51639e38d73bbb9b833dec0efaa91ea43be1dda8
1097
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 MorganandGitHub
|
56b29b5df6 | chore: rename app.ts to bootstrap.ts on api-v2 (#26604) | ||
|
|
b6c243f1dd |
fix: improve cleanup for managed event types and fix flaky api v2 e2e test (#26602)
* fix: improve cleanup for managed event types in e2e tests - Add deleteAllUserEventTypes method to EventTypesRepositoryFixture - Update afterAll cleanup to delete user event types before deleting users - This ensures child event types of managed event types are properly cleaned up - Fixes flaky tests caused by incomplete cleanup between test runs - Add explicit return types to fixture methods to satisfy lint rules - Replace @ts-ignore with @ts-expect-error for better type safety Co-Authored-By: anik@cal.com <adhabal2002@gmail.com> * fix --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Pedro CastroandGitHub
|
d9aef5b6a6 |
fix: add URL validation for logo fields (#26522)
* fix(auth): add URL validation for organization logo fields - Add URL validation utility for server-side fetched URLs - Validate logo URLs in tRPC organization schema - Validate logo URLs in API v2 team DTOs - Add graceful fallback in logo route for invalid URLs - Only allow HTTPS and image data URLs - Add unit tests for URL validation * fix: add missing IP range and type validation - Add RFC 6598 CGNAT range (100.64.0.0/10) to blocked IPs - Add @IsString() decorator before custom URL validators - Add boundary tests for new IP range * fix: address review feedback - Export validateUrlForSSRFSync via @calcom/platform-libraries - Fix nullable/optional order in Zod schema * fix: block localhost hostname and explicit null check - Add localhost to BLOCKED_HOSTNAMES for sync validation - Use explicit null check (url == null) instead of falsy check * fix: allow empty string in URL validation * refactor: extract shared validation logic - Extract validateUrlCore() to eliminate duplication between sync/async versions - Add JSDoc to all exported functions for better discoverability - Remove redundant comments that repeated function names - Simplify existing comments to be more concise * fix: reject empty strings in URL validator Previously if (!url) allowed empty strings to bypass validation. Now explicitly checks for null/undefined only |
||
|
|
ccff0045fc |
fix: Add email verification requirement for API v1 and v2 email updates (#24988)
* fix: Add email verification requirement for API v1 and v2 email updates
- API v2 (/v2/me): Implement email verification check when updating primary email
- Store new email in metadata as emailChangeWaitingForVerification when verification is required
- Send verification email using sendChangeOfEmailVerification
- Allow immediate email change if new email is already a verified secondary email
- Add hasEmailBeenChanged and sendEmailVerification flags to response
- Add tests to verify email verification behavior
- Add findVerifiedSecondaryEmail method to UsersRepository
- Add PrismaFeaturesRepository to MeModule providers
- API v1 (/v1/users/{userId}): Implement same email verification logic
- Check if email-verification feature flag is enabled
- Store new email in metadata when verification is required
- Send verification email for unverified email changes
- Allow immediate change for verified secondary emails
- Preserve existing API v1 response format
- Test fixtures: Add createSecondaryEmail method to UserRepositoryFixture
This fixes the vulnerability where users could update their primary email
without verification via API endpoints.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* update
* update
* refactor: Extract business logic to MeService and add platform-managed bypass
- Create MeService with all business logic extracted from MeController
- Update MeController to delegate to MeService (thin controller pattern)
- Add PrismaWorkerModule to MeModule imports to provide PrismaWriteService
- Add isPlatformManaged bypass: platform-managed users can update email without verification
- Fix test cleanup to use delete by ID instead of email to avoid failures when email changes
- Remove hasEmailBeenChanged and sendEmailVerification response flags per reviewer feedback
- Add comprehensive documentation to @ApiOperation describing email verification behavior
- Update tests to remove flag assertions
Addresses PR comments:
- supalarry: Extract logic to service layer
- supalarry: Allow platform-managed users to update email without verification
- supalarry: Remove response flags and document behavior in @ApiOperation instead
- cubic-dev-ai: Fix module dependency for PrismaFeaturesRepository
- cubic-dev-ai: Fix test cleanup issue
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* docs: Simplify API operation description
Remove internal implementation details about metadata staging and shorten the description to focus on API consumer behavior.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix
* update
* update
* update
* remove comment
* addressed commit
* review addressed
* use repository
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
||
|
Alex van AndelandGitHub
|
23ecd1c906 |
refactor: First high level changes to getUsersAvailability (#26566)
* refactor: First high level changes to getUsersAvailability * Fix usage of getUserAvailability where getUsersAvailability is unused * Fix user.schema.ts in APIv2 * User handler did not provide initial data * Small ts fixes * Set user non-nullable in getTimezoneFromDelegatedCredential * Small ts fixes, ensure consumers are aware its nonnullable * Mode is defaulted to none * Mode is defaulted to none, fix ts when directly using fn (temp) |
||
|
|
dbc6b15ffc |
fix: time and timeUnit partial update workflows api v2 (#26503)
* test: add e2e test for workflow partial update time/timeUnit preservation Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: time and timeUnit partial update workflows api v2 --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
ac3699dcb4 |
fix: set attendeeSeatId in evt for seated booking reschedule emails (#26498)
* fix: set attendeeSeatId in evt for seated booking reschedule emails When an attendee reschedules a seated booking, the reschedule/cancel links in emails were using bookingUid instead of seatUid after the first reschedule. This was because evt.attendeeSeatId was not being set before sending the email. This fix ensures that evt.attendeeSeatId is set to bookingSeat.referenceUid so that the email links consistently use seatUid for seated bookings. Co-Authored-By: morgan@cal.com <morgan@cal.com> * test: add E2E test for seatUid preservation across multiple reschedules Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: use valid time slots within availability window for E2E test Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: make E2E test self-contained to avoid shared state issues Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: update E2E test to validate seatUid usability across reschedules Co-Authored-By: morgan@cal.com <morgan@cal.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Volnei MunhozGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> |
a62eb2bdac |
refactor: replace shouldServeCache with mode parameter for calendar cache control (#26539)
* refactor: replace shouldServeCache with mode parameter for calendar cache control Replace the boolean shouldServeCache parameter with a new CalendarFetchMode type that can have values 'slots', 'overlay', and 'booking'. This provides better control over when to serve cache vs relay on calendar providers. - 'slots' mode: Check feature flags and use cache when available (for getting actual calendar availability) - 'overlay' mode: Don't use cache (for overlay calendar availability) - 'booking' mode: Don't use cache (for booking confirmation) - undefined: Same as 'slots' for backwards compatibility The cache decision logic is now centralized in getCalendar.ts based on the mode parameter. Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: update CalendarService.test.ts to use mode parameter Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * refactor: use shared GetAvailabilityParams type across all calendar services - Import GetAvailabilityParams and GetAvailabilityWithTimeZonesParams from @calcom/types/Calendar - Replace inline type definitions with shared types in all calendar service implementations - Update BaseCalendarService, CalendarCacheWrapper, and CalendarTelemetryWrapper - Ensures consistent typing and follows DRY principles Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add missing IntegrationCalendar import and update mock getAvailability signature - Add IntegrationCalendar back to sendgrid CalendarService imports - Update bookingScenario mock getAvailability to use typed params object - Add listCalendars method to mock Calendar object Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: update test files to use typed params object for getAvailability methods - Update CalendarCacheWrapper.test.ts to call getAvailability/getAvailabilityWithTimeZones with params object - Update getCalendarsEvents.test.ts toHaveBeenCalledWith assertions to expect params object - All 32 tests now pass Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * refactor: consolidate to single GetAvailabilityParams type for both getAvailability methods - Remove GetAvailabilityWithTimeZonesParams, use GetAvailabilityParams for both methods - Add mode parameter to getAvailabilityWithTimeZones calls - Update wrapper classes to pass mode through to underlying calendar - Update test files to include mode in getAvailabilityWithTimeZones calls and assertions Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * refactor: use EventBusyDate with optional timeZone for getAvailabilityWithTimeZones - Add optional timeZone field to EventBusyDate type - Update getAvailabilityWithTimeZones return type to use EventBusyDate[] - Update Google Calendar service and wrapper classes to use the new type Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: type errors and remove unused calendar watching methods - Fix type errors in CalendarCacheWrapper.ts (convert null to undefined for timeZone) - Fix type errors in getCalendarsEvents.ts (ensure timeZone is always present) - Remove unused watchCalendar/unwatchCalendar from Calendar interface - Remove unused startWatchingCalendarsInGoogle/stopWatchingCalendarsInGoogle from GoogleCalendarService - Remove unused imports (uuid, uniqueBy, GOOGLE_WEBHOOK_URL, ONE_MONTH_IN_MS) Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: remove watchCalendar/unwatchCalendar from CalendarTelemetryWrapper Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * refactor: remove verbose JSDoc param comments from wrapper classes Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * refactor: make mode parameter required in getCalendar Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add required mode parameter to all getCalendar callers Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: provide default mode value in getBusyCalendarTimes Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add mode parameter to remaining getCalendar callers Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add mode parameter to vital and wipemycalother reschedule Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add mode parameter to credential-sync API endpoint Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * refactor: add 'none' mode to CalendarFetchMode and use as default Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * test: add mode parameter to getCalendarsEvents test calls Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * Update packages/app-store/delegationCredential.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> |
