* fix: add CSRF protection to OAuth callback via HMAC-signed nonce
The OAuth state parameter was used only for passing application data
(returnTo, teamId) with no cryptographic binding to the user session.
An attacker could authorize their own account on a provider, capture the
authorization code, and trick a logged-in user into visiting the callback
URL to link the attacker's account to the victim's Cal.com profile.
Changes:
- encodeOAuthState: generate a random nonce and HMAC-sign it with
NEXTAUTH_SECRET + userId, injecting both into the OAuth state
- decodeOAuthState: verify the HMAC on callback using timingSafeEqual;
skip verification when nonce is absent (backwards compatible with apps
that don't yet use encodeOAuthState)
- Stripe callback: replace raw state.returnTo redirect with
getSafeRedirectUrl to prevent open redirect, remove redundant
getReturnToValueFromQueryState, add missing return on access_denied
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make CSRF nonce verification mandatory with allowlist for exempt apps
Makes nonce/HMAC verification mandatory by default in decodeOAuthState,
preventing attackers from bypassing CSRF protection by omitting nonce
fields from the state parameter.
Apps not yet migrated to encodeOAuthState (stripe, basecamp3, dub,
webex, tandem) are explicitly allowlisted and pass their slug to
decodeOAuthState to skip verification.
Addresses review feedback (identified by cubic) about the conditional
check being trivially bypassable.
Co-Authored-By: unknown <>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-02-20 10:35:01 +00:00
Keith WilliamsGitHubkeith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* perf(app-store): convert services to factory functions to narrow SDK type exports
This change converts CRM, Calendar, Payment, and Analytics services from
exporting classes to exporting factory functions that return interface types.
This prevents SDK types (HubSpot, Stripe, etc.) from leaking into the type
system when TypeScript emits .d.ts files.
Services modified:
- CRM: hubspot, salesforce, closecom, pipedrive-crm, zoho-bigin, zohocrm
- Calendar: all 13 calendar services
- Payment: stripe, paypal, alby, btcpayserver, hitpay, mock-payment-app
- Analytics: dub
Video adapters were audited and already use factory pattern.
WIP: Salesforce CRM service has a type error that needs fixing.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(salesforce): add type assertion for appOptions in factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update remaining consumers to use factory functions
- getAnalytics.ts: call factory function instead of new
- getConnectedApps.ts: call factory function instead of new
- salesforce/CrmService.ts: fix type assertion with default value
- salesforce/routingForm/incompleteBookingAction.ts: use factory function
- salesforce/routingFormBookingFormHandler.ts: use factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(salesforce): add SalesforceCRM interface for Salesforce-specific methods
- Create SalesforceCRM interface extending CRM with findUserEmailFromLookupField and incompleteBookingWriteToRecord methods
- Add createSalesforceCrmServiceWithSalesforceType factory function for internal Salesforce modules
- Update routing form files to use the new factory function with proper typing
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(salesforce): correct return type in SalesforceCRM interface
The findUserEmailFromLookupField method returns { email: string; recordType: RoutingReasons } | undefined,
not string | undefined. Updated the interface to match the actual implementation.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update all call sites to use factory functions
- Update calendar API add files to use factory functions (7 files)
- Update Google Calendar test files to use factory functions (3 files)
- Update Salesforce test files to use SalesforceCRM interface
- Add testMode parameter to createSalesforceCrmServiceWithSalesforceType
- Remove unused @ts-expect-error directive in bookingScenario.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add GoogleCalendar interface and update factory functions for service-specific methods
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add type annotation to attendee parameter in google-calendar.e2e.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update selected-calendars/route.ts to use GoogleCalendar factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update remaining GoogleCalendarService call sites to use factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove explicit type annotation in google-calendar.e2e.ts to fix type error
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update test mocks to use factory function pattern for calendar and payment services
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: convert MockPaymentService to factory function in setupVitest.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(api-v2): call calendar service factory functions instead of using new
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* perf(trpc): add TypeScript project references to reduce build file count
- Add tsconfig.build.json to app-store with composite settings for declaration emit
- Add tsconfig.server.build.json to trpc with project references
- Add types and typesVersions to app-store package.json to redirect type resolution to dist-types
- Add build:types script to app-store for generating declarations
- Add dist-types to .gitignore
This reduces the tRPC build file count from 7,733 to 5,618 files (27% reduction)
by having TypeScript resolve to prebuilt .d.ts files instead of source files.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(app-store): add fallback to typesVersions for CI compatibility
The typesVersions now prefers dist-types but falls back to source files
when dist-types don't exist. This fixes CI type-check failures while
still allowing the optimization when dist-types are built.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Added build dependency for tRPC on app-store
* fix(app-store): exclude test directories from tsconfig.build.json
Exclude __tests__, __mocks__, and tests directories from the build
config to prevent test utility files (which import from outside rootDir)
from being included in the declaration emit.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(turbo): add build:types task definition for app-store
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(turbo): remove circular build dependency between trpc and app-store
The build:types task for app-store transitively imports from @calcom/features,
which imports from @calcom/trpc. This creates a circular build dependency when
@calcom/trpc#build depends on @calcom/app-store#build:types.
