* refactor: migrate UnconfirmedBookingBadge from features to apps/web
Move UnconfirmedBookingBadge.tsx from packages/features/bookings/ to
apps/web/modules/bookings/components/ as part of the architectural
refactor to remove trpc client imports from the features layer.
Also removes unused preserveBookingsQueryParams function from Navigation.tsx.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* refactor: move shell navigation and badges to apps/web
Move shell navigation components and trpc-using badges from
packages/features to apps/web/modules to fix circular dependency:
- Move navigation folder to apps/web/modules/shell/navigation/
- Move TeamInviteBadge.tsx to apps/web/modules/shell/
- Create Shell wrapper in apps/web that provides MobileNavigationContainer
- Update all Shell imports in apps/web to use the new wrapper
- Remove MobileNavigationContainer default from features Shell.tsx
- Fix pre-existing lint warnings in touched files
This establishes the pattern for migrating React components that use
trpc hooks from the features layer to the web app layer, ensuring
proper dependency direction: apps/web imports from packages/features,
never the reverse.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: move SideBar.tsx to apps/web to fix build error
SideBar.tsx was importing Navigation from the moved navigation folder,
causing a build error. Moving SideBar.tsx to apps/web and updating the
features Shell to not have a default SidebarContainer fixes this.
The web Shell wrapper now provides both the default SidebarContainer
and MobileNavigationContainer, maintaining the injection pattern.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* revert
* revert
* revert
* wip
* wip
* wip
* wip
* wip
* wip
* not used anywhere
* wip
* wip
* wip
* wip
* fix
* fix
* wip
* wip
* wip
* wip
* wip
* fix
* fix
* fix
* fix
* migrate
* migrate admin-adpi
* wip
* feat: migrate organization settings components from packages/features to apps/web/modules
- Migrate profile.tsx, appearance.tsx, general.tsx, privacy.tsx, guest-notifications.tsx, delegationCredential.tsx, other-team-members-view.tsx, other-team-profile-view.tsx
- Migrate attributes directory (AttributesForm.tsx, DeleteAttributeModal.tsx, ListSkeleton.tsx, attributes-create-view.tsx, attributes-edit-view.tsx, attributes-list-view.tsx)
- Migrate admin directory (AdminOrgEditPage.tsx, AdminOrgPage.tsx, WorkspacePlatformPage.tsx)
- Update all page imports to use new paths from ~/settings/organizations/
- Update relative imports in migrated files to use @calcom/features paths
- Fix lint warnings in migrated files
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update test import path after migration
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: remove unnecessary test-setup import (already in vitest config)
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* wip
* refactor: delete original files after migration to apps/web/modules
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* fix
* fix
* fix
* fix
* wip
* refactor more
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* mv
* update import paths
* wip
* wip
* fix
* fix
* fix
* fix
* fix
* fix
* fix
* mv
* mv
* mv
* fix
* wip
* wip
* fix
* fix
* fix
* fix: make test mocks resilient to vi.resetAllMocks()
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: fix AttributeForm test failures
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix
* fix
* refactor: move ee files to apps/web/modules/ee/ folder
- Move teams, workflows, and organizations folders to apps/web/modules/ee/
- Add LICENSE file to apps/web/modules/ee/
- Update all import paths from ~/teams/ to ~/ee/teams/
- Update all import paths from ~/settings/organizations/ to ~/ee/organizations/
- Remove duplicate MemberInvitationModal copy.tsx file
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: move useHasPaidPlan and dependent files to apps/web/modules
- Move useHasPaidPlan.ts from packages/features/billing/hooks to apps/web/modules/billing/hooks
- Move intercom files from packages/features/ee/support to apps/web/modules/ee/support
- Move ContactMenuItem.tsx and dependencies (freshchat, helpscout, zendesk) to apps/web/modules/ee/support
- Move ViewRecordingsDialog.tsx and RecordingListSkeleton to apps/web/modules/ee/video
- Move CalVideoSettings.tsx to apps/web/modules/eventtypes/components/locations