||
|
|
59fca85d92 |
fix: use graceful filtering for previously hard failing blocked users in team events (#26446)
* init * typefix * -- * fix test * update index * cleanup * rm unnecessary comments * improvements * add tests * test fixes * fixes * fixes * fixes * add try catch to make booking fail-open * Update packages/features/watchlist/operations/check-user-blocking.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * fix type --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> |
||
|
|
f5d345b133 |
refactor: remove @calcom/web imports from @calcom/features and add @calcom/testing package (#26480)
* fix: remove @calcom/web imports from packages/features to eliminate circular dependency - Migrate UserTableUser and MemberPermissions types to packages/features/users/types/user-table.ts - Migrate useGeo hook to packages/features/geo/GeoContext.tsx - Migrate buildLegacyRequest to packages/lib/buildLegacyCtx.ts - Migrate Calendar component to packages/features/calendars/weeklyview/components/ - Move test utilities (bookingScenario, fixtures) to packages/features/test/ - Update all imports in packages/features to use new locations - Add re-exports in apps/web for backward compatibility Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: delete original implementation files and fix type issues - Delete original calendar component files in apps/web (keep only re-export stubs) - Migrate OutOfOfficeInSlots to packages/features/bookings/components - Convert apps/web OutOfOfficeInSlots to re-export stub - Fix className vs class issue in Calendar.tsx - Fix @calcom/trpc import violation in user-table.ts by using structural type Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing isGroup and contains fields to UserTableUser attributes type Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update customRole type to match actual Prisma Role model Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix build * fix * fix * cleanup weeklyview * fix * refactor to mv MemberPermissions to types package * add types dependency to features * fix * fix * fix * fix * fix * fix * rename * rename * migrate * migrate * migrate * fix * fix * fix * refactor: move test utilities from packages/features/test to tests/libs - Move bookingScenario utilities to tests/libs/bookingScenario - Move fixtures to tests/libs/fixtures - Update all imports in packages/features test files to use new location - Update all imports in apps/web test files to use new location - Eliminates duplication of test utilities between packages/features and apps/web Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: correct relative import paths for tests/libs in test files Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * refactor: replace test utility implementations with re-exports to tests/libs Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: fix test import paths and move signup handler tests to apps/web Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: move buildLegacyCtx to packages/lib and restore handlers to packages/features - Move buildLegacyCtx from apps/web/lib to packages/lib to break circular dependency - Update apps/web/lib/buildLegacyCtx.ts to re-export from @calcom/lib - Restore signup handlers and tests to packages/features/auth/signup/handlers - Update handler imports to use @calcom/lib/buildLegacyCtx instead of @calcom/web/lib/buildLegacyCtx Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update recurring-event.test.ts imports to use tests/libs path Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * refactor: delete test re-export files and update imports to use tests/libs directly Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update remaining test imports to use tests/libs directly Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update handleRecurringEventBooking calls to match function signature (1 arg) Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * remove * migrate tests * migrate tests * refactor: update test mock imports by removing and using async for mock creators. * fix type errors * fix: add type assertion for MockUser in p2002.test-suite.ts Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: restore locale import in compareReminderBodyToTemplate.test.ts using relative path Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * feat: create @calcom/testing package and migrate tests from /tests directory - Created new @calcom/testing package in /packages/testing - Moved all files from /tests to /packages/testing - Updated all imports across the codebase to use @calcom/testing alias - Removed /tests directory at root level This allows other packages like @calcom/features and @calcom/web to import testing utilities using the @calcom/testing alias instead of relative paths. Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix * fix * fix: add missing useBookings export to @calcom/atoms package Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing useCalendarsBusyTimes and useConnectedCalendars exports to @calcom/atoms Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * chore: add @calcom/testing as explicit devDependency to packages that use it Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * refactor: move setupVitest.ts into @calcom/testing package Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix * chore: add biome rules to restrict @calcom/testing imports Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix * rename libs to lib * rename libs to lib * add rule * add rule * refactor: remove @calcom/features imports from @calcom/testing - Move mockPaymentSuccessWebhookFromStripe to fresh-booking.test.ts - Replace ProfileRepository.generateProfileUid() with uuidv4() - Clone Tracking type into @calcom/testing/src/lib/types.ts - Update imports in expects.ts and getMockRequestDataForBooking.ts - Move source files into src/ folder - Move CalendarManager mock to @calcom/features Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add explicit exports for nested paths in @calcom/testing Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * improve * improve * fix * fix * fix type checks * fix type checks * fix type checks * fix tests --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Udit TakkarandGitHub
|
0d905a6c11 | fix: add arrayLimit (#26542) | ||
|
Dhairyashil ShindeandGitHub
|
dcf10935de |
feat: add missing event type fields for advanced settings in api v2 (#25739)
* feat: api v2 add missing event type fields for advanced settings Add 9 event type fields to API v2 that were available in tRPC but missing from the platform API: - disableCancelling: disable cancelling for guests/organizer - disableRescheduling: disable rescheduling for guests/organizer - canSendCalVideoTranscriptionEmails: send Cal Video transcription emails - autoTranslateInstantMeetingTitleEnabled: auto-translate instant meeting titles - interfaceLanguage: preferred booking interface language - allowReschedulingPastBookings: allow rescheduling past events - allowReschedulingCancelledBookings: allow booking via reschedule link - customReplyToEmail: custom reply-to email for confirmations - showOptimizedSlots: optimize time slot arrangement Updated output/input schemas, transformation services, and E2E tests. * fix(api-v2): add proper OpenAPI types for nullable event type fields Add explicit type and nullable properties to @ApiPropertyOptional decorators for fields with `boolean | null` or `string | null` types. Without these, Swagger was generating incorrect "type": "object" instead of the correct types. Fixed fields: - disableCancelling: type: Boolean, nullable: true - disableRescheduling: type: Boolean, nullable: true - interfaceLanguage: type: String, nullable: true - allowReschedulingCancelledBookings: type: Boolean, nullable: true - customReplyToEmail: type: String, nullable: true - showOptimizedSlots: type: Boolean, nullable: true * refactor: customReplyToEmail was intentionally excluded from this PR. The web UI restricts this field to only allow the user's own verified emails via a dropdown, but implementing the same validation in the API requires additional business logic. This will be addressed in a separate PR with proper email ownership validation. * feat(api-v2): add validation for interfaceLanguage field Add @IsIn validation to interfaceLanguage field to only accept supported locales. This ensures API v2 matches the web UI behavior where users can only select from a predefined dropdown of supported languages. Changes: - Add SUPPORTED_LOCALES constant to @calcom/platform-constants - Add @IsIn([...SUPPORTED_LOCALES]) validation to create/update DTOs - Add E2E tests for invalid locale rejection (400 error) - Add cross-reference comments in i18n.json and api.ts to keep in sync * docs(api): add default values to event type input field documentation Added default value documentation to @DocsPropertyOptional decorators for the new event type fields in API v2 (2024_06_14): - disableCancelling: false - disableRescheduling: false - canSendCalVideoTranscriptionEmails: true - autoTranslateInstantMeetingTitleEnabled: false - allowReschedulingPastBookings: false - allowReschedulingCancelledBookings: false - showOptimizedSlots: false This improves API documentation by clearly communicating default values to API consumers in the OpenAPI spec. * feat(api-v2): refactor event type settings to object types for future extensibility - Convert disableRescheduling from boolean to object with disabled and minutesBefore properties - Convert disableCancelling from boolean to object with disabled property - Move canSendCalVideoTranscriptionEmails into CalVideoSettings as sendTranscriptionEmails - Remove autoTranslateInstantMeetingTitleEnabled (Enterprise-only feature) - Add DisableRescheduling_2024_06_14 and DisableCancelling_2024_06_14 input/output types - Add transformation methods for new object types in input and output services - Update E2E tests for new API contract BREAKING CHANGE: disableRescheduling and disableCancelling now accept objects instead of booleans * fix(api-v2): prevent clearing calVideoSettings when only sendTranscriptionEmails is provided Only include calVideoSettings in transformed output if it has properties, avoiding unintentional reset of existing settings during updates. |
||
|
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>Peer RichelsenVolnei MunhozVolnei Munhoz |
61a932f8f5 |