Solution: Remove the turbo dependency. The typesVersions fallback pattern
['./dist-types/*', './*'] will use source files when dist-types/ doesn't exist,
and use prebuilt declarations when they do exist (for faster builds).
Also exclude dist-types from regular tsconfig.json to prevent 'Cannot write file'
errors when dist-types/ exists.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor(app-store): rename dist-types to types for consistency
Rename the prebuilt TypeScript declarations folder from dist-types to types
to match the convention used by @calcom/trpc and other packages in the monorepo.
Updated files:
- tsconfig.build.json: declarationDir and exclude
- tsconfig.json: exclude
- package.json: typesVersions paths
- turbo.json: build:types outputs
- .gitignore: ignore path
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(api-v2): update ICS calendar test to mock factory function instead of class prototype
The IcsFeedCalendarService is now a factory function, not a class, so
jest.spyOn(IcsFeedCalendarService.prototype, 'listCalendars') no longer works.
Updated to use jest.spyOn(appStore, 'IcsFeedCalendarService').mockImplementation()
to mock the factory function return value instead.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor(app-store): rename factory functions to Build* naming convention
- Rename Calendar factory functions from create*CalendarService to BuildCalendarService
- Rename CRM factory functions from create*CrmService to BuildCrmService
- Rename Payment factory functions from PaymentService to BuildPaymentService
- Rename Analytics factory function from createDubAnalyticsService to BuildAnalyticsService
- Update all index.ts re-exports to use new names
- Update all call sites throughout the codebase
- Update test mocks to use new factory function names
This makes it clear that these are factory functions, not class constructors.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(app-store): update remaining CalendarService and PaymentService imports to Build* names
- Update api/add.ts files for applecalendar, caldavcalendar, exchange2013calendar, exchange2016calendar, exchangecalendar, ics-feedcalendar
- Update mock-payment-app index.ts to export BuildPaymentService
- Fix googlecalendar test import alias for createInMemoryDelegationCredentialForBuildCalendarService
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(tests): update payment service mocks to use BuildPaymentService
- Update setupVitest.ts to use BuildPaymentService instead of PaymentService
- Update handlePayment.test.ts mock to use BuildPaymentService
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: address PR review comments - rename to Build* and remove unused code
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: remove explanatory comments and fix indentation
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: update .gitignore to use *.tsbuildinfo pattern
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(api-v2): update IcsFeedCalendarService to BuildIcsFeedCalendarService in e2e test
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* style: format CalendarService.test.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Delete apps/ui-playground/next-env.d.ts
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-15 11:28:05 -03:00
Volnei MunhozGitHubVolnei Munhozcubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* refactor: replace shouldServeCache with mode parameter for calendar cache control
Replace the boolean shouldServeCache parameter with a new CalendarFetchMode type
that can have values 'slots', 'overlay', and 'booking'. This provides better
control over when to serve cache vs relay on calendar providers.
