* fix: add guest limits and rate limiting to booking-guests endpoint
- Add ArrayMaxSize(10) validation to limit guests per request to 10
- Add aggressive rate limiting (5 requests/minute) via @Throttle decorator
- Add total guest limit check (max 30 guests per booking) to prevent abuse
- Update API documentation to reflect new limits
This prevents scammers from using the endpoint to send spam emails
to hundreds of guests through our system.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* docs: update openapi.json with guest limits and rate limiting info
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(salesforce): add field rules for round robin skip
- Add rrSkipFieldRules schema to appDataSchema in zod.ts
- Implement applyFieldRules method in CrmService.ts for post-query filtering
- Integrate field rules into getContacts method when forRoundRobinSkip=true
- Add UI component for configuring field rules in EventTypeAppCardInterface
- Add translations for new UI strings
- Add comprehensive tests for field rules functionality
Field rules allow users to specify conditions based on Salesforce record fields
with 'ignore' or 'must_include' actions. Rules are evaluated with AND logic
and gracefully handle missing fields by skipping those rules.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add children prop to Section.SubSectionHeader for field rules
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat(salesforce): add edit button for field rules
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat(salesforce): apply field rules to GraphQL results
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat(salesforce): add Redis caching for field validation
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix(salesforce): remove Redis caching to fix ERR_INVALID_THIS error
- Removed Redis caching for field validation that was causing ERR_INVALID_THIS errors
- Simplified field rules filtering to try query directly and skip filtering if it fails
- Restored ensureFieldsExistOnObject method for other uses (write to record)
- Field rules now gracefully handle invalid fields by skipping filtering
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* chore: reformat getAttributes.ts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(salesforce): dynamically build GraphQL query for field rules with multi-edge iteration
- Add buildDynamicAccountQuery to inject field rule fields into GraphQL query
- Add passesFieldRules to evaluate ignore/must_include rules against UIAPI nodes
- Validate field rules via getObjectFieldNames (in-memory + Redis cache) before branching
- Remove applyFieldRulesToGraphQLRecords (used jsforce conn in GraphQL path)
- Iterate all edges in Tiers 1 and 2 instead of only the first result
- Rank Tier 3 accounts by contact count and fallback to next on field rule failure
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(salesforce): add field rule routing trace steps
Add trace calls alongside field rule info logs for routing visibility:
- fieldRulesValidated: records validation result in CrmService
- fieldRuleFilteredRecord: records when account is filtered at each tier
- fieldRuleEvaluated: records individual rule evaluation details
- allRecordsFilteredByFieldRules: records when SOQL records are all filtered
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(salesforce): remove duplicate field validation and fix disabled Select options
applyFieldRules now receives pre-validated rules from the early
validation block instead of re-validating internally. Also adds
the missing options prop to the disabled Select in the field rules UI.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(salesforce): include failed rule details in field rule trace steps
Rename passesFieldRules to getFailingFieldRule so the caller receives
the specific rule that caused filtering. The fieldRuleFilteredRecord
trace step now includes failedRule with field, value, and action.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(salesforce): add GraphQL path tests for field rules
Cover field rule filtering across all three GraphQL resolution tiers
(contact, account, related contacts) with ignore and must_include
actions, multi-edge fallback, case-insensitivity, and dynamic query
selection.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Abstract new field rules settings
* Reduce extra SOQL call
* fix(salesforce): fix type errors in CrmService and GraphQL client
- Add missing import for getRedisService from @calcom/features/di/containers/Redis
- Fix ensureFieldsExistOnObject to properly return Field[] instead of incomplete function
- Use Array.from() instead of spread operator for Set and Map iterators to fix downlevelIteration errors
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 23:03:19 -05:00
Peer RichelsenGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: move Booker hooks from packages/features to apps/web/modules
Migrate the following Booker hooks:
- useOverlayCalendar
- useSkipConfirmStep
- useInitializeWeekStart
- useIsQuickAvailabilityCheckFeatureEnabled
- useDecoyBooking
These hooks are only imported by apps/web files, making them safe to move
without creating circular dependencies.
