* fix: correct admin password banner message to require both password length and 2FA
The banner message incorrectly used 'or' implying only one condition was needed,
but the code requires BOTH a password of at least 15 characters AND 2FA enabled.
Updated the message to clearly state both requirements and added a hint that
users need to log out and log back in after updating their security settings.
Fixes#9527
Co-Authored-By: unknown <>
* fix: auto-sign-out INACTIVE_ADMIN users after enabling 2FA
When an INACTIVE_ADMIN user enables 2FA, automatically sign them out so
they can log back in with refreshed session role, dismissing the banner.
This matches the existing behavior for password changes.
Co-Authored-By: unknown <>
* feat: add dynamic admin banner message based on inactiveAdminReason
Co-Authored-By: unknown <>
* Remove and add various localization strings
* Update common.json
* Add cookie consent checkbox message and remove entries
* test: add unit tests for AdminPasswordBanner and inactiveAdminReason logic
Co-Authored-By: unknown <>
* fix: add expires field to session mock to fix type check
Co-Authored-By: unknown <>
* fix: wrap CALENDSO_ENCRYPTION_KEY mutations in try/finally to prevent env state leaks
Addresses Cubic AI review feedback (confidence 9/10): when a test fails
early, the CALENDSO_ENCRYPTION_KEY env var was not being restored, which
could leak state into subsequent tests. Wrapped the env mutation in
try/finally blocks to guarantee cleanup.
Co-Authored-By: bot_apk <apk@cognition.ai>
* fix: add missing 'expires' field to buildSession in AdminPasswordBanner test
The Session type requires 'expires' to be a string, but buildSession was
not providing it, causing a type error caught by CI type-check.
Co-Authored-By: bot_apk <apk@cognition.ai>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: bot_apk <apk@cognition.ai>
* fix: trigger lingo.dev by removing duplicate value
* under progress
* wow this worked
* migrate schema
* fix types
* fix import for google login
* Add onboarding tests for Azure (Microsoft sign up)
* add comments back
* fix failing test
* fix: update Outlook login configuration and improve type safety in authentication adapter
- Set OUTLOOK_LOGIN_ENABLED to false in .env.example
- Refactor getServerSideProps to directly use samlTenantID and samlProductID
- Update linkAccount method in next-auth-custom-adapter for better type handling
- Remove redundant comment in next-auth-options related to Azure AD email verification
* remove log
* remove debug log from signin callback in next-auth options
* fixup
* chore: standardize naming
* chore: add primary calendar for outlook, verify email and auto link org for outlook
* chore: helper fns
* chore: implement cubic feedback
* cleanup
* chore: implement cubic feedback again
* WIP design#
* feat: login design
* fix: map identity provider names correctly
* 32px of mt
* fix: login UI
* fix: type check
* fix: fix type check again
* chore: update OAuth login tests
* fixup
* fix: bad import
* chore: update tests
* fixup
* fix: locales test
* chore: implement PR feedback and fix minor issues
* fix: revert token spreading change
* fix: merge conflicts
* chore: revert signup view changes
* fixup: bring back reverted changes because of merge conflicts
* fix: disable email input when microsoft sign in is in progress
* chore: implement cubic feedback
* cleanup: unused variables
* fix: address Cubic AI review feedback (confidence >= 9/10)
- Remove userId (PII) from log payloads in updateProfilePhotoMicrosoft.ts
- Replace text selectors with data-testid in locale.e2e.ts and oauth-provider.e2e.ts
- Restore callbackUrl redirect parameter in signup link in login-view.tsx
- Add data-testid='login-subtitle' to login page subtitle element
Co-Authored-By: unknown <>
* fix: use empty alt for decorative icon images in login view
MicrosoftIcon and GoogleIcon are decorative (adjacent to text labels),
so they should have empty alt attributes per accessibility best practices.
Co-Authored-By: unknown <>
* chore: implement cubic feedback
* cleanup
* fixup
* chore: implement PR feedback
* chore: implement feedback
* fix: address PR review feedback - type safety and centralize constants
- Replace non-null assertions (!) with proper null checks for OUTLOOK_CLIENT_ID/SECRET
- Replace `as any` casting with `Record<string, unknown>` for OAuth profile claims
- Remove non-null assertion on account.access_token by adding conditional check
- Centralize Outlook env constants in @calcom/lib/constants alongside MICROSOFT_CALENDAR_SCOPES
- Add explanatory comment for getNextAuthProviderName usage in get.handler.ts
Co-Authored-By: unknown <>
* Revert "fix: address PR review feedback - type safety and centralize constants"
This reverts commit 91ace141e6a28a23deea5897f7f9d6ad80319d84.
* chore: implement feedback
* chore: cleanup
* chore: implement feedback
* fix: merge conflicts
* fix: revert formatting-only changes in packages/lib/constants.ts
Co-Authored-By: unknown <>
* fix: revert IdentityProvider enum location change in schema.prisma
Co-Authored-By: unknown <>
* chore: implement more PR feedback
* fix: restore database-derived profileId from determineProfile in OAuth JWT
The profileId regression was identified by Cubic AI (confidence 9/10).
Previously, determineProfile's returned id was used to set profileId in the
JWT via 'profileResult.id ?? token.profileId ?? null'. A recent refactor
changed this to 'token.profileId ?? null', which drops the database-derived
profile ID. On first OAuth login (or when profile switcher is disabled),
token.profileId is likely null, so profileId would incorrectly be set to
null even though determineProfile returned a valid profile with an id.
