* fix another
* fix flakes
* Update apps/web/playwright/fixtures/apps.ts
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* fix
* fix
* test fix
* fix test
* tweak
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
This fixes a race condition in the embed E2E tests where the __iframeReady
event could fire before the Cal.ns[namespace] API was ready to receive it.
The fix adds a window.message listener immediately in the addInitScript that
captures __iframeReady events directly from postMessage, which doesn't depend
on the namespace API being ready. This ensures window.iframeReady is set
even if the event fires before the Cal API listener is attached.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-29 18:35:50 +05:30
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: migrate GitHub workflows from Buildjet to Blacksmith
- Replace buildjet-*vcpu-ubuntu-2204 runners with blacksmith-*vcpu-ubuntu-2204
- Replace buildjet/cache@v4 with actions/cache@v4
- Replace buildjet/setup-node@v4 with actions/setup-node@v4
- Replace buildjet/cache-delete@v1 with useblacksmith/cache-delete@v1
- Rename delete-buildjet-cache.yml to delete-blacksmith-cache.yml
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: bump Blacksmith runners to Ubuntu 24.04
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Reduce 16vcpu to 4vcpu for the API v2 E2E
* Remove 8vcpu usage
* chore: switch Blacksmith runners to ARM architecture
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: switch Blacksmith runners back to AMD (remove -arm suffix)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: improve test cleanup to cover all bookings including reassignment-created ones
- Changed afterEach cleanup to find all bookings by eventTypeId instead of tracking bookingIds
- This ensures bookings created indirectly by managedEventManualReassignment are also cleaned up
- Removed problematic prefix-based deleteMany calls that could affect parallel tests
- Fixes idempotencyKey collision errors on high-parallelism CI runners
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: improve icons screenshot test stability with deviceScaleFactor and increased threshold
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: cap Playwright workers to 4 to match vCPU allocation on Blacksmith runners
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: split confirm-emails e2e test to authenticate as booking owner
The test was flaky because it authenticated as an admin user (authEmail)
but created bookings for different users (emailsEnabledSetup.user and
emailsDisabledSetup.user). When confirming/declining bookings, the
ApiAuthGuard + BookingUidGuard rejected requests with 401 because the
authenticated user wasn't the booking owner.
The fix splits the test into two separate describe blocks, each with its
own app instance that authenticates as the actual booking owner. This
ensures the authenticated user always matches the booking owner.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: add unauthenticated app for attendee reschedule test
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: use real API key authentication instead of withApiAuth mock
- Replace withApiAuth mock with real API key authentication using ApiKeysRepositoryFixture
- This avoids Passport strategy registration conflicts between test suites
- For attendee reschedule test, use unauthenticated request (no auth header) since endpoint uses OptionalApiAuthGuard
- Remove separate unauthenticatedApp instance as it's no longer needed
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix flakes
* update
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: flaky E2E tests and refactor
* fix
* fix: week limit tests to use same week for pre-booking and UI booking
The week limit tests were failing because the pre-booking was created in
week 1 but the UI booking was done in week 2. Since weekly limits are
per-week, the pre-booking didn't count toward the limit in week 2.
Fixed by keeping both bookings in the same week:
- Pre-booking on Monday (satisfies daily limit, counts toward weekly)
- UI booking on Tuesday (same week, hits weekly limit of 2)
This ensures the weekly limit is properly tested and all remaining
weekdays in the week get blocked after hitting the limit.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add enabled column to UserFeatures and TeamFeatures for tri-state semantics
- Add enabled Boolean column to UserFeatures model with default true
- Add enabled Boolean column to TeamFeatures model with default true
- Update FeaturesRepository to use tri-state semantics:
- enabled=true: feature is explicitly enabled
- enabled=false: feature is explicitly disabled (blocks inheritance)
- No row: inherit from team/org level
- Update SQL queries to check enabled=true for feature access
- Add enableFeatureForTeam method to interface and implementation
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update comments
* add integration tests
* add more test
* select enabled only
* no @default(true)
* fix types and tests
* add missing enabled
* add missing enabled
* rename enableFeatureForTeam to updateFeatureForTeam and support FeatureState
* refactor: rename updateFeatureForTeam to setTeamFeatureState
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix integration test
* fix tests
* add more tests
* add missing enabled
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: improve E2E test stability and reduce flakiness
- Replace hardcoded waits with proper Playwright waitFor assertions in slot selection
- Add explicit waits for calendar and time slot elements to be visible before clicking
- Replace fixed 2s wait in gotoRoutingLink with networkidle wait
- Replace fixed 5s email wait with retry logic (10 retries, 500ms intervals)
- Use unique usernames with timestamps to avoid parallel test collisions
- Use features fixture instead of direct prisma calls for feature flag mutations