Part of the tRPC-driven UI migration from packages/features to apps/web/modules.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: revert useIsQuickAvailabilityCheckFeatureEnabled move and fix import paths
- Reverted useIsQuickAvailabilityCheckFeatureEnabled.ts back to packages/features since it's imported by useSlots.ts in packages/features (would create circular dependency)
- Fixed import paths in useOverlayCalendar.ts to use @calcom/features paths
- Fixed import paths in useSkipConfirmStep.ts to use @calcom/features paths
- Updated Booker.tsx to import useIsQuickAvailabilityCheckFeatureEnabled from original location
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: use @calcom/web alias for hook imports to fix vitest resolution
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* refactor
* migrate more hooks
* fix
* mv types
* fix
* fix
* fix
* fix
* revert: remove formatting-only changes to make PR easier to review
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix
* fix
* fix
* revert: restore original import ordering in moved hooks
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix imports
* fix
* fix
* wip
* wip
* wip
* wip
* wip
* wip
* fix: add isBrowser guard to useSlotsViewOnSmallScreen hook
Address Cubic AI review feedback (confidence 9/10) by adding the isBrowser
guard to the useSlotsViewOnSmallScreen hook to follow the file's client-only
contract and avoid executing during SSR/prerendering.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-31 07:33:33 -03:00
Peer RichelsenGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
When the eligibility check returns "already_enabled", store this in
local storage to prevent repeated API calls on subsequent page loads.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: Add tooltip for disabled Cancel button on past bookings
Show a tooltip explaining "You cannot cancel a past booking" when hovering over the disabled Cancel dropdown item for bookings that have already occurred.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* refactor: Extract tooltip condition into named variable
Improves readability by extracting the tooltip open condition into a descriptive variable `showPastBookingCancelTooltip`.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
2026-01-30 14:07:24 +00:00
sean-brydonGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: TOUTOC in handleSeats
* fix type check
* refactor: replace Prisma include with select in integration tests
Address Cubic AI review feedback (confidence 9/10) to use select instead
of include in Prisma queries to limit returned fields and avoid pulling
full related records.
Co-Authored-By: unknown <>
* fix seat count
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Add menuPlacement="bottom" to the reason Select in the OOO modal
to ensure dropdown opens downwards consistently with other selects.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 13:27:52 +00:00
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The previous implementation relied on the hosts array returned from
findTeamEventTypes, which is limited to 5 hosts for display purposes.
This caused the 'Assigned' badge to not show for users who were hosts
but not in the first 5 returned by the query.
This fix queries the Host table directly with a single batch query to
get all event type IDs where the current user is a host, ensuring the
badge shows correctly regardless of how many hosts an event type has.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: ali@cal.com <ali@cal.com>
Adds encrypted credential storage using a new keyring system:
- New `encryptedKey` column with AES-256-GCM encryption
- Decryption in getCalendarsEvents with fallback to legacy `key`
- buildCredentialCreateData service for credential creation
- Phase 1: Google Calendar only, other integrations follow
2026-01-30 09:15:13 -03:00
Hariom BalharaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(companion): add dark mode support using NativeWind system preference
- Set userInterfaceStyle to 'automatic' in app.json to follow system preference
- Add useColorScheme hook from NativeWind to detect color scheme
- Update root layout with dynamic colors for StatusBar, containers, and modals
- Update tabs layout with dynamic colors for tab bar and icons
- Update all Stack.Screen options to use dynamic background colors and blur effects
- Support both iOS and Android with appropriate dark mode colors
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix(companion): use NativeWind dark: variant classes for automatic dark mode
Use dark: Tailwind variant classes instead of conditional logic based on
useColorScheme for the container background. This ensures NativeWind
automatically applies dark mode styles based on system preference.
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix(companion): use darkMode 'media' for automatic dark mode detection
- Changed darkMode from 'class' to 'media' in tailwind.config.js
- Updated global.css to use @media (prefers-color-scheme: dark) instead of .dark selector
- This ensures NativeWind properly detects system color scheme on iOS/Android
Co-Authored-By: peer@cal.com <peer@cal.com>
* dark mode starting
* feat(companion): add dark mode support to core infrastructure (Phase 1)
* feat(companion): add dark mode support to tab pages (Phase 2)
* fix(companion): add dark mode support to booking list components for font visibility
* fix(companion): add dark mode support to EventTypeListItem components
* event types and bookings page
* Availability list page
* more page, and some ui fixes
* feat(companion): add dark mode support to detail screens and modals
- BookingDetailScreen (iOS & Android): dynamic colors for all UI elements
- AvailabilityDetailScreen (iOS & Android): dark mode backgrounds and text
- profile-sheet (iOS & Android): dark mode support for profile modal
- RescheduleScreen (all platforms): dark mode for date/time pickers
- EditLocationScreen (iOS & Android): dark mode for location editor
- AddGuestsScreen: partial dark mode implementation (in progress)
Uses iOS system colors: #000000 (black), #1C1C1E (secondary), #FFFFFF (white), #38383A (border), #8E8E93 (text secondary)
* fix typecheck and lint
* feat(companion): add dark mode support to remaining screens
- ScreenWrapper: Fix hardcoded #800020 color with dynamic destructive color
- EditAvailabilityDayScreen: Add dark mode for Android/Web and iOS
- EditAvailabilityHoursScreen: Add dark mode for Android/Web and iOS
- EditAvailabilityNameScreen: Add dark mode for Android/Web and iOS
- EditAvailabilityOverrideScreen: Add dark mode for Web, iOS, and Android
- MarkNoShowScreen: Add dark mode with dynamic colors for no-show states
- MeetingSessionDetailsScreen: Add dark mode for session details
- ViewRecordingsScreen: Add dark mode for recordings list
Uses iOS system colors (#000000, #1C1C1E, #38383A, #8E8E93) and
useColorScheme hook for automatic theme detection.