This commit restores the correct priority chain:
visitorProfileId ?? token.profileId ?? null
Co-Authored-By: bot_apk <apk@cognition.ai>
* refactor: revert pure formatting and import reordering changes
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* fix: normalize determineProfile return type to use consistent 'id' field
The determineProfile function returned a union type where one branch used
'id' and the other used 'profileId'. This caused TS2339 when destructuring
'id' from the result. Normalize the token.upId branch to also return 'id'
(mapped from token.profileId) so the return type is consistent.
Co-Authored-By: bot_apk <apk@cognition.ai>
* chore: add tests
* reveret: profileId changes should be in a separate PR
* fix: avoid logging entire existingUser object in OAuth JWT callback
Revert to logging only { userId, upId } instead of the full existingUser
object, which contains PII (email, name, identity provider details).
This restores the previous safe logging pattern.
Co-Authored-By: bot_apk <apk@cognition.ai>
* chore: remove profileId related tests
---------
Co-authored-by: amrit <iamamrit27@gmail.com>
Co-authored-by: Devanshu Sharma <devanshusharma658@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Sean Brydon <sean@cal.com>
Co-authored-by: bot_apk <apk@cognition.ai>
* fix: hide branding for teams
* fix: remove unused organizationId and username fields from profiles select
Addresses Cubic AI review feedback (confidence 9/10) to select only
the profile fields that are actually used. The organizationId and
username fields were fetched but never referenced in this function.
Co-Authored-By: unknown <>
* fix: unit tests
* fix: add prisma named export to test mock
Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com>
* Add tests: packages/features/profile/lib/hideBranding.test.ts
Generated by Paragon from proposal for PR #27643
* chore: implement cubic feedback
* fix: merge conflicts
* fix: unit tests
* fixup
* refactor: implement DI pattern for event type service
* fix: atoms build
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Alex van AndelGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* feat: add signup watchlist review feature flag and handler logic
- Add 'signup-watchlist-review' global feature flag
- Add SIGNUP to WatchlistSource enum in Prisma schema
- When flag enabled, lock new signups and add email to watchlist
- Show 'account under review' message on signup page
- Add i18n strings for review UI
- Create seed migration for the feature flag
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* test: add isAccountUnderReview tests to fetchSignup test suite
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: address Cubic AI review feedback (confidence >= 9/10)
- Remove 'import process from node:process' in signup-view.tsx (P0 bug in 'use client' component)
- Move watchlist review check before checkoutSessionId early return in calcomSignupHandler (P1 premium bypass)
- Revert selfHostedHandler to original state (out of scope per user request)
- Add test mocks for FeaturesRepository and GlobalWatchlistRepository
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: remove node:process import from useFlags.ts (client-side file)
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* fix: remove !token condition from watchlist review check
Token is present in normal email-verified signups, so the !token
condition was incorrectly skipping watchlist review for verified users.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* Apply suggestion from @cubic-dev-ai[bot]
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* refactor: move user lock to UserRepository.lockByEmail
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* refactor: use cached getFeatureRepository() instead of deprecated FeaturesRepository
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* refactor: remove user locking, keep only watchlist addition on signup review
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* feat: lock user on signup review, remove watchlist entry on unlock
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* refactor: apply biome formatting to packages/features (batch 1 - small subdirs)
Format small subdirectories in packages/features: di, flags, holidays, oauth,
settings, users, assignment-reason, selectedCalendar, hashedLink, host, form,
form-builder, availability, data-table, pbac, schedules, troubleshooter,
eventtypes, calendar-subscription, and root-level files.
Also includes straggler apps/web BookEventForm.tsx.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 2 - medium subdirs)
Format medium subdirectories in packages/features: auth, credentials,
calendars, routing-forms, routing-trace, attributes, watchlist, calAIPhone,
tasker, and webhooks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 3 - bookings + insights)
Format bookings and insights subdirectories in packages/features.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 4 - ee)
Format packages/features/ee subdirectory covering billing, workflows,
organizations, teams, managed-event-types, round-robin, dsync,
integration-attribute-sync, and payments.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 5 - booking-audit part 1)
Format booking-audit di, actions, common, dto, repository, and types
subdirectories in packages/features/booking-audit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 6 - booking-audit part 2)
Format booking-audit service subdirectory in packages/features/booking-audit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Adds encrypted credential storage using a new keyring system:
- New `encryptedKey` column with AES-256-GCM encryption
- Decryption in getCalendarsEvents with fallback to legacy `key`
- buildCredentialCreateData service for credential creation
- Phase 1: Google Calendar only, other integrations follow
* feat: store utm params in stripe on signup
* fix: fallback to cookie when query params don't contain valid UTM data
Changed from else-if to separate if statement so that when query
params exist but don't contain valid UTM data, the cookie fallback
is still tried. Previously, any request with non-UTM query params
would skip the stored cookie data entirely.
Co-Authored-By: unknown <>
* fix: e2e
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-22 08:13:47 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* perf(app-store): convert services to factory functions to narrow SDK type exports
This change converts CRM, Calendar, Payment, and Analytics services from
exporting classes to exporting factory functions that return interface types.