- 'slots' mode: Check feature flags and use cache when available (for getting
actual calendar availability)
- 'overlay' mode: Don't use cache (for overlay calendar availability)
- 'booking' mode: Don't use cache (for booking confirmation)
- undefined: Same as 'slots' for backwards compatibility
The cache decision logic is now centralized in getCalendar.ts based on the mode
parameter.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update CalendarService.test.ts to use mode parameter
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: use shared GetAvailabilityParams type across all calendar services
- Import GetAvailabilityParams and GetAvailabilityWithTimeZonesParams from @calcom/types/Calendar
- Replace inline type definitions with shared types in all calendar service implementations
- Update BaseCalendarService, CalendarCacheWrapper, and CalendarTelemetryWrapper
- Ensures consistent typing and follows DRY principles
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add missing IntegrationCalendar import and update mock getAvailability signature
- Add IntegrationCalendar back to sendgrid CalendarService imports
- Update bookingScenario mock getAvailability to use typed params object
- Add listCalendars method to mock Calendar object
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update test files to use typed params object for getAvailability methods
- Update CalendarCacheWrapper.test.ts to call getAvailability/getAvailabilityWithTimeZones with params object
- Update getCalendarsEvents.test.ts toHaveBeenCalledWith assertions to expect params object
- All 32 tests now pass
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: consolidate to single GetAvailabilityParams type for both getAvailability methods
- Remove GetAvailabilityWithTimeZonesParams, use GetAvailabilityParams for both methods
- Add mode parameter to getAvailabilityWithTimeZones calls
- Update wrapper classes to pass mode through to underlying calendar
- Update test files to include mode in getAvailabilityWithTimeZones calls and assertions
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: use EventBusyDate with optional timeZone for getAvailabilityWithTimeZones
- Add optional timeZone field to EventBusyDate type
- Update getAvailabilityWithTimeZones return type to use EventBusyDate[]
- Update Google Calendar service and wrapper classes to use the new type
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: type errors and remove unused calendar watching methods
- Fix type errors in CalendarCacheWrapper.ts (convert null to undefined for timeZone)
- Fix type errors in getCalendarsEvents.ts (ensure timeZone is always present)
- Remove unused watchCalendar/unwatchCalendar from Calendar interface
- Remove unused startWatchingCalendarsInGoogle/stopWatchingCalendarsInGoogle from GoogleCalendarService
- Remove unused imports (uuid, uniqueBy, GOOGLE_WEBHOOK_URL, ONE_MONTH_IN_MS)
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: remove watchCalendar/unwatchCalendar from CalendarTelemetryWrapper
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: remove verbose JSDoc param comments from wrapper classes
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: make mode parameter required in getCalendar
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add required mode parameter to all getCalendar callers
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: provide default mode value in getBusyCalendarTimes
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add mode parameter to remaining getCalendar callers
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add mode parameter to vital and wipemycalother reschedule
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add mode parameter to credential-sync API endpoint
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* refactor: add 'none' mode to CalendarFetchMode and use as default
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test: add mode parameter to getCalendarsEvents test calls
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Update packages/app-store/delegationCredential.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* mv PaymentPage to web
* mv 2 more components to web
* refactor
* update imports
* mv
* revert
* fix
* fix
* update
* migrate relevant test too
* move setup components to web from appstore
* move wipemycalother
* mv
* fix typechecks
* mv more routing forms components
* fix
* fix
* fix
* fix: resolve type errors in SingleForm.tsx after migration
- Updated SingleFormComponentProps type to include enriched form properties
- Added proper typing for user, team, nonOrgUsername, nonOrgTeamslug, userOrigin, teamOrigin
- Fixes type errors that occurred after migrating SingleForm.tsx from packages/app-store/routing-forms/components/
- Resolves both SingleForm.tsx and TestForm.tsx type errors
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* delete
* refactors
* fix
* fix
* fix
* remove usage of trpc client from OmniInstallAppButton.tsx
* fix test
* import only type
* fix test
* remove trpc package from appstore package.json
* remove remaining trpc usage
* update test
* fix type checks
* fix errors
* fix
* make it error
* nit
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix trpc session circle dep