* fix(companion): fix iOS modal dark mode backgrounds for transparent glass UI
* fix(companion): fix dark mode for booking action screens in transparent background mode
* fix(companion): fix Android dark mode for transparent background in EditAvailabilityOverrideScreen
* refactor(companion): centralize dark mode colors and align with main website
- Update tailwind.config.js with centralized color definitions
- Create constants/colors.ts for inline style color references
- Replace iOS system colors with main website neutral grays:
- #1C1C1E -> #171717 (secondary dark background)
- #38383A -> #4D4D4D (dark border)
- #8E8E93 -> #A3A3A3 (secondary text dark)
- Keep pure black (#000000) for main backgrounds (OLED friendly)
- Add semantic color mappings for consistent UI styling
* feat(companion): complete dark mode implementation across all priority files
- Priority 1: Updated SettingsUI.tsx, BasicsTab.tsx, LimitsTab.tsx, AdvancedTab.tsx, RecurringTab.tsx, AvailabilityTab.tsx, event-type-detail.tsx
- Priority 2: Updated edit-availability-hours/name/override/day.tsx, oauth/callback.tsx
- Priority 3: Updated AvailabilityListScreen.tsx with dark mode for modals and list items
- Priority 4: Updated BookingActionsModal.tsx, BookingActionsModal.ios.tsx, GlassModalHeader.tsx, LoginScreen.tsx, LocationsList.tsx, SearchHeader.tsx, toast.tsx
Dark mode colors used:
- Main bg: #000000 (cal.bg.dark)
- Secondary bg: #171717 (cal.bg.secondaryDark)
- Muted bg: #262626 (cal.bg.mutedDark)
- Borders: #4D4D4D (cal.border.dark)
- Secondary text: #A3A3A3 (cal.text.secondaryDark)
* fix(companion): add dark mode support to iOS header, GlassView modals, and main content background
* fix(companion): add dark mode support to toggle/switch components
* fix(companion): use iOS green (#34C759) for toggle ON state in dark mode
* fix(companion): use white track + black thumb for dark mode toggles
* fix(companion): add dark mode support to login page logo and button
* dark mode to many pages, centralize the colors
* dark mode skelaton
* Availability pages android
* toggles
* headers
* red color for dark mode
* copy button
* white flash on bottom ui native ios sheet
* bottom sheet buttons
* bottom sheet in gray color
* bottom sheet again.. yeahh
* toggle green
* toggle green
* fix lint and typechecks
* fix exntension error
* Update companion/components/event-type-detail/tabs/LimitsTabDatePicker.android.tsx
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* address cubic comments
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: peer@cal.com <peer@cal.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix: allow wildcard prefix in normalizeDomain function
The normalizeDomain function now accepts domains with *. prefix
(e.g., *.cal.com) for wildcard domain matching in the watchlist.
The domain part after *. is validated using the existing regex.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: allow wildcard domains in validation checks
Update WatchlistOperationsService and CreateBlocklistEntryModal to
accept wildcard domain prefixes (*.) in domain validation. This ensures
wildcard domains like *.cal.com can be added through both the API and UI.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Remove 7 environment variables no longer referenced in the codebase:
- NEXT_PUBLIC_CONSOLE_URL
- NEXT_PUBLIC_STRIPE_PRICING_TABLE_PUBLISHABLE_KEY
- NEXT_PUBLIC_PLAIN_CHAT_EXCLUDED_PATHS
- NEXT_PUBLIC_VERCEL_ENV
- NEXT_PUBLIC_VERCEL_BRANCH_URL
- PRISMA_FIELD_ENCRYPTION_KEY
- PRISMA_GENERATE_DATAPROXY
Deduplicate 6 entries that appeared twice in globalEnv:
- CALCOM_CREDENTIAL_SYNC_SECRET
- INTERCOM_SECRET
- NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED
- ORG_MONTHLY_CREDITS
- STRIPE_ORG_PRODUCT_ID
- VAPID_PRIVATE_KEY
Also removes the unused vars from .env.example.
