* feat: enable onboarding-v3 globally and update e2e tests
- Add migration to set onboarding-v3 feature flag enabled=true
- Rewrite onboarding.e2e.ts for v3 flow (Plan Selection → Personal Settings → Calendar)
- Update URL assertions in signup, team-invitation, org-invitation, ab-tests-redirect, and auth tests to accept both old and new onboarding paths
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: use pathname-only matching in waitForURL to prevent false matches on callbackUrl query param
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* use test IDs
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
* Revert "Revert "feat: redesign team creation flow to match onboarding-v3 design (#26733)""
This re-applies the team creation redesign from PR #26733 which was
previously reverted. Cherry-picked from 2540423ba3.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: check org/username slug when in org context
* fix: use expect(page).toHaveURL() instead of page.waitForURL() in team e2e test
Co-Authored-By: unknown <>
* fix: redirect URL
* fix: flag import
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: redesign team creation flow to match onboarding-v3 design
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* feat: skip invite options and go directly to email invite step
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* feat: invalidate teams query on submit to refresh teams list
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: use server action to invalidate server-side teams cache
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: conditionally render avatar in browser view to remove extra padding
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix browser view
* test: update team creation E2E tests to use new onboarding-v3 flow
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* test: update auth-index.e2e.ts to use new team creation flow
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* test: update team-management.e2e.ts to use new team creation flow
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: add error handling for createTeam and improve CSV parsing for quoted fields
Co-Authored-By: sean@cal.com <Sean@brydon.io>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: invalidate old password reset tokens when new one is requested
Security fix: Previously, old password reset tokens remained valid
even after requesting a new one, creating a potential account takeover
vulnerability. This change ensures that when a user requests a new
password reset link, all previous valid tokens for that email are
immediately invalidated.
Changes:
- Expire all existing valid tokens before creating new one
- Add E2E test to verify old tokens are invalidated
- Prevent potential account takeover scenario
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Clean up code by removing blank line
Removed unnecessary blank line in forgot-password.e2e.ts.
* test: fix strict mode violation in password reset test
Use getByRole to specifically target the heading element instead of
text locator which was matching both the heading and button.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: CSRF protect forgot-password functionality
* feat: implement conditional sameSite cookie setting for CSRF tokens
- Use WEBAPP_URL to determine secure cookie settings
- Set sameSite to 'none' for HTTPS environments to support cross-origin scenarios
- Fall back to 'lax' for HTTP development environments
- Follows patterns from PRs #23439 and #23556
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* update
* change
* NIT
* minor
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: unknown <adhabal2002@gmail.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
* perf: Slim down loggedInViewer tRPC router
* Fixed trpc client calls for new routes
* Moved bookingUnconfirmedCount
* Moved getUserTopBanners to me router
* Moved shouldVerifyEmail to me router
* Moved i18n from public to its own router
* fix ssrInit
* fix ssrInit usage
* fix type check
* better naming
* fix
* fix
* Fix types
* Removed used of importHandler
---------
Co-authored-by: hbjORbj <sldisek783@gmail.com>
Found via `codespell -q 3 -S "*.svg,./apps/web/public/static/locales,./packages/app-store/stripepayment/lib/currencyOptions.ts,./packages/lib/freeEmailDomainCheck/freeEmailDomains.ts" -L afterall,atleast,datea,fo,incase,ist,nam,noone,notin,optionel,perview,pris,reccuring`
* Replace the ui login with api login
* test api login
* go to first page after login in some tests
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* [CAL-1517] fix all Typescript warnings
* solve conflicts
* Update stripeCheckoutSession.handler.ts
Parse is a guard, so even though the variable is unused the parse itself is needed.
* Update ToolbarPlugin.tsx
Don't change dependency tree
---------
Co-authored-by: gitstart-calcom <gitstart@users.noreply.github.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
* Comment userv2Banner
* Fixed wipemycal test
* Fixed 'Delete my account' and WipeMyCal tests
* Fixed at least one test, need stripe for others.
* Disable embed tests for now
* Fixed console error due to illegal setState
* Hopefully fixed change-password functionality
* Partially implement new team flow
* Fix Change password test by setting a password with both capital and small letters
* recurring event text fix
* Fixed hash-my-url test
* Fixed event-types tests, done?
* fixing event type edit first event e2e
* Temp disable
Co-authored-by: Alan <alannnc@gmail.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
Co-authored-by: Leo Giovanetti <hello@leog.me>
* manual migration to rename verificationtoken, maybe it could be dropped and create a new table instead if we're not using it, will consult @zomars
* feat: rename verificationRequest --> verificationToken in schema.prisma
* fix: rename verificationRequest -> verificationToken in the codebase
* feat: add default cookies for next-auth
* fix: moves @lib/serverConfig to @calcom/lib so it can be called by website too
* fix: make self-certificate work in dev env by not rejecting tls in serverConfig
* fix verificationTokenToken typo
Co-authored-by: Omar López <zomars@me.com>
* Adds domain: .cal.com if not dev env in cookies
* Adds default-cookies to apps/web, and nextauth_domain to turbo website build deps"a
* update NEXTAUTH_DOMAIN to NEXTAUTH_COOKIE_DOMAIN
* Updates website submodule
* Removes deprecated env vars
* Consolidates auth logic in one place
* Updates website module
* Signup fixes
* Build fixes
* Updates example
* Updates example
* Fixes
* Fix Email Verification
* fix: move csrf-token cookiePrefix from __Host -> __Secure
* Removes console log
* Fixes link in email template
* Removed irrelevant coment
* Testing with a 32 bit secret
* Fixes for cookien in E2E
* E2E fixes
* Fixes Stripe tests locally
* Temp fix for E2E
Co-authored-by: Agusti Fernandez Pardo <git@agusti.me>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
Co-authored-by: Omar López <zomars@me.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
