- Supports fallback to role-based permissions when PBAC is disabled
- Fix linting issue in getUserMemberships method by replacing include with select
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix usages
* revert some change
* fix unit tests
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: adds user plan info in `useHasPaidPlan` for intercom
* add to support api route
* Update constants.ts
* sql migration to backfill plans and create/change plans on upgrade/downgrade/create of teams and orgs
* fix: breaking unit tests
* test: add comprehensive tests for billing plan service and team/org flows
- Add unit tests for BillingPlanService.getUserPlanByMemberships() covering all plan determination scenarios
- Add tests for team creation handler verifying TEAMS vs ORGANIZATIONS plan assignment
- Add tests for hasTeamPlan handler integration with BillingPlanService
- Add tests for MembershipRepository.findAllMembershipsByUserIdForBilling() data fetching
- Add tests for InternalTeamBilling upgrade/downgrade flows with proper mocking
- All tests follow existing vitest patterns with proper Prisma and service mocking
- Covers both self-serve and platform billing scenarios with comprehensive edge cases
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* Revert "test: add comprehensive tests for billing plan service and team/org flows"
This reverts commit 58e511f15caf8757c3ec45f6d026caf96ee1a75e.
* fix: make `BillingPlanService` instantiable and use `TeamRepository`
* Revert "fix: make `BillingPlanService` instantiable and use `TeamRepository`"
This reverts commit ae1ff8f15b725566b828864a217d8d0e308b520f.
* revert to runtime calculations. review fixes
* remove uneccessary changes and logs
* review fixes
* review fixes
* fix: type check
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-09-25 13:00:19 +05:30
Eunjae LeeGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: replace isTeamAdminOrOwner with PBAC permissions
- Remove isTeamAdminOrOwner from team-members-view.tsx, rely on server-side permissions
- Replace role checks in addMembersToEventTypes.handler.ts with eventType.update permission
- Follow PBAC refactoring guide patterns for consistent permission checking
- Fix TypeScript any type usage and unused variable warnings
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* use enum
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: implement PBAC for team member listing
- Replace membership-based team filtering with getTeamIdsWithPermission
- Use team.listMembers permission for access control
- Maintain fallback to original logic when PBAC fails
- Add comprehensive PBAC refactoring guide for future use
Fixes team fetching logic to use Permission-Based Access Control
while preserving existing functionality and privacy checks.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* docs: move PBAC refactoring guide to packages/features/pbac/
Move the PBAC refactoring guide to the appropriate location within
the PBAC feature package for better organization and discoverability.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: remove unnecessary try-catch wrapper
The getTeamIdsWithPermission method already handles all errors internally
and returns an empty array instead of throwing exceptions, making the
try-catch wrapper redundant. Simplified to use direct fallback logic
based on empty array return.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: simplify PBAC implementation
- Remove flawed fallback logic that assumed empty array meant PBAC failure
- Use direct string 'team.listMembers' instead of PermissionMapper
- Remove unused imports (PermissionMapper, Resource, CustomAction)
- Empty array from getTeamIdsWithPermission is legitimate (no permissions)
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* docs: simplify PBAC refactoring guide
- Reduce from 260 to 87 lines by removing bloated content
- Focus on core pattern: direct permission strings, no fallback logic
- Align with actual PR implementation
- Remove verbose theoretical sections and complex patterns
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Fallback to org admin
* Prevent accidental privilege escalation as code changes in the future
* When org admin, we don't actually need to do the db query
* Use findMany and Map to drill down permission adjustments
* Exclude .MEMBER from overriding role, we likely don't want to demote
* refactor logic
* Add tests for services/factories + removeHandler
* fix type check
---------
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Sean Brydon <sean@cal.com>