Reduces globalEnv from 321 to 308 entries, lowering the surface
for unnecessary Turbo cache invalidation.
2026-01-29 21:27:22 -03:00
Alex van AndelGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add wildcard domain matching to watchlist
When a domain is blocked in the watchlist (e.g., cal.com), all subdomains
are now also blocked (e.g., app.cal.com, sub.app.cal.com).
Changes:
- Add getParentDomains() utility to extract all parent domains
- Update GlobalBlockingService.isBlocked() and areBlocked() for wildcard matching
- Update OrganizationBlockingService.isBlocked() and areBlocked() for wildcard matching
- Add comprehensive tests for wildcard domain matching
- More specific subdomain matches take precedence over parent domain matches
- Email matches still take precedence over domain matches
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* feat: make wildcard domain matching configurable
- *.cal.com blocks all subdomains (app.cal.com, sub.app.cal.com, etc.)
- cal.com only blocks exact matches (not subdomains)
- Updated getWildcardPatternsForDomain to generate wildcard patterns
- Added domainMatchesWatchlistEntry for configurable matching logic
- Updated GlobalBlockingService and OrganizationBlockingService
- Updated tests to verify new behavior
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* refactor: simplify wildcard pattern generation to strip only first part
- Only strips the first part before the first dot
- Handles multi-part TLDs correctly (e.g., .co.uk)
- Returns empty array for two-part domains (e.g., cal.com -> no pattern)
- app.cal.com -> *.cal.com
- bloody-hell.cal.co.uk -> *.cal.co.uk
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-29 23:59:51 +00:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: Add routing trace presenters
Add domain-specific presenters (SalesforceRoutingTracePresenter,
RoutingFormTracePresenter) that format trace steps into human-readable
strings, and a core RoutingTracePresenter that delegates to them based
on step domain. Includes unit tests for all presenters.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: Add findByBookingUid to RoutingTraceRepository
Add method to look up a routing trace by booking UID, needed by the
routing trace presenter tRPC endpoint.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: Add getRoutingTrace tRPC endpoint
Expose routing trace data for a booking via viewer.bookings.getRoutingTrace.
Tries the permanent RoutingTrace first (round robin bookings), then falls
back to PendingRoutingTrace via the booking's form response relation.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: Add routing trace side sheet to booking list item
Add a route icon button on booking list items that came from routing
forms. Clicking it opens a side sheet displaying the full routing trace
as human-readable steps. Adds RoutingTraceSheet component, store state,
and translation key.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: Move routing trace action to dropdown menu
Move the routing trace button from a standalone icon on the booking list
item into the actions dropdown menu alongside "Report wrong assignment".
The RoutingTraceSheet is now rendered from BookingActionsDropdown.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: Improve routing trace UI and handle unnamed routes
- Redesign RoutingTraceSheet with vertical timeline layout, domain badges,
skeleton loading state, and millisecond timestamps
- Use Salesforce app-store icon for Salesforce steps
- Fall back to "Unnamed route" when route name is missing or matches route ID
- Fix dropdown menu icon to git-merge (valid icon, unique in menu)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: Add tests for getRoutingTrace handler and findByBookingUid repository method
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Abstract functions
* Fix build error
* Add permission check
* fix: Update getRoutingTrace tests to include ctx and mock BookingAccessService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## What does this PR do?
Replaces direct instantiation of `FeaturesRepository` with the dependency-injected version using `getFeaturesRepository()` from the DI container in the feature flags router.
**Key improvement:** The DI-ed version uses Redis caching, replacing the previous in-memory 5-minute cache implementation which was not ideal. This follows the established DI pattern in the codebase for loose coupling, better testability, and more robust caching across instances.
## Type of change
- [x] Refactor (non-breaking change that improves code quality)
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed.
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works.
