* fix: add CSRF protection to OAuth callback via HMAC-signed nonce
The OAuth state parameter was used only for passing application data
(returnTo, teamId) with no cryptographic binding to the user session.
An attacker could authorize their own account on a provider, capture the
authorization code, and trick a logged-in user into visiting the callback
URL to link the attacker's account to the victim's Cal.com profile.
Changes:
- encodeOAuthState: generate a random nonce and HMAC-sign it with
NEXTAUTH_SECRET + userId, injecting both into the OAuth state
- decodeOAuthState: verify the HMAC on callback using timingSafeEqual;
skip verification when nonce is absent (backwards compatible with apps
that don't yet use encodeOAuthState)
- Stripe callback: replace raw state.returnTo redirect with
getSafeRedirectUrl to prevent open redirect, remove redundant
getReturnToValueFromQueryState, add missing return on access_denied
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make CSRF nonce verification mandatory with allowlist for exempt apps
Makes nonce/HMAC verification mandatory by default in decodeOAuthState,
preventing attackers from bypassing CSRF protection by omitting nonce
fields from the state parameter.
Apps not yet migrated to encodeOAuthState (stripe, basecamp3, dub,
webex, tandem) are explicitly allowlisted and pass their slug to
decodeOAuthState to skip verification.
Addresses review feedback (identified by cubic) about the conditional
check being trivially bypassable.
Co-Authored-By: unknown <>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Initial commit
* Adding feature flag
* Add schema relation for teams and credentials
* feat: Orgs Schema Changing `scopedMembers` to `orgUsers` (#9209)
* Change scopedMembers to orgMembers
* Change to orgUsers
* Create getUserAdminTeams function & tRPC endpoint
* Get user admin teams on app store page
* Create UserAdminTeams type
* Add user query to getUserAdminTeams
* Letting duplicate slugs for teams to support orgs
* Covering null on unique clauses
* Add dropdown to install button on app store
* Supporting having the orgId in the session cookie
* On app page, only show dropdown if there are teams
* Add teamId to OAuth state
* Create team credential for OAuth flow
* Create team credential for GCal
* Add create user or team credential for Stripe
* Create webex credentials for users or teams
* Fix type error on useAddAppMutation
* Hubspot create credential on user or team
* Zoho create create credential for user or team
* Zoom create credentials on user or team
* Salesforce create credential on user or teams
* OAuth create credentials for user or teams
* Revert Outlook changes
* Revert GCal changes
* Default app instal, create credential on user or team
* Add teamId to credential creation
* Disable installing for teams for calendars
* Include teams when querying installed apps
* Render team credentials on installed page
* Uninstall team apps
* Type fix on app card
* Add input to include user in teams query
* Add dropdown to install app page for user or team
* Type fixes on category page
* Install app from eventType page to user or team
* Render user and team apps on event type app page
* feat: organization event type filter (#9253)
Signed-off-by: Udit Takkar <udit.07814802719@cse.mait.ac.in>
* Missing changes to support orgs schema changes
* Render user and team apps on event type app page
* Add credentialOwner to eventTypeAppCard types
* Type fixes
* Create hook to check if app is enabled
* Clean up console.logs
* Fix useIsAppEnabled by returning not an array
* Convert event type apps to useIsAppEnabled
* Abstract credential owner type
* Remove console.logs
* On installed app page, show apps if only team credential is installed
* Clean up commented lines
* Handle installing app to just an team event from event type page
* Fix early return when creating team app credential
* Zoom add state to callback
* Get team location credentials and save credential id to location
* feat: Onboarding process to create an organization (#9184)
* Desktop first banner, mobile pending
* Removing dead code and img
* WIP
* Adds Email verification template+translations for organizations (#9202)
* First step done
* Merge branch 'feat/organizations-onboarding' of github.com:calcom/cal.com into feat/organizations-onboarding
* Step 2 done, avatar not working
* Covering null on unique clauses
* Onboarding admins step
* Last step to create teams
* Moving change password handler, improving verifying code flow
