* feat: make orgId optional for user and team scopes in InsightsRoutingBaseService
- User scope authorization only checks formUserId and formTeamId IS NULL
- Team scope now supports standalone teams without organizations
- Add validation logic to return NOTHING_CONDITION if team belongs to org but no orgId provided
- Add comprehensive test coverage for null/undefined orgId scenarios in both scopes
- Aligns schema with actual usage patterns and supports teams without organizations
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: extend orgId optional support to InsightsBookingBaseService
- Make orgId optional for user and team scopes in InsightsBookingBaseService
- Update InsightsBookingServicePublicOptions type to allow orgId: number | null
- Add validation logic for team scope to handle missing orgId
- Add comprehensive test coverage for null/undefined orgId scenarios
- Fix type casting issues in test file
- Maintains backward compatibility while supporting teams without organizations
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: correct authorization logic for optional orgId in team scope
- Skip isOwnerOrAdmin check for team scope when orgId is null (standalone teams)
- Maintain security for org scope and team scope with orgId
- Fixes integration test failures for null orgId test cases
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: use != null instead of !== undefined for orgId checks
- Properly handle both null and undefined orgId values in authorization logic
- Fix integration test failures where null orgId was incorrectly triggering isOwnerOrAdmin check
- Ensure team scope with null orgId skips ownership validation for standalone teams
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: always validate team membership for team scope
- Remove orgId condition from isOwnerOrAdmin check for team scope
- Ensure both standalone teams and org-based teams require ownership validation
- Maintain orgId validation logic in buildTeamAuthorizationCondition methods
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: use nullish() for orgId schema validation
- Change from .optional() to .nullish() to allow both null and undefined
- Fixes schema validation when tests pass orgId: null
- Resolves authorization logic returning NOTHING_CONDITION for valid cases
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: replace isOwnerOrAdmin with PBAC checkPermission in insights services
- Replace isOwnerOrAdmin method in InsightsBookingBaseService with checkPermission from PermissionCheckService
- Replace isOwnerOrAdmin method in InsightsRoutingBaseService with checkPermission from PermissionCheckService
- Use permission 'insights.read' with fallback roles MembershipRole.OWNER and MembershipRole.ADMIN
- Maintain same method signature and behavior while leveraging PBAC system
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* clean up types
* add comment
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Add mounted state to ensure component renders after hydration
- Fix hydration mismatch between server and client rendering
- Ensure ConfigureStepCard renders properly on initial load in production
Fixes the issue where GTM analytics app configuration form appears blank
on step 3 until page refresh.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Fix route pattern from **/api/trpc/viewer.slots.getSchedule** to **/api/trpc/slots/getSchedule**
- Remove permissive assertions that allowed tests to pass with 0 API calls
- Tests now properly fail when duplicate getSchedule calls are detected
- Addresses issue where E2E tests weren't catching duplicate API calls on main branch
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
2025-09-18 17:09:45 +00:00
Alex van AndelGitHubalex@cal.com <me@alexvanandel.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Keith Williams
* chore: Skip static file copy if not required
* feat: Replace MD5 hash checks with Turborepo caching for static file copying
- Add copy-app-store-static Turborepo task with proper inputs/outputs
- Remove manual MD5 hash calculation logic that was causing performance issues
- Update package.json scripts to use Turborepo task
- Addresses Keith's feedback about using Turborepo cache instead of manual checks
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: Add copy-app-store-static script to package.json for Turborepo task execution
- Add missing script definition in apps/web/package.json
- Enables Turborepo to properly execute the static file copying task
- Fixes 'No tasks were executed' issue by providing the command to run
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: Remove skipped jobs from required check failure condition
- Allow conditional E2E jobs to be skipped without failing the required check
- Maintain failure detection for actual job failures and cancellations
- Apply fix consistently to both pr.yml and all-checks.yml workflows
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* Revert "fix: Remove skipped jobs from required check failure condition"
This reverts commit 429f0506d009eaae7fa88be6db077681d5124f2a.