This prevents SDK types (HubSpot, Stripe, etc.) from leaking into the type
system when TypeScript emits .d.ts files.
Services modified:
- CRM: hubspot, salesforce, closecom, pipedrive-crm, zoho-bigin, zohocrm
- Calendar: all 13 calendar services
- Payment: stripe, paypal, alby, btcpayserver, hitpay, mock-payment-app
- Analytics: dub
Video adapters were audited and already use factory pattern.
WIP: Salesforce CRM service has a type error that needs fixing.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(salesforce): add type assertion for appOptions in factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update remaining consumers to use factory functions
- getAnalytics.ts: call factory function instead of new
- getConnectedApps.ts: call factory function instead of new
- salesforce/CrmService.ts: fix type assertion with default value
- salesforce/routingForm/incompleteBookingAction.ts: use factory function
- salesforce/routingFormBookingFormHandler.ts: use factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(salesforce): add SalesforceCRM interface for Salesforce-specific methods
- Create SalesforceCRM interface extending CRM with findUserEmailFromLookupField and incompleteBookingWriteToRecord methods
- Add createSalesforceCrmServiceWithSalesforceType factory function for internal Salesforce modules
- Update routing form files to use the new factory function with proper typing
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(salesforce): correct return type in SalesforceCRM interface
The findUserEmailFromLookupField method returns { email: string; recordType: RoutingReasons } | undefined,
not string | undefined. Updated the interface to match the actual implementation.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update all call sites to use factory functions
- Update calendar API add files to use factory functions (7 files)
- Update Google Calendar test files to use factory functions (3 files)
- Update Salesforce test files to use SalesforceCRM interface
- Add testMode parameter to createSalesforceCrmServiceWithSalesforceType
- Remove unused @ts-expect-error directive in bookingScenario.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add GoogleCalendar interface and update factory functions for service-specific methods
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add type annotation to attendee parameter in google-calendar.e2e.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update selected-calendars/route.ts to use GoogleCalendar factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update remaining GoogleCalendarService call sites to use factory function
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove explicit type annotation in google-calendar.e2e.ts to fix type error
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update test mocks to use factory function pattern for calendar and payment services
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: convert MockPaymentService to factory function in setupVitest.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(api-v2): call calendar service factory functions instead of using new
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* perf(trpc): add TypeScript project references to reduce build file count
- Add tsconfig.build.json to app-store with composite settings for declaration emit
- Add tsconfig.server.build.json to trpc with project references
- Add types and typesVersions to app-store package.json to redirect type resolution to dist-types
- Add build:types script to app-store for generating declarations
- Add dist-types to .gitignore
This reduces the tRPC build file count from 7,733 to 5,618 files (27% reduction)
by having TypeScript resolve to prebuilt .d.ts files instead of source files.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(app-store): add fallback to typesVersions for CI compatibility
The typesVersions now prefers dist-types but falls back to source files
when dist-types don't exist. This fixes CI type-check failures while
still allowing the optimization when dist-types are built.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Added build dependency for tRPC on app-store
* fix(app-store): exclude test directories from tsconfig.build.json
Exclude __tests__, __mocks__, and tests directories from the build
config to prevent test utility files (which import from outside rootDir)
from being included in the declaration emit.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(turbo): add build:types task definition for app-store
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(turbo): remove circular build dependency between trpc and app-store
The build:types task for app-store transitively imports from @calcom/features,
which imports from @calcom/trpc. This creates a circular build dependency when
@calcom/trpc#build depends on @calcom/app-store#build:types.
Solution: Remove the turbo dependency. The typesVersions fallback pattern
['./dist-types/*', './*'] will use source files when dist-types/ doesn't exist,
and use prebuilt declarations when they do exist (for faster builds).
Also exclude dist-types from regular tsconfig.json to prevent 'Cannot write file'
errors when dist-types/ exists.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor(app-store): rename dist-types to types for consistency
Rename the prebuilt TypeScript declarations folder from dist-types to types
to match the convention used by @calcom/trpc and other packages in the monorepo.
Updated files:
- tsconfig.build.json: declarationDir and exclude
- tsconfig.json: exclude
- package.json: typesVersions paths
- turbo.json: build:types outputs
- .gitignore: ignore path
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(api-v2): update ICS calendar test to mock factory function instead of class prototype
The IcsFeedCalendarService is now a factory function, not a class, so
jest.spyOn(IcsFeedCalendarService.prototype, 'listCalendars') no longer works.