* Clearing error before submitting
* Reverting email testing api changes
* Reverting having the banner for now
* Consistent exported components
* Remove unneeded files from banner
* Removing uneeded code
* Fixing avatar selector
* Using meta component for head/descr
* Missing i18n strings
* Feedback
* Making an org avatar (temp)
* Check for subteams slug clashes with usernames
* Fixing create teams onsuccess
* feedback
* Making sure we check requestedSlug now
---------
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
* Type fix
* Grab team location credentials
* Add isInstalled to eventType apps query
* feat: [CAL-1816] Organization subdomain support (#9345)
* Desktop first banner, mobile pending
* Removing dead code and img
* WIP
* Adds Email verification template+translations for organizations (#9202)
* First step done
* Merge branch 'feat/organizations-onboarding' of github.com:calcom/cal.com into feat/organizations-onboarding
* Step 2 done, avatar not working
* Covering null on unique clauses
* Onboarding admins step
* Last step to create teams
* Moving change password handler, improving verifying code flow
* Clearing error before submitting
* Reverting email testing api changes
* Reverting having the banner for now
* Consistent exported components
* Remove unneeded files from banner
* Removing uneeded code
* Fixing avatar selector
* Using meta component for head/descr
* Missing i18n strings
* Feedback
* Making an org avatar (temp)
* Check for subteams slug clashes with usernames
* Fixing create teams onsuccess
* Covering users and subteams, excluding non-org users
* Unpublished teams shows correctly
* Create subdomain in Vercel
* feedback
* Renaming Vercel env vars
* Vercel domain check before creation
* Supporting cal-staging.com
* Change to have vercel detect it
* vercel domain check data message error
* Remove check domain
* Making sure we check requestedSlug now
* Feedback and unneeded code
* Reverting unneeded changes
* Unneeded changes
---------
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
* Vercel subdomain creation in PROD only
* Enable payment apps for team credentials
* Fix for team-user apps for event types
* Fix layout and add teamId to app card
* Disable apps on managed event types
* Add managed event type fields to event type apps
* Include organizations in query
* Change createAppCredential to createOAuthAppCredential
* Show app installed on teams
* Making sure we let localhost still work
* UI show installed for which team
* Type fixes
* For team events move use host location to top
* Add around to appStore
* New team event types organizer default conf app
* Fix app card bug
* Clean up
* Search for teamId or userId when deleting credential
* Type fixes
* Type fixes
* Type fixes
* Type fixes
* Address feedback
* Feedback
* Type check fixes
* feat: Organization branding in side menu (#9279)
* Desktop first banner, mobile pending
* Removing dead code and img
* WIP
* Adds Email verification template+translations for organizations (#9202)
* First step done
* Merge branch 'feat/organizations-onboarding' of github.com:calcom/cal.com into feat/organizations-onboarding
* Step 2 done, avatar not working
* Covering null on unique clauses
* Onboarding admins step
* Last step to create teams
* Moving change password handler, improving verifying code flow
* Clearing error before submitting
* Reverting email testing api changes
* Reverting having the banner for now
* Consistent exported components
* Remove unneeded files from banner
* Removing uneeded code
* Fixing avatar selector
* Org branding provider used in shell sidebar
* Using meta component for head/descr
* Missing i18n strings
* Feedback
* Making an org avatar (temp)
* Using org avatar (temp)
* Not showing org logo if not set
* User onboarding with org branding (slug)
* Check for subteams slug clashes with usernames
* Fixing create teams onsuccess
* feedback
* Feedback
* Org public profile
* Public profiles for team event types
* Added setup profile alert
* Using org avatar on subteams avatar
* Making sure we show the set up profile on org only
* Profile username availability rely on org hook
* Update apps/web/pages/team/[slug].tsx
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
* Update apps/web/pages/team/[slug].tsx
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
---------
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
* feat: Organization support for event types page (#9449)
* Desktop first banner, mobile pending
* Removing dead code and img
* WIP
