* refactor(holidays): improve code quality and address PR review feedback
- Move HolidaysView.tsx from /features to /apps/web/modules following
the pattern of keeping trpc-using components in /apps/web/modules
- Fix prisma import to use named import: `import { prisma }`
- Fix timezone bug in checkConflicts: use dayjs.utc() for consistent
date boundaries regardless of server timezone
- Fix toggleHoliday validation to include both current and next year
holidays, matching the holidays displayed to users
- Implement dependency injection pattern for holiday repository:
- Create PrismaHolidayRepository with instance methods
- Add HOLIDAY_REPOSITORY DI token and module
- Update containers to load holiday repository module
- Update calculateHolidayBlockedDates to use injected repository
- Remove stale HOLIDAY_CACHE_DAYS env declaration (now a constant)
- Update tests to mock repository instead of prisma directly
* feat(holidays): improve UI responsiveness and add country flags
- Add country flag emojis to holidays dropdown using Unicode regional
indicator symbols
- Handle edge cases for religious holidays (Hindu, Christian, etc.)
which dont have 2-letter country codes
- Increase country dropdown width to 180px for better readability
- Make OOO/Holidays tabs responsive: use Select dropdown on mobile,
ToggleGroup on desktop
- Make + Add button responsive: show only + icon on mobile,
full text on desktop
- Fix PrismaHolidayRepository import to use @calcom/prisma for
consistency with other repositories
* feat(holidays): add contextual emojis for holidays
- Add keyword-based emoji mapping for 80+ holidays
- Display holiday emojis in styled containers on settings page
- Add country flag emojis to dropdown using Unicode regional indicators
- Use dynamic emojis on booking page unavailable dates
* fix(holidays): address PR review feedback
- Fix emoji ordering: move Chinese/Lunar New Year before generic new year to prevent incorrect match
- Fix i18n: use t() instead of hardcoded text more in conflict warning
- Fix a11y: use sr-only pattern for mobile button to maintain screen reader accessibility
* fix failing test: packages/features/availability/lib/calculateHolidayBlockedDates.test.ts
* fix failing test: packages/features/availability/lib/calculateHolidayBlockedDates.test.ts
* fix failing tests and builds
* feat: extract core booking audit infrastructure from PR 25125
This PR contains only the core booking audit infrastructure changes from PR 25125,
excluding integration changes with booking flows.
Included:
- All packages/features/booking-audit/* (core audit services, actions, repository)
- packages/features/di/containers/BookingAuditViewerService.container.ts
- packages/features/tasker/tasker.ts (audit task types)
- packages/features/bookings/lib/types/actor.ts (actor types for audit)
- packages/features/bookings/repositories/BookingRepository.ts (getFromRescheduleUid method)
- apps/web/modules/booking/logs/views/booking-logs-view.tsx (UI for viewing audit logs)
- apps/web/public/static/locales/en/common.json (translations)
Excluded (integration changes):
- packages/trpc/server/* (tRPC handlers)
- packages/features/ee/round-robin/* (round-robin integration)
- packages/features/bookings/lib/handleCancelBooking.ts
- packages/features/bookings/lib/handleConfirmation.ts
- packages/features/bookings/lib/onBookingEvents/BookingEventHandlerService.ts
- packages/features/bookings/lib/service/RegularBookingService.ts
- apps/api/v2/* (API v2 integration)
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: make booking audit interfaces backwards-compatible with main
- Add queueAudit method back to BookingAuditProducerService interface for backwards compatibility
- Implement queueAudit method in BookingAuditTaskerProducerService
- Make userTimeZone parameter optional in BookingAuditViewerService
- Add BookingAuditTaskProducerActionData type for legacy queueAudit method
- Use any generics in BookingAuditActionServiceRegistry (matching PR 25125)
- Fix type assertions in BookingAuditTaskConsumer
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix switch eslint and ts
* feat: enhance BookingAuditViewerService with logging and type improvements
- Added ISimpleLogger dependency to BookingAuditViewerService for better error handling.
- Updated actor type in enriched audit logs to use AuditActorType for improved type safety.
- Replaced console.error with logger for error reporting when no rescheduled log is found.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* feat: add hostSubsetIds parameter for round robin host filtering
Add support for filtering round robin event type hosts via API v2.
When hostSubsetIds is provided, only the specified hosts are considered
for availability calculation and booking assignment.
Changes:
- Add hostSubsetIds to slots API input (GET /slots/available)
- Add hostSubsetIds to booking API input (POST /bookings)
- Update _findQualifiedHostsWithDelegationCredentials to filter by hostSubsetIds
- Pass hostSubsetIds through all layers: API -> tRPC -> slots/booking services
This allows API consumers to request availability and create bookings
for a subset of hosts within a round robin event type.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* chore: add e2e tests
* chore: add enableHostSubset team event-type setting
* fixup! chore: add enableHostSubset team event-type setting
* fix tests
* fix tests
* improve isWithinRRHostSubset
* rename to rrHost subset
* fix ai review
* fix: add booker platform wrapper rrHostSubsetIds prop
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-10 10:37:39 +00:00
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: preserve metadata fields during partial event type updates
- Fix multipleDuration (lengthInMinutesOptions) being reset to undefined on partial updates
- Fix bookerLayouts being reset to undefined on partial updates
- Fix requiresConfirmationThreshold being reset to undefined on partial updates
- Add e2e test for lengthInMinutesOptions preservation
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* test: expand metadata preservation test to include bookerLayouts and confirmationPolicy
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## What does this PR do?
