* fix(auth): add URL validation for organization logo fields
- Add URL validation utility for server-side fetched URLs
- Validate logo URLs in tRPC organization schema
- Validate logo URLs in API v2 team DTOs
- Add graceful fallback in logo route for invalid URLs
- Only allow HTTPS and image data URLs
- Add unit tests for URL validation
* fix: add missing IP range and type validation
- Add RFC 6598 CGNAT range (100.64.0.0/10) to blocked IPs
- Add @IsString() decorator before custom URL validators
- Add boundary tests for new IP range
* fix: address review feedback
- Export validateUrlForSSRFSync via @calcom/platform-libraries
- Fix nullable/optional order in Zod schema
* fix: block localhost hostname and explicit null check
- Add localhost to BLOCKED_HOSTNAMES for sync validation
- Use explicit null check (url == null) instead of falsy check
* fix: allow empty string in URL validation
* refactor: extract shared validation logic
- Extract validateUrlCore() to eliminate duplication between sync/async versions
- Add JSDoc to all exported functions for better discoverability
- Remove redundant comments that repeated function names
- Simplify existing comments to be more concise
* fix: reject empty strings in URL validator
Previously if (!url) allowed empty strings to bypass validation.
Now explicitly checks for null/undefined only
* version and verify-booking-token
* username route
* api/me
* logo route
* render email in dev
* link route
* future
* nope and geo location
* referal link and daily
* intercom route and dynamic variables
* intercom route and dynamic variables
* scim 2.0 and helpscout route
* app credentials
* api/book events
* fix daily import path in tests
* fix buildLegacyRequest generation
* fix type errors
* migrate the /teams/ routes
* move cron jobs
* fix daily import path in tests
* fix buildLegacyRequest generation
* fix type errors
* migrate the /teams/ routes
* move cron jobs
* Revert "api/book events"
This reverts commit 607a32fb5b754cad090c2d0cbf64a68f990e220e.
* mock next server NextResponse to fix daily video
* add default responder to teams api
* fix search params
* uses nextUrl.searchParams instead of new url
* uses nextUrl.searchParams instead of new url
* remove outdated api config
* remove app dir version of inbound dynamic variables
* restore pages version of inbound variables
* fix missing code from stupid cursor
---------
Co-authored-by: Benny Joo <sldisek783@gmail.com>