- Fix login.e2e.ts to use unique username instead of hardcoded 'pro'
- Fix signup.e2e.ts to use unique usernames and proper feature flag handling
- Remove unused 'users' parameter from tests that don't need it
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* perf: replace waitForTimeout with smart waits for faster E2E tests
- Replace 30 waitForTimeout calls with proper Playwright waits
- Use waitFor({ state: 'visible' }) for element visibility
- Use waitForLoadState('networkidle') for page load completion
- Use waitForFunction for localStorage state changes
Performance improvements:
- limit-tab.e2e.ts: 10s fixed wait -> element visibility wait
- booking-duplicate-api-calls.e2e.ts: 5s fixed wait -> networkidle
- change-theme.e2e.ts: 3s fixed wait -> localStorage state check
- team-invitation.e2e.ts: multiple 500ms-3s waits -> element waits
- booking-seats.e2e.ts: 2s waits -> dropdown visibility waits
- embed-code-generator.e2e.ts: 1s waits -> iframe visibility waits
- organization-privacy.e2e.ts: 500ms waits -> element/networkidle waits
- organization-invitation.e2e.ts: 500ms-1s waits -> element waits
- analyticsApps.e2e.ts: 1s wait -> networkidle
- integrations.e2e.ts: 1s wait -> calendar element wait
- fixtures/apps.ts: 1s waits -> element visibility waits
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* use booking.uid instead of booking.id for url param
* show timezone on calendar
* fix type
* restore horizontal tab and remove header and subtitle
* clean up sidebar items
* fix event propagation from attendees
* fetch all statuses except for cancelled on calendar view
* clean up styles of the badges on BookingListItem
* fix useMediaQuery
* add close button to the header
* add assignment reason to the details sheet
* use separator row
* use ToggleGroup for the top bookings tab
* move ViewToggleButton
* resize the action button
* remove wrong prop
* fix type error
* fix type error
* hide view toggle button on mobile (and fix the breakpoint)
* remove unused e2e tests
* fix e2e tests
* hide toggle button when feature flag is off
* update skeleton
* improve attendees on booking list item and slide over
* improve attendee dropdown
* fix type error
* move query to containers
* select attendee email
* infinite fetching for calendar view
* update styles
* fix compatibility
* fix: add backward compatibility for status field in getAllUserBookings
* increase calendar height
* fix type error
* support Member filter only for admin / owners
* add debug log (TEMP)
* add event border color
* show Reject / Accept buttons on BookingDetailsSheet
* move description section to the top
* update When section
* update style of Who section
* add CancelBookingDialog WIP
* fix CancelBookingDialog
* increase clickable area
* add schedule info section WIP
* fix flaky reject button
* fixing reschedule info WIP
* add fromReschedule index to Booking
* improve rescheduled information
* improve reassignment
* fix type error
* fix unit test
* respect user's weekStart value on the booking calendar view
* update debug log
* improve payment section
* clean up
* fix log message
* reposition filters on list view
* fix bookings controller api2 e2e test
* clean up file by extracting logic into custom hooks
* rename files
* merge BookingCalendar into its container
* extract logic into separate hook files
* remove redundant logic
* rearrange items on calendar view
* add WeekPicker
* extract filter button
* responsive header on list view
* horizontal scroll for ToggleGroup WIP
* fix type error
* fix cancelling recurring event
* address feedback
* fix e2e tests
* fix unit test
* fix e2e tests
* make hover style more visible for ToggleGroup
* fix margin on CancelBookingDialog
* update styles on the slide over (mostly font weight)
* update style of CancelBookingDialog
* update styles
* update margin top for the header
* refactor getBookingDetails handler
* fix gap in who section
* auto-filter the current user on the calendar view
* calculate calendar height considering top banners
* improve booking details sheet interaction without overlay
* update calendar event styles
* update reject dialog style
* put uid first in the query params
* fix class name
* memoize functions in useMediaQuery
* query attendee with id instead of email
* update margins
* replace TRPCError with ErrorWithCode
* move calculation outside loop
* remove dead code
2025-12-10 13:40:04 +00:00
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: simplify date range picker to Airbnb-style selection
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* feat: apply Airbnb-style selection to allowPastDates branch
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: extract date range selection logic and add unit tests
- Extract date range selection logic into pure function (dateRangeLogic.ts)
- Remove unused allowPastDates parameter from selection logic
- Add comprehensive unit tests (11 test cases covering all scenarios)
- Simplify DateRangePicker component (30+ lines -> 5 lines)
- Improve separation of concerns: allowPastDates only controls calendar date restrictions
* style update
* feat: add hover highlighting for date range selection
When a start date is selected and user hovers over other dates,
the potential range between start and hovered date now shows
bg-emphasis background for better visual feedback.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* memoize hovering range and update styles
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-03 14:52:25 +00:00
Eunjae LeeGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: integer to text comparison in routing insights query
Add explicit integer array cast to prevent PostgreSQL type mismatch error when comparing bookingUserId (integer) with user_id array values in getRoutedToPerPeriodData query
* add e2e tests
* refactor: remove LoadingInsight component and handle loading in ChartCard
- Enhanced ChartCard to render default loading UI when isPending is true