- Move CreateOrEditOutOfOfficeModal.tsx to apps/web/modules/settings/outOfOffice
- Refactor UpgradeTeamsBadge to accept props and create wrapper in apps/web/modules/billing
- Update all callers to use new file locations
- Add eslint-disable comments for pre-existing lint warnings
This fixes the tRPC server build failure caused by circular dependency where
the server build was traversing into packages/features and pulling in React
hooks that depend on @calcom/trpc/react types.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: correct UpgradeTeamsBadge import path to use package export
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* wip
* fix
* fix
* fix
* fix
* fix
* fix
* fix
* fix: pass plan state through SelectProps to UpgradeTeamsBadge
- Add upgradeTeamsBadgeProps field to ExtendedOption type in Select component
- Update OptionComponent to spread upgradeTeamsBadgeProps to UpgradeTeamsBadge
- Update getOptions.ts to accept PlanState object and include upgradeTeamsBadgeProps
- Update WorkflowStepContainer.tsx to pass planState to getWorkflowTriggerOptions/getWorkflowTemplateOptions
- Update WorkflowDetailsPage.tsx to pass upgradeTeamsBadgeProps in transformed action options
- Update AddActionDialog.tsx interface and mapping to include upgradeTeamsBadgeProps
- Add eslint-disable comments for pre-existing React Hook dependency warnings
This fixes the UpgradeTeamsBadge refactoring issue where the badge was always showing
'upgrade' text instead of the correct text based on plan state (trial_mode, inactive_team_plan, etc.)
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update import paths to use /ee/ folder for workflows and organizations
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update workflow component imports to use /ee/ folder
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: add missing types.ts for LocationInput.tsx
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: extract BookingRedirectForm type to shared location
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix
* wip
* wip
* fix: update BookingRedirectForm import to use local types file
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* wip
* fix
* fix
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(api): fix user creation with avatarUrl and username
- avatarValidator: accept URLs in addition to base64 images
- organizations-users-service: use email for user creation instead of username
The avatarValidator was incorrectly rejecting valid URLs even though the API documentation shows URL examples and all e2e tests use URLs.
The user creation was failing when username was provided because createNewUsersConnectToOrgIfExists requires a valid email, not username. The username is correctly applied via updateOrganizationUser after creation.
Fixes user creation endpoint POST /v2/organizations/{orgId}/users
* test(api): add tests for avatar validator fixes
Add comprehensive test coverage for avatarValidator changes:
- Unit tests: 18 scenarios covering valid/invalid URLs and base64 images
- E2E tests: user creation with username + avatarUrl (URL and base64)
- Security validation: reject unsafe protocols and malformed data
- Error message verification for validation failures
Addresses testing requirements from code review
* fix(api): enhance avatar validator security per code review
- Reject HTTP URLs, accept only HTTPS for security and browser compatibility
- Reject empty strings and whitespace (use null to reset avatar)
- Update validation message to clarify HTTPS requirement
- Add test coverage for new security restrictions
Addresses security feedback from code review regarding mixed content vulnerabilities and clearer API semantics for avatar reset
* refactor(api): simplify avatarValidator null check
Remove redundant null/undefined check since @IsOptional decorator already skips validation for undefined values. Updated test mock to include @IsOptional to match real DTO usage
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
2025-12-23 15:07:14 +00:00
Hariom BalharaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The PATCH endpoint for /v2/teams/:teamId/memberships/:membershipId had a bug
where host records for assignAllTeamMembers event types were not created when
a membership transitioned from accepted=false to accepted=true.