feat: OAuth2 controller api v2 + refactor oAuth Trpc handlers (#25989)
* feat(api-v2): add OAuth2 controller skeleton for auth module - Add new OAuth2 module under /auth with controller, service, repository, and DTOs - Implement skeleton endpoints: - GET /v2/auth/oauth2/clients/:clientId - Get OAuth client info - POST /v2/auth/oauth2/clients/:clientId/authorize - Generate authorization code - POST /v2/auth/oauth2/clients/:clientId/exchange - Exchange code for tokens - POST /v2/auth/oauth2/clients/:clientId/refresh - Refresh access token - Create input DTOs for authorize, exchange, and refresh operations - Create output DTOs for client info, authorization code, and tokens - Register OAuth2Module in endpoints.module.ts Co-Authored-By: morgan@cal.com <morgan@cal.com> * chore: add missing functions to platform libraries * feat(api-v2): integrate OAuthService from platform-libraries into OAuth2 controller - Add OAuthService export to platform-libraries - Refactor OAuth2Service to use OAuthService.validateClient() and OAuthService.verifyPKCE() - Remove duplicate local implementations of validateClient and verifyPKCE methods Co-Authored-By: morgan@cal.com <morgan@cal.com> * feat(api-v2): use local validateClient and verifyPKCE implementations - Remove OAuthService export from platform-libraries (will be deprecated) - Reimplement validateClient and verifyPKCE methods locally in OAuth2Service - Use verifyCodeChallenge and generateSecret from platform-libraries directly Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor(api-v2): separate repositories for OAuth2, access codes, and teams - Create AccessCodeRepository for access code Prisma operations - Add findTeamBySlugWithAdminRole method to TeamsRepository - Move generateAuthorizationCode, createTokens, verifyRefreshToken to OAuth2Service - Update OAuth2Repository to only contain OAuth client operations - Update OAuth2Module to import TeamsModule and provide AccessCodeRepository Addresses PR review comments to properly separate concerns Co-Authored-By: morgan@cal.com <morgan@cal.com> * feat(api-v2): implement JWT token creation and verification for OAuth2 - Implement createTokens method using jsonwebtoken to sign access and refresh tokens - Implement verifyRefreshToken method to verify JWT refresh tokens - Add ConfigService injection for CALENDSO_ENCRYPTION_KEY access - Import ConfigModule in OAuth2Module for dependency injection Based on logic from apps/web/app/api/auth/oauth/token/route.ts and apps/web/app/api/auth/oauth/refreshToken/route.ts Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: refactor and dayjs import fix * feat(api-v2): add ApiAuthGuard to getClient endpoint and e2e tests for OAuth2 - Add @UseGuards(ApiAuthGuard) to getClient endpoint for authentication - Add comprehensive e2e tests for all OAuth2 endpoints: - GET /v2/auth/oauth2/clients/:clientId - POST /v2/auth/oauth2/clients/:clientId/authorize - POST /v2/auth/oauth2/clients/:clientId/exchange - POST /v2/auth/oauth2/clients/:clientId/refresh - Tests cover happy paths and error cases (invalid client, invalid code, etc.) Co-Authored-By: morgan@cal.com <morgan@cal.com> * chore(api-v2): hide OAuth2 endpoints from Swagger documentation Co-Authored-By: morgan@cal.com <morgan@cal.com> * hide endpoints from doc * fix(api-v2): address PR feedback for OAuth2 controller - Fix P0 critical bug: token_type field name mismatch in DecodedRefreshToken interface - Add @Equals('authorization_code') validation to exchange.input.ts grantType - Add @Equals('refresh_token') validation to refresh.input.ts grantType - Add @IsNotEmpty() validation to get-client.input.ts clientId - Add @Expose() decorators to all output DTOs for proper serialization - Add security test assertion to verify clientSecret is not returned in response Co-Authored-By: morgan@cal.com <morgan@cal.com> * feat(api-v2): implement redirect behavior for OAuth2 authorize endpoint - Update authorize endpoint to return HTTP 303 redirect with authorization code - Add exact match validation for redirect URI (security requirement) - Implement error handling with redirect to redirect URI and error query params - Add state parameter support for CSRF protection - Update e2e tests to verify redirect behavior (303 status, Location header, error redirects) Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor(api-v2): address PR feedback for OAuth2 authorize endpoint - Make redirectUri a required input parameter (remove optional fallback) - Move buildRedirectUrl and mapErrorToOAuthError to oauth2Service - Add return statements to res.redirect() calls - Simplify controller by delegating redirect URL building to service Co-Authored-By: morgan@cal.com <morgan@cal.com> * wip move code outside of api v2 * feat(oauth): wire up dependency injection for OAuthService and repositories Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor: oAuthService used in routes * fix imports * fix(api-v2): return 404 for invalid client ID instead of redirect in authorize endpoint Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api-v2): fix E2E test URL paths and remove bootstrap() in authenticated section - Remove bootstrap() call in authenticated section to match working test pattern - Change URL paths from /api/v2/... to /v2/... in authenticated section - Keep bootstrap() and /api/v2/... paths in unauthenticated section Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api-v2): mock getToken from next-auth/jwt for E2E tests - Add jest.mock for next-auth/jwt getToken function - Mock returns null for unauthenticated tests - Mock returns { email: userEmail } for authenticated tests - Remove withNextAuth helper since ApiAuthGuard uses ApiAuthStrategy which calls getToken directly, not NextAuthStrategy Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix tests and code review * cleanup generate secrets * cleanup controller * chore: remove console.log from OAuthService.validateClient Co-Authored-By: morgan@cal.com <morgan@cal.com> * Update apps/web/app/api/auth/oauth/refreshToken/route.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * fix(api-v2): add bootstrap() to authenticated E2E tests and update URL paths to /api/v2/ Co-Authored-By: morgan@cal.com <morgan@cal.com> * Merge remote-tracking branch 'origin/devin/oauth2-controller-skeleton-1765988792' and remove console.log from token route Co-Authored-By: morgan@cal.com <morgan@cal.com> * chore: remove dead code * refactor * refactor: generateAuthCode trpc handler and getClient trpc handler * remove pkce check for refreshToken endpoint * Update packages/trpc/server/routers/viewer/oAuth/getClient.handler.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * refactor: error handling * refactor: error handling * refactor: error handling * remove console log * provide redirectUri in generateAuthCodeHandler * provide redirectUri in authorize view * refactor: replace HttpError with ErrorWithCode in OAuth files - Update OAuthService to use ErrorWithCode instead of HttpError - Update mapErrorToOAuthError to check ErrorCode instead of status codes - Update token/route.ts and refreshToken/route.ts to use ErrorWithCode - Add ErrorWithCode export to platform-libraries - Use getHttpStatusCode to map ErrorCode to HTTP status codes Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: update generateAuthCode handler to use ErrorWithCode instead of HttpError The handler was still checking for HttpError in its catch block, but OAuthService now throws ErrorWithCode. This caused the error messages to be lost and replaced with 'server_error' instead of the specific error messages. Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: update OAuth2 controller to use ErrorWithCode instead of HttpError The controller was still checking for HttpError in its catch blocks, but OAuthService now throws ErrorWithCode. This caused all errors to return 500 Internal Server Error instead of the correct HTTP status codes (400, 401, 404). Also added getHttpStatusCode export to platform-libraries. Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: add explicit unknown type annotation to catch blocks in OAuth2 controller Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: change NotFoundException to HttpException in authorize endpoint Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: handle err with ErrorWithCode in authorize endpoint catch block Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: move errorWithCode * fix: error code rfc * fix: no need to handle errors there is a middleware * refactor errors * refactor errors * refactor redirecturi and state from api * refactor: address PR comments for OAuth2 controller - Remove unused GetOAuth2ClientInput class - Change API tag from 'Auth / OAuth2' to 'OAuth2' - Move OAuthClientFixture to separate fixture file (oauth2-client.repository.fixture.ts) - Add 'type' property to OAuth2ClientDto for confidential/public client type - Rename 'clientId' to 'id' in OAuth2ClientDto (using @Expose mapping) - Clean up duplicate provider declarations in oauth2.module.ts - Update e2e tests to use new fixture and verify type property Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: Peer Richelsen <peeroke@gmail.com> Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com> Co-authored-by: Volnei Munhoz <volnei@cal.com> |
||
|
Hariom BalharaandGitHub
|
ca32f04cc1 |
chore: Integrate booking cancellation audit (#26458)
## What does this PR do? > **⚠️ Note: This PR does not enable booking audit in production.** The `BookingAuditTaskerProducerService` has an [`IS_PRODUCTION` guard](https://github.com/calcom/cal.com/blob/integrate-booking-creation-reschedule-audit/packages/features/booking-audit/lib/service/BookingAuditTaskerProducerService.ts#L106-L108) that skips audit task queueing in production environments. This allows the integration to be tested in development before enabling it in production. Integrates audit logging for booking cancellations, following the pattern established in PR #26046 for booking creation/rescheduling audit. - Related to #25125 (Booking Audit Infrastructure) ### Changes: - Add audit logging for single booking cancellation via `onBookingCancelled` - Add audit logging for bulk recurring booking cancellation via `onBulkBookingsCancelled` - Pass `userUuid` and `actionSource` from webapp cancel route (WEBAPP) - Pass `userUuid` and `actionSource` from API-v2 bookings service (API_V2) - Create `getAuditActor` helper to derive actor from userUuid or create synthetic guest actor - Add `getUniqueIdentifier` helper for generating unique actor identifiers - Add warning log when `actionSource` is "UNKNOWN" for observability - Add integration tests for booking cancellation audit ### Audit Data Captured: - `cancellationReason` (simple string value) - `cancelledBy` (simple string value) - `status` (old → new, e.g., "ACCEPTED" → "CANCELLED") ### Updates since last revision: - Simplified `CancelledAuditActionService` schema: `cancellationReason` and `cancelledBy` are now stored as simple nullable strings instead of change objects (old/new), since cancellation is a one-time event where tracking previous values doesn't apply - Added integration tests for cancelled booking audit in `booking-audit-cancelled.integration-test.ts` - Added `getUniqueIdentifier` helper function in actor.ts for generating unique identifiers with prefixes ## Mandatory Tasks (DO NOT REMOVE) - [x] I have self-reviewed the code (A decent size PR without self-review might be rejected). - [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed. - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works. ## How should this be tested? 