Updated to use jest.spyOn(appStore, 'IcsFeedCalendarService').mockImplementation()
to mock the factory function return value instead.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor(app-store): rename factory functions to Build* naming convention
- Rename Calendar factory functions from create*CalendarService to BuildCalendarService
- Rename CRM factory functions from create*CrmService to BuildCrmService
- Rename Payment factory functions from PaymentService to BuildPaymentService
- Rename Analytics factory function from createDubAnalyticsService to BuildAnalyticsService
- Update all index.ts re-exports to use new names
- Update all call sites throughout the codebase
- Update test mocks to use new factory function names
This makes it clear that these are factory functions, not class constructors.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(app-store): update remaining CalendarService and PaymentService imports to Build* names
- Update api/add.ts files for applecalendar, caldavcalendar, exchange2013calendar, exchange2016calendar, exchangecalendar, ics-feedcalendar
- Update mock-payment-app index.ts to export BuildPaymentService
- Fix googlecalendar test import alias for createInMemoryDelegationCredentialForBuildCalendarService
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(tests): update payment service mocks to use BuildPaymentService
- Update setupVitest.ts to use BuildPaymentService instead of PaymentService
- Update handlePayment.test.ts mock to use BuildPaymentService
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: address PR review comments - rename to Build* and remove unused code
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: remove explanatory comments and fix indentation
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: update .gitignore to use *.tsbuildinfo pattern
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(api-v2): update IcsFeedCalendarService to BuildIcsFeedCalendarService in e2e test
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* style: format CalendarService.test.ts
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Delete apps/ui-playground/next-env.d.ts
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-15 11:28:05 -03:00
sean-brydonGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add server-side redirect for users with pending invites on onboarding page
When users sign up with an invite token, they were being redirected to
/onboarding/getting-started (plan selection page) instead of going
directly to /onboarding/personal/settings. This caused users to see
the payment prompt for team/org plans before being redirected.
This fix adds a server-side check in the /onboarding/getting-started
page to redirect users with pending invites directly to the personal
onboarding flow, preventing them from seeing the plan selection page.
Also refactored onboardingUtils.ts to use MembershipRepository instead
of direct prisma access.
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* test: add integration tests for hasPendingInviteByUserId method
Co-Authored-By: sean@cal.com <Sean@brydon.io>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(auth): sanitize unverified accounts during OAuth linking
- Add AccountSanitizationService for secure account cleanup
- Clear webhooks, API keys, credentials, and sessions for unverified accounts
- Reset password and 2FA settings during OAuth conversion
- Nullify redirect URLs on event types
Only affects accounts that never completed email verification
* fix(auth): block OAuth linking for unverified accounts
Replace sanitization with simpler blocking approach:
- Unverified CAL accounts cannot link to OAuth (Google/SAML)
- Add user-friendly error message with recovery path
- Remove AccountSanitizationService (no data loss risk)
2026-01-09 11:04:39 +00:00
Benny JooGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: remove @calcom/web imports from packages/features to eliminate circular dependency
- Migrate UserTableUser and MemberPermissions types to packages/features/users/types/user-table.ts
- Migrate useGeo hook to packages/features/geo/GeoContext.tsx
- Migrate buildLegacyRequest to packages/lib/buildLegacyCtx.ts
- Migrate Calendar component to packages/features/calendars/weeklyview/components/
- Move test utilities (bookingScenario, fixtures) to packages/features/test/
- Update all imports in packages/features to use new locations
- Add re-exports in apps/web for backward compatibility
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: delete original implementation files and fix type issues
- Delete original calendar component files in apps/web (keep only re-export stubs)
- Migrate OutOfOfficeInSlots to packages/features/bookings/components
- Convert apps/web OutOfOfficeInSlots to re-export stub
- Fix className vs class issue in Calendar.tsx
- Fix @calcom/trpc import violation in user-table.ts by using structural type
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: add missing isGroup and contains fields to UserTableUser attributes type
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update customRole type to match actual Prisma Role model
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix build
* fix
* fix
* cleanup weeklyview
* fix
* refactor to mv MemberPermissions to types package
* add types dependency to features
* fix
* fix
* fix
* fix
* fix
* fix
* rename
* rename
* migrate
* migrate
* migrate
* fix
* fix
* fix
* refactor: move test utilities from packages/features/test to tests/libs
- Move bookingScenario utilities to tests/libs/bookingScenario
- Move fixtures to tests/libs/fixtures
- Update all imports in packages/features test files to use new location
- Update all imports in apps/web test files to use new location
- Eliminates duplication of test utilities between packages/features and apps/web
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: correct relative import paths for tests/libs in test files
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* refactor: replace test utility implementations with re-exports to tests/libs
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: fix test import paths and move signup handler tests to apps/web
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: move buildLegacyCtx to packages/lib and restore handlers to packages/features
- Move buildLegacyCtx from apps/web/lib to packages/lib to break circular dependency
- Update apps/web/lib/buildLegacyCtx.ts to re-export from @calcom/lib
- Restore signup handlers and tests to packages/features/auth/signup/handlers
- Update handler imports to use @calcom/lib/buildLegacyCtx instead of @calcom/web/lib/buildLegacyCtx
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update recurring-event.test.ts imports to use tests/libs path
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* refactor: delete test re-export files and update imports to use tests/libs directly
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update remaining test imports to use tests/libs directly
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update handleRecurringEventBooking calls to match function signature (1 arg)
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* remove
* migrate tests
* migrate tests
* refactor: update test mock imports by removing and using async for mock creators.