## How should this be tested?
1. Verify feature flags functionality works as expected:
- Feature flag list endpoint should return all features
- Team feature check should work correctly
2. No environment variables needed beyond standard setup
## Checklist
- [x] My code follows the style guidelines of this project
- [x] I have checked if my changes generate no new warnings
## Human Review Checklist
- [ ] Verify `getFeaturesRepository()` returns a properly configured instance from the DI container
- [ ] Confirm the DI container properly injects the Prisma client
- [ ] Verify Redis caching is working as expected for feature flag data
---
**Link to Devin run:** https://app.devin.ai/sessions/2ff6e4551c8649e4b6178b31a2195327
**Requested by:** @eunjae-lee
* feat: Add infrastructure for no-show audit integration
- Add Prisma migrations for SYSTEM source and NO_SHOW_UPDATED audit action
- Add NoShowUpdatedAuditActionService with array-based attendeesNoShow schema
- Update BookingAuditActionServiceRegistry to include NO_SHOW_UPDATED
- Update BookingAuditTaskConsumer and BookingAuditViewerService
- Add AttendeeRepository methods for no-show queries
- Update IAuditActionService interface with values array support
- Update locales with no-show audit translation keys
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Add NO_SHOW_UPDATED to BookingAuditAction and SYSTEM to ActionSource types
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Remove HOST_NO_SHOW_UPDATED and ATTENDEE_NO_SHOW_UPDATED from BookingAuditAction type to match Prisma schema
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update BookingAuditActionSchema to use NO_SHOW_UPDATED instead of HOST_NO_SHOW_UPDATED and ATTENDEE_NO_SHOW_UPDATED
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: Remove deprecated no-show audit services and unify to NoShowUpdatedAuditActionService
- Delete HostNoShowUpdatedAuditActionService and AttendeeNoShowUpdatedAuditActionService
- Update BookingAuditProducerService.interface.ts to use queueNoShowUpdatedAudit
- Update BookingAuditTaskerProducerService.ts to use queueNoShowUpdatedAudit
- Update BookingEventHandlerService.ts to use onNoShowUpdated
- Add integration tests for NoShowUpdatedAuditActionService
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Add data migration step for deprecated no-show enum values
Addresses Cubic AI review feedback (confidence 9/10): The migration now
includes an UPDATE statement to convert existing records using the
deprecated 'host_no_show_updated' or 'attendee_no_show_updated' enum
values to the new unified 'no_show_updated' value before the type cast.
This prevents migration failures if any existing data uses the old values.
Co-Authored-By: unknown <>
* fix: Use CASE expression in USING clause for enum migration
Fixes PostgreSQL error 'unsafe use of new value of enum type' by avoiding
the ADD VALUE statement and instead using a CASE expression in the ALTER
TABLE USING clause to convert deprecated enum values (host_no_show_updated,
attendee_no_show_updated) to the new unified value (no_show_updated) during
the type conversion.
Co-Authored-By: unknown <>
* fix: Replace hardcoded color with semantic text-success class
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Remove color class completely from display fields
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-29 08:47:26 -03:00
Syed Ali ShahbazGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: implement webhook tasker with async/sync fallback
This PR implements a webhook tasker with async/sync fallback architecture
to fix failing E2E tests. The solution follows the existing proration
tasker pattern and uses Dependency Injection with @evyweb/ioctopus.
Key changes:
- Create IWebhookTasker interface for webhook delivery
- Implement WebhookSyncTasker for immediate execution (E2E tests)
- Implement WebhookAsyncTasker for queued execution (production)
- Create main WebhookTasker class extending Tasker<IWebhookTasker>
- Add DI modules and tokens for all tasker components
- Update WebhookTaskerProducerService to use new WebhookTasker
- Add unit tests for sync and async taskers
The ENABLE_ASYNC_TASKER flag automatically selects the appropriate mode:
- Production: Uses WebhookAsyncTasker to queue tasks
- E2E Tests: Uses WebhookSyncTasker for immediate execution
This ensures webhooks are delivered immediately in E2E tests without
requiring the cron job that processes queued tasks.
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* fix: update WebhookTaskerProducerService tests for new interface
Update tests to use the new deps-based constructor and
mockWebhookTasker.deliverWebhook instead of mockTasker.create
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* fix: use moduleLoader pattern for WebhookProducerService in container
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* refactor: replace InternalTasker with Trigger.dev for webhook delivery
This commit refactors the WebhookTasker to use Trigger.dev instead of
InternalTasker, following the pattern established in BookingEmailAndSmsTasker
and PlatformOrganizationBillingTasker (PR #26803).
Changes:
- Replace WebhookAsyncTasker with WebhookTriggerTasker that uses trigger.dev
- Create trigger.dev task files (deliver-webhook.ts, config.ts, schema.ts)
- Update DI modules to use WebhookTriggerTasker
- Remove old InternalTasker-based implementation
- Update unit tests for new implementation
The WebhookSyncTasker continues to execute webhooks immediately for E2E tests
where ENABLE_ASYNC_TASKER is automatically false.