This PR adds user UUID plumbing from API v2 controllers through to packages/features functions. This is preparatory work extracted from PR #25125 to support future audit logging functionality.
**Key changes:**
- API v2 controllers (2024-04-15, 2024-08-13) now extract and pass `userUuid` to downstream functions
- `handleMarkNoShow` and `CancelBookingInput` types now accept optional `userUuid` parameter
- `UserRepository.findUnlockedUserForSession` now selects `uuid` field
- Session middleware now includes `uuid` in the returned user object
- Fixed lint warning: changed `PromiseSettledResult<any>` to `PromiseSettledResult<unknown>`
**Refactoring (optimization):**
- Renamed `getOwnerId` → `getOwner` and `getOwnerIdRescheduledBooking` → `getOwnerRescheduledBooking`
- These methods now return `{ id: number; uuid: string } | null` instead of just `number | undefined`
- This eliminates redundant database calls by fetching user id and uuid in a single query
**Important:** This is plumbing-only - packages/features receives the `userUuid` but does not use it directly (note the `_userUuid` prefix). The actual audit logging usage will come in a follow-up PR.
Requested by: @hariombalhara (hariom@cal.com)
Link to Devin run: https://app.devin.ai/sessions/545209189f6347cd807bf1b336f9ac40
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed.
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A - plumbing only, existing tests cover the functionality.
## How should this be tested?
1. Run type checks: `yarn type-check:ci --force`
2. Verify the changes compile without new type errors related to uuid
3. The `userUuid` parameters are optional, so existing functionality should work unchanged
## Checklist
- [x] My code follows the style guidelines of this project
- [x] I have checked if my changes generate no new warnings
## Human Review Checklist
- [ ] Verify the `userUuid` parameter is intentionally unused (prefixed with `_userUuid`) - this is plumbing for future audit logging
- [ ] Verify all callers of `getOwner` and `getOwnerRescheduledBooking` correctly handle the new `{ id, uuid } | null` return type
- [ ] Confirm the change from `undefined` to `null` as the "not found" return value is handled consistently
- [ ] Verify the `uuid` field exists in the User model schema
## What does this PR do?
This PR introduces the booking audit infrastructure with a viewer service to fetch, enrich, and format audit logs. This is the first iteration that includes only the CREATED action with versioned schema
Note: Additional audit actions, UI improvements to match with Figma will be taken care of in followup PRs, to ensure the PR size remains as small as possible(as it is large enough already)
Demo - Loom - https://www.loom.com/share/22c2f38b052b480b8be3716e1608eaf6
### Key Changes
**New Booking Audit Package** (`packages/features/booking-audit/`):
- `BookingAuditViewerService` - Fetches, enriches, and formats audit logs for display
- `BookingAuditTaskConsumer` - Processes audit tasks asynchronously via Tasker
- `CreatedAuditActionService` (v1) - Handles RECORD_CREATED action with versioned schema
**Repository Layer**:
- `BookingAuditRepository` - CRUD operations for audit records
- `AuditActorRepository` - Actor management (users, guests, system)
- `UserRepository.findByUuid()` - User lookup for actor enrichment
**UI Components**:
- New page at `/booking/logs/[bookinguid]` for viewing audit history
- Filterable audit log list with search, type, and actor filters
- Expandable log entries showing detailed change information
**Infrastructure**:
- `bookingAudit` Tasker task type for async processing
- `booking-audit` feature flag (disabled by default)
- tRPC endpoint `viewer.bookings.getAuditLogs`
### Updates since last revision
- **Refactored `Task` class to `TaskRepository`**: Converted all static methods to instance methods following the repository pattern. A singleton `Task` is exported for backward compatibility, so existing call sites continue to work unchanged.
### Important Notes for Reviewers
- **Permission check is TODO**: `checkPermissions()` in `BookingAuditViewerService` is not yet implemented
- **Only CREATED action supported**: Other actions will throw an error - additional actions will be added iteratively in follow-up PRs
- **Feature flag controlled**: System is behind `booking-audit` flag, disabled by default
- **UI strings need i18n**: Some UI text in `booking-logs-view.tsx` may need translation
### Human Review Checklist
- [ ] Verify permission enforcement strategy for audit log access
- [ ] Review DI wiring in module files
- [ ] Confirm error handling in `BookingAuditTaskConsumer` is appropriate for retry scenarios
- [ ] Check if UI strings need to be added to translation files
- [ ] Verify `TaskRepository` refactoring maintains backward compatibility (singleton export `Task` should work for all existing call sites)
## Mandatory Tasks (DO NOT REMOVE)
- [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - internal infrastructure
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works.
## How should this be tested?
Run the integration tests:
```bash
TZ=UTC yarn test packages/features/booking-audit/lib/service/BookingAuditViewerService.integration-test.ts
TZ=UTC yarn test packages/features/booking-audit/lib/service/BookingAuditTaskConsumer.integration-test.ts
```
To test the UI:
1. Enable the `booking-audit` feature flag in the database
2. Create a booking (only CREATED action is supported in this PR)
3. Navigate to `/booking/logs/{bookingUid}` to view the audit trail
## Checklist
- [x] I have read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
- [x] My code follows the style guidelines of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have checked if my changes generate no new warnings
<!-- Link to Devin run: https://app.devin.ai/sessions/a8ae61c253b549429401c9651dcbcf44 -->
<!-- Requested by: hariom@cal.com (@hariombalhara) -->
* feat(api): PATCH Event Type V2 API to support all current locations
* docs(api): update locations documentation and add E2E tests for new integrations
- Updated locations property documentation in create-event-type.input.ts
and update-event-type.input.ts to clarify app installation requirements
- Explained that only Google Meet, MS Teams, and Zoom can be installed via API
- Noted that Cal Video is installed by default
- Added E2E tests for creating and updating event types with newly supported
integration locations (jitsi, zoom, google-meet, whereby, huddle, element-call)
- Regenerated openapi.json with updated API documentation
Addresses feedback from Lauris regarding platform API location support.