The bug was caused by incorrect operation ordering:
1. Update membership (first update)
2. Get current membership (gets already-updated state)
3. Update membership again (second update)
4. Check if transition happened (condition never fires)
Fixed by reordering to match the org-scoped controller pattern:
1. Get current membership BEFORE any updates
2. Update membership
3. Compare and call updateNewTeamMemberEventTypes if transition occurred
Also added an e2e test to verify host records are created when membership
transitions from accepted=false to accepted=true via PATCH.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: store ads clickid when creating an account
* fix: type check
* fix: google campaignId not being added to stripe
* remove tracking in stripe app
2025-12-22 23:29:51 +05:30
Volnei MunhozGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: remove webpack experimental flags from apps/web
- Remove webpackMemoryOptimizations and webpackBuildWorker from experimental config
- Remove unused DefinePlugin for process.env.BUILD_ID (not used anywhere in codebase)
- Remove unused buildId parameter from webpack function signature
These webpack-specific experimental flags were showing up during dev mode
even though Turbopack is used for development. The flags only apply to
production webpack builds and their presence in the config was confusing.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* chore: remove webpack function for full Turbopack build
- Remove entire webpack function (IgnorePlugin, PrismaPlugin, resolve.fallback, sideEffects)
- Remove unused PrismaPlugin import
- Turbopack handles all bundling without webpack configuration
Benchmark shows no performance regression:
- Main (with webpack): 67s compile
- Full webpack removal: 69s compile
Both fail at same pre-existing TypeScript error on main branch.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* chore: convert next.config.js to TypeScript
- Convert CommonJS require() to ES6 imports
- Add proper TypeScript types for config and plugins
- Remove /* eslint-disable */ comment
- Keep all existing functionality intact
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* conditional load axiom
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: add server and client raqbUtils modules
Add two new modules to split RAQB utilities:
- raqbUtils.server.ts: Server-safe utilities without RAQB runtime
- raqbUtils.client.ts: Client-only utilities requiring RAQB runtime
This enables server-side code to import RAQB utilities without
pulling in the react-awesome-query-builder runtime library.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: update imports to use server/client raqbUtils modules and fix lint warnings
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix type errors in getLuckyUser.ts and remove dead code in RouteBuilder.tsx
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-22 02:00:19 +00:00
Volnei MunhozGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
MOVE:
- Move @next/third-parties from root to apps/web (only used there)
- Remove date-fns-tz from root, add date-fns and date-fns-tz to root deps
REMOVE:
- Remove sonner from packages/lib (not used there, already in apps/web)
- Remove next-seo from packages/ui (not used there, already in apps/web)
- Remove next-auth from apps/api/v2 (only used for User type in tests)
ADD peerDependencies:
- packages/ui: add react-dom
- packages/features: add react, react-dom, react-is, date-fns-tz, stripe, zod
- packages/platform/atoms: add react-dom
- packages/trpc: add next, react, react-dom
ADD dependencies:
- apps/web: add @next/third-parties, i18next, react-i18next
- apps/api/v2: add axios (required by @nestjs/axios)
FIX:
- apps/api/v2: replace next-auth User type with @calcom/prisma/client User
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-21 23:20:49 +00:00
Volnei MunhozGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: upgrade apps/web to Next.js 16.1.0
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: enable Turbopack for Next.js 16.1 production builds
- Add turbopack: {} config to next.config.js to enable Turbopack for builds
- Fix re-exported config errors in webhook API routes by defining config locally
- alby/webhook.ts
- btcpayserver/webhook.ts
- paypal/webhook.ts
- stripepayment/webhook.ts
Turbopack requires route segment configs to be statically analyzable,
so they cannot be re-exported from other modules.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update revalidateTag calls for Next.js 16.1 API changes
Next.js 16.1 changed the revalidateTag signature to require a second
argument (profile). Using 'max' profile as recommended by Next.js docs
for stale-while-revalidate semantics.
Updated files:
- app/(booking-page-wrapper)/team/[slug]/[type]/actions.ts
- app/(use-page-wrapper)/(main-nav)/teams/actions.ts
- app/(use-page-wrapper)/settings/(settings-layout)/developer/api-keys/actions.ts
- app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/actions.ts
- app/(use-page-wrapper)/settings/organizations/(org-user-only)/members/actions.ts
- app/cache/travelSchedule.ts
Also cleaned up next.config.js turbopack config formatting.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add profile parameter to revalidateTag in membership.ts for Next.js 16.1
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix routing form
* refactor: rename middleware.ts to proxy.ts per Next.js 16 migration
Next.js 16 has deprecated the 'middleware' file convention and renamed it to 'proxy'.