- Replaced all LoadingInsight usages with ChartCard that accepts isPending/isError props
- Removed LoadingInsight component and updated exports
- Updated 16 chart components to use the new pattern
- ChartCard now shows spinner and skeleton title during loading state
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: make children prop optional in ChartCard when isPending is true
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: remove unused loadingState prop from ChartCard
- Remove loadingState prop and ChartLoadingState type export
- Simplify computedLoadingState to derive state only from isPending/isError
- No functional changes - loadingState was not being used by any components
- data-loading-state attribute behavior remains unchanged for E2E tests
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: remove duplicate isPending early returns from chart components
- Update all 16 chart components to use single ChartCard return pattern
- Gate children rendering with !isPending && isSuccess && data checks
- Prevents data processing code from executing during loading state
- Improves code consistency and maintainability across all charts
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: remove redundant !isPending check from chart conditionals
- Simplify conditional rendering to use just 'isSuccess && data' or 'isSuccess'
- In TanStack Query, isSuccess and isPending are mutually exclusive
- The !isPending check was redundant since isSuccess already implies !isPending
- Applied to all 16 chart components for consistency
- Components with safe defaults (data ?? []) use just 'isSuccess'
- Components requiring data check use 'isSuccess && data'
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* revert the mistake
* apply feedback
* apply feedback
* fix e2e
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-01 15:07:57 +01:00
Amit SharmaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* add public client
* implement PKCE
* pass codeChallenge and codeChallengeMethod to handler
* fixes for secure oauth flow
* fix type error
* clean up refresh token endpoint
* only support S256
* fix type error
* remove comment
* add tests
* fix type errors in route.test.ts
* add missing support for refresh token
* add e2e test for public client refresh tokens
* allow pkce for confidential clients
* fix type error
* fix e2e
* fix option pkce for confidential clients
* e2e test improvements
* fix test
* remove only
* add delay
* fix e2e tests
* remove only
* don't skip pkce if codeChallenge is set
* add service functions for token endpoint
* use service function in refreshToken endpoint
* use repository
* remove return types
* e2e test fixes
* fix e2e test
* remove .only in e2e test
* remove pause
* fix error responses in token endpoints
* adjust tests to new error responses
* fix error responses
* e2e improvements
* redirect on error
* adjust tests
* Update apps/web/modules/auth/oauth2/authorize-view.tsx
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2025-11-26 17:02:42 +01:00
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: exclude booking responses from calendar/CRM integrations for seated events
For seated events (events with seatsPerTimeSlot), booking responses are now excluded from being sent to calendar integrations (Google Calendar, etc.), CRM integrations (HubSpot, Salesforce, etc.), and other integrations.
This applies to both creating new seated bookings and rescheduling seated bookings.
The calendar event and CRM records are still created, but without the custom booking field responses included in the description/notes.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* test
* Refactor Office 365 Calendar OAuth redirect URI
Removed debug logging for redirect URI and client ID.
* test
* check
* Update Prisma connection logic for integration tests
Refactor database connection handling for integration tests.
* update
* Refactor conditionals and simplify role handling
* Add test comment in index.ts
* Remove integration test flag from index.ts
Remove integration test flag from database connection logic.
* update
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: Remove all code related to the old cache system
* Removed some redundant tests, some type fixes
* Further type fixes
* More type fixes re. tests
* Next iteration, couple of fixes remaining
* Remove cache from CredentialActionsDropdown
* Fix tests by mocking credential, instead of db queries
* Remove Cache DI wiring from v2
* Make sure apiv2 build passes
* Remove another cache cron
* Remove old tokens for calendar-cache v1
* Revert "fix: revert bookings redesign (#25172)"
This reverts commit 1f102bf3b4.
* add bookings-v3 feature flag
* put things behind a feature flag
* remove no longer needed test
* revert e2e tests
* put back description
* revert AvatarGroup
* apply feedback
* remove "view" booking action
* remove Alert (When the bookings query errors, this branch now renders only the alert and skips the data-table filter/segment controls. Those controls moved into BookingsList, so in error states users can no longer clear or tweak filters to recover from the failure, effectively trapping them behind the alert.)
* address feedback
* revert useMediaQuery
* Remove auto adding users to an org
* Update tests
* Fix tests
* fix: Update organization invitation E2E tests to not expect auto-accept before signup
- Changed isMemberShipAccepted expectations from true to false before signup
- Users with emails matching orgAutoAcceptEmail are no longer auto-accepted
- They must explicitly accept the invitation after signup
- Fixed lint warnings for unused parameters
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: Update E2E tests to expect pending membership after signup without auto-accept
Since auto-accept functionality was removed, users with emails matching
orgAutoAcceptEmail are no longer automatically accepted into organizations
after signup. They remain in pending state until explicitly accepted.