* fix(api): use supportedIntegrations list for app validation
Updated checkAppIsValidAndConnected to use the full supportedIntegrations
list from locations.input.ts instead of hardcoded array. This allows all
27 supported conferencing apps to be set as event type locations via API,
as long as they are already connected by the user.
* fix(api): add slug mapping for all conferencing integrations
Added comprehensive slug mapping to translate API integration names
(e.g., 'facetime-video', 'whereby-video') to actual app slugs
(e.g., 'facetime', 'whereby'). This ensures the app lookup works
correctly for all 27 supported conferencing integrations.
Addresses AI bot feedback about slug mismatches.
* fix(api): add missing huddle to huddle01 slug mapping
Added mapping for huddle -> huddle01. Other apps like tandem, jitsi,
cal-video, google-meet, and zoom don't need mapping as their API names
already match their app slugs (handled by the fallback || appSlug).
* update key
* update ket
* test(api): update E2E tests to validate newly supported integrations
Replaced end-to-end tests with validation-focused tests that follow
the existing pattern. The new test creates event types with various
newly supported integrations (jitsi, whereby-video, huddle, tandem,
element-call-video) directly in the database (bypassing app connection
checks) and verifies the API correctly returns them.
This approach tests that the input validation accepts all 27 supported
integration types without requiring actual app installations in the
test environment.
* fix(api): correct slug mappings for whatsapp, shimmer, and jelly integrations
- Fixed whatsapp-video mapping from 'whatsappvideo' to 'whatsapp'
- Fixed shimmer-video mapping from 'shimmer' to 'shimmervideo'
- Fixed jelly-conferencing mapping from 'jelly-conferencing' to 'jelly'
All slug mappings now correctly match the actual app slugs in
packages/app-store/*/config.json files. This ensures proper app
validation when users create/update event types with these locations.
Addresses feedback from @pedroccastro
* updated openapi.json file because of main branch code
* test(api): add negative test for unsupported integration locations
- Added E2E test to validate 400 error when creating event type with unsupported integration
- Test verifies exact error message listing all supported integrations
- Uses imported supportedIntegrations constant for maintainability
- Follows same pattern as booking fields validation tests
Addresses feedback from @supalarry
* test(api): add negative test for patching event type with unconnected integration
- Added E2E test to validate 400 error when user tries to PATCH event type with jitsi integration they haven't connected
- Test verifies exact error message 'jitsi not connected.'
- Follows existing test patterns with proper cleanup
* feat: api-v2-event-types-ordering
* sort team and org event types
* revert: remove accidental changes to api-auth.strategy.ts
* docs: add ordering documentation and test for event types endpoints
- Added test assertion to verify event types are returned in descending order by ID (newest first)
- Added API documentation to user event types endpoint describing default ordering behavior
- Added API documentation to team event types endpoint describing default ordering behavior
- Added API documentation to organization event types endpoints describing default ordering behavior
Addresses PR feedback to document and test the ordering behavior introduced in the API v2 event types ordering feature.
* feat: add optional sortCreatedAt parameter to event types endpoints
- Add sortCreatedAt query parameter (SortOrderType: "asc" | "desc") to all event types endpoints
- Define SortOrder enum and SortOrderType in pagination.input.ts for reusability
- When not provided, no explicit ordering is applied (backward compatible)
- Update user, team, and organization event types endpoints
- Add comprehensive e2e tests for all sorting scenarios
- Fix circular dependency in platform-types import
- Thread sortCreatedAt through all service layers
- Use spread pattern for conditional orderBy to avoid empty array issues
Addresses PR feedback to make ordering opt-in rather than changing default behavior
* fix: preserve seatsPerTimeSlot during partial event type updates
When doing a partial update on the PATCH /v2/organizations/{orgId}/teams/{teamId}/event-types/{eventTypeId} endpoint, providing a partial body would reset seatsPerTimeSlot back to null because the transformSeatsApiToInternal function was always called even when seats was undefined.
This fix ensures that the seat options are only transformed when the seats field is explicitly provided in the update request, preserving existing values during partial updates.
Also adds e2e test to verify partial updates preserve seatsPerTimeSlot.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: handle TypeScript union type narrowing for seatsPerTimeSlot
When seats is not provided in a partial update, the transformed body
may not have seatsPerTimeSlot property. This fix uses 'in' operator
to safely check for the property before accessing it.
Also fixes the e2e test to properly narrow the union type for seats
using type guards.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: simplify seatsPerTimeSlot handling per review feedback
Per supalarry's suggestion, instead of using 'in' operator checks in
multiple validation calls, we now return {seatsPerTimeSlot: undefined}
when seats is not provided. This keeps the validation code unchanged
and only requires modifying one line in the transformation.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: allow false for custom field 'fieldRequired' by using z.boolean()
* updated to z.boolean().optional()
---------
Co-authored-by: Pallav <90088723+Pallava-Joshi@users.noreply.github.com>
2025-12-02 02:46:29 +00:00
MorganGitHubhbjORbjDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* wip
* wip
* feature: Booking Tasker without DI yet
* feature: Booking Tasker with DI
* fix type check 1
* fix type check 2
* fix
* comment booking tasker for now
* fix: DI regularBookingService api v2
* fix: convert trigger.dev SDK imports to dynamic imports to fix unit tests
The unit tests were failing because BookingEmailAndSmsTriggerTasker.ts had static imports of trigger files that depend on @trigger.dev/sdk. This caused Vitest to try to resolve the SDK at module load time, even though it should be optional.