1. Cancel a single booking via the webapp - verify audit record is created with actor and actionSource="WEBAPP" 2. Cancel a single booking via API v2 - verify audit record is created with actionSource="API_V2" 3. Cancel all remaining bookings in a recurring series - verify bulk audit records are created with shared operationId 4. Cancel via unauthenticated cancel link - verify guest actor is created with synthetic email (prefixed with "param-" or "fallback-") 5. Run integration tests: `yarn test packages/features/booking-audit/lib/service/__tests__/booking-audit-cancelled.integration-test.ts` ## Human Review Checklist - [ ] Verify `onBookingCancelled` and `onBulkBookingsCancelled` methods exist in `BookingEventHandlerService` - [ ] Review the `getAuditActor` fallback logic - creates synthetic email with "fallback-" or "param-" prefix when no userUuid available - [ ] Confirm the simplified schema for `cancellationReason`/`cancelledBy` (no longer tracking old→new) is intentional - [ ] Note: Audit logging calls are awaited directly - if audit service fails, the cancellation will fail. Confirm this is the desired behavior. - [ ] Verify `CancelledAuditDisplayData` type no longer includes `previousReason` and `previousCancelledBy` fields --- Link to Devin run: https://app.devin.ai/sessions/42404e76a66946fe9e46fa07fb12e779 Requested by: @hariombalhara (hariom@cal.com) |
||
|
|
701c4cdb76 |
perf: batch booking queries in output service (#25900)
Replace N sequential queries with single batch queries in: - getOutputRecurringBookings - getOutputRecurringSeatedBookings Uses existing batch repository methods. Reduces database roundtrips from O(n) to O(1) for recurring booking lookups Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com> |
||
|
|
f4248bf20d |
feat: implement FeatureOptInService (#25805)
* feat: implement FeatureOptInService WIP * clean up * feat: consolidate feature repositories and add updateFeatureForUser - Implement updateFeatureForUser in FeaturesRepository (similar to updateFeatureForTeam) - Move getUserFeatureState and getTeamFeatureState from PrismaFeatureOptInRepository to FeaturesRepository - Update FeatureOptInService to use only FeaturesRepository - Add setUserFeatureState and setTeamFeatureState methods to FeatureOptInService - Update _router.ts to remove PrismaFeatureOptInRepository usage - Remove PrismaFeatureOptInRepository.ts and FeatureOptInRepositoryInterface.ts - Update features.repository.interface.ts and features.repository.mock.ts - Add integration tests for updateFeatureForUser, getUserFeatureState, getTeamFeatureState - Update service.integration-test.ts to use FeaturesRepository Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: rename updateFeatureForUser to setUserFeatureState Rename to match the convention used for setTeamFeatureState Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: return FeatureState type from getUserFeatureState and getTeamFeatureState * fix integration tests * clean up logics * update services and router * refactor: change getUserFeatureState and getTeamFeatureState to accept featureIds array - Renamed getUserFeatureState to getUserFeatureStates - Renamed getTeamFeatureState to getTeamFeatureStates - Changed parameter from featureId: string to featureIds: string[] - Changed return type from FeatureState to Record<string, FeatureState> - Updated FeatureOptInService to use the new batch methods - Added tests for querying multiple features in a single call - Optimized listFeaturesForTeam to fetch all feature states in one query Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * feat: add getFeatureStateForTeams for batch querying multiple teams - Added getFeatureStateForTeams method to query a single feature across multiple teams in one call - Updated FeatureOptInService.resolveFeatureStateAcrossTeams to use the new batch method - Replaces N+1 queries with a single database query for team states - Added comprehensive integration tests for the new method Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: combine org and team state queries into single call - Include orgId in the teamIds array passed to getFeatureStateForTeams - Extract org state and team states from the combined result - Reduces database queries from 3 to 2 in resolveFeatureStateAcrossTeams Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: use team.isOrganization and clarify computeEffectiveState comment Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: use MembershipRepository.findAllByUserId with isOrganization Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * feat: add featureId validation using isOptInFeature type guard Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * less queries * add fallback value * fix type error * move files * add autoOptInFeatures column * use autoOptInFeatures flag within FeatureOptInService * add setUserAutoOptIn and setTeamAutoOptIn * fix computeEffectiveState logic * rewrite computeEffectiveState * clean up integration tests * clean up in afterEach * fix type error * refactor: use FeaturesRepository methods instead of direct Prisma calls Replace all manual userFeatures and teamFeatures Prisma operations with the new setUserFeatureState and setTeamFeatureState repository methods. Changes include: - Admin handlers (assignFeatureToTeam, unassignFeatureFromTeam) - Test fixtures and integration tests - Playwright fixtures - Development scripts This ensures consistent feature flag management through the repository pattern and supports the new tri-state semantics (enabled/disabled/inherit). Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * clean up * fix the logic * extract some logic into applyAutoOptIn() * remove wrong code * refactor: convert setUserFeatureState and setTeamFeatureState to object params with discriminated union - Convert multiple positional parameters to single object parameter - Use discriminated union types: assignedBy required for enabled/disabled, omitted for inherit - Update all callers across repository, service, handlers, fixtures, and tests * fix type error * use Promise.all * fix --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
81b5d62f07 |
feat(api): add team event-types webhooks controller (#26449)
* feat(api): add team event-types webhooks controller - Add TeamsEventTypesWebhooksController for managing webhooks on team event types - Add IsTeamEventTypeWebhookGuard for authorization - Add TeamEventTypeWebhooksService for business logic - Register new controller in TeamsEventTypesModule - Enable unsafeParameterDecoratorsEnabled in biome.json for NestJS support Co-Authored-By: morgan@cal.com <morgan@cal.com> * test(api): add e2e tests for team event-types webhooks controller Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api): restrict team event-type webhooks to admins/owners only Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api): use regular imports instead of type imports for DI and DTOs Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api): use regular imports for DI in guard file Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: circular depndency in modules * delete teams in test * fix roles guard * fix biome * fix guard * resolve type import * resolve review feedback --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Hariom BalharaandGitHub
|
e61e66ec34 |
chore: Ensure that uuid is available in server session[Booking Audit Prerequisite] (#25963)
## What does this PR do? Similar to #25721, adds uuid in session so that BookingAudit has it readily available Adds the user's UUID to the booking metadata by: 1. Extending the NextAuth `User` interface to include an optional `uuid` property from PrismaUser 2. Making `uuid` required on `Session.user` via intersection type (`User & { uuid: PrismaUser["uuid"] }`) 3. Adding `uuid` to the session user object in `getServerSession.ts` 4. Adding `uuid` to the `AdapterUser` transformation in `next-auth-custom-adapter.ts` 5. Passing `userUuid` from the session to the booking creation flow 6. Updating the API key verification flow to include `uuid` in the user data (repository, service, and type definitions) 7. Adding `req.userUuid` as a required field on the request object (like `req.userId`) 8. Adding `uuid` to mock session objects in web app routes and test context 9. Adding `uuid` to the `findByEmailAndIncludeProfilesAndPassword` query in UserRepository Also removes commented-out code that was placeholder for future work and fixes lint warnings for unused variables. ## Mandatory Tasks (DO NOT REMOVE) - [x] I have self-reviewed the code (A decent size PR without self-review might be rejected). - [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed. - [x] I confirm automated tests are in place that prove my fix is effective or that my feature works. ## How should this be tested? 1. Verify that the NextAuth session callback is already populating the `uuid` field on the user object 2. Create a booking and confirm `userUuid` is included in the booking metadata 3. Test API v1 endpoints (`/api/invites` POST and `/api/teams/[teamId]/publish`) to verify they receive the uuid from the authenticated user 4. Check that the booking flow works correctly with the new parameter 5. Test SAML login flow to verify session still works correctly (uuid is resolved from database after authentication) ## Human Review Checklist - [ ] Verify the NextAuth session callback populates `uuid` - if not, this change will pass `undefined` at runtime - [ ] Confirm `userUuid` is consumed downstream in the booking service - [ ] Verify that `PrismaApiKeyRepository.findByHashedKey()` correctly fetches the user's uuid from the database - [ ] Verify the discriminated union type in `ApiKeyService.ts` ensures `result.user` is always defined when `result.valid` is true - [ ] Confirm all API v1 endpoints using `req.userUuid` go through the `verifyApiKey` middleware - [ ] Verify `UserRepository.findByEmailAndIncludeProfilesAndPassword()` includes `uuid` in the select clause - [ ] Verify SAML login still works correctly - uuid is now optional on User interface so SAML providers don't need to supply it at profile stage ## Updates since last revision - **Made uuid optional on User, required on Session**: Changed the type strategy so `uuid` is optional on the NextAuth `User` interface but required on `Session.user` via intersection type. This allows SAML providers to not supply uuid at the profile stage while ensuring uuid is always present on the session after the user is resolved from the database. - **Removed uuid from SAML functions**: Since uuid is now optional on User, the SAML profile and authorize functions no longer need to include it. --- Link to Devin run: https://app.devin.ai/sessions/97e5603b719a420b9b35041252c9db26 Requested by: hariom@cal.com (@hariombalhara) |
||