* fix type errors
* fix: add type assertion for MockUser in p2002.test-suite.ts
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: restore locale import in compareReminderBodyToTemplate.test.ts using relative path
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* feat: create @calcom/testing package and migrate tests from /tests directory
- Created new @calcom/testing package in /packages/testing
- Moved all files from /tests to /packages/testing
- Updated all imports across the codebase to use @calcom/testing alias
- Removed /tests directory at root level
This allows other packages like @calcom/features and @calcom/web to import
testing utilities using the @calcom/testing alias instead of relative paths.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix
* fix
* fix: add missing useBookings export to @calcom/atoms package
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: add missing useCalendarsBusyTimes and useConnectedCalendars exports to @calcom/atoms
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* chore: add @calcom/testing as explicit devDependency to packages that use it
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* refactor: move setupVitest.ts into @calcom/testing package
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix
* chore: add biome rules to restrict @calcom/testing imports
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix
* rename libs to lib
* rename libs to lib
* add rule
* add rule
* refactor: remove @calcom/features imports from @calcom/testing
- Move mockPaymentSuccessWebhookFromStripe to fresh-booking.test.ts
- Replace ProfileRepository.generateProfileUid() with uuidv4()
- Clone Tracking type into @calcom/testing/src/lib/types.ts
- Update imports in expects.ts and getMockRequestDataForBooking.ts
- Move source files into src/ folder
- Move CalendarManager mock to @calcom/features
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: add explicit exports for nested paths in @calcom/testing
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* improve
* improve
* fix
* fix
* fix type checks
* fix type checks
* fix type checks
* fix tests
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(auth): validate user before signup with invite token
Validate if user already exists before creating account when
signing up with team or organization invite tokens. Existing users
are redirected to login to accept the invitation.
- Add user existence check in signup handlers
- Return 409 for existing users with redirect to login
- Extract signup fetch logic to dedicated module
- Add e2e test coverage
* fix(auth): address code review feedback
- Fix fetchSignup tests to use vi.spyOn for proper mock restoration
- Add content-type validation before parsing JSON response
- Guard against undefined error in Stripe callback
- Use t() for localized error message
- Fix race condition in handlers by catching P2002 on create
* fix(auth): address additional code review feedback
- Add INVALID_SERVER_RESPONSE constant to follow established pattern
- Check error.meta.target includes email before returning USER_ALREADY_EXISTS
to avoid false positives from other unique constraint violations
- Add select: { id: true } to user.create calls since downstream functions only
need the user id
* test: add unit tests for P2002 handling in signup handlers
- Add shared test suite covering all P2002 edge cases
- Ensure 409 only for email constraint violations
- Fix non-token paths to use atomic create + catch pattern
* fix: update error message copy per review feedback
* fix(auth): address code review feedback and prevent orphan Stripe customers
- Add user existence check before Stripe customer creation (token flow)
- Add select clause to user.create for consistency
- Fix showToast argument order (pre-existing bug)
- Use toHaveURL instead of waitForURL in E2E tests
* fix(auth): resolve 500 errors by fixing Prisma error detection across module boundaries
The instanceof check for PrismaClientKnownRequestError fails when different
Prisma client instances are loaded. Added fallback check by constructor name
* fix(auth): validate invitedTo before upsert on team invite signup
* test(auth): update P2002 tests for new invite flow
P2002 tests now use non-token flow since token flow uses upsert
Added tests for invitedTo validation on invite signup
* fix(auth): add guards and P2002 handling per review feedback
- Guard existingUser check with if (foundToken?.teamId)
- Guard username check with if (username) for premium flow
- Add `select` clause to findFirst/findUnique queries
- Add try-catch on upsert for race condition P2002 errors
* fix(auth): narrow P2002 handling to email/username targets
## What does this PR do?
Adds infrastructure to track impersonation context in booking audit records and displays it in the UI. When an admin impersonates another user and performs booking actions, the audit system now:
- Records the **admin** as the actor (who actually performed the action)
- Stores the **impersonated user's UUID** in a separate `context` field
- Displays **"Impersonated By"** in the booking logs UI when viewing audit details
This separation ensures audit trail integrity (the admin is accountable) while preserving full context about whose account was being used.
### Changes
- Added `uuid` to `impersonatedBy` session object for actor identification
- Added `uuid` to top-level `User` type in next-auth types for session enrichment
- Added `context Json?` field to `BookingAudit` Prisma model
- Added `BookingAuditContextSchema` for type-safe context handling with `actingAsUserUuid` field
- Updated producer service interface and implementation to pass context through all queue methods
- Updated consumer service to persist context to database
- Updated repository to store and fetch context in BookingAudit records
- Added `impersonatedBy` field to `EnrichedAuditLog` type in `BookingAuditViewerService`
- Added `enrichImpersonationContext` method to resolve impersonated user details
- Updated booking logs UI to display "Impersonated By" in expanded details
- Added `impersonated_by` translation key
Link to Devin run: https://app.devin.ai/sessions/3f1252527aef4ead9401bdf055c0817b
Requested by: hariom@cal.com (@hariombalhara)
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - internal infrastructure change
- [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.
## How should this be tested?
1. Verify type checks pass: `yarn type-check:ci --force`
2. Verify existing audit tests still pass: `TZ=UTC yarn test`
3. To fully test impersonation context display:
- Have an admin impersonate a user
- Perform a booking action (create, cancel, reschedule)
- Navigate to the booking's audit logs
- Expand the details for the action
- Verify "Impersonated By" row appears showing the impersonated user's name
- Verify the BookingAudit record has:
- `actorId` pointing to the admin's AuditActor
- `context` containing `{ actingAsUserUuid: "<impersonated-user-uuid>" }`
## Human Review Checklist
- [ ] Verify the `context` field schema design is appropriate for future extensibility
- [ ] Confirm the `uuid` addition to User type in next-auth doesn't break existing auth flows
- [ ] Check that the optional `context` parameter doesn't break existing queue method callers
- [ ] Verify no migration file is needed (or if squashing is handled separately)
- [ ] Verify the UI displays "Impersonated By" correctly when impersonation context is present
- [ ] Confirm `enrichImpersonationContext` handles edge cases (null context, invalid context, deleted user)
## Checklist
- [x] My code follows the style guidelines of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have checked if my changes generate no new warnings
- Extract tenant from userInfo in saml-idp (IdP-initiated)
- Add profile.requested?.tenant fallback for OAuth (SP-initiated)
- Block invalid tenant format in hosted (security)