Updated assertions in:
- 'nonexisting user is invited to Org' test
- 'nonexisting user is invited to a team inside organization' test
Both tests now correctly expect isMemberShipAccepted: false after signup.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Restore `verify-email` and tests from `main`
* Add `orgAutoJoinOnSignup` to `organizationSettings`
* Update
`OrganizationRepository.findUniqueNonPlatformOrgsByMatchingAutoAcceptEmail`
to find orgs where `orgAutoJoinOnSignup` is true
* `organization.update` lint fix
* `organization.update` to handle `orgAutoJoinOnSignup`
* Create toggle for `orgAutoJoinOnSignup`
* test: Add comprehensive tests for orgAutoJoinOnSignup functionality
- Update existing test to expect null instead of error when multiple orgs match
- Add test for when orgAutoJoinOnSignup is false (should return null)
- Add test for when orgAutoJoinOnSignup is true (should return org)
- Add test for default behavior (orgAutoJoinOnSignup defaults to true)
These tests verify that the new orgAutoJoinOnSignup setting correctly controls
whether users are automatically added to organizations during email verification.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Type fix
* e2e: invited users should be accepted after signup (address cubic r2511916791)
Reverted post-signup isMemberShipAccepted assertions from false to true for
explicit invite scenarios. When users are explicitly invited to an org/team
and complete signup via invite link, their membership should be accepted.
This is distinct from auto-join by domain (controlled by orgAutoJoinOnSignup),
which only affects users who sign up without an invite but match the org's
email domain.
Backend sets membership.accepted = true on invite completion in:
packages/features/auth/signup/utils/createOrUpdateMemberships.ts:61,67,77,83
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Fix API V2 build
---------
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* bookings page redesign work in progress
fix: duplicate translation key
chore: use newly supported separator type
remove outdated BookingDetailsSheet
remove dropdown and related code
revert unncessary changes
* fix wrong rebase
* fix type error
* refactor: separate bookings columns into filter and display columns (#24959)
* refactor: separate bookings columns into filter and display columns
- Extract filter-only columns into shared filterColumns.ts
- Extract list display columns into listColumns.tsx
- Create BookingsListContainer for list view with both column sets
- Create BookingsCalendarContainer for calendar view with filter columns only
- Refactor bookings-view.tsx to use dynamic imports for containers
- Remove column/table creation logic from bookings-view.tsx
This ensures calendar view doesn't import list-specific UI components (AvatarGroup, Badge, etc.)
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: return null instead of false for separator rows in filter accessors
The filter accessor functions were returning false for separator rows instead of null,
which would pollute the multi-select filters with bogus 'false' values.
This fix ensures that separator rows return null so they are properly excluded from filters.
Addresses cubic AI reviewer feedback on PR #24959
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* clean up filter column visibility
* feat: integrate booking calendar view with re-designed list (#24973)
* add toggle button
* remove the dateRange filter when switching from calendar to list view
* move "view" to the action dropdown
* add close button the details sheet
* move close button
* fix more button behavior
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix type error
* update the test case
* fix e2e util
* fix actions dropdown
* revert e2e tests
* fix type error on BookingActionsDropdown.tsx
* fix: include today's bookings in flatData for past status
Previously, flatData excluded groupedBookings.today, which caused
past bookings that happened today to not show up when status === 'past'.
This fix includes today's bookings in flatData for all statuses.
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* improve attendee cell
* fix e2e tests
* change max
* fix e2e
* add reschedule requested message
* fix e2e
* update e2e
* remove flaky checks
---------
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: hide duplicate phone field when attendee phone location selected
* Instead of hiding use autofill the value to all other phone fields
* add e2e test
* add not sync test and use changeHandler instead of useEffect
* address cubics comments
* adding the phone check back
* use zod schema instead of this type casting
* use Enum instead of hardcoded string for phone
* Fix e2e test
* Fix e2e tests
* Delete .retracify.html
---------
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com>
Co-authored-by: Volnei Munhoz <volnei@cal.com>
* Add critical logger for booking created log to prevent stdout buffering issues
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Add comment
* Separate critialLogger into it's own file
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* Rename eventTypes.heavy to eventTypesHeavy
* Update eventTypes lib types
* Remove trpc and trpc client heavy resolve endpoint
* Update shared file
* Fix comments
* Rename path
* Fix wait for URL path
* Fix API endpoint in event-types.e2e.ts test
* fix: Import WorkflowType from enums instead of client
The WorkflowType enum should be imported from @calcom/prisma/enums
rather than @calcom/prisma/client. This was causing integration tests
to fail with 'Cannot read properties of undefined (reading EVENT_TYPE)'
because the enum wasn't being properly exported from the client.