|
Volnei MunhozandGitHub
|
a1e5384859 | Prefix node protocol (#26391) | ||
|
Pedro CastroandGitHub
|
40dd546429 |
chore(deps): update dependencies and add version constraints (#26328)
* chore(deps): update dependencies and add version constraints - Update direct dependencies: body-parser, @nestjs/swagger, react-use, trigger.dev - Add resolutions for consistent dependency versions across the monorepo - Add packageExtensions to ensure compatible transitive dependency versions * fix: upgrade rollup resolution from 3.29.5 to 4.22.4 Rollup 3.x is incompatible with vite 5.x which requires rollup ^4.20.0. The previous resolution caused CI failures due to missing ./parseAst export * fix: update axios resolution to 1.13.2 Align resolution with direct dependency in apps/api/v2. Both versions include the fix, but 1.13.2 is newer and avoids an unnecessary downgrade |
||
|
|
bbf9274d37 |
chore: upgrade Vitest to 4.0.16 and Vite to 6.4.1 (#26351)
* chore: upgrade Vitest to 4.0.16 and Vite to 6.4.1 - Update vitest from 2.1.9 to 4.0.16 - Update @vitest/ui from 2.1.9 to 4.0.16 - Update vitest-fetch-mock from 0.3.0 to 0.4.5 - Update vitest-mock-extended from 2.0.2 to 3.1.0 - Update vite from 4.5.14/5.4.21 to 6.4.1 across all packages - Update @vitejs/plugin-react to 5.1.2 - Update @vitejs/plugin-react-swc to 4.2.2 - Update @vitejs/plugin-basic-ssl to 2.1.0 - Update vite-plugin-dts to 4.5.4 - Rename vitest.config.ts to vitest.config.mts for ESM compatibility - Add globals: true to vitest config Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: address Vitest 4.0 and Vite 6 breaking changes - Convert arrow function mockImplementation patterns to regular functions (Vitest 4.0 breaking change: arrow functions can't be constructor mocks) - Fix CSS imports with ?inline suffix for Vite 6 compatibility - Add biome override to disable useArrowFunction rule for test files - Fix syntax errors in test files introduced by regex replacements Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: fix remaining Vitest 4.0 constructor mock patterns Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: fix more Vitest 4.0 constructor mock patterns and exclude API v2 spec files Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert more arrow function mocks to regular functions for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert more arrow function mocks to regular functions for Vitest 4.0 - Fix CrmService.integration.test.ts jsforce.Connection mock - Fix RetellSDKClient.test.ts Retell mock - Fix RetellAIService.test.ts CreditService mocks - Fix GoogleCalendarSubscriptionAdapter.test.ts CalendarAuth mock Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert Google Calendar and OAuthManager arrow function mocks for Vitest 4.0 - Fix googleapis.ts Calendar, OAuth2Client, and JWT mocks - Fix utils.ts JWT mock - Fix OAuthManager.ts defaultMockOAuthManager mock Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add React plugin, jsdom environment, and fix more constructor mocks for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert HostRepository PrismaClient mock to regular function for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add useOrgBranding mock to React component tests for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: update TestFunction type for Vitest 4.0 compatibility Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert listBookingReports constructor mocks to regular functions for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert UserRepository constructor mock to regular function for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert OrganizationPaymentService constructor mock to regular function for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert more constructor mocks to regular functions for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add apps/web path aliases to vitest config Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: fix test issues for Vitest 4.0 compatibility - Fix Response constructor 204 status code issue in testUtils.ts - Fix FeaturesRepository mock persistence in handleNotificationWhenNoSlots.test.ts - Add @vitest-environment node directive to formSubmissionUtils.test.ts - Fix document.querySelector mock in embed.test.ts Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: clear EventManager spy between tests for Vitest 4.0 compatibility Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: update TeamRepository mock pattern for Vitest 4.0 compatibility Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert RoutingFormResponseRepository mock to regular function for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: convert more constructor mocks to regular functions for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: fix mock reset and spy clear issues for Vitest 4.0 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: fix remaining test failures for Vitest 4.0 upgrade - Fix booking-validations.test.ts: convert UserRepository mock to regular function - Fix route.test.ts: update 500 error test to mock ImageResponse instead of fetch - Fix users-public-view.test.tsx: add missing mocks for getOrgFullOrigin and useRouterQuery - Add @calcom/web path alias to vitest config Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add vitest-mocks for generated files that don't exist in CI - Add svg-hashes.json mock for route.test.ts - Add tailwind.generated.css mock for embed.test.ts - Update vitest config to use mock files Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: update vitest config aliases for CI compatibility - Use array format for aliases to ensure proper ordering - Add @calcom/platform-constants alias to resolve from source - Add @calcom/embed-react alias to resolve from source - Ensure svg-hashes.json mock alias is matched before @calcom/web Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add @calcom/embed-snippet alias for CI compatibility Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * Fix wrong test * fix: migrate from CLI flags to VITEST_MODE env var for Vitest 4.0 Vitest 4.0 no longer allows custom CLI flags like --packaged-embed-tests-only. This change migrates to using VITEST_MODE environment variable instead: - VITEST_MODE=packaged-embed for packaged embed tests - VITEST_MODE=integration for integration tests - VITEST_MODE=timezone for timezone-dependent tests Updated vitest.config.mts to handle mode-based include/exclude patterns. Updated CI workflows and package scripts to use the new env var approach. Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: return default include pattern instead of undefined in vitest config The getTestInclude() function was returning undefined for the default case, but Vitest 4.0 expects an array. This caused 'resolved.include is not iterable' error in CI. Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: always set INTEGRATION_TEST_MODE for jsdom environment The getBookingFields.ts file checks for INTEGRATION_TEST_MODE to allow server-side imports in the jsdom environment. Without this, tests fail with 'getBookingFields must not be imported on the client side' error. Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: support legacy CLI flags for backwards compatibility with main workflow The CI runs workflows from main branch, which uses the old CLI flag approach (yarn test -- --integrationTestsOnly). This commit adds backwards compatibility by checking both VITEST_MODE env var and process.argv for the legacy flags. Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Pedro CastroGitHubKeith WilliamsDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
128d15ea8f |
fix: ensure proper async handling in delegation credentials (#25898)
* fix: ensure proper async handling in ensureDefaultCalendars Replace forEach(async...) with Promise.allSettled to ensure: - Caller properly awaits completion - Errors are captured and logged - All users are processed even if some fail Adds unit tests for ensureDefaultCalendars * fix: use correct Jest assertion pattern for async test Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> --------- Co-authored-by: Keith Williams <keithwillcode@gmail.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
b08997b553 |
fix: remove debug logs and clean up verbose logging (#25896)
- Remove debug console.log statements in calendar and video adapter services - Clean up verbose request/response logging in OAuth controllers - Remove leftover debug prefixes Ensure only necessary data is captured in observability systems Co-authored-by: Keith Williams <keithwillcode@gmail.com> |
||
|
Volnei MunhozandGitHub
|
ed14219e44 | upgrade typescript (#26347) | ||
|
|
17224d9df3 |
ci: reduce e2e-api-v2 test overhead with caching and Jest optimizations (#26331)
* perf: increase E2E test shards from 4 to 6 for faster CI Increase the number of parallel E2E test shards from 4 to 6 to reduce overall CI wall-clock time. Each shard runs on a separate 4-vCPU runner with 4 workers, so adding more shards increases total parallelism. This should reduce E2E test time from ~3 minutes per shard to ~2 minutes per shard by distributing tests across more parallel jobs. Co-Authored-By: anik@cal.com <adhabal2002@gmail.com> * update * fix * update * readd * final update * fix flake --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
2c7cb530a1 |
fix: add eventTypeId and eventTypeSlug guard (#25773)
* fix: add eventTypeId and eventTypeSlug guard * chore: update test * refactor: improvemnt * revert: --------- Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com> |
||
|
|
7c373ddad6 |
feat: Introduce biome (#25664)
* Configure biome * Fix companion build * fix: remove generated files from formatter ignore list to enable proper formatting Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add explicit stripe dependency to @calcom/features to fix type resolution Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: rename const require to nodeRequire in generate-swagger.ts to avoid TypeScript reserved identifier conflict Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add guard for document in makeBodyVisible to prevent test environment teardown errors Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: replace ESLint with Biome CLI in embed-code-generator.e2e.ts Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: address cubic review comments - Fix invalid --reporter-path Biome CLI option by using shell redirection - Fix packages/lib lint report filename (app-store.json -> lib.json) - Add typescript-eslint and eslint back to companion for lint:react-compiler - Add missing restricted import rules to biome.json: - packages/lib: add ../trpc/** and @trpc/server restrictions - packages/trpc: add ../apps/web/** restriction Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * chore: regenerate companion bun.lock after adding eslint dependencies Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * Remove remaining eslint things * add tailwind directives --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