This change follows the official migration guide:
https://nextjs.org/docs/messages/middleware-to-proxy
Changes:
- Renamed apps/web/middleware.ts to apps/web/proxy.ts
- Renamed the middleware function to proxy
- Updated CODEOWNERS reference
- Updated comment reference in logout page
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Anik Dhabal Babu <adhabal2002@gmail.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
2025-12-21 16:31:48 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: lock package versions to exact versions from yarn.lock
Replace version ranges (^, ~) with exact resolved versions from yarn.lock
to ensure consistent dependency resolution across all environments.
This change affects 26 package.json files with 89 version updates including:
- TypeScript: ^5.9.0-beta -> 5.9.2
- Zod: ^3.22.4 -> 3.25.76
- React: ^18 -> 18.2.0
- Various Radix UI, Vite, PostCSS, and other dependencies
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: preserve npm alias format for @radix-ui packages
The previous commit incorrectly converted npm aliases like
'npm:@radix-ui/react-dialog@^1.0.4' to just '1.0.4', which broke
yarn install as it tried to find non-existent packages.
This fix restores the npm alias format while keeping the pinned versions:
- @radix-ui/react-dialog-atoms: npm:@radix-ui/react-dialog@1.0.4
- @radix-ui/react-tooltip-atoms: npm:@radix-ui/react-tooltip@1.0.6
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: move dev dependencies to devDependencies section
Move 26 dependencies that are clearly development-only to the
devDependencies section across 10 packages:
- Testing: @types/jest, jest, ts-jest, @golevelup/ts-jest
- Build tools: typescript, ts-node, concurrently, dotenv-cli
- Linting: eslint-*, eslint-config-*, eslint-plugin-*
- Types: @types/express, @types/turndown, @types/uuid
This improves dependency organization and ensures production builds
don't include unnecessary development dependencies.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* Remove all links legacyBehavior
* fix: resolve type errors in Button and Dropdown when using Link without legacyBehavior
- Button.tsx: Only pass ref to button element, not to Link (Link manages its own anchor)
- Dropdown.tsx: Strip ref from props when using Link to avoid type incompatibility
This fixes the type errors that were causing API V1 and V2 builds to fail.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: only pass disabled and type props to button element, not to Link
Link component doesn't accept disabled or type props, so these should only be passed when rendering a button element.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: strip ref from passThroughProps when rendering Link
The passThroughProps spread was including a ref property that's incompatible with Link's expected ref type. This strips the ref when rendering a Link component.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: use type assertion for React.createElement props to handle union types
The Button component uses a union type for props that can be either Link or button props. TypeScript can't narrow the union type properly when using React.createElement with a dynamic element type, so we use a type assertion to cast the props to the correct type.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: render Link and button separately to avoid type conflicts
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: preserve data-testid when rendering Button as Link
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: import AppRouter from generated types instead of server source
This change improves tRPC build performance by having the client-side code
import AppRouter from pre-generated type declarations instead of traversing
the entire server router tree.
Changes:
- Create type bridge file at packages/trpc/types/app-router.ts
- Update packages/trpc/react/trpc.ts to import from the bridge
- Update .gitignore to only ignore types/server (generated files)
- Update eslint.config.mjs to only ignore types/server (generated files)
The type bridge provides:
1. Faster typechecking - avoids parsing 458 server files
2. Stable import location that's easy to lint against
3. Single place to adjust if generated path changes
Build order is already enforced in turbo.json (type-check depends on @calcom/trpc#build).
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: move bridge file to react/ to avoid TS5055 error
Move the AppRouter type bridge file from types/app-router.ts to react/app-router.ts
to avoid the TS5055 'Cannot write file because it would overwrite input file' error.
The issue was that placing the bridge file in types/ caused TypeScript to treat
the generated .d.ts files as input files during the tRPC build, then fail when
trying to emit to the same location.