This fixes the remaining integration test failures after the Prisma 6.16
upgrade.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: anik@cal.com <adhabal2002@gmail.com>
2025-10-23 07:32:06 -03:00
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: invalidate old password reset tokens when new one is requested
Security fix: Previously, old password reset tokens remained valid
even after requesting a new one, creating a potential account takeover
vulnerability. This change ensures that when a user requests a new
password reset link, all previous valid tokens for that email are
immediately invalidated.
Changes:
- Expire all existing valid tokens before creating new one
- Add E2E test to verify old tokens are invalidated
- Prevent potential account takeover scenario
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Clean up code by removing blank line
Removed unnecessary blank line in forgot-password.e2e.ts.
* test: fix strict mode violation in password reset test
Use getByRole to specifically target the heading element instead of
text locator which was matching both the heading and button.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-10-22 12:35:07 +01:00
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Add consistent ordering to seat references queries and fix ESLint warnings
- Add orderBy clause to seatsReferences in bookings list query
- Add orderBy clause to seatsReferences in getBookingToDelete query
- Ensures seat references are always returned in consistent order (by ID ascending)
- Prevents race conditions when matching seat references by user email
- Fix ESLint no-unused-expressions warnings by converting to if statements
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* update
* Add ordering to attendee queries in tests for consistency
- Add orderBy clause to all attendee queries in booking-seats.e2e.ts
- Ensures attendees are queried in consistent order before mapping to seats
- Prevents mismatch between test expectations and actual seat order
- Fix unused variable warning
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Fix seat ordering to use attendeeId instead of seat ID
- Order seats by attendeeId in both bookings list and getBookingToDelete queries
- This ensures seats are returned in the same order as attendees were created
- Fixes mismatch where seat IDs and attendee IDs use different auto-increment sequences
- Also add attendeeId to seatsReferences select for consistency
- Fix ESLint warnings by converting && expressions to if statements
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Remove orderBy from bookingSeats queries
* update
* fix another test
* fix flakes
* Fix test to order seats by attendeeId to match backend ordering
The test was ordering seats by seat ID, but the backend orders by attendeeId. This caused flakiness because seat IDs and attendee IDs use different auto-increment sequences and can be in different orders. Now both test and backend use the same ordering (attendeeId), ensuring references[1] consistently refers to the second attendee's seat.
Also remove unused 'user' variable from test.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Change orderBy from attendeeId to id in query
* Implement seatReferenceUid check in booking flow
Added logic to handle missing seatReferenceUid by reloading the page and retrying the action.
* Reduce wait time and update visibility check
* Update visibility check for 'Seats available' text
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-10-22 11:14:15 +05:30
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>cal.comMorgancubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* feat: upgrade Prisma to 6.16.0 with no-rust engine
- Update Prisma packages to 6.16.0
- Add PostgreSQL adapter dependency
- Configure engineType: 'client' and provider: 'prisma-client' in schema
- Update Prisma client instantiation with PostgreSQL adapter
- Remove binaryTargets from generators (not needed with library engine)
- Fix schema view issue by removing @id decorator from BookingTimeStatusDenormalized
- Fix ESLint warning by removing non-null assertion
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Web app running but types wrecked
* web app running but build and type issues
* Removed the connection pool
* Fixed zod type issue
* Fixed types in booking reference extension
* Fixed test issues
* Type checks passing it seems
* Using cjs as moduleFormat
* Fixing Prisma undefined
* fix: update prismock initialization for Prisma 6.16 compatibility
- Add @prisma/internals dependency for getDMMF()
- Restructure prismock initialization to use createPrismock() with DMMF
- Create Proxy that's returned from mock factory for proper spy support
- Fixes 89 failing unit tests with 'Cannot read properties of undefined (reading datamodel)' error
- Based on workaround from prismock issue #1482
All unit tests now pass (375 test files, 3323 tests passed)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: cast serviceAccountKey to Prisma.InputJsonValue in bookingScenario.ts
- Apply type cast at lines 2493 and 2535
- Fixes type errors from Prisma 6.16 upgrade
- Follows established pattern from delegationCredential.ts
- Add eslint-disable for pre-existing any types
- Rename unused appStoreLookupKey parameter to satisfy lint
- All 3323 tests passing
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: remove whitespace-only lines from bookingScenario.ts
- Remove blank lines where eslint-disable comments were replaced
- Cleanup from pre-commit hook formatting
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Update is-prisma-available-check.ts
* fix: remove datasources config when using Prisma Driver Adapters
- Update customPrisma to create new adapter when datasources URL is provided
- Remove datasources config from API v2 Prisma services (already in adapter)
- Fixes 'Custom datasource configuration is not compatible with Prisma Driver Adapters' error
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: use Pool instances for PrismaPg adapters in index.ts
- Create Pool instance before passing to PrismaPg adapter
- Update customPrisma to create Pool for custom connection strings
- Matches working pattern from API v2 services
- Fixes 'Invalid `prisma.$queryRawUnsafe()` invocation' error
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Not using queryRawUnsafe
* Trying anything at this point
* Make sure the DB is ready first
* Don't auto run migrations in CI mode
* Revert "Make sure the DB is ready first"
This reverts commit 2b20bd45c974f3d7e07d8b904bc7fcdae37cce03.