96dc3b5cc6 |
fix: improve test isolation for managed event type e2e tests (#26283)
- Move managedEventTypeSlug generation inside beforeAll to ensure uniqueness across test runs - Add deleteAllTeamEventTypes method to EventTypesRepositoryFixture - Explicitly delete all team event types in afterAll before deleting teams This fixes flaky tests in organizations-member-team-admin-event-types.e2e-spec.ts where the managed event type creation was intermittently failing with 400 Bad Request. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
55805f081d |
fix: add artifact handling for API v2 E2E tests (#26249)
* fix: add artifact handling for API v2 E2E tests - Add jest-junit reporter to generate JUnit XML test results - Update workflow to upload from correct path (apps/api/v2/test-results) - Add if-no-files-found: ignore and retention-days: 30 for consistency Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * Apply suggestion from @keithwillcode --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Pedro CastroandGitHub
|
ab512ea263 |
chore: bump package versions (#26211)
* chore: bump package versions - @nestjs/common 10.4.20 - @nestjs/platform-express 10.4.20 - @jsforce/jsforce-node 3.10.10 - dompurify 3.3.1 - @dub/embed-react 0.0.18 - @dub/embed-core 0.0.18 - http-proxy-middleware 2.0.9 - action-download-artifact v6 * fix: align NestJS core packages to same version Update @nestjs/core and @nestjs/testing to 10.4.20 to match @nestjs/common and @nestjs/platform-express versions |
||
|
|
44586c7dec |
chore: lock all package versions to match yarn.lock (#26204)
This commit pins all dependency versions in package.json files to exact versions matching the yarn.lock file, removing ^ and ~ prefixes. Changes: - Locked 427 dependencies across 47 package.json files - Versions now match exactly what is resolved in yarn.lock - Ensures reproducible builds and prevents unexpected version drift This change improves build reproducibility by ensuring that the versions specified in package.json files match exactly what yarn.lock resolves to. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
8befcced39 |
ci: shard API v2 E2E tests into 4 parallel jobs (#26183)
* ci: shard API v2 E2E tests into 4 parallel jobs Co-Authored-By: anik@cal.com <adhabal2002@gmail.com> * check * Fix typo in workflow name from 'Update' to 'Updatee' * Rename workflow from 'PR Updatee' to 'PR Update' * update * test * update * fix * update * check * remove * revert --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Pedro CastroandGitHub
|
99b82c55d5 |
chore: update direct dependencies (#26172)
Updates: - vite: 4.5.3→4.5.14, 5.4.6→5.4.21 - nodemailer: 6.7.8→7.0.11 - @playwright/test: 1.45.3→1.55.1 - next-auth: 4.22.1→4.24.13 - class-validator: 0.14.0→0.14.3 - dompurify: 3.2.3→3.3.1 Includes type fixes for next-auth adapter compatibility |
||
|
|
cd6c5fe6df |
chore: remove unused dependencies (#26169)
* chore: remove unused dependencies - Remove msw from apps/web (test was disabled with test.fixme) - Remove integrations.e2e.ts (unused test file depending on msw) - Remove jsforce from apps/api/v2 (never imported, salesforce uses @jsforce/jsforce-node) - Remove rollup-plugin-node-builtins and vite-plugin-node-polyfills from atoms (never used) - Remove fs/path/os aliases from atoms vite.config.ts Resolves: #76, #118, #354 (partial), #356, #347, #266 * fix(companion): remove unused glob dependency Glob was declared as devDependency but never imported in companion code Resolves dependabot alerts #465, #460 --------- Co-authored-by: Keith Williams <keithwillcode@gmail.com> |
||
|
|
7847177e8b |
fix(api): accept avatar URLs and use email for user creation (#25629)
* fix(api): fix user creation with avatarUrl and username
- avatarValidator: accept URLs in addition to base64 images
- organizations-users-service: use email for user creation instead of username
The avatarValidator was incorrectly rejecting valid URLs even though the API documentation shows URL examples and all e2e tests use URLs.
The user creation was failing when username was provided because createNewUsersConnectToOrgIfExists requires a valid email, not username. The username is correctly applied via updateOrganizationUser after creation.
Fixes user creation endpoint POST /v2/organizations/{orgId}/users
* test(api): add tests for avatar validator fixes
Add comprehensive test coverage for avatarValidator changes:
- Unit tests: 18 scenarios covering valid/invalid URLs and base64 images
- E2E tests: user creation with username + avatarUrl (URL and base64)
- Security validation: reject unsafe protocols and malformed data
- Error message verification for validation failures
Addresses testing requirements from code review
* fix(api): enhance avatar validator security per code review
- Reject HTTP URLs, accept only HTTPS for security and browser compatibility
- Reject empty strings and whitespace (use null to reset avatar)
- Update validation message to clarify HTTPS requirement
- Add test coverage for new security restrictions
Addresses security feedback from code review regarding mixed content vulnerabilities and clearer API semantics for avatar reset
* refactor(api): simplify avatarValidator null check
Remove redundant null/undefined check since @IsOptional decorator already skips validation for undefined values. Updated test mock to include @IsOptional to match real DTO usage
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
|
||
|
|
866c8c046d |
fix: create host records when team membership transitions to accepted via PATCH (#26138)
The PATCH endpoint for /v2/teams/:teamId/memberships/:membershipId had a bug where host records for assignAllTeamMembers event types were not created when a membership transitioned from accepted=false to accepted=true. The bug was caused by incorrect operation ordering: 1. Update membership (first update) 2. Get current membership (gets already-updated state) 3. Update membership again (second update) 4. Check if transition happened (condition never fires) Fixed by reordering to match the org-scoped controller pattern: 1. Get current membership BEFORE any updates 2. Update membership 3. Compare and call updateNewTeamMemberEventTypes if transition occurred Also added an e2e test to verify host records are created when membership transitions from accepted=false to accepted=true via PATCH. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Anik Dhabal BabuGitHubcubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>Syed Ali Shahbaz |
23920fe9ce |
fix: Org/team admin or owner should be marked as ‘no show’ in a member’s booking (#26009)
* fix: update tempOrgRediret on updating s lug * Update packages/trpc/server/routers/viewer/organizations/adminUpdate.handler.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * refactor * fix * fix * revert * fix handle no show * revert * Remove metadata from organization query selection Removed metadata selection from organization query. * use repo * update * Update packages/features/bookings/lib/checkIfUserIsAuthorizedToManageBooking.ts Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com> * update --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com> |
||
|
Rajiv SahalandGitHub
|
f9ff3248e5 |
feat: endpoint to update location for existing booking (#25367)
* feat: init endpoint to update booking location * chore: update controller * chore: DTOs for update location endpoint * chore: add update booking method * fix: refactor * feat: service update booking location * chore: update platform libraries * chore: update exports * chore: e2e tests for updating booking location endpoint * chore: update e2e tests for updating booking location endpoint * chore: update bookings module * fixup * chore: update configs * fixup: revert changes * chore: remove unused handlers * fix: update inputs * refactor: booking location service * fixup * revert: unnecessary changes * chore: cleanup * fix: e2e tests * chore: implement cubic feedback * chore: implement feedback * fixup * chore: more PR feedback |
||
|
|
40883386f0 |
fix: address peer dependency issues across the monorepo (#26105)
MOVE: - Move @next/third-parties from root to apps/web (only used there) - Remove date-fns-tz from root, add date-fns and date-fns-tz to root deps REMOVE: - Remove sonner from packages/lib (not used there, already in apps/web) - Remove next-seo from packages/ui (not used there, already in apps/web) - Remove next-auth from apps/api/v2 (only used for User type in tests) ADD peerDependencies: - packages/ui: add react-dom - packages/features: add react, react-dom, react-is, date-fns-tz, stripe, zod - packages/platform/atoms: add react-dom - packages/trpc: add next, react, react-dom ADD dependencies: - apps/web: add @next/third-parties, i18next, react-i18next - apps/api/v2: add axios (required by @nestjs/axios) FIX: - apps/api/v2: replace next-auth User type with @calcom/prisma/client User Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
0673d667f8 |
feat: upgrade api/v1 and example apps to Next.js 16.1.0 (#26104)
* feat: upgrade api/v1 and example apps to Next.js 16.1.0 - Update apps/api/v1 to Next.js 16.1.0 - Rename middleware.ts to proxy.ts per Next.js 16 migration - Add turbopack config to next.config.js - Update packages/platform/examples/base to Next.js 16.1.0 - Add eslint-disable to config files (following apps/web pattern) Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * chore: update yarn.lock for Next.js 16.1.0 upgrade Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Volnei MunhozGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Keith Williams |
83ee986bbd |
fix: lock package versions and organize devDependencies (#26095)
* fix: lock package versions to exact versions from yarn.lock Replace version ranges (^, ~) with exact resolved versions from yarn.lock to ensure consistent dependency resolution across all environments. This change affects 26 package.json files with 89 version updates including: - TypeScript: ^5.9.0-beta -> 5.9.2 - Zod: ^3.22.4 -> 3.25.76 - React: ^18 -> 18.2.0 - Various Radix UI, Vite, PostCSS, and other dependencies Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: preserve npm alias format for @radix-ui packages The previous commit incorrectly converted npm aliases like 'npm:@radix-ui/react-dialog@^1.0.4' to just '1.0.4', which broke yarn install as it tried to find non-existent packages. This fix restores the npm alias format while keeping the pinned versions: - @radix-ui/react-dialog-atoms: npm:@radix-ui/react-dialog@1.0.4 - @radix-ui/react-tooltip-atoms: npm:@radix-ui/react-tooltip@1.0.6 Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * refactor: move dev dependencies to devDependencies section Move 26 dependencies that are clearly development-only to the devDependencies section across 10 packages: - Testing: @types/jest, jest, ts-jest, @golevelup/ts-jest - Build tools: typescript, ts-node, concurrently, dotenv-cli - Linting: eslint-*, eslint-config-*, eslint-plugin-* - Types: @types/express, @types/turndown, @types/uuid This improves dependency organization and ensures production builds don't include unnecessary development dependencies. Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Keith Williams <keithwillcode@gmail.com> |
