* fix: invalidate old password reset tokens when new one is requested
Security fix: Previously, old password reset tokens remained valid
even after requesting a new one, creating a potential account takeover
vulnerability. This change ensures that when a user requests a new
password reset link, all previous valid tokens for that email are
immediately invalidated.
Changes:
- Expire all existing valid tokens before creating new one
- Add E2E test to verify old tokens are invalidated
- Prevent potential account takeover scenario
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Clean up code by removing blank line
Removed unnecessary blank line in forgot-password.e2e.ts.
* test: fix strict mode violation in password reset test
Use getByRole to specifically target the heading element instead of
text locator which was matching both the heading and button.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: CSRF protect forgot-password functionality
* feat: implement conditional sameSite cookie setting for CSRF tokens
- Use WEBAPP_URL to determine secure cookie settings
- Set sameSite to 'none' for HTTPS environments to support cross-origin scenarios
- Fall back to 'lax' for HTTP development environments
- Follows patterns from PRs #23439 and #23556
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* update
* change
* NIT
* minor
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: unknown <adhabal2002@gmail.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
* perf: Slim down loggedInViewer tRPC router
* Fixed trpc client calls for new routes
* Moved bookingUnconfirmedCount
* Moved getUserTopBanners to me router
* Moved shouldVerifyEmail to me router
* Moved i18n from public to its own router
* fix ssrInit
* fix ssrInit usage
* fix type check
* better naming
* fix
* fix
* Fix types
* Removed used of importHandler
---------
Co-authored-by: hbjORbj <sldisek783@gmail.com>
* Replace the ui login with api login
* test api login
* go to first page after login in some tests
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* [CAL-1517] fix all Typescript warnings
* solve conflicts
* Update stripeCheckoutSession.handler.ts
Parse is a guard, so even though the variable is unused the parse itself is needed.
* Update ToolbarPlugin.tsx
Don't change dependency tree
---------
Co-authored-by: gitstart-calcom <gitstart@users.noreply.github.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