* Dynamic import of prisma
* Commenting where it seems to break
* Backwards compatability for API v2
* fix: add explicit type annotations for map callbacks in API v2
- Add type annotation for map parameter in memberships.repository.ts
- Add type annotation for map parameter in stripe.service.ts
- Fixes implicit 'any' type errors from stricter Prisma 6.16.0 type inference
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add explicit type annotations for API v2 map callbacks
- users.repository.ts:292: add Profile & { user: User } type
- memberships.service.ts:19-20: add Membership type to filter callbacks
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add explicit type annotation for attributeToUser in organizations-users.repository.ts
- organizations-users.repository.ts:63: add AttributeToUser with nested relations type
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add explicit Membership type annotations in teams.repository.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: use API v2 dedicated Prisma client to support adapter in PrismaClientOptions
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Running API v2 build commands together so they all get the space size var
* Fixing Maximum call depth exceeded error
* fixed type issues
* Trying to make the seed more stable
* Revert "Trying to make the seed more stable"
This reverts commit 1fd4495e6af7acd7981cda7dedec3168979b0e9d.
* Fixed path to prisma client
* Fixed type check
* Fix eslint warnings
* fix: externalize @prisma/adapter-pg and pg in platform-libraries Vite config
- Add @prisma/adapter-pg and pg to external dependencies list
- Add corresponding globals for these packages
- Fix Prisma client aliases to point to packages/prisma/client instead of node_modules
- Add Node.js resolve conditions to prefer Node.js exports
- Keep commonjsOptions.include for proper CommonJS transformation
- Add eslint-disable for __dirname in Vite config file
- Remove problematic prettier/prettier eslint comment
This fixes the 'Extensions.defineExtension is unable to run in this browser environment' error when running yarn generate-swagger in apps/api/v2 after upgrading to Prisma v6.16 with the no-rust engine approach.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update Prisma imports in API v2 services to use package path
- Change imports from '../../../generated/prisma/client' to '@calcom/prisma/client'
- Fixes CI error: Cannot find module '../../../../../packages/prisma/generated/prisma/client.ts'
- Aligns with backwards compatibility re-export structure after Prisma v6.16 upgrade
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove .ts extension from Prisma client path mapping in tsconfig
- Remove file extension from @calcom/prisma/client path mapping
- Fixes runtime error: Cannot find module '../../../../../packages/prisma/generated/prisma/client.ts'
- TypeScript path mappings should not include file extensions per best practices
- Allows Node.js to correctly resolve to .js files at runtime
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: resolve Prisma 6.16.0 type incompatibilities in bookingScenario tests
- Changed InputPayment.data type from PaymentData to Prisma.InputJsonValue
- Changed createCredentials key parameter from JsonValue to InputJsonValue
- Removed unused PaymentData type definition
- Resolves type errors at lines 709 and 1088 without using 'as any' casts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove non-existent Watchlist fields from test fixtures
- Remove createdById from isLockedOrBlocked.test.ts (lines 15, 20)
- Remove severity and createdById from _post.test.ts (line 110)
- These fields don't exist in Watchlist model schema after Prisma 6.16.0 upgrade
- Resolves TS2353 errors without using 'as any' casts
Relates to PR #23816
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: api v2 imports generated prisma and platform libraries
* fix: resolve type errors from Prisma 6.16 upgrade
- Add missing markdownToSafeHTML import in AppCard.tsx
- Fix organizationId null handling in fresh-booking.test.ts
- Remove non-existent createdById field from Watchlist test utils
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Put back some external rollups
* Added back the resolve conditions
* Stop using Pool directly
* chore: remove prisma bookingReferenceExtension and update calls
* fix: organizations-admin-not-team-member-event-types.e2e-spec.ts
* chore: bring back POOL in api v2 prisma clients
* chore: remove Pool but await connect
* fixup! chore: remove Pool but await connect
* chore: bring back Pool on all clients
* chore: end pool manually
* chore: test with pool max 1
* chore: e2e test prisma max pool of 1 connection
* chore: give more control over pool for prisma module with env
* remove pool from base prisma client
* chore: prisma client in libraries use pool
* Fixed types
* chore: log pool events and improve pooling
* Fixing some types and tests
* Changing the parsing of USE_POOL
* fix: ensure Prisma client is connected before seeding to prevent transaction errors
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: adjust pools
* chore: add process.env.USE_POOL to libraries vite config
* fix: v1 _patch reference check bookingRef on the booking find
* fix: v1 get references deleted null for system admin
* test: add integration tests for bookingReference soft-delete behavior
- Add bookingReference.integration-test.ts to test repository methods
- Add handleDeleteCredential.integration-test.ts to test credential deletion cascade