Changed all imports in BookingEmailAndSmsTriggerTasker.ts from static to dynamic (using await import()) so the trigger files are only loaded when the tasker methods are actually called, not at module load time during tests.
This fixes the 'Failed to load url @trigger.dev/sdk' errors that were causing 28+ test failures.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix unit tests
* keep inline smsAndEmailHandler.send calls
* chore: add team feature flag
* add satisfies ModuleLoader
* fix type check app flags
* move trigger in feature
* fix: add trigger.dev prisma generator
* fix: email app statuses
* fix: CalEvtBuilder unit test
* chore: improvements, schema, config, retry
* fixup! chore: improvements, schema, config, retry
* chore: cleanup code
* chore: cleanup code
* chore: clean code and give full payload
* remove log
* add booking notifications queue
* add attendee phone number for sms
* bump trigger to 4.1.0
* add missing booking seat data in attendee
* update config
* fix logger regular booking service
* fix: prisma as external deps of trigger
* fix yarn.lock
* revert change to example app booking page
* fix: resolve circular dependencies and improve cold start performance in trigger tasks
- Convert BookingRepository import to type-only in CalendarEventBuilder.ts to eliminate circular dependency risk
- Convert EventNameObjectType, CalendarEvent, and JsonObject imports to type-only in BookingEmailAndSmsTaskService.ts
- Use dynamic imports in all trigger notification tasks (confirm, request, reschedule, rr-reschedule) to reduce cold start time
- Move heavy imports (BookingEmailSmsHandler, BookingRepository, prisma, TriggerDevLogger, BookingEmailAndSmsTaskService) inside run functions
- Eliminates module-level prisma import which violates repo guidelines and adds cold start overhead
- Reduces initial module dependency graph by deferring heavy imports (email templates, workflows, large repositories) until task execution
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: improve cold start performance in reminderScheduler with dynamic imports
- Remove module-level prisma import (violates 'No prisma outside repositories' guideline)
- Use dynamic imports for UserRepository (1,168 lines) - only loaded when needed in EMAIL_ATTENDEE action
- Use dynamic imports for twilio provider (386 lines) - only loaded in cancelScheduledMessagesAndScheduleEmails
- Use dynamic imports for all manager functions by action type:
- scheduleSMSReminder (387 lines) - loaded only for SMS actions
- scheduleEmailReminder (459 lines) - loaded only for Email actions
- scheduleWhatsappReminder (266 lines) - loaded only for WhatsApp actions
- scheduleAIPhoneCall (478 lines) - loaded only for AI phone call actions
- Use dynamic imports for sendOrScheduleWorkflowEmails in cancelScheduledMessagesAndScheduleEmails
- Significantly reduces cold start time by deferring heavy module loading until execution paths need them
- Eliminates module-level prisma import that violated repository pattern guidelines
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: improve cold start performance in BookingEmailSmsHandler with dynamic imports
- Remove module-level imports of all email-manager functions (653 LOC + 30+ email templates)
- Add dynamic imports in each method (_handleRescheduled, _handleRoundRobinRescheduled, _handleConfirmed, _handleRequested, handleAddGuests)
- Defer heavy email-manager loading until method execution
- Verified no circular dependencies between email-manager and bookings
- Significantly reduces cold start time for RegularBookingService and BookingEmailAndSmsTaskService
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use dynamic imports
* update yarn lock
* code review
* trigger config project ref in env
* update yarn lock
* add .env.example trigger variables
* add .env.example trigger variables
* fix: cleanup error handling and loggin
* fix: trigger config from env
* fix: small typo fix
* fix: ai review comments
* fix: ai review comments
* ai review
* prettier
---------
Co-authored-by: hbjORbj <sldisek783@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: Remove all code related to the old cache system
* Removed some redundant tests, some type fixes
* Further type fixes
* More type fixes re. tests
* Next iteration, couple of fixes remaining
* Remove cache from CredentialActionsDropdown
* Fix tests by mocking credential, instead of db queries
* Remove Cache DI wiring from v2
* Make sure apiv2 build passes
* Remove another cache cron
* Remove old tokens for calendar-cache v1
* feat: add validation for null values in bookingFieldsResponses
- Add test case to verify 400 error when bookingFieldsResponses contains null values
- Create ValidateBookingFieldsResponses decorator to reject null values in booking field responses
- Apply validator to CreateBookingInput_2024_08_13.bookingFieldsResponses property
- Ensure all booking field response values are non-null strings
* feat: transform null values to empty strings in bookingFieldsResponses
- Remove ValidateBookingFieldsResponses validator that rejected null values
- Add Transform decorator to convert null values to empty strings in bookingFieldsResponses
- Update test to verify null values are transformed to empty strings instead of returning 400 error
* remove extra spaces
* test: add rescheduleReason null value test case
---------
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* feat: add avatarUrl to /v2/me endpoint response
- Add avatarUrl field to userSchemaResponse schema in packages/platform/types/me.ts
- Update e2e tests to verify avatarUrl is returned in GET and PATCH /v2/me responses
- Field is nullable to match User model in Prisma schema
- Fix pre-existing lint warnings by removing 'as any' type assertions in test file
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* feat: add avatarUrl to MeOutput DTO for OpenAPI docs
- Add avatarUrl field to MeOutput class in apps/api/v2/src/ee/me/outputs/me.output.ts
- Field is nullable to match the Zod schema and Prisma model
- This ensures OpenAPI documentation will include avatarUrl when regenerated
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* feat: add bio field to /v2/me endpoint response
- Add bio field to userSchemaResponse Zod schema in packages/platform/types/me.ts
- Add bio field to MeOutput NestJS DTO in apps/api/v2/src/ee/me/outputs/me.output.ts
- Update e2e tests to verify bio is returned in both GET and PATCH responses
- Field is nullable to match the User model in Prisma schema
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: chauhan_s <somaychauhan98@gmail.com>
* feat: add delegation credential error webhook trigger
- Add DELEGATION_CREDENTIAL_ERROR to WebhookTriggerEvents enum
- Create DelegationCredentialErrorDTO type for webhook payload
- Implement DelegationCredentialErrorWebhookService
- Add translation for delegation_credential_error
- Enable webhook for API v2 organization webhooks
This webhook will send delegation credential error data to configured URLs when errors occur during calendar authentication with delegation credentials.