||
|
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Dhairyashil Shinde |
51bce6763f |
refactor: split tRPC build into server and react phases (#26082)
* refactor: import AppRouter from generated types instead of server source This change improves tRPC build performance by having the client-side code import AppRouter from pre-generated type declarations instead of traversing the entire server router tree. Changes: - Create type bridge file at packages/trpc/types/app-router.ts - Update packages/trpc/react/trpc.ts to import from the bridge - Update .gitignore to only ignore types/server (generated files) - Update eslint.config.mjs to only ignore types/server (generated files) The type bridge provides: 1. Faster typechecking - avoids parsing 458 server files 2. Stable import location that's easy to lint against 3. Single place to adjust if generated path changes Build order is already enforced in turbo.json (type-check depends on @calcom/trpc#build). Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: move bridge file to react/ to avoid TS5055 error Move the AppRouter type bridge file from types/app-router.ts to react/app-router.ts to avoid the TS5055 'Cannot write file because it would overwrite input file' error. The issue was that placing the bridge file in types/ caused TypeScript to treat the generated .d.ts files as input files during the tRPC build, then fail when trying to emit to the same location. By placing the bridge in react/ (which is excluded from the tRPC server build), the bridge file is only used by client code and doesn't interfere with the server type generation. Changes: - Move bridge file from types/app-router.ts to react/app-router.ts - Update import in react/trpc.ts to use ./app-router - Revert .gitignore to ignore all of types/ (generated files) - Revert eslint.config.mjs to ignore all of types/** Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * refactor: split tRPC build into server and react phases - Create tsconfig.server.json for server-only type generation - Create tsconfig.react.json for react/client type generation - Update build script to run server build first, then react build - Remove || true so build properly fails on errors - This allows react code to import from generated server types Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * refactor: split @calcom/trpc exports to separate server and react entrypoints - Remove react exports from @calcom/trpc root (index.ts) - Update 89 files to import from @calcom/trpc/react instead of @calcom/trpc - This fixes the boundary leak where server builds were pulling in react code - Server build no longer compiles react/app-router.ts, fixing the chicken-and-egg issue where react code needed generated server types that didn't exist yet This improves TypeScript build performance by preventing the server type generation from traversing the entire react/client type graph. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: import WorkflowType from lib/types instead of React component This fixes a boundary leak where the server build was pulling in React components through the WorkflowRepository import chain. By importing WorkflowListType from lib/types instead of WorkflowListPage.tsx, the server build no longer traverses React component files. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: extract server-safe types to prevent boundary leaks in tRPC build - Extract ChildrenEventType to lib/childrenEventType.ts (server-safe) - Extract Slots type to calendars/lib/slots.ts (server-safe) - Create types.server.ts files for eventtypes and bookings - Update server code to import from server-safe type files - Update DatePicker.tsx to use extracted Slots type - Update app-store utils to use BookerEventForAppData type This prevents the server build from pulling in React files through transitive imports from @calcom/features barrel exports. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: update Segment.test.tsx mock path to @calcom/trpc/react The test was mocking @calcom/trpc but importing from @calcom/trpc/react. After the entrypoint separation, the mock path needs to match the import path. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: temporarily restore || true to unblock PR merge The pre-existing Prisma type errors (~345 errors) will be addressed in a follow-up PR. This allows the two-phase build architecture changes to be merged first. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * Run trpc build as part of API v2 build * Removed the bridge file * refactor: extract event type schemas to server-safe file - Create packages/features/eventtypes/lib/schemas.ts with createEventTypeInput and EventTypeDuplicateInput - Update types.ts to re-export schemas from the new server-safe location - Update tRPC schema files to import from schemas.ts instead of types.server.ts - Delete types.server.ts (was duplicating ~200 lines unnecessarily) This keeps the server build graph clean while avoiding code duplication. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * Removed the optionality of the tRPC builds * Removed the extra command for API v2 * refactor: rename calendars/lib/slots.ts to types.ts Per Keith's feedback, renamed the file to types.ts since it contains type definitions. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * Added back tRPC build:server for API v2 --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com> |
||
|
|
0e3696f20c |
chore: dedupe yarn.lock to remove duplicate package versions (#26068)
* chore: dedupe yarn.lock to remove duplicate package versions - Consolidated 762 duplicate package versions - Reduced yarn.lock from 51,211 lines (1.7MB) to 44,471 lines (1.5MB) - Removed 7,071 lines (~200KB) of redundant dependency entries - Major packages deduplicated include: resolve, semver, type-fest, commander, glob, lru-cache, dotenv, @babel/* packages, typescript, tslib, postcss, and many more Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: resolve type errors in managed event types and react-select components - Add Zod-compatible versions of allManagedEventTypeProps and unlockedManagedEventTypeProps that only include scalar fields (excludes Prisma relation fields) - Update handleChildrenEventTypes.ts and queries.ts to use the new Zod-compatible props - Fix react-select CSS type errors in Select.tsx files by using Object.assign instead of spread operator to avoid TypeScript type inference issues - Fix lint warning in updateNewTeamMemberEventTypes by using if statement Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: derive eventType parameter type from actual query result Use Awaited<ReturnType<typeof getEventTypesToAddNewMembers>>[number] to ensure type safety at call sites, avoiding Prisma type namespace mismatches. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: disable turbo cache for @calcom/trpc#build to prevent stale type errors Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: correct field names in API v1 validation schemas - Remove timeZone from booking schema (field doesn't exist on Booking model) - Remove bookingId from destination-calendar schema (field doesn't exist, only booking relation) - Change avatar to avatarUrl in user schema (correct field name) Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: use Object.assign for react-select styles to fix TypeScript spread type errors The spread operator causes TypeScript to compute an incompatible type with CSSObjectWithLabel due to the accentColor property. Using Object.assign preserves the correct type inference. Fixed files: - FormEdit.tsx - DestinationCalendarSelector.tsx (features and platform) - TimezoneSelect.tsx - ApiKeyDialogForm.tsx - Select.tsx (features/form) - WebhookForm.tsx Also fixed pre-existing lint warnings: - Constant truthiness in label assignment - Unused variant parameter Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: remove extra fields from allManagedEventTypePropsForZod to match original behavior The Zod-compatible version should only include scalar fields that were in the original allManagedEventTypeProps. Removed instantMeetingScheduleId, profileId, rrSegmentQueryValue, and assignRRMembersUsingSegment which were incorrectly added and caused test failures by including extra fields in Prisma update payloads. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: remove access to fields not in Zod schema - Remove unnecessary destructuring of profileId and instantMeetingScheduleId from managedEventTypeValues in handleChildrenEventTypes.ts (these fields are already sourced from other variables) - Set rrSegmentQueryValue to undefined directly in queries.ts instead of accessing it from managedEventTypeValues (not applicable for managed children) Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: add name property to mock credentials and revert turbo cache change - Add name property to MockCredential type and factory function in InstallAppButtonChild.test.tsx to match expected credentials type - Revert turbo cache disable for @calcom/trpc#build (per review comment) Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: revert API v1 validation changes and restore eslint comment - Revert API v1 validation changes (booking.ts, destination-calendar.ts, user.ts) since API v1 is deprecated and these could be breaking changes - Restore eslint-disable comment for @typescript-eslint/no-empty-function in Select.tsx that was accidentally removed Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: add inputs to @calcom/trpc#build to properly invalidate cache Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: properly fix API v1 validation schemas for stricter zod 3.25.76 The yarn dedupe upgraded zod from 3.22.4 to 3.25.76, which has stricter .pick() typing that now properly rejects picking non-existent fields. Changes: - user.ts: Pick avatarUrl (actual Prisma field) and extend with avatar for API v1 backward compatibility - booking.ts: Remove timeZone from pick (not a field on Booking model, only exists in nested attendees/user objects) - destination-calendar.ts: Remove bookingId from pick (not a field on DestinationCalendar model) Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: remove turbo.json inputs for @calcom/trpc#build to use cached artifacts Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: use robust selector for react-select option in routing forms E2E test The previous selector used .nth(1) which assumed the email text appeared exactly twice in the DOM in a specific order. This broke when react-select was upgraded from 5.7.2 to 5.8.0 via yarn dedupe. The new approach waits for the react-select listbox to appear and clicks the option within it, which is more robust against DOM structure changes. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