## What does this PR do?
Similar to #25721, adds uuid in session so that BookingAudit has it readily available
Adds the user's UUID to the booking metadata by:
1. Extending the NextAuth `User` interface to include an optional `uuid` property from PrismaUser
2. Making `uuid` required on `Session.user` via intersection type (`User & { uuid: PrismaUser["uuid"] }`)
3. Adding `uuid` to the session user object in `getServerSession.ts`
4. Adding `uuid` to the `AdapterUser` transformation in `next-auth-custom-adapter.ts`
5. Passing `userUuid` from the session to the booking creation flow
6. Updating the API key verification flow to include `uuid` in the user data (repository, service, and type definitions)
7. Adding `req.userUuid` as a required field on the request object (like `req.userId`)
8. Adding `uuid` to mock session objects in web app routes and test context
9. Adding `uuid` to the `findByEmailAndIncludeProfilesAndPassword` query in UserRepository
Also removes commented-out code that was placeholder for future work and fixes lint warnings for unused variables.
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed.
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works.
## How should this be tested?
1. Verify that the NextAuth session callback is already populating the `uuid` field on the user object
2. Create a booking and confirm `userUuid` is included in the booking metadata
3. Test API v1 endpoints (`/api/invites` POST and `/api/teams/[teamId]/publish`) to verify they receive the uuid from the authenticated user
4. Check that the booking flow works correctly with the new parameter
5. Test SAML login flow to verify session still works correctly (uuid is resolved from database after authentication)
## Human Review Checklist
- [ ] Verify the NextAuth session callback populates `uuid` - if not, this change will pass `undefined` at runtime
- [ ] Confirm `userUuid` is consumed downstream in the booking service
- [ ] Verify that `PrismaApiKeyRepository.findByHashedKey()` correctly fetches the user's uuid from the database
- [ ] Verify the discriminated union type in `ApiKeyService.ts` ensures `result.user` is always defined when `result.valid` is true
- [ ] Confirm all API v1 endpoints using `req.userUuid` go through the `verifyApiKey` middleware
- [ ] Verify `UserRepository.findByEmailAndIncludeProfilesAndPassword()` includes `uuid` in the select clause
- [ ] Verify SAML login still works correctly - uuid is now optional on User interface so SAML providers don't need to supply it at profile stage
## Updates since last revision
- **Made uuid optional on User, required on Session**: Changed the type strategy so `uuid` is optional on the NextAuth `User` interface but required on `Session.user` via intersection type. This allows SAML providers to not supply uuid at the profile stage while ensuring uuid is always present on the session after the user is resolved from the database.
- **Removed uuid from SAML functions**: Since uuid is now optional on User, the SAML profile and authorize functions no longer need to include it.
---
Link to Devin run: https://app.devin.ai/sessions/97e5603b719a420b9b35041252c9db26
Requested by: hariom@cal.com (@hariombalhara)
* chore: upgrade Vitest to 4.0.16 and Vite to 6.4.1
- Update vitest from 2.1.9 to 4.0.16
- Update @vitest/ui from 2.1.9 to 4.0.16
- Update vitest-fetch-mock from 0.3.0 to 0.4.5
- Update vitest-mock-extended from 2.0.2 to 3.1.0
- Update vite from 4.5.14/5.4.21 to 6.4.1 across all packages
- Update @vitejs/plugin-react to 5.1.2
- Update @vitejs/plugin-react-swc to 4.2.2
- Update @vitejs/plugin-basic-ssl to 2.1.0
- Update vite-plugin-dts to 4.5.4
- Rename vitest.config.ts to vitest.config.mts for ESM compatibility
- Add globals: true to vitest config
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: address Vitest 4.0 and Vite 6 breaking changes
- Convert arrow function mockImplementation patterns to regular functions
(Vitest 4.0 breaking change: arrow functions can't be constructor mocks)
- Fix CSS imports with ?inline suffix for Vite 6 compatibility
- Add biome override to disable useArrowFunction rule for test files
- Fix syntax errors in test files introduced by regex replacements
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix remaining Vitest 4.0 constructor mock patterns
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix more Vitest 4.0 constructor mock patterns and exclude API v2 spec files
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more arrow function mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more arrow function mocks to regular functions for Vitest 4.0
- Fix CrmService.integration.test.ts jsforce.Connection mock
- Fix RetellSDKClient.test.ts Retell mock
- Fix RetellAIService.test.ts CreditService mocks
- Fix GoogleCalendarSubscriptionAdapter.test.ts CalendarAuth mock
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert Google Calendar and OAuthManager arrow function mocks for Vitest 4.0
- Fix googleapis.ts Calendar, OAuth2Client, and JWT mocks
- Fix utils.ts JWT mock
- Fix OAuthManager.ts defaultMockOAuthManager mock
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add React plugin, jsdom environment, and fix more constructor mocks for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert HostRepository PrismaClient mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add useOrgBranding mock to React component tests for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update TestFunction type for Vitest 4.0 compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert listBookingReports constructor mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert UserRepository constructor mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert OrganizationPaymentService constructor mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more constructor mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add apps/web path aliases to vitest config