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fix: add delegation credential error payload type and type guards
- Add DelegationCredentialErrorPayloadType to sendPayload.ts
- Update WebhookPayloadType union to include new payload type
- Add isDelegationCredentialErrorPayload type guard function
- Update isEventPayload to exclude delegation credential errors
- Update template application logic to handle new payload type
- Add corresponding payload type to dto/types.ts for consistency
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* feat: add delegation credential error handling to WebhookNotificationHandler
- Add DELEGATION_CREDENTIAL_ERROR case to createPayload switch
- Return payload with error, credential, and user data
- Ensures exhaustive type checking passes for new trigger
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* feat: restrict DELEGATION_CREDENTIAL_ERROR to organization webhooks only
- Add validation in UserWebhooksService to reject DELEGATION_CREDENTIAL_ERROR
- Add validation in EventTypeWebhooksService to reject DELEGATION_CREDENTIAL_ERROR
- Ensures trigger is only available for API v2 organization webhooks as requested
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* feat: wire up delegation credential error webhook emission in calendar services
- Add webhook emission calls in CalendarAuth.ts for Google Calendar delegation errors
- Add webhook emission calls in Office365 CalendarService.ts for Azure AD delegation errors
- Implement actual webhook emission using WebhookRepository pattern
- Fix pre-existing lint warnings in Office365 CalendarService.ts (unused catch variables, unsafe optional chaining)
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* test: add e2e tests for DELEGATION_CREDENTIAL_ERROR webhook trigger
- Add comprehensive e2e tests for creating, retrieving, updating, and deleting webhooks with DELEGATION_CREDENTIAL_ERROR trigger
- Test combining DELEGATION_CREDENTIAL_ERROR with other triggers
- Fix import in triggerDelegationCredentialErrorWebhook.ts to use default import for sendPayload
- Tests follow existing patterns in organizations-webhooks.e2e-spec.ts
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* refactor: remove name field from webhook payload and delete unused service
- Remove name field from triggerDelegationCredentialErrorWebhook function signature and payload
- Update all call sites in GoogleCalendar and Office365 calendar services
- Update DelegationCredentialErrorDTO and DelegationCredentialErrorPayloadType to remove name field
- Delete unused DelegationCredentialErrorWebhookService.ts (dead code - not used anywhere)
- The helper function approach is more appropriate for app-store integrations without DI
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* refactor: make fire-and-forget intent explicit for webhook emission
- Add void cast to all triggerDelegationCredentialErrorWebhook calls
- Remove redundant .catch() handlers (helper already handles errors internally)
- This makes it clear that webhook emission is non-blocking by design
- Avoids delaying error propagation while webhook HTTP requests complete
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* feat: await webhook emission and add HTTP timeout for guaranteed delivery
- Change all triggerDelegationCredentialErrorWebhook calls from void to await
- Add 10-second timeout to webhook HTTP requests using AbortController
- Remove name field from DelegationCredentialErrorPayloadType to match payload
- Ensures webhooks are sent before error is thrown (per user requirement)
- Prevents indefinite hangs on unresponsive webhook endpoints
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fix: make getAuthUrl async and await all call sites
- Make getAuthUrl async to support awaiting webhook emission
- Add await to all 3 getAuthUrl call sites (constructor, getAzureUserId, testDelegationCredentialSetup)
- Remove leftover name field from getAzureUserId webhook call
- Fixes TS1308 error about await in non-async function
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* docs: add JSDoc clarifying error handling guarantees for webhook trigger
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* Revert "docs: add JSDoc clarifying error handling guarantees for webhook trigger"
This reverts commit 3e33090197bfe2f2e3fb890402b32e04c44305e3.
* Revert "fix: make getAuthUrl async and await all call sites"
This reverts commit de28b7337149104412c861fd9b05e76fffc1fed7.
* Revert "feat: await webhook emission and add HTTP timeout for guaranteed delivery"
This reverts commit 9da7241f83a8373b4fadc03ccf34e097c28adf3a.
* Revert "refactor: make fire-and-forget intent explicit for webhook emission"
This reverts commit f4f7fa06b7dfa151bfbea29905b8783261d9f353.