* Adds Email verification template+translations for organizations (#9202)
* First step done
* Merge branch 'feat/organizations-onboarding' of github.com:calcom/cal.com into feat/organizations-onboarding
* Step 2 done, avatar not working
* Covering null on unique clauses
* Onboarding admins step
* Last step to create teams
* Moving change password handler, improving verifying code flow
* Clearing error before submitting
* Reverting email testing api changes
* Reverting having the banner for now
* Consistent exported components
* Remove unneeded files from banner
* Removing uneeded code
* Fixing avatar selector
* Org branding provider used in shell sidebar
* Using meta component for head/descr
* Missing i18n strings
* Feedback
* Making an org avatar (temp)
* Using org avatar (temp)
* Not showing org logo if not set
* User onboarding with org branding (slug)
* Check for subteams slug clashes with usernames
* Fixing create teams onsuccess
* feedback
* Feedback
* Org public profile
* Public profiles for team event types
* Added setup profile alert
* Using org avatar on subteams avatar
* Processing orgs and children as profile options
* Reverting change not belonging to this PR
* Making sure we show the set up profile on org only
* Removing console.log
* Comparing memberships to choose the highest one
---------
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
* Type errors
* Refactor and type fixes
* Update orgDomains.ts
* Feedback
* Reverting
* NIT
* Address feedback
* fix issue getting org slug from domain
* Improving orgDomains util
* Host comes with port
* Update useRouterQuery.ts
* Fix app card bug
* Fix schema
* Type fixes
* Revert changes to location apps
* Remove console.log
* Fix app store test
* Handle install app dropdown
* Add CalendarApp to `getCalendar`
* Add PaymentApp type fix
* Payment type fix
* Type fixes
* Match with main
* Change type to account for team
* Fix app count for team events
* Type fixes
* More type fixes
* Type fix?
* Fix the type fix
* Remove UserAdminTeams empty array union
* Type fix
* Type fix
* Type fix
* Uses type predicates
* Use teamId. Fixes installation for teams after user installation
* Fix Team Events not working
* Get embed for org events working
* Fix rewrites
* Address feedback
* Type fix
* Fixes
* Add useAppContextWithSchema in useIsAppEnabled
* Type fix for apps using useIsAppEnabled
* Integrations.handler change credentialIds to userCredentialIds
* Remove apps endpoint
* Add LockedIcon and disabled props to event type app context
* Type fixes
* Type fix
* Type fixes
* Show team installed apps for members
* Type fix
* Reverting findFirst
* Revert findFirst
* Avoid a possible 500
* Fix missing tanslation
* Avoid possible 500
* Undo default app for teams
* Type fix
* Fix test
* Update package.json
* feat: Fix invite bug - added tests (#9945)
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
* chore: Button Component Tidy up (#9888)
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
* feat: Make Team Private
## What does this PR do?
Fixes https://github.com/calcom/cal.com/issues/8974
1) When user is admin
<img width="1440" alt="Screenshot 2023-07-03 at 6 45 50 PM" src="https://github.com/calcom/cal.com/assets/53316345/ce15158f-d278-4f1a-ba2e-8b63e4274793">
2) When user is not admin and team is private
<img width="1440" alt="Screenshot 2023-07-03 at 6 47 15 PM" src="https://github.com/calcom/cal.com/assets/53316345/ce23560e-690a-4c42-a76d-49691260aa4d">
3)
<img width="1440" alt="Screenshot 2023-07-03 at 6 51 56 PM" src="https://github.com/calcom/cal.com/assets/53316345/13af38f8-5618-4dae-b359-b24dc91e4eb4">
## Type of change
<!-- Please delete bullets that are not relevant. -->
- New feature (non-breaking change which adds functionality)
## How should this be tested?
1) go to Team members page and turn on switch Make Team Private.
Now after making the team private only admin would be able to see all the members list in the settings. There will not be a button to Book a team member instead on the team page like before.
## Mandatory Tasks
- [ ] Make sure you have self-reviewed the code. A decent size PR without self-review might be rejected.
---------
Signed-off-by: Udit Takkar <udit.07814802719@cse.mait.ac.in>
Co-authored-by: Leo Giovanetti <hello@leog.me>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
Co-authored-by: Alan <alannnc@gmail.com>
Co-authored-by: zomars <zomars@me.com>
Co-authored-by: Efraín Rochín <roae.85@gmail.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