- Add booking-references.integration-test.ts for API v1 integration tests
- All tests verify soft-delete behavior without using mocks
- Tests use real database operations to ensure soft-deleted records persist
- Cover scenarios: replacing references, credential deletion, querying with filters
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: convert booking-references test to actual API endpoint testing
- Modified _get.ts to export handler function for testing
- Refactored integration test to call API handler instead of directly testing Prisma
- Added timestamps to test data to avoid conflicts
- Tests now verify API layer correctly filters soft-deleted references
- All 4 tests passing
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add explicit prisma.$connect() call to seed-insights script
With Prisma 6.16 and the PostgreSQL adapter, scripts need to explicitly call $connect() before running database operations to ensure the connection pool is properly initialized. This prevents 'Transaction already closed' errors.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add $connect() to main() execution in seed-insights
Both main() and createPerformanceData() entry points need explicit prisma.$connect() calls with the Prisma 6.16 PostgreSQL adapter.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: always use connection pool for Prisma PostgreSQL adapter
Enable connection pooling by default for the Prisma adapter to prevent
transaction state issues during seed operations. Without a pool, each
operation creates a new connection which can lead to 'Transaction already
closed' errors during heavy database operations like seeding.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Revert "fix: always use connection pool for Prisma PostgreSQL adapter"
This reverts commit 6724bb08e42bc0a94846069de83b04db0aeb8e8b.
* fix: enable connection pool for db-seed in cache-db action
Set USE_POOL=true when running yarn db-seed to use connection pooling
with the Prisma PostgreSQL adapter. This prevents 'Transaction already
closed' errors during seeding by maintaining stable database connections.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add safety check for undefined ownerForEvent in seed script
Prevent 'Cannot read properties of undefined' error when orgMembersInDBWithProfileId
is empty. This can happen if organization members fail to create or when there's a
duplicate constraint violation causing early return.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: v1 _patch reference check bookingRef
* fix: increase pool size and add timeout settings to prevent transaction errors
- Increase max connections from 5 to 10
- Add connectionTimeoutMillis: 30000 (30 seconds)
- Add statement_timeout: 60000 (60 seconds)
These settings help prevent 'Unknown transaction status' errors during
heavy database operations like seeding by giving transactions more time
to complete and allowing more concurrent connections.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Revert "fix: increase pool size and add timeout settings to prevent transaction errors"
This reverts commit 148264f1f1861dfb09a082937a3e2b49e78fc41a.
* fix: remove standalone execution in seed-app-store to prevent premature disconnect
The seed-app-store.ts file had a standalone main() call at the bottom
that would execute immediately when imported, including a prisma.$disconnect()
in its .finally() block.
This caused issues because:
1. seed.ts imports and calls mainAppStore()
2. The import triggers the standalone main() execution
3. This standalone execution disconnects prisma after completion
4. seed.ts then tries to call mainHugeEventTypesSeed() but prisma is disconnected
5. This leads to 'Unknown transaction status' errors
Fixed by removing the standalone execution since mainAppStore() is already
called programmatically from seed.ts which manages the connection lifecycle.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: use require.main check to prevent premature disconnect when imported
Added require.main === module check so seed-app-store.ts:
- Runs standalone with proper connection management when executed directly
via 'yarn seed-app-store' or 'ts-node seed-app-store.ts'
- Does NOT run standalone when imported as a module by seed.ts,
preventing premature prisma disconnect
This fixes 'Unknown transaction status' errors while maintaining
backward compatibility for direct execution.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: seed apps before creating users to prevent foreign key constraint violation
Reordered seeding operations to call mainAppStore() before main() because:
- main() creates users with credentials that reference apps via appId foreign key
- mainAppStore() seeds the App table with app records
- Apps must exist before credentials can reference them
This fixes the 'Foreign key constraint violated on Credential_appId_fkey' error
that occurred when creating credentials before the apps they reference existed.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Apply suggestion from @cubic-dev-ai[bot]
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Removing functional changes of deleted: null
* Apply suggestion from @keithwillcode
* refactor: move seedAppData call to bottom of main() in seed.ts
Moved seedAppData() call from seed-app-store.ts to the bottom of main()
in seed.ts to ensure the 'pro' user is created before attempting to
create routing form data for them.