* feat: await webhook emission to match standard pattern
- Updated all webhook call sites to await triggerDelegationCredentialErrorWebhook
- Made getAuthUrl async and updated all 3 call sites to await it
- Removed .catch() wrappers at call sites (error handling is in trigger function)
- Matches standard pattern used in WebhookService.sendPayload with Promise.allSettled
- Ensures webhooks are sent before delegation errors are thrown
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fix: address PR feedback - add migration, remove 'as any', remove user.name
- Add Prisma migration for DELEGATION_CREDENTIAL_ERROR enum
- Replace 'as any' type casting with safe type-narrowing helper in CalendarAuth.ts
- Remove user.name field from DelegationCredentialErrorPayloadType (email is sufficient)
- Ensure all type definitions are consistent across sendPayload.ts and dto/types.ts
Addresses feedback from alishaz-polymath and morgan@cal.com
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* chore: cleanup type in CalendarAuth
* fix: missing DELEGATION_CREDENTIAL_ERROR in WEBHOOK_TRIGGER_EVENTS_GROUPED_BY_APP constant
* fix: review
* fit: import webhook dto
* fit: type error
* feat: add delegation credential error webhook handling to Office365 video adapter
- Emit webhook before throwing delegation credential errors in Office365 video
- Added webhook emission in 4 locations:
1. Missing clientId/Secret in fetchNewTokenObject
2. Missing tenantId in getAuthUrl
3. Missing clientId/Secret in getAzureUserId
4. User doesn't exist in Azure AD
- Made getAuthUrl async to support webhook emission
- Follows same pattern as GoogleCalendar and Office365Calendar implementations
Co-Authored-By: morgan@cal.com <morgan@cal.com>
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fixup! Merge branch 'devin/delegation-credential-errors-webhook-1762171203' of https://git-manager.devin.ai/proxy/github.com/calcom/cal.com into devin/delegation-credential-errors-webhook-1762171203
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Co-authored-by: cal.com <morgan@cal.com>
* refactor: create team event type hosts
* refactor: update team event type hosts
* feat: allow switching between collective and round robin
* fix: make schedulingType optional when updating
* fix: e2e tests
* fix: e2e and add more tests
* test: only hosts update
* fix: remove test that makes no sense
* fix: update profile me ednpoint to include name of user
* fix: update user schema
* pass name for user
* implement PR feedback
* chore: implement PR feedback
---------
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
* fix: APIV2 team membership addition
* feat: Add trimming for email domain and orgAutoAcceptEmail in auto-accept logic
- Trim whitespace from both user email domain and orgAutoAcceptEmail
- Ensures consistent matching even with accidental whitespace
- Addresses feedback from PR review
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* simplify
* feat: Use shared OrganizationMembershipService in TRPC for consistent auto-accept logic
- Create OrganizationMembershipService.container.ts for DI in TRPC
- Update getOrgConnectionInfo to apply trimming + case-insensitive comparison
- Precompute auto-accept decisions in createNewUsersConnectToOrgIfExists using the service
- Use service in handleNewUsersInvites for consistent auto-accept determination
- Ensures both API v2 and TRPC paths use identical trimming and normalization logic
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Revert "feat: Use shared OrganizationMembershipService in TRPC for consistent auto-accept logic"
This reverts commit 0b2bd28b6e32e8c1d3dea139ca8ff9cbf402ac00.
* refactor: Unify OrganizationRepository and remove duplicate PrismaOrganizationRepository (#24869)
* refactor: Convert OrganizationRepository from static to instance methods
- Add constructor accepting deps object with prismaClient
- Convert all static methods to instance methods
- Add getOrganizationAutoAcceptSettings method
- Create singleton instance export in repository barrel file
- Update API v2 OrganizationsRepository to extend from OrganizationRepository
- Update all call sites to use singleton instance
- Add platform-libraries organizations.ts export
- Fix mock imports to use repository barrel
- Fix unsafe optional chaining in next-auth-options.ts
- Fix any types in test files with proper type inference
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update all imports to use OrganizationRepository barrel export
- Update imports from direct OrganizationRepository file to barrel export
- This ensures mocks work correctly in tests
- Fixes 202 failing tests related to organizationRepository mock
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update test mocks to use partial mock pattern
- Convert organizationMock to partial mock that preserves real class
- Add proper prisma mocks to failing test files
- Remove old OrganizationRepository mocks from test files
- This fixes test failures related to mock interception
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Export mocked singleton and update tests to use it directly
- Export mockedSingleton as organizationRepositoryMock from organizationMock
- Update delegationCredential.test.ts to import and use the exported mock
- This fixes 'vi.mocked(...).mockResolvedValue is not a function' errors
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Use platform-libraries import for API v2 OrganizationRepository
API v2 should import shared features through @calcom/platform-libraries
instead of directly from @calcom/features to maintain proper architectural
boundaries and packaging/licensing separation.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: Implement DI pattern for OrganizationRepository
- Create OrganizationRepository.module.ts and .container.ts for DI
- Replace singleton pattern with getOrganizationRepository() across 20 files
- Update platform-libraries to export getOrganizationRepository
- Delete duplicate PrismaOrganizationRepository.ts
- Remove singleton export file (repositories/index.ts)
- Update test mocks to use DI container pattern
- All type checks and unit tests passing
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Implement read/write client separation in OrganizationRepository
- Updated OrganizationRepository constructor to accept optional prismaWriteClient parameter
- Routed all write operations (create, update) through prismaWrite client
- Routed all read operations (find, get) through prismaRead client
- Updated API v2 OrganizationsRepository to pass both dbRead.prisma and dbWrite.prisma to super()
- Optimized getOrganizationRepository() calls by storing in local variables to avoid repeated function calls
- This fixes the critical issue where API v2 was passing read-only client to base class with write methods
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Fix mock setup and optimize getOrganizationRepository() calls
- Fixed verify-email.test.ts mock to return mocked repository instance instead of scenario helper object
- Added mockReset to organizationMock.ts beforeEach to properly reset mock implementations between tests
- Added local variables in page.tsx to store getOrganizationRepository() result for consistency
This fixes the issue where getOrganizationRepository() was returning organizationScenarios.organizationRepository (scenario helper) instead of the actual mocked repository instance, causing findUniqueNonPlatformOrgsByMatchingAutoAcceptEmail to be undefined.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: Simplify OrganizationRepository to use single prismaClient
- Updated base OrganizationRepository constructor to accept only { prismaClient } instead of { prismaClient, prismaWriteClient? }
- Replaced this.prismaRead and this.prismaWrite with single this.prismaClient property
- Updated API v2 OrganizationsRepository to pass only dbWrite.prisma as prismaClient
- Removed unused PrismaReadService import from API v2
- All read and write operations now use the same client instance
This simplifies the architecture as requested - API v2 uses write client for all operations, and apps/web uses the client from DI container.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: Match OrganizationsRepository.findById signature with base class
The findById method in OrganizationsRepository was using a different signature
than the base OrganizationRepository class, causing type errors in CI.