By placing the bridge in react/ (which is excluded from the tRPC server build),
the bridge file is only used by client code and doesn't interfere with the
server type generation.
Changes:
- Move bridge file from types/app-router.ts to react/app-router.ts
- Update import in react/trpc.ts to use ./app-router
- Revert .gitignore to ignore all of types/ (generated files)
- Revert eslint.config.mjs to ignore all of types/**
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: split tRPC build into server and react phases
- Create tsconfig.server.json for server-only type generation
- Create tsconfig.react.json for react/client type generation
- Update build script to run server build first, then react build
- Remove || true so build properly fails on errors
- This allows react code to import from generated server types
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: split @calcom/trpc exports to separate server and react entrypoints
- Remove react exports from @calcom/trpc root (index.ts)
- Update 89 files to import from @calcom/trpc/react instead of @calcom/trpc
- This fixes the boundary leak where server builds were pulling in react code
- Server build no longer compiles react/app-router.ts, fixing the chicken-and-egg
issue where react code needed generated server types that didn't exist yet
This improves TypeScript build performance by preventing the server type
generation from traversing the entire react/client type graph.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: import WorkflowType from lib/types instead of React component
This fixes a boundary leak where the server build was pulling in React
components through the WorkflowRepository import chain. By importing
WorkflowListType from lib/types instead of WorkflowListPage.tsx, the
server build no longer traverses React component files.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: extract server-safe types to prevent boundary leaks in tRPC build
- Extract ChildrenEventType to lib/childrenEventType.ts (server-safe)
- Extract Slots type to calendars/lib/slots.ts (server-safe)
- Create types.server.ts files for eventtypes and bookings
- Update server code to import from server-safe type files
- Update DatePicker.tsx to use extracted Slots type
- Update app-store utils to use BookerEventForAppData type
This prevents the server build from pulling in React files through
transitive imports from @calcom/features barrel exports.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update Segment.test.tsx mock path to @calcom/trpc/react
The test was mocking @calcom/trpc but importing from @calcom/trpc/react.
After the entrypoint separation, the mock path needs to match the import path.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: temporarily restore || true to unblock PR merge
The pre-existing Prisma type errors (~345 errors) will be addressed in a follow-up PR.
This allows the two-phase build architecture changes to be merged first.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Run trpc build as part of API v2 build
* Removed the bridge file
* refactor: extract event type schemas to server-safe file
- Create packages/features/eventtypes/lib/schemas.ts with createEventTypeInput and EventTypeDuplicateInput
- Update types.ts to re-export schemas from the new server-safe location
- Update tRPC schema files to import from schemas.ts instead of types.server.ts
- Delete types.server.ts (was duplicating ~200 lines unnecessarily)
This keeps the server build graph clean while avoiding code duplication.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Removed the optionality of the tRPC builds
* Removed the extra command for API v2
* refactor: rename calendars/lib/slots.ts to types.ts
Per Keith's feedback, renamed the file to types.ts since it contains type definitions.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Added back tRPC build:server for API v2
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
2025-12-20 23:43:04 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: dedupe yarn.lock to remove duplicate package versions
- Consolidated 762 duplicate package versions
- Reduced yarn.lock from 51,211 lines (1.7MB) to 44,471 lines (1.5MB)
- Removed 7,071 lines (~200KB) of redundant dependency entries
- Major packages deduplicated include: resolve, semver, type-fest, commander, glob, lru-cache, dotenv, @babel/* packages, typescript, tslib, postcss, and many more
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: resolve type errors in managed event types and react-select components
- Add Zod-compatible versions of allManagedEventTypeProps and unlockedManagedEventTypeProps
that only include scalar fields (excludes Prisma relation fields)
- Update handleChildrenEventTypes.ts and queries.ts to use the new Zod-compatible props
- Fix react-select CSS type errors in Select.tsx files by using Object.assign
instead of spread operator to avoid TypeScript type inference issues
- Fix lint warning in updateNewTeamMemberEventTypes by using if statement
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: derive eventType parameter type from actual query result
Use Awaited<ReturnType<typeof getEventTypesToAddNewMembers>>[number] to ensure
type safety at call sites, avoiding Prisma type namespace mismatches.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: disable turbo cache for @calcom/trpc#build to prevent stale type errors
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: correct field names in API v1 validation schemas
- Remove timeZone from booking schema (field doesn't exist on Booking model)
- Remove bookingId from destination-calendar schema (field doesn't exist, only booking relation)
- Change avatar to avatarUrl in user schema (correct field name)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: use Object.assign for react-select styles to fix TypeScript spread type errors
The spread operator causes TypeScript to compute an incompatible type with
CSSObjectWithLabel due to the accentColor property. Using Object.assign
preserves the correct type inference.