Co-Authored-By: ali@cal.com <alishahbaz7@gmail.com>
* fix: update comments to reflect Trigger.dev usage instead of InternalTasker
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add invoice URL to proration and test seed scripts
- Add invoiceUrl field to MonthlyProration schema
- Update billing service to return hosted_invoice_url after finalizing
- Save invoice URL when creating proration invoices
- Add seed script for testing proration with real Stripe data
- Add cleanup script for test data removal
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add due invoice banner and invitation blocking for orgs
- Add DueInvoiceBanner component showing overdue prorations
- Add DueInvoiceService for checking blocking status and banner data
- Block invitations when proration invoices are 7+ days overdue
- Allow sub-team invites for existing org members (exception)
- Show banner to users with billing management permissions
- Link directly to Stripe invoice URL when available
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: set subscriptionId in team metadata in seed script
The seed script was not setting subscriptionId on the team metadata,
causing checkIfOrgNeedsUpgrade to treat the org as needing upgrade
and showing the "trialing" banner.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* push trigger test to script
* fix mocks
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: preserve UI config across iframe resets for element-click embeds
For element-click embeds, ui() is called before the iframe exists, and
iframeReset() clears the queue when the modal is opened. This causes UI
config like hideEventTypeDetails, cssVarsPerTheme, and styles to be lost.
This fix stores UI config in a persistent property that survives iframe
resets and applies it when the iframe becomes ready.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* test: add assertion to verify hideEventTypeDetails config is applied in element-click embed
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Add mergeUiConfig function and related tests for UI configuration merging
- Introduced mergeUiConfig function to handle merging of UI configuration, specifically for cssVarsPerTheme at theme level.
- Added comprehensive tests for mergeUiConfig covering various scenarios including merging themes, handling missing properties, and preserving existing configuration values.
- Updated utils.test.ts to include tests for the new function and ensure correct behavior in different merging situations.
* Fixes
* Remove process import as it breaks embed.js
* Simplify
* fix name
* fix name
* fix: use forEach instead of for...of for URLSearchParams iteration
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
* feat: add organization.passwordReset PBAC permission
Allow org admins/owners to reset passwords for members of their
organization via a new PBAC permission. Previously this was only
available to system-level admins.
- Add PasswordReset to CustomAction enum and PERMISSION_REGISTRY
- Create migration to grant permission to admin_role (owner has wildcard)
- Add org-scoped tRPC endpoint using createOrgPbacProcedure
- Handler validates org membership, prevents self-targeting, and blocks
resetting owner passwords
- Wire permission through MemberPermissions, getOrgMembersPageData, and
the org members table UI dropdown
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use targeted select in org password reset to avoid over-fetching
Replace findById with findForPasswordReset repository method that only
selects email, name, and locale instead of the full userSelect which
includes sensitive fields like twoFactorSecret and backupCodes.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add unit tests for sendPasswordReset handler
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 11:18:02 +00:00
sean-brydonGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## What does this PR do?
Adds a `displayLocations` property to the `OptInFeatureConfig` interface to control where opt-in features are displayed (settings page, banner, or both), and applies this filtering at the callers' side.
## How to test locally
```
update "Feature" set enabled = true where slug='bookings-v3';
```
Run it to globally enable the flag, and then go to the settings page to see the "Features" menu.
---
**Changes:**
- Added `OptInFeatureDisplayLocation` type with values `"settings"` | `"banner"`
- Added optional `displayLocations` property to `OptInFeatureConfig` interface
- Added helper functions:
- `getFeatureDisplayLocations()` - returns display locations with default of `['settings']`
- `shouldDisplayFeatureAt()` - checks if a feature should display at a specific location
- `getOptInFeaturesForLocation()` - filters features by location
- Updated `getOptInFeaturesForScope()` to accept an optional `displayLocation` parameter for filtering
- Simplified `HAS_*_OPT_IN_FEATURES` constants to use `getOptInFeaturesForScope(scope, "settings").length > 0`
- Updated `FeatureOptInService.listFeaturesForUser()` to filter by 'settings' location
- Updated `FeatureOptInService.listFeaturesForTeam()` to filter by 'settings' location
- Updated `useFeatureOptInBanner` hook to check for 'banner' location before showing
**Default behavior:** If `displayLocations` is omitted, features default to `['settings']` only.
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - internal config change only.
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works.