Changes:
- Exported seedAppData function from seed-app-store.ts
- Removed seedAppData() call from the main() export in seed-app-store.ts
- Added seedAppData() call at the bottom of main() in seed.ts
- Updated standalone execution in seed-app-store.ts to still call
seedAppData() when run directly via 'yarn seed-app-store'
This ensures proper ordering: apps seeded → users created → routing
form data created for existing users.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: move routing form seeding from seed-app-store.ts to seed.ts
Moved the routing form seeding logic (previously in seedAppData function)
from seed-app-store.ts to be inline at the bottom of main() in seed.ts.
This ensures the 'pro' user is created before attempting to create routing
form data for them.
Changes:
- Removed seedAppData function and seededForm export from seed-app-store.ts
- Removed import of seedAppData from seed.ts
- Added routing form seeding logic inline at bottom of main() in seed.ts
Seeding order: apps → users (including 'pro') → routing forms
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add deleted: null filter to bookingReference update operations
- Add deleted: null filter to API v1 PATCH endpoint to prevent updating soft-deleted booking references
- Add deleted: null filter to DailyVideo updateMeetingTokenIfExpired and setEnableRecordingUIAndUserIdForOrganizer
- Add comprehensive test coverage for PATCH endpoint soft-delete behavior
- Tests verify that soft-deleted booking references cannot be updated
- Tests verify that only active booking references can be updated successfully
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* revert: remove deleted: null filters to preserve existing functionality
Per @keithwillcode's feedback, reverting the soft-delete filtering changes to preserve existing functionality in this PR. This PR should focus only on the Prisma upgrade itself.
- Reverted API v1 PATCH endpoint change
- Reverted DailyVideo adapter changes (updateMeetingTokenIfExpired and setEnableRecordingUIAndUserIdForOrganizer)
- Removed test file that was added for soft-delete behavior testing
Addresses comments:
- https://github.com/calcom/cal.com/pull/23816#discussion_r2448854197
- https://github.com/calcom/cal.com/pull/23816#discussion_r2448860594
- https://github.com/calcom/cal.com/pull/23816#discussion_r2448860833
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* test: restore and update booking reference tests to match existing functionality
Updated tests to verify existing behavior where PATCH endpoint can update
booking references regardless of their deleted status. This matches the
current implementation after reverting the deleted: null filters.
Changes:
- Restored test file that was previously deleted
- Updated PATCH tests to expect successful updates of soft-deleted references
- Renamed test suite to 'Existing functionality' to clarify intent
- Tests now verify that the PATCH endpoint preserves existing behavior
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* test: rename booking-references test to integration-test
The test requires a database connection and should run in the integration
test job, not the unit test job. Renamed from .test.ts to .integration-test.ts
to match the repository's testing conventions.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: cal.com <morgan@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* feat: redirect to new onboarding flow
* Getting started
* Brand details
* Preview organization brands
* Orgs team pages
* Invite team steps
* Move to global zustand store
* Few darkmdoe fixes
* Wip onboarding + stripe flow
* Default plan state
Server Action for gettting slug satus of org
* Remove onboardingId
* Confirmation prompt
* Update old onboarding flow handlers to handle new fields
* update onboarding hook
* Filter out organization section for none -company emails
* Match placeholders to users domain
* Drop migration
* Wip new onboarding intent
* WIP flow for self-hosted. Same service call just split logic
* WIP
* Add TODO
* Use onboarding user type instead of trpc session
* WIP
* WIP
* pass role and team name from onboarding to save in schema
* Add test to ensure role + name + team are persisted into onboarding table
* migrate roles to enum values
* Update ENUM
* Fix type error
* Redirect if flag is disabled
* Remove web
* WIP
* WIP
* Fix migration
* Fix calls
* User onboarding User types instead of trpc session
* Fix factory tests
* Fix flow for self hoste
* Type error
* More type fixes
* Fix handler tests
* Fix enum return type being different
* Use consistant types across the oganization stuff
* Fix
* Use TEAM_BILLING for e2e test
* Refactor is not company email and add tests
* Fix
* Fix
* Refactor flow to submit after form complete
* Fix flow with billing disabled
* Fix tests
* Apply suggestion from @coderabbitai[bot]
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Rename and move test files
* WIP
* Fix types
* Update repo paths + tests
* Move to service folder
* Fix tests
* Fix types
* Remove old test files
* Restore lock
* Fix path
* Fix tests with new paths and factory logic
* Fix updaetdAt
* WIP onboardingID isolation
* Fix e2e test
* verify test
* Code rabbit
* Rename SelfHostedOnboardongService -> SelfHostedOrganizationOnboardingService
* Fix stores
* Fix type error
* Fix types
* remove tsignore
* Apply suggestion from @coderabbitai[bot]
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* NITS
* Add the logic to auto complete admin org when billing enabled
* Fix store being weird
* We need to return the parsed value
* fixes
* sync from db always
* Add onboardingSgtore tests
* fix test
* remove step and status
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