Fixed files:
- FormEdit.tsx
- DestinationCalendarSelector.tsx (features and platform)
- TimezoneSelect.tsx
- ApiKeyDialogForm.tsx
- Select.tsx (features/form)
- WebhookForm.tsx
Also fixed pre-existing lint warnings:
- Constant truthiness in label assignment
- Unused variant parameter
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove extra fields from allManagedEventTypePropsForZod to match original behavior
The Zod-compatible version should only include scalar fields that were in the
original allManagedEventTypeProps. Removed instantMeetingScheduleId, profileId,
rrSegmentQueryValue, and assignRRMembersUsingSegment which were incorrectly
added and caused test failures by including extra fields in Prisma update payloads.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove access to fields not in Zod schema
- Remove unnecessary destructuring of profileId and instantMeetingScheduleId
from managedEventTypeValues in handleChildrenEventTypes.ts (these fields
are already sourced from other variables)
- Set rrSegmentQueryValue to undefined directly in queries.ts instead of
accessing it from managedEventTypeValues (not applicable for managed children)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add name property to mock credentials and revert turbo cache change
- Add name property to MockCredential type and factory function in
InstallAppButtonChild.test.tsx to match expected credentials type
- Revert turbo cache disable for @calcom/trpc#build (per review comment)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: revert API v1 validation changes and restore eslint comment
- Revert API v1 validation changes (booking.ts, destination-calendar.ts,
user.ts) since API v1 is deprecated and these could be breaking changes
- Restore eslint-disable comment for @typescript-eslint/no-empty-function
in Select.tsx that was accidentally removed
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add inputs to @calcom/trpc#build to properly invalidate cache
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: properly fix API v1 validation schemas for stricter zod 3.25.76
The yarn dedupe upgraded zod from 3.22.4 to 3.25.76, which has stricter
.pick() typing that now properly rejects picking non-existent fields.
Changes:
- user.ts: Pick avatarUrl (actual Prisma field) and extend with avatar
for API v1 backward compatibility
- booking.ts: Remove timeZone from pick (not a field on Booking model,
only exists in nested attendees/user objects)
- destination-calendar.ts: Remove bookingId from pick (not a field on
DestinationCalendar model)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove turbo.json inputs for @calcom/trpc#build to use cached artifacts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: use robust selector for react-select option in routing forms E2E test
The previous selector used .nth(1) which assumed the email text appeared
exactly twice in the DOM in a specific order. This broke when react-select
was upgraded from 5.7.2 to 5.8.0 via yarn dedupe.
The new approach waits for the react-select listbox to appear and clicks
the option within it, which is more robust against DOM structure changes.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(auth): validate IdP authority before SAML account linking
Adds verification that SAML IdP is authoritative for the email domain
before allowing account conversion
* fix(auth): deny by default on missing SAML tenant + optimize membership query
- Block account conversion when tenant is missing (deny by default)
- Replace JOIN + ILIKE with two indexed lookups for O(1) performance
* refactor(auth): apply data minimization to security logs
2025-12-20 17:45:18 +00:00
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: split confirm-emails e2e test to authenticate as booking owner
The test was flaky because it authenticated as an admin user (authEmail)
but created bookings for different users (emailsEnabledSetup.user and
emailsDisabledSetup.user). When confirming/declining bookings, the
ApiAuthGuard + BookingUidGuard rejected requests with 401 because the
authenticated user wasn't the booking owner.