## How should this be tested?
1. Verify the helper functions work as expected:
- `getFeatureDisplayLocations({ slug: "test", ... })` should return `["settings"]` (default)
- `getFeatureDisplayLocations({ slug: "test", displayLocations: ["banner"] })` should return `["banner"]`
- `shouldDisplayFeatureAt(feature, "settings")` should return `true` for features without `displayLocations`
- `getOptInFeaturesForScope("user", "banner")` should only return user-scoped features with `"banner"` in their `displayLocations`
2. Verify caller-side filtering:
- `listFeaturesForUser()` and `listFeaturesForTeam()` should only return features with 'settings' in displayLocations
- Banner hook should only show features with 'banner' in displayLocations
- `HAS_*_OPT_IN_FEATURES` constants should only be true if there are features with 'settings' location
## Checklist
- [x] My code follows the style guidelines of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] My changes generate no new warnings
---
### Human Review Checklist
- [ ] Verify the default behavior (defaulting to `['settings']`) matches requirements
- [ ] Confirm the filtering logic is applied correctly in all callers (service methods, banner hook, constants)
- [ ] Verify the banner hook correctly prevents showing features without 'banner' in displayLocations
- [ ] Note: The test mock returns all features regardless of `displayLocation` parameter - the filtering logic in `getOptInFeaturesForScope` isn't directly tested. Consider if this is acceptable or if tests should be added.
**Link to Devin run:** https://app.devin.ai/sessions/a064ee43a56d458caf2892b55959f1ea
**Requested by:** @eunjae-lee
2026-01-29 10:17:50 +01:00
Hariom BalharaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: exclude third-party video apps from areCalendarEventsEnabled setting
When areCalendarEventsEnabled is false, video meeting creation for third-party
video apps (like Daily.co) was being skipped, causing the meetingUrl field in
webhook payloads to contain the location identifier (integrations:daily) instead
of the actual video meeting URL.
This fix adds a skipCalendarEvent option to EventManager.create() that:
- Skips calendar event creation when true
- Skips CRM event creation when true (CRM events are tied to calendar events)
- Still creates video meetings for third-party video apps
The calling code in handleConfirmation.ts and RegularBookingService.ts now uses
this option when areCalendarEventsEnabled is false, ensuring video meetings are
still created while respecting the platform customer's preference to manage
their own calendar events.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* test: update E2E tests to verify skipCalendarEvent option is passed when areCalendarEventsEnabled is false
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: address PR review feedback - remove comments and update E2E tests to spy on createAllCalendarEvents
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* test: add spy for createAllCRMEvents in e2e tests when areCalendarEventsEnabled is false
Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>
* test: add missing spy for createAllCRMEvents in beforeEach hook
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: use videoCallUrl from metadata for webhook payload location
Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>
* fix: simplify webhook location to use metadata?.videoCallUrl || evt.location
Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>
* docs: add description about video call link limitations when calendar events disabled
Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>
* i18n: add translation key for calendar events disabled video limitation
Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>
* fix: update translation text to accurately reflect video app behavior
Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>
* Update common.json
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Lauris Skraucis <lauris.skraucis@gmail.com>
2026-01-29 10:23:52 +02:00
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## What does this PR do?
Updates the embed lifecycle documentation to clarify that `bookerReopened` and `bookerReloaded` events are only applicable for prerendered modals that are now visible.
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - this PR is itself a documentation update.
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A - documentation only change.
## How should this be tested?
This is a documentation-only change. Review the accuracy of the added "Applicability" notes for both events.