f1011ddd08 |
chore: Improves the core booking audit architecture by adding new capabilities and simplifying the existing interfaces. (#25872)
* feat(booking-audit): extract core audit system changes from PR 25125 This PR extracts core audit infrastructure changes without integration changes: 1. New action services introduced: - SeatBookedAuditActionService - SeatRescheduledAuditActionService 2. Simplification of ActionService interface: - Streamlined IAuditActionService interface - Reduced TypeScript burden with cleaner type definitions 3. ActionSource support: - Added BookingAuditSource enum (API_V1, API_V2, WEBAPP, WEBHOOK, UNKNOWN) - Added source and operationId fields to BookingAudit model 4. New AuditAction types: - SEAT_BOOKED - SEAT_RESCHEDULED - APP actor type 5. New BookingAuditAccessService: - Permission-based access control for audit logs - Added readTeamAuditLogs and readOrgAuditLogs permissions 6. Fixes in the logs viewer flow: - Enhanced BookingAuditViewerService with improved filtering - Local AttendeeRepository for actor enrichment Changes are contained within packages/features/booking-audit with minimal outside changes (permission registry only). Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * refactor(booking-audit): streamline action handling and enhance localization - Replaced action icon retrieval with a mapping object for improved clarity and performance. - Introduced constants for actor role labels to simplify role retrieval. - Added new localization strings for audit log permission errors and organization requirements. - Updated various service and repository interfaces to enhance type safety and clarity. - Removed deprecated architecture documentation and adjusted related imports for consistency. These changes aim to improve code maintainability and user experience in the booking audit system. * fix(booking-audit): enhance actor role localization and operation ID tracking - Updated actor role labels in the booking logs view to use lowercase for consistency. - Improved localization by wrapping actor role display in a translation function. - Added operationId field to audit logs for better correlation of actions across multiple bookings. - Enhanced BookingAuditViewerService to include operationId in enriched audit logs. - Updated integration tests to verify consistent operationId across related audit logs. These changes aim to improve localization accuracy and facilitate better tracking of user actions in the booking audit system. * feat: integrate credential repository and enhance app actor handling - Added CredentialRepository to manage app credentials, including a method to find credentials by ID. - Updated BookingAudit system to support app actors identified by credential ID, improving actor attribution and audit clarity. - Introduced a new utility function to map app slugs to display names, enhancing the user experience in audit logs. - Modified relevant interfaces and types to accommodate the new credential handling and app actor structure. - Enhanced BookingAuditViewerService to display app names based on credentials, ensuring accurate representation in audit logs. --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
cef8610925 |
feat: add enabled column to UserFeatures and TeamFeatures for tri-state semantics (#25765)
* feat: add enabled column to UserFeatures and TeamFeatures for tri-state semantics - Add enabled Boolean column to UserFeatures model with default true - Add enabled Boolean column to TeamFeatures model with default true - Update FeaturesRepository to use tri-state semantics: - enabled=true: feature is explicitly enabled - enabled=false: feature is explicitly disabled (blocks inheritance) - No row: inherit from team/org level - Update SQL queries to check enabled=true for feature access - Add enableFeatureForTeam method to interface and implementation Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * update comments * add integration tests * add more test * select enabled only * no @default(true) * fix types and tests * add missing enabled * add missing enabled * rename enableFeatureForTeam to updateFeatureForTeam and support FeatureState * refactor: rename updateFeatureForTeam to setTeamFeatureState Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * fix integration test * fix tests * add more tests * add missing enabled --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Syed Ali ShahbazandGitHub
|
056922b6ee |
feat: add webhook versioning (#23861)
* add webhook version schema * version the code * update version from numeric to date val * migration * update schema and build factory * update string * move version picker * tooltip instead of infobadge * -- * fix type * -- * fix type * fix type * -- * fix messed up merge * improvements to payloadfactory * extract version off of DB and instead keep it in IWebhookRepository * fix webhookform * fix type safety and routing ambiguity * scalable with easier factory extensions and base definition * fix types * -- * -- * clean up prisma/client type imports * fix * type fix * type fix * cleanup * add tests and registry changes * unintended file inclusion * type-fix * select in repo * -- * explicit return type * -- * fix type * fixes * feedback 1 * feedback 2 * use enum instead of string * fixes |
||
|
Benny JooandGitHub
|
cb7844fd22 |
refactor: Migrate repositories/services from /lib to /features (#25925)
* deployment * update imports * booking report * update import paths * watch list * watch list * api key * api key * selected slots * wip * event type translation * work flow step * booking reference * fix tests * fix * fix * migrate * wip * address * fix |
||
|
Anik Dhabal BabuandGitHub
|
593ed461c8 | slugify lenient (#25923) | ||
|
|
f98acb7301 |
refactor: migrate workflows utilities from trpc to features layer (#25534)
* refactor: migrate workflows utilities from trpc to features layer Move workflow utility functions from packages/trpc/server/routers/viewer/workflows/util.ts to packages/features/ee/workflows/lib/workflowUtils.ts to break circular dependencies. Functions migrated: - isAuthorized - getAllWorkflowsFromEventType - scheduleWorkflowNotifications - scheduleBookingReminders Changes: - Created new workflowUtils.ts in features layer with migrated functions - Added getBookingsForWorkflowReminders to WorkflowRepository (no prisma outside repositories) - Updated all imports in features layer to use new location - Updated trpc util.ts to re-export from features for backward compatibility - Fixed pre-existing lint warning (any -> unknown) in handleMarkNoShow.ts This is part of the effort to remove circular dependencies between packages/features and packages/trpc. Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * refactor: remove re-exports from trpc util.ts, update imports to use features layer Per user request, removed the backward compatibility re-exports from packages/trpc/server/routers/viewer/workflows/util.ts and updated all imports in the trpc package to import directly from the features layer. Files updated to import from @calcom/features/ee/workflows/lib/workflowUtils: - confirm.handler.ts (getAllWorkflowsFromEventType) - delete.handler.ts (isAuthorized) - update.handler.ts (isAuthorized, scheduleWorkflowNotifications) - getAllActiveWorkflows.handler.ts (getAllWorkflowsFromEventType) - get.handler.ts (isAuthorized) - util.test.ts (isAuthorized) - delete.handler.test.ts (isAuthorized) Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update test imports to use features layer for workflow utilities Updated test files to import scheduleBookingReminders and scheduleWorkflowNotifications from @calcom/features/ee/workflows/lib/workflowUtils instead of @calcom/trpc/server/routers/viewer/workflows/util. Files updated: - packages/features/ee/workflows/lib/test/workflows.test.ts - packages/features/tasker/tasks/scanWorkflowBody.test.ts Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * refactor: split workflowUtils.ts into individual files Split the monolithic workflowUtils.ts into separate files for each function: - isAuthorized.ts - Authorization check for workflow access - getAllWorkflowsFromEventType.ts - Get workflows for an event type - scheduleWorkflowNotifications.ts - Schedule workflow notifications - scheduleBookingReminders.ts - Schedule booking reminders The workflowUtils.ts now re-exports from these individual files for backward compatibility. Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix import * fix more * wip * wip * remove workflowUtils * wip * refactor deleteRemindersOfActiveOnIds * fix --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Dhairyashil ShindeandGitHub
|
5b9dd09f0d |
feat(holidays): improve UI/UX and add contextual emojis (#25895)
* refactor(holidays): improve code quality and address PR review feedback
- Move HolidaysView.tsx from /features to /apps/web/modules following
the pattern of keeping trpc-using components in /apps/web/modules
- Fix prisma import to use named import: `import { prisma }`
- Fix timezone bug in checkConflicts: use dayjs.utc() for consistent
date boundaries regardless of server timezone
- Fix toggleHoliday validation to include both current and next year
holidays, matching the holidays displayed to users
- Implement dependency injection pattern for holiday repository:
- Create PrismaHolidayRepository with instance methods
- Add HOLIDAY_REPOSITORY DI token and module
- Update containers to load holiday repository module
- Update calculateHolidayBlockedDates to use injected repository
- Remove stale HOLIDAY_CACHE_DAYS env declaration (now a constant)
- Update tests to mock repository instead of prisma directly
* feat(holidays): improve UI responsiveness and add country flags
- Add country flag emojis to holidays dropdown using Unicode regional
indicator symbols
- Handle edge cases for religious holidays (Hindu, Christian, etc.)
which dont have 2-letter country codes
- Increase country dropdown width to 180px for better readability
- Make OOO/Holidays tabs responsive: use Select dropdown on mobile,
ToggleGroup on desktop
- Make + Add button responsive: show only + icon on mobile,
full text on desktop
- Fix PrismaHolidayRepository import to use @calcom/prisma for
consistency with other repositories
* feat(holidays): add contextual emojis for holidays
- Add keyword-based emoji mapping for 80+ holidays
- Display holiday emojis in styled containers on settings page
- Add country flag emojis to dropdown using Unicode regional indicators
- Use dynamic emojis on booking page unavailable dates
* fix(holidays): address PR review feedback
- Fix emoji ordering: move Chinese/Lunar New Year before generic new year to prevent incorrect match
- Fix i18n: use t() instead of hardcoded text more in conflict warning
- Fix a11y: use sr-only pattern for mobile button to maintain screen reader accessibility
* fix failing test: packages/features/availability/lib/calculateHolidayBlockedDates.test.ts
* fix failing test: packages/features/availability/lib/calculateHolidayBlockedDates.test.ts
* fix failing tests and builds
|