The fix splits the test into two separate describe blocks, each with its
own app instance that authenticates as the actual booking owner. This
ensures the authenticated user always matches the booking owner.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: add unauthenticated app for attendee reschedule test
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: use real API key authentication instead of withApiAuth mock
- Replace withApiAuth mock with real API key authentication using ApiKeysRepositoryFixture
- This avoids Passport strategy registration conflicts between test suites
- For attendee reschedule test, use unauthenticated request (no auth header) since endpoint uses OptionalApiAuthGuard
- Remove separate unauthenticatedApp instance as it's no longer needed
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix flakes
* update
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Booking confirmation pages contain PII (names, emails, phone numbers)
and should not be indexed by search engines
- Add robots noindex to /booking/[uid]/page.tsx
- Add robots noindex to /booking/[uid]/embed/page.tsx
Follows same pattern as not-found.tsx
* feat: add environment-based favicons (prod vs dev)
- Add cal-prod.png (dark/gray) favicon for production environments
- Add cal-dev.png (red) favicon for development/localhost environments
- Update FAVICON_16 and FAVICON_32 constants to switch based on IS_PRODUCTION
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add higher resolution icons for all icon types (apple-touch, android-chrome, mstile)
- Add 180x180 apple-touch-icon for prod and dev
- Add 150x150 mstile icons for prod and dev
- Add 192x192 and 256x256 android-chrome icons for prod and dev
- Update all icon constants to use IS_PRODUCTION switching
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: simplify favicon to single new design
- Remove environment-based favicon switching
- Update all icon files with new Cal favicon design
- Remove dev/prod icon variants
- Update constants to use static icon paths
Co-Authored-By: peer@cal.com <peer@cal.com>
* feat: add favicon.ico with new Cal favicon design
Co-Authored-By: peer@cal.com <peer@cal.com>
* chore: update favicon icons with final design
Co-Authored-By: peer@cal.com <peer@cal.com>
* chore: update favicon icons with final design v3
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add name property to delegation credentials for type compatibility
The MultiDisconnectIntegration component expects credentials with user.name property,
but delegation credentials only had user.email. This caused a type mismatch when
spreading both credential types together in appCredentialsByType handler.
Added name: null to the delegation credentials user object to ensure type compatibility.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update getUserDisplayName to check value instead of just property existence
The narrowing logic was causing TypeScript to infer 'never' type because
after adding name property to delegation credentials, the 'name in user'
check always passes. Now we check if name has a truthy value before using it.
Also fixed lint warning by using optional chaining for onSuccess callback.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add explicit return type and typeof checks to getUserDisplayName
The function now has an explicit return type of string | null and uses
typeof checks to ensure proper type narrowing. This prevents TypeScript
from inferring a wider return type that includes {} when the user object
has properties with non-string types.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test: update delegation credential test to include name property
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: flaky E2E tests and refactor
* fix
* fix: week limit tests to use same week for pre-booking and UI booking
The week limit tests were failing because the pre-booking was created in
week 1 but the UI booking was done in week 2. Since weekly limits are
per-week, the pre-booking didn't count toward the limit in week 2.