## Checklist
- [x] I have read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
- [x] My code follows the style guidelines of this project
- [x] I have checked if my changes generate no new warnings
---
### Reviewer Checklist
- [ ] Verify that the documentation accurately reflects when `bookerReopened` and `bookerReloaded` events fire (only for prerendered modals)
---
> [!NOTE]
> **Link to Devin run**: https://app.devin.ai/sessions/35a0c5d4d5fc4feb9a5af2d8d340b9c5
> **Requested by**: @hariombalhara
2026-01-29 10:13:58 +05:30
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: join teams with feature enabled directly in findNextSubscriptionBatch query
- Changed findNextSubscriptionBatch to accept featureId instead of teamIds
- Join TeamFeatures table directly in the query instead of separate queries
- Updated CalendarSubscriptionService.checkForNewSubscriptions to pass featureId
- Removed separate getTeamsWithFeatureEnabled call
- Updated tests to reflect the new query structure
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: change featureId to featureIds array for flexibility
- Changed findNextSubscriptionBatch to accept featureIds array instead of single featureId
- Updated Prisma query to use 'in' operator for multiple feature IDs
- Updated CalendarSubscriptionService to pass array with single feature
- Updated all tests to use featureIds array
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-28 17:52:00 -03:00
Alex van AndelGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Add DB schema
* Init zod schema
* Init RoutingTrace and PendingRoutingTrace repository interfaces
* Create PrismaPendingRoutingTraceRepository
* Init RoutingTraceService
* Create RoutingTraceService container
* User routing trace service in routing
* Create RoutingTraceRepository and PrismaRoutingTraceRepoistory
* Add findByFormResponseId and findByQueuedFormResponseId to PendingRoutingTraceRepository
* Update DI containers
* RoutingTraceService create process booking method
* Use pending routing trace rather than URL params
* Fix schema
* Fix writing assignment reason for routed booking
* Remove from service
* Refactor RoutingTraceService to not rely on async local storage
* Pass RoutingTraceService through routing call
* Add attribute-logic-evaluated to routing trace step
* Add routing trace to trpc endpoint
* Add CRM routing trace step
* Fix extracting routing trace to assignment reason
* Add back CRM params to prevent refetching
* test: Add unit tests for RoutingTraceService and repositories
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* test: Add missing mock for RoutingTraceService in getRoutedUrl tests
Also fix pre-existing lint issues in the test file:
- Add explicit types to mockForm and mockSerializableForm variables
- Add explicit type to url parameter in mockContext
- Replace 'as any' with 'as unknown as InstanceType<typeof UserRepository>'
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Link pending form submission to routing trace
* Clean up
* Add lookup field assignment reasons
* Rename to PendingRoutingTrace
* Add migration file
* fix: Update RoutingTraceService tests to use assignmentReasonRepository mock
- Add getStepsCount() method back to RoutingTraceService
- Add queuedFormResponseId support to processForBooking method
- Update tests to use mockAssignmentReasonRepository instead of prisma mock
- Remove test for missing routingTraceRepository (all deps now required)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: Remove PII (organizer email) from log payload in RoutingTraceService
Addresses Cubic AI review feedback with confidence 9/10.
Logging PII violates sensitive information logging rules.
Co-Authored-By: unknown <>
* Write field values at the time of routing
* Write attributes used to route
* feat: add CRM routing trace service
Add CrmRoutingTraceService as a reusable wrapper around RoutingTraceService
for CRM-specific tracing. Also adds CrmRoutingTraceServiceInterface type
to support passing trace services through the CRM call chain.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add Salesforce routing trace infrastructure
Add SalesforceRoutingTrace static class with 19 trace methods covering:
- Account resolution (SOQL path): searching by website, contact domain
- Lookup field queries
- Owner lookups (contact, lead, account)
- Validation and skip scenarios
- GraphQL three-tier resolution
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: wire CRM trace service through call chain
Pass crmTrace parameter through the CRM call chain:
- routerGetCrmContactOwnerEmail creates CrmRoutingTraceService
- Passes to app booking form handlers and CRM round robin skip
- CrmManager.getContacts accepts and forwards crmTrace
- All handlers accept optional crmTrace parameter
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add trace instrumentation to Salesforce CRM service
Instrument Salesforce CRM methods with routing trace steps:
- getContacts: trace owner lookups for contact/lead/account
- getAccountIdBasedOnEmailDomainOfContacts: trace website and domain searches
- findUserEmailFromLookupField: trace lookup field queries
- GetAccountRecordsForRRSkip (GraphQL): trace three-tier resolution
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: rename SalesforceRoutingTrace to SalesforceRoutingTraceService
Consistent naming with CrmRoutingTraceService.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add unit tests for CrmRoutingTraceService and SalesforceRoutingTraceService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: use AsyncLocalStorage for CRM routing trace
Replace explicit crmTrace parameter passing with AsyncLocalStorage:
- Add AsyncLocalStorage to RoutingTraceService with getCurrent() and runAsync()
- Update SalesforceRoutingTraceService to auto-resolve trace from AsyncLocalStorage
- Remove CrmRoutingTraceService wrapper (no longer needed)
- Remove crmTrace parameter from all CRM method signatures
- Wrap CRM operations in routingTraceService.runAsync() context
This is cleaner than threading crmTrace through 5+ function layers.
The trace context is available within the withReporting wrapper.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Use async local storage for `CrmRoutingTraceService`
* fix: correct template literal syntax in RoutingTraceService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: use narrowed eventTypeId variable in nested async function
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: update SalesforceRoutingTraceService tests to use AsyncLocalStorage API
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: rename crmTrace to crmRoutingTraceService for consistency
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Volnei Munhoz <volnei@cal.com>