* fixes trpc session cirlce dep
* fix relative imports
* fix more imports to use types and not trpc
* fix exports
* Fixed types
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* remove barrel export for client
* fix more imports
* remove server barrel
* remove more barrel exporst and fix tssconfig
* fix types
* fix imports for removed barrels
* fig ssg createserverside helpers
* restore lock
* new yarn lock
* remove barel exports
* remove barrel
* replace client with react in tsconfig
* fix yarn lock
* Update exports for trpc to not be types
* add ENDPOINTS export to the correct location
* other exports fixes lost due to barrel
* fix client error export
* more imports
---------
Co-authored-by: hbjORbj <sldisek783@gmail.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Found via `codespell -q 3 -S "*.svg,./apps/web/public/static/locales,./packages/app-store/stripepayment/lib/currencyOptions.ts,./packages/lib/freeEmailDomainCheck/freeEmailDomains.ts" -L afterall,atleast,datea,fo,incase,ist,nam,notin,optionel,perview,reccuring`
* feat(appStore): add isOAuth config
* refactor(appStore): EventTypeAppSettngsInterface
* refactor(qr_code): split EventTypeAppCardInterface and EventTypeAppSettingsInterface
* feat(appStore): redirect to onboarding for stripe and basecam
* fix(ui/ScrollableArea): overflow indicator not working
* feat(apps): new install app flow
* fix(configureStep): get disabled props for settings
* fix: getAppInstallsBySlug now use teamIds
* chore: Alby to AppSettingsInterface
* chore: Giphy to appsettings interface
* chore: GTM migration
* chore: GT4 - migration
* chore: fathom migration
* chore: paypal
* feat: basecamp migration
* feat: metapixel migration
* feat:plausable
* feat:stripe
* fix merge issues
* fix merge issues in new app install flow steps
* wip: callback to onboarding
* fix: imports
* fix: more imports
* feat: use redirect to onboarding on install flow
* fix: redirect to event-type after oauth flow
* When clicking on install new app button, only redirect to the new app install flow if it is an oAuth app or an app that extends the EventType feature in it's config
* code refactor, skip event-type step
* removed extra consoles
* so that no one can change the eventTypeId in url
* theme support enabled
* only pass eventTypeId instead of whole evetType obj to OmniInstallAppButton
* fix: clicking on event-type gives error and redirects to /apps
* saved appOnboardingRedirectUrl to OAuth State
* fix: a user having no team breaks the onboarding flow
* add optional chaining to appMetadata.extendsFeature and appMetadata.isOAuth;
* encode appOnboardingRedirectUrl
* fix: dark theme ui issues
* skip configure step if no-event types
if user/team does not have event-type then skip configure step and goto apps/installed/[category]
* exclude calendars from apps- onboarding flow
* Update getAppOnboardingRedirectUrl.ts
* fix: On configure step, inputs aren't showing errors
* change route from `apps/onboarding` to `apps/installation`
* fix: flow not correctly working for teams
* should only allow team ADMIN or OWER to install an app to team
* Prevent two payment apps to be enabled
* removed loading state
* Fix type error
* undo new-app-flow from OmniInstallAppButton
* remove OAuth Step, handle step numbering
* fix: redirect url
* getAppOnboardingRedirectUrl refactor
* for debugging
* Revert "for debugging"
This reverts commit b9362c1a8f47f2280e684c213d7ec08d04a8ac4c.
* fix: added toaster
* feat: added support to select multiple events (almost)
* hide button
* Move inner form outside outer form using portal
Due to limitations with nested forms in React Hook Form, moved the inner form outside the outer form using a portal to ensure proper form handling.
* submit buttons refs madness
* removed configure step
we had to use query params to manage selected event-types, between routes which was causing 2 issues:
* each time we selected or unselected an event the whole page was reloaded including getserversideprops being called again and again
* the form was reloaded causing more issues
* removed extra unwanted code
* small fix
* fix: type error
* fix: types
* implemented suggested changes
* removed step footer
* fixed error.message
* removed commented styles
* removed step footer
* fix: Display team event types instead of user's on event types step when team selected
* fix: typo
* removed shouldLockDisableProps
* refactor setUpdatedEventTypesStatus, fix type
* removed extra code
* can't delete while saving
* added translations
* fix: loading in select account step, fix handle onSelect params type
* Fix typo
* feat: add skip button to event-types step
* use set-up-later button in tests
* added skip button to configure step as well
* feat: add test for analytics apps using the new app install flow
* feat: add test for stripe 1
* feat: add test for stripe 2
* Fix: Redirect only those apps that extend 'EventType' to the new app install flow (#14527)
* fix: type errors
* fix: failing tests
* fix: tests
* fix test flakiness
* better naming and code refactor for analytics apps tests
* run tests parallelly
* removed network idle, giving error
* another shot at test flakiness
* Fix: can't install apps without team selector dropdown on main app store page.