Changed from: findById(organizationId: number)
Changed to: findById({ id }: { id: number })
This matches the base class signature and resolves the CI unit test failures.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update all findById call sites to use object parameter
Fixed 6 call sites in API v2 that were calling findById with a number
instead of the required { id: number } object parameter:
- is-org.guard.ts
- is-admin-api-enabled.guard.ts
- is-webhook-in-org.guard.ts
- organizations.service.ts
- managed-organizations.service.ts (2 call sites)
This resolves the API v2 build failure caused by the signature change
in OrganizationsRepository.findById to match the base class.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Remove redundant findById override from OrganizationsRepository
The findById method was duplicating the base class OrganizationRepository
implementation. Both methods had identical logic (filtering by isOrganization: true),
so the override was unnecessary.
Since OrganizationsRepository extends OrganizationRepository and passes
dbWrite.prisma to the base constructor, the base class method already
provides the exact same functionality.
This resolves the API v2 build failure by eliminating the duplicate method
that was causing conflicts.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Remove unncessary changes
* Store in variable
* Revert "Remove unncessary changes"
This reverts commit af9351786a21616c9508c441191c17f2374fb2cc.
* Revert dbRead/dbWrite changes
* Add organizations library to tsconfig.json
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* feat: Pbac decorator and guard
* feat: v2 roles endpoints
* fix: test
* fix: starting v2
* fix: test error
* fix: test api keys
* fix fixture
* test permission creation
* feat: permissions endpoints
* refactors
* refactor: project structure
* test: role permissions crud
* test: permissions endpoint negative tests
* docs: org, team permissions swagger
* unit tests for validator
* Update roles.guard.ts
* fix type
* test: error messages
* refactor: dont throw error in pbac
* delete redundant test file
* feedback: logging error
* fix: persist role.permissions when updating role.otherProperty
* refactor: use output service to return permissions
* refactor: service functions return current permissions
* refactor: remove OrganizationsRepository from providers
* refactor: try catch possibly duplicate create
* refactor: require min length name if provided
* refactor: org role has orgId and team role teamId
* fix: pbac guard caching
* fix: e2e tests in parallel
* refactor: use IsTeamInOrg guard for orgs teams roles and permissions endpoints
* refactor: use redis service getter and setter
* refactor: invalidate team permissions cache when permissions change
* refactor: delete keys instead of versioning when caching
- Remove cal.cache query parameter parsing from booking and slots flows
- Set shouldServeCache to false for all booking availability checks
- Remove _shouldServeCache from schemas and type definitions
- Clean up all references in platform atoms and API endpoints
This ensures fresh Google Calendar data is always fetched for conflict checking,
preventing bookings when there are actual calendar conflicts.
2025-11-05 13:01:22 +00:00
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: skip authentication check for reschedule bookings with validation
- Skip checkBookingRequiresAuthentication when rescheduleUid is present
- Add validation to ensure rescheduleUid points to a real booking
- Verify booking status is ACCEPTED (upcoming)
- Verify booking uses the same event-type
- Throw appropriate errors for invalid reschedule attempts
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: move reschedule validation logic into checkBookingRequiresAuthentication
- Refactor checkBookingRequiresAuthentication to accept optional rescheduleUid parameter
- Move reschedule booking validation logic inside the method
- Simplify createBooking method by removing duplicate validation code
- Maintain same validation logic: check booking exists, is ACCEPTED, and uses same event-type
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: allow PENDING bookings to be rescheduled
- Update status validation to allow both ACCEPTED and PENDING bookings
- Change error message to reflect both allowed statuses
- PENDING bookings can now be rescheduled without authentication check
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: separate reschedule validation from auth check
- Extract validateRescheduleBooking method to handle reschedule-specific validation
- Keep checkBookingRequiresAuthentication strictly for auth checks
- Use conditional logic in createBooking: validate reschedule OR check auth
- Improves code clarity by separating concerns per lauris's feedback
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: move org admin related logic to org server
* fix: update cancellation logic to make sure org admin can cancel seated bookings of a team user
* fix: import path
* update bookings repository
* fix: update reschedule endpoint logic to let org admin reschedule bookings for a user
* refactor: make logic more simple
* chore: update platform libraries
* more refactors
* fix: add check to make sure org admin can reschedule booking
* chore: remove unused comments
* test: add e2e tests for org admin reschedule and cancel seated bookings
- Add seated event type creation for testing
- Add test for org admin rescheduling a seated booking for a managed user
- Add test for org admin canceling a full seated booking for a managed user
- Add test for org admin canceling a specific seat in a seated booking
These tests verify the functionality added in PR #24640 which allows
org admins to reschedule and cancel seated bookings for users in their
organization.