* Only write new logs
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* feat: add Webhook resource to PBAC system with permission enforcement
- Add Webhook resource to PBAC permission registry with CRUD actions
- Implement PBAC permission checks in webhook handlers (create, edit, delete)
- Add webhook permission translations to common.json
- Use PermissionCheckService with fallback roles [ADMIN, OWNER] for team webhooks
- Maintain backward compatibility when PBAC is disabled
- Follow same pattern as workflow PBAC implementation from PR #22845
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: implement PBAC permission filtering in webhook list handler
- Add PermissionCheckService to filter team webhooks by webhook.read permission
- Only show webhooks from teams where user has proper permissions
- Maintain backward compatibility with fallback to all team memberships
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* add migration for default roles
* new forUserMethod
* update webhook repository
* fix UI showing/hiding webhooks for webhoo.create teams
* WIP pbac procedure migratoin + tests
* add more roles to get fallback
* permissions in cmponents instead of readOnly
* passPermissions to list item
* push instant events logic
* Git merge
* wip teamId accessable refactor
* fix delete handler
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: allow to choose dateTarget for /insights (startTime by default)
* feat: add timestamp selector for insights date filtering
- Add TimestampFilter component with Start Time/Created At options
- Extend useInsightsBookingParameters hook with timestamp selection
- Update all insight components to use dateTarget parameter
- Add i18n translations for new UI strings
- Position selector next to DateRangeFilter as requested
Addresses user request to add select box next to date range filter
allowing users to choose between startTime (default) and createdAt
for displaying booking metrics on the Insights page.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: rename TimestampFilter to DateTargetSelector with nuqs URL state
- Rename TimestampFilter component to DateTargetSelector
- Implement nuqs hook in InsightsPageContent for URL state management
- Update useInsightsBookingParameters to return dateTarget from URL state
- Add dateTarget field to insightsRoutingServiceInputSchema and related types
- Simplify individual insight components to use insightsBookingParams directly
- Remove manual timestampTarget destructuring from all components
- Update all tRPC routing service calls to include dateTarget parameter
- All TypeScript checks now pass successfully
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update styles
* fix inconsistency
* feat: replace Select with Command component and rename filter ID
- Replace Select with Command + Popover for compact width and wider dropdown
- Add descriptive option labels with translations
- Change filter ID from 'createdAt' to 'timestamp' across all components
- Maintain URL state management with nuqs
- Fix ESLint warning for missing dependency in useEffect
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: revert routing components to use createdAt filter ID
- Keep timestamp filter ID change scoped only to main insights page
- Routing components should continue using createdAt as filter ID
- Only insights-view.tsx and related booking hooks use timestamp
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update styles
* fix trpc router
* refactor timestamp column for insights booking service
* fix
* update text
* rename and clean up
* fix endDate in DateRangeFilter
* fix type errors
* fix startTime filter and type errors
* provide default date range
* add completed to getMembersStatsWithCount
* add unit tests
* fix type error
* address feedback
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: resolve JSON parsing error in Stripe subscription endpoint
- Fix 'Unexpected end of JSON input' error during premium username upgrade
- Replace res.status(404).end() with proper JSON response
- Add descriptive error message for missing userId or intentUsername parameters
- Ensure consistent JSON response format across all error paths
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: add proper session handling to Stripe subscription endpoint
- Import getServerSession from @calcom/features/auth/lib/getServerSession
- Use getServerSession({ req }) to properly populate user session
- Fix session validation that was causing 'Unexpected end of JSON input' error
- Ensure subscription endpoint handles sessions consistently with other Cal.com API endpoints
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Wrap ConfigureStepCard content with NoSSR component
- Prevents blank step 3 configuration page in production
- Fixes hydration mismatch between server and client rendering
- Ensures analytics apps (GTM, Fathom, GA4) installation works properly
- Uses Cal.com's established NoSSR pattern for client-side only rendering