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix test issues for Vitest 4.0 compatibility
- Fix Response constructor 204 status code issue in testUtils.ts
- Fix FeaturesRepository mock persistence in handleNotificationWhenNoSlots.test.ts
- Add @vitest-environment node directive to formSubmissionUtils.test.ts
- Fix document.querySelector mock in embed.test.ts
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: clear EventManager spy between tests for Vitest 4.0 compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update TeamRepository mock pattern for Vitest 4.0 compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert RoutingFormResponseRepository mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more constructor mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix mock reset and spy clear issues for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix remaining test failures for Vitest 4.0 upgrade
- Fix booking-validations.test.ts: convert UserRepository mock to regular function
- Fix route.test.ts: update 500 error test to mock ImageResponse instead of fetch
- Fix users-public-view.test.tsx: add missing mocks for getOrgFullOrigin and useRouterQuery
- Add @calcom/web path alias to vitest config
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add vitest-mocks for generated files that don't exist in CI
- Add svg-hashes.json mock for route.test.ts
- Add tailwind.generated.css mock for embed.test.ts
- Update vitest config to use mock files
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update vitest config aliases for CI compatibility
- Use array format for aliases to ensure proper ordering
- Add @calcom/platform-constants alias to resolve from source
- Add @calcom/embed-react alias to resolve from source
- Ensure svg-hashes.json mock alias is matched before @calcom/web
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add @calcom/embed-snippet alias for CI compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Fix wrong test
* fix: migrate from CLI flags to VITEST_MODE env var for Vitest 4.0
Vitest 4.0 no longer allows custom CLI flags like --packaged-embed-tests-only.
This change migrates to using VITEST_MODE environment variable instead:
- VITEST_MODE=packaged-embed for packaged embed tests
- VITEST_MODE=integration for integration tests
- VITEST_MODE=timezone for timezone-dependent tests
Updated vitest.config.mts to handle mode-based include/exclude patterns.
Updated CI workflows and package scripts to use the new env var approach.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: return default include pattern instead of undefined in vitest config
The getTestInclude() function was returning undefined for the default case,
but Vitest 4.0 expects an array. This caused 'resolved.include is not iterable'
error in CI.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: always set INTEGRATION_TEST_MODE for jsdom environment
The getBookingFields.ts file checks for INTEGRATION_TEST_MODE to allow
server-side imports in the jsdom environment. Without this, tests fail
with 'getBookingFields must not be imported on the client side' error.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: support legacy CLI flags for backwards compatibility with main workflow
The CI runs workflows from main branch, which uses the old CLI flag approach
(yarn test -- --integrationTestsOnly). This commit adds backwards compatibility
by checking both VITEST_MODE env var and process.argv for the legacy flags.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-01 18:16:10 -03:00
Volnei MunhozGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit pins all dependency versions in package.json files to exact
versions matching the yarn.lock file, removing ^ and ~ prefixes.
Changes:
- Locked 427 dependencies across 47 package.json files
- Versions now match exactly what is resolved in yarn.lock
- Ensures reproducible builds and prevents unexpected version drift
This change improves build reproducibility by ensuring that the versions
specified in package.json files match exactly what yarn.lock resolves to.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: store ads clickid when creating an account
* fix: type check
* fix: google campaignId not being added to stripe
* remove tracking in stripe app
* fix(auth): validate IdP authority before SAML account linking
Adds verification that SAML IdP is authoritative for the email domain
before allowing account conversion
* fix(auth): deny by default on missing SAML tenant + optimize membership query
- Block account conversion when tenant is missing (deny by default)
- Replace JOIN + ILIKE with two indexed lookups for O(1) performance
* refactor(auth): apply data minimization to security logs
* feat: add toggle to opt out of booking title translation in instant meetings (#25547)
* feat: add toggle to opt out of booking title translation in instant meetings
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateTitleEnabled to test builder
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: respect autoTranslateTitleEnabled toggle in InstantBookingCreateService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: fetch autoTranslateTitleEnabled directly in InstantBookingCreateService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: rename autoTranslateTitleEnabled to autoTranslateInstantMeetingTitleEnabled
- Renamed field to clarify it only applies to instant meeting title translation
- Moved Prisma query to EventTypeRepository.findInstantMeetingConfigById()
- Removed title translation logic from update.handler.ts (flag only controls instant meeting title)
- Updated all references across the codebase
- Added new i18n translation keys for the renamed field
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateInstantMeetingTitleEnabled to test destructuring patterns
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: use Prisma.TeamCreateInput type for metadata in test helper
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateInstantMeetingTitleEnabled to mockUpdatedEventType in test