Fixed by keeping both bookings in the same week:
- Pre-booking on Monday (satisfies daily limit, counts toward weekly)
- UI booking on Tuesday (same week, hits weekly limit of 2)
This ensures the weekly limit is properly tested and all remaining
weekdays in the week get blocked after hitting the limit.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Add CalComPageStatus handling in NotFound and ErrorPage components using useLayoutEffect
- Remove redundant pageStatus logic from PageWrapperAppDir.tsx since App Router error/notFound pages set status themselves
- Refactor embed-iframe.ts: split checkPageStatusAndHandleError into hasPageError() and handlePageError()
- Add page status checks before firing linkReady to catch errors set after initialization
- Ensures linkFailed event fires correctly for all error status codes in embed scenarios
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(booking-audit): extract core audit system changes from PR 25125
This PR extracts core audit infrastructure changes without integration changes:
1. New action services introduced:
- SeatBookedAuditActionService
- SeatRescheduledAuditActionService
2. Simplification of ActionService interface:
- Streamlined IAuditActionService interface
- Reduced TypeScript burden with cleaner type definitions
3. ActionSource support:
- Added BookingAuditSource enum (API_V1, API_V2, WEBAPP, WEBHOOK, UNKNOWN)
- Added source and operationId fields to BookingAudit model
4. New AuditAction types:
- SEAT_BOOKED
- SEAT_RESCHEDULED
- APP actor type
5. New BookingAuditAccessService:
- Permission-based access control for audit logs
- Added readTeamAuditLogs and readOrgAuditLogs permissions
6. Fixes in the logs viewer flow:
- Enhanced BookingAuditViewerService with improved filtering
- Local AttendeeRepository for actor enrichment
Changes are contained within packages/features/booking-audit with minimal
outside changes (permission registry only).
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor(booking-audit): streamline action handling and enhance localization
- Replaced action icon retrieval with a mapping object for improved clarity and performance.
- Introduced constants for actor role labels to simplify role retrieval.
- Added new localization strings for audit log permission errors and organization requirements.
- Updated various service and repository interfaces to enhance type safety and clarity.
- Removed deprecated architecture documentation and adjusted related imports for consistency.
These changes aim to improve code maintainability and user experience in the booking audit system.
* fix(booking-audit): enhance actor role localization and operation ID tracking
- Updated actor role labels in the booking logs view to use lowercase for consistency.
- Improved localization by wrapping actor role display in a translation function.
- Added operationId field to audit logs for better correlation of actions across multiple bookings.
- Enhanced BookingAuditViewerService to include operationId in enriched audit logs.
- Updated integration tests to verify consistent operationId across related audit logs.
These changes aim to improve localization accuracy and facilitate better tracking of user actions in the booking audit system.
* feat: integrate credential repository and enhance app actor handling
- Added CredentialRepository to manage app credentials, including a method to find credentials by ID.
- Updated BookingAudit system to support app actors identified by credential ID, improving actor attribution and audit clarity.
- Introduced a new utility function to map app slugs to display names, enhancing the user experience in audit logs.
- Modified relevant interfaces and types to accommodate the new credential handling and app actor structure.
- Enhanced BookingAuditViewerService to display app names based on credentials, ensuring accurate representation in audit logs.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-18 12:46:24 +00:00
Eunjae LeeGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add enabled column to UserFeatures and TeamFeatures for tri-state semantics
- Add enabled Boolean column to UserFeatures model with default true
- Add enabled Boolean column to TeamFeatures model with default true
- Update FeaturesRepository to use tri-state semantics:
- enabled=true: feature is explicitly enabled
- enabled=false: feature is explicitly disabled (blocks inheritance)
- No row: inherit from team/org level
- Update SQL queries to check enabled=true for feature access
- Add enableFeatureForTeam method to interface and implementation
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* update comments
* add integration tests
* add more test
* select enabled only
* no @default(true)
* fix types and tests
* add missing enabled
* add missing enabled
* rename enableFeatureForTeam to updateFeatureForTeam and support FeatureState
* refactor: rename updateFeatureForTeam to setTeamFeatureState
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix integration test
* fix tests
* add more tests
* add missing enabled
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* add webhook version schema
* version the code
* update version from numeric to date val
* migration
* update schema and build factory
* update string
* move version picker
* tooltip instead of infobadge
* --
* fix type
* --
* fix type
* fix type
* --
* fix messed up merge
* improvements to payloadfactory
* extract version off of DB and instead keep it in IWebhookRepository
* fix webhookform
* fix type safety and routing ambiguity
* scalable with easier factory extensions and base definition
* fix types
* --
* --
* clean up prisma/client type imports
* fix
* type fix
* type fix
* cleanup
* add tests and registry changes
* unintended file inclusion
* type-fix
* select in repo
* --
* explicit return type
* --
* fix type
* fixes
* feedback 1
* feedback 2
* use enum instead of string
* fixes