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: Past booking redirect
* fix: rename ENV_PAST_BOOKING_RESCHEDULE_CHANGE to ENV_PAST_BOOKING_RESCHEDULE_CHANGE_TEAM_IDS for clarity
- Renamed environment variable to better reflect that it contains comma-separated team IDs
- Updated all references in constants.ts, implementation file, tests, and turbo.json
- Addresses PR comment feedback about misleading variable name
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix members page crash with pbac feature flag
* invite member to org backend
* update org permissions
* feat: org profile update settings
* org general page
* remove redudant me call
* privacy page
* add attributes to pbac
* dync + sso on organization permissions
* add tests for resource-permission util
* pass permissions to attributes\
* restore invite members
* update org update and attribute backends
* fix type errors
* fix orgId
* fix types attempt two
* fix types attempt two
* fix type error
* show/hide team event types based on eventType.read permission
* fix dupe string in i18n
* fix tests
* fix team-dsync
* update session to use profile
* use profile metadata to get orgRolew
* fix dsync
* fix typing
* Event type create pbac check
* fix the readonly permission check. WIP
* refactor getUserEventTypes
* fix test
* add generate util for update
* update router to use new generator function for pbac procedures
* update transform utils
* fix members being able to update on UI
* fix allSettled
* fix fallback permissions
* fix permission logic
* fix compare memebrship type error
* fix unit test error
* fix manage test error
* fix nested permissions
* filter based on canView permission in getUserEventGroups
* Update packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.test.ts
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix tests
* fix tests
* feat: Adding workflow permission checks inside of eventTypes (#23038)
* add permission checks for workflows
* wip getall active workflows
* check eventType.update permission on activiating workflow on event type
* pass permissions to context and use context in client
* remove local parsePermissionString and use registery
* Use new scoped function
* default scope to orgs
* use object values for workflow permissions
* fix type errors
* Fix permission traversal + fix all state caluclation
* fix eventType group to use permissions.canRead
* fix: update failing PBAC unit tests and resolve ESLint warnings
- Fix getUserEventGroups test: MEMBER role should not have update permissions in fallback scenario
- Fix EventTypeGroupFilter test: add missing canRead property to mock permissions map
- Replace 'as any' type assertions with proper 'as unknown as' type assertions to resolve ESLint warnings
Both tests now pass and align with PBAC permission model where MEMBER role has read-only access to event types.
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* add pbac to _heavy router
* Merge main
* restore versions
* Parallelizable members query
* fix nits
* fix create
* Restore lock file
* Fix import from merge artifact
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* e2e tests for apple connect atom
* update globalEnv for turbo.json
* update pages for tests
* update playwright config so we can use env variables inside tests
* update packages
* update variable names
* update playwright config
* fix: import variables from env instead of separate files
* update env variables for atoms e2e yml
* Change display mode from 'standalone' to 'minimal-ui'
this shows the refresh and back button for easier navigation ux
* Update display settings in site.webmanifest
---------
Co-authored-by: Kartik Saini <41051387+kart1ka@users.noreply.github.com>
* fix
* Update UserForm.tsx
* test: add e2e tests for admin user creation and editing
- Add test for successful user creation via /settings/admin/users/add
- Add test for successful user editing via /settings/admin/users/{id}
- Tests verify form submission, API responses, and database changes
- Follow Cal.com e2e testing patterns with admin authentication
- Use Playwright for end-to-end form interaction testing
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Update admin-users.e2e.ts
* Update admin-users.e2e.ts
* update
* tweak
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: return attendees when fetching all bookings
* refactor: v2 show hidden attendees for authenticated requests
* chore: regenerate docs
* chore: add test
2025-09-16 19:57:42 +05:30
Eunjae LeeGitHubeunjae@cal.com <hey@eunjae.dev>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
* chore: use local platform libraries instead of npm package
The allowTypeImports option is only supported by @typescript-eslint/no-restricted-imports,
not the standard ESLint no-restricted-imports rule. This fixes the configuration error:
'Configuration for rule no-restricted-imports is invalid: allowTypeImports should NOT have additional properties'
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