* fix: test flakiness
* fix: account select loading issue
* removed getPaymentCredential (unused)
* fix: only redirect after the app has been added to all the event-types
* remove overflowIndicatorStyles
* fixed failing test
* fix: exclude org team events
* undo some random merge changes
---------
Co-authored-by: Morgan Vernay <morgan@cal.com>
Co-authored-by: sean-brydon <sean@cal.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Joe Au-Yeung <j.auyeung419@gmail.com>
Co-authored-by: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>
Co-authored-by: Omar López <zomars@me.com>
* feat(appStore): add isOAuth config
* refactor(appStore): EventTypeAppSettngsInterface
* refactor(qr_code): split EventTypeAppCardInterface and EventTypeAppSettingsInterface
* feat(appStore): redirect to onboarding for stripe and basecam
* fix(ui/ScrollableArea): overflow indicator not working
* feat(apps): new install app flow
* fix(configureStep): get disabled props for settings
* fix: getAppInstallsBySlug now use teamIds
* chore: Alby to AppSettingsInterface
* chore: Giphy to appsettings interface
* chore: GTM migration
* chore: GT4 - migration
* chore: fathom migration
* chore: paypal
* feat: basecamp migration
* feat: metapixel migration
* feat:plausable
* feat:stripe
* fix merge issues
* fix merge issues in new app install flow steps
* wip: callback to onboarding
* fix: imports
* fix: more imports
* feat: use redirect to onboarding on install flow
* feat: New app install flow 2 (#14077)
* fix: redirect to event-type after oauth flow
* When clicking on install new app button, only redirect to the new app install flow if it is an oAuth app or an app that extends the EventType feature in it's config
* code refactor, skip event-type step
* removed extra consoles
* so that no one can change the eventTypeId in url
* theme support enabled
* only pass eventTypeId instead of whole evetType obj to OmniInstallAppButton
* fix: clicking on event-type gives error and redirects to /apps
* saved appOnboardingRedirectUrl to OAuth State
* fix: a user having no team breaks the onboarding flow
* add optional chaining to appMetadata.extendsFeature and appMetadata.isOAuth;
* encode appOnboardingRedirectUrl
* fix: dark theme ui issues
* skip configure step if no-event types
if user/team does not have event-type then skip configure step and goto apps/installed/[category]
* exclude calendars from apps- onboarding flow
* Update getAppOnboardingRedirectUrl.ts
* fix: On configure step, inputs aren't showing errors
* change route from `apps/onboarding` to `apps/installation`
* fix: flow not correctly working for teams
* should only allow team ADMIN or OWER to install an app to team
* Prevent two payment apps to be enabled
* removed loading state
* Fix type error
* undo new-app-flow from OmniInstallAppButton
* remove OAuth Step, handle step numbering
* fix: redirect url
* getAppOnboardingRedirectUrl refactor
* for debugging
* Revert "for debugging"
This reverts commit b9362c1a8f47f2280e684c213d7ec08d04a8ac4c.
* fix: added toaster
* feat: added support to select multiple events (almost)
* hide button
* Move inner form outside outer form using portal
Due to limitations with nested forms in React Hook Form, moved the inner form outside the outer form using a portal to ensure proper form handling.
* submit buttons refs madness
* removed configure step
we had to use query params to manage selected event-types, between routes which was causing 2 issues:
* each time we selected or unselected an event the whole page was reloaded including getserversideprops being called again and again
* the form was reloaded causing more issues
* removed extra unwanted code
* small fix
* fix: type error
* fix: types
* implemented suggested changes
* removed step footer
* fixed error.message
* removed commented styles
* removed step footer
* fix: Display team event types instead of user's on event types step when team selected
* fix: typo
* removed shouldLockDisableProps
* refactor setUpdatedEventTypesStatus, fix type
* removed extra code
* can't delete while saving
* added translations
* fix: loading in select account step, fix handle onSelect params type
* Fix typo
---------
Co-authored-by: Joe Au-Yeung <j.auyeung419@gmail.com>
* fix: type errors
* fix: failing tests
---------
Co-authored-by: sean-brydon <sean@cal.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Joe Au-Yeung <j.auyeung419@gmail.com>
Co-authored-by: Somay Chauhan <somaychauhan98@gmail.com>
* feat: installing the app works
* Update yarn.lock
* feat: /api/callback now gets user auth info from basecamp
* feat: updated basecamp logo
* feat: added project dropdown on event apps page
* feat: basecamp event creation and deletion working
* feat: basecamp event rescheduling now works
* refactor(CalendarService): basecamp CaldendarService code clean up
* refactor: code cleanup for basecamp app API
* feat: updated event summary text sent to basecamp
* chore: updated basecamp images and contact info
* fix: fixed typescript errors and added logic to refresh tokens on event settings
* refactor(CaldendarService): used refreshAccessToken from helpers.ts instead
* chore: updated basecamp description
* fix: fixed incorrect import
* fix: accidentally deleted props to toggle app for event
* chore: updated .env.appStore.example and added README for app
* Update .env.appStore.example
Co-authored-by: Leo Giovanetti <hello@leog.me>
* feat: added basecamp userAgent in env instead of hardcoded value
* feat: updated README to include how to set basecamp user agent env
* fix: removed unused import
* feat: used URLSearchParams to construct url params
* fix: fixed typescript errors
* chore: updated README to include an example on how to set basecamp user-agent
* feat: using TRPC instead of REST
* chore: removed old projects REST code
---------
Co-authored-by: Leo Giovanetti <hello@leog.me>