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* chore: add cubic feedback
* fix: tests for seated booking management by org admin
* chore: implement PR feedback
* fixup
* chore: update docs
* fixup: get optional user from request and then pass it down to getBookingForReschedule
* fix: validate seatUid before checking booking cancellation status
Move canRescheduleBooking call to happen after input validation
(including seatUid validation for seated bookings) but before the
actual booking creation. This ensures that when trying to reschedule
a seated booking without providing seatUid, users get the proper
'seatUid required' error instead of 'booking has been cancelled' error.
Fixes failing e2e test: 'should not be able to reschedule seated
booking if seatUid is not provided'
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: Modified teamName to be null when host is not fixed
* feat: Added test cases for round robin bookings reassignment with fixed and non-fixed hosts
* feat: improve team name handling in round robin reassignment
* refactor: improve booking title validation in reassignment tests
2025-10-30 14:00:25 +02:00
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add bookingRequiresAuthentication validation to 2024-04-15 booking controller
- Add checkBookingRequiresAuthentication method to validate authentication requirements
- Check if user is event type owner, host, team admin/owner, or org admin/owner
- Add comprehensive e2e tests for bookingRequiresAuthentication feature
- Ensure parity with 2024-08-13 controller implementation
- Fix type issue in setPlatformAttendeesEmails method
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: move Prisma calls to repository pattern
- Add findByIdIncludeHostsAndTeamMembers method to EventTypeRepository
- Inject PrismaEventTypeRepository and PrismaTeamRepository into controller
- Replace direct Prisma calls with repository methods in checkBookingRequiresAuthentication
- Use getTeamByIdIfUserIsAdmin for org admin/owner check
- Add repositories to BookingsModule_2024_04_15 providers
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* handle httpException in handleBookingErrors
* test: add test case for authenticated but unauthorized user booking
- Create second user who is not authorized to book the event type
- Verify that authenticated user without proper permissions receives 403 Forbidden
- Test validates that bookingRequiresAuthentication properly checks authorization levels
- Cleanup unauthorized user in afterAll hook
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: add accepted filter to team members and handle org-owned event types
Addresses PR comments from cubic-dev-ai and @ThyMinimalDev:
1. Add accepted: true filter to team.members query
- Prevents pending team invitations from being treated as authorized
- Also filter by role to only fetch ADMIN and OWNER roles
- Reduces payload size and improves query performance
2. Add isOrganization field to team select
- Enables proper handling of org-owned event types
3. Update authorization logic for org-owned event types
- Handle case where team.isOrganization is true with no parent
- Ensure org admins/owners are properly authorized for org-owned events
- Matches behavior of 2024-08-13 controller
Changes:
- packages/features/eventtypes/repositories/eventTypeRepository.ts:
* Add where clause to members query with accepted: true and role filter
* Add isOrganization: true to team select
- apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts:
* Update authorization logic to handle org-owned event types
* Check if team.isOrganization is true when no parentId exists
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add endpoint to add attendees to existing bookings
- Created POST /v2/bookings/:bookingUid/attendees endpoint
- Added AddAttendeesInput_2024_08_13 for input validation
- Added AddAttendeesOutput_2024_08_13 for response format
- Created BookingAttendeesService_2024_08_13 for business logic
- Created BookingAttendeesController_2024_08_13 for API endpoint
- Added validation to check for duplicate attendee emails
- Integrated with existing booking and event type repositories
- Added validateAndTransformAddAttendeesInput method to InputBookingsService
- Fixed pre-existing ESLint no-prototype-builtins warnings
- Left placeholder for custom booking field validation logic
Co-Authored-By: somay@cal.com <somaychauhan98@gmail.com>
* refactor: move booking attendee operations to dedicated repository
* refactor: move repository files into dedicated repositories directory
* feat: validate guests field availability before adding attendees to booking
* feat: migrate addAttendees API to use existing addGuests handler
* refactor: remove unused validateAndTransformAddAttendeesInput method from InputBookingsService
* refactor: rename attendees to guests in booking API endpoints and types
* refactor: rename booking-attendees to booking-guests for consistency
* WIP: add e2e tests for add booking guests endpoint
* faet: improve guest booking tests
* refactor: extract getHtml method in email templates
* feat: add email toggle support for guest invites based on OAuth client settings
* refactor: addGuests handler
* feat: add SMS notifications when adding guests to existing bookings
* refactor: rename add-attendees to add-guests for consistent terminology
* refactor: added repository pattern in addGuests.handler
* test: add attendee scheduled email spy to booking guests tests
* fix: use event type team ID instead of user org ID for booking permission check
* Update BookingEmailSmsHandler.ts
* Remove comments
* refactor: rename booking guests to booking attendees
* refactor: rename guest-related methods to use attendees terminology for consistency
* update api docs
* refactor: restructure addGuests handler to top
* refactor: update guest email format to use object structure in booking tests
* docs: clarify API version header requirement for booking attendees endpoint
* docs: add email notification details to booking attendees API documentation
* refactor: rename booking attendees to guests for consistency
* refactor: rename attendees to guests in booking API endpoints
* feat: add email validation for guest invites
* feat: improve error handling for guest booking failures
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