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: use generic findByIdMinimal instead of business-specific method
- Add autoTranslateInstantMeetingTitleEnabled to eventTypeSelect constant
- Remove findInstantMeetingConfigById from EventTypeRepository
- Update InstantBookingCreateService to use findByIdMinimal
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: remove autoTranslateInstantMeetingTitleEnabled from eventTypeSelect (not needed for findByIdMinimal)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat: add autoTranslateInstantMeetingTitleEnabled to event type form defaults
- Rename shouldTranslateTitle to shouldAutoTranslateInstantMeetingTitle for clarity
- Add autoTranslateInstantMeetingTitleEnabled to findById and findByIdForOrgAdmin selects
- Add autoTranslateInstantMeetingTitleEnabled to useEventTypeForm defaultValues
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: only update autoTranslateInstantMeetingTitleEnabled when explicitly provided
Fixes issue where omitting the field in update requests would overwrite
the saved opt-out setting with the default value (true). Now the field
is only included in the update payload when explicitly provided.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: Create standard for rate limits
---------
Co-authored-by: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Handle Stripe logic in `paymentCallback`
* Remove endpoint
* Do not send email verification email if premium username
* Remove logic from verify-view
* Callback send verification email
* Add `create` method to `VerificationToken` repository
* Create `VerificationTokenService`
* Early return if payment failed
* Refactor token generation
* Add tests
* Type fixes
* Type fixes
2025-11-21 19:51:19 +00:00
Joe Au-YeungGitHubcubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Syed Ali Shahbaz
* Move TeamBillingRepositories
* WIP refactor team internal billing service
* Remove duplicate billing repository files
* Remove logic check in repository for billing is enabled
* Rename repository to `TeamBillingData`
* Use repository factory in main service
* Fix new import paths
* Rename to
* Ensure `IS_TEAM_BILLING_ENABLED` is of type boolean
* Rename classes to TeamBillingService and TeamBillingServiceFactory
* Implement DI in `BookingServiceFactory`
* `TeamBillingService` use repository in `getOrgIfNeeded`
* DI `isTeamBillingEnabled` to `TeamBillingServiceFactory`
* Rename files for consistency
* Return stub BillingRepository if billing is not enabled
* Move Stripe billing service to service folder
* Rename file
* `StripeBillingService.getSubscriptionStatus` return `SubscriptionStatus`
* Type fices in StripeBillingService
* Type fix in `stubTeamBillingService`
* DI the `BillingProviderService` into the `TeamBillingService`
* Implement DI in `skipTeamTrials.handler`
* Implement DI for team billing in `inviteMember.handler`
* `skipTeamTrials.handler` use `team.isOrganization`
* Implement DI for billing in `hasActiveTeamPlan.handler`
* Type fixes
* Implement DI in `bulkDeleteUsers.handler`
* Implement `BillingProviderServiceFactory` in `updateProfile.handler`
* Implment `BillingProviderServiceFactory` in `buyCredits.handler`
* Fix import in `stripeCustomer.handler`
* Add a constructor to `teamBillingServiceFactory`
* Add DI to `PrismaTeamBillingRepository`
* Add DI to `StripeBillingService`
* Implement singleton in `BillingProviderServiceFactory`
* Add DI folder and contents to billing folder
* Use `getTeamBillingServiceFactory` in `inviteMember.handler`
* Add `saveTeamBilling` method to `ITeamBillingService`
* Implement DI in new team route
* Implement DI in `teamService`
* Implement DI in `OrganizationPaymentService`
* Implement DI in `credit-service`
* In `StripeBillingService` remove `static` from status methods
* Implemnt DI in `_invoice.paid.org`
* Refactor `hasActiveTeamPlan` to use `getTeamBillingFactory`
* Refactor `skipTeamTrials` to use `getTeamBillingFactory`
* Refactor `skipTeamTrials` to use `getTeamBillingServiceFactory`
* `stripeCustomer.handler` to use `getBillingProviderService`
* Remove old factories
* Type fix
* Remove unused factory
* Refactor `updateProfile.handler` to use `getBillingProviderService`
* Change name to `TeamBillingDataRepositoryFactory`
* Type Prisma return in `prisma.module`
* Type fix
* Refactor `buyCredits.handler` to use `getBillingProviderService`
* Refactor `credit-service` to use billing DI containers
* Type fix
* Add `getTeamBillingDataRepository`
* Refactor `_invoice.paid.org` to use DI container
* Refactor `_customer.subscription.deleted.team-plan` to use DI container
* Refactor `calcomHandler` to use DI container
* Refactor `getCustomerAndCheckoutSession` to use DI container
* Refactor `verify-email` to use DI containers
* Refactor `api/create/route` to use DI container
* Refactor downgradeUsers to use DI container
* Type fix
* Clean up console.logs
* Add await to `this.billingRepository.create` in `saveTeamBilling`
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Fix type errors
* Address comments
* fix: update tests to work with new DI pattern
- Update teamBillingService.test.ts to properly inject DI dependencies
- Remove unused billingModule import and mock
- Fix import naming in teamService.integration-test.ts (remove unused rename)
- Fix import path for TeamBillingPublishResponseStatus
All tests now properly mock IBillingProviderService, ITeamBillingDataRepository,
and IBillingRepository instead of using the old BillingRepositoryFactory pattern.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add compatibility layer and env setup for unit tests
- Add STRIPE_PRIVATE_KEY dummy value to vitest.config.ts to prevent DI module errors
- Fix import paths in credit-service.test.ts (StripeBillingService, TeamBillingService)
- Create compatibility barrel at packages/features/ee/billing/teams/index.ts for test mocking
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: update unit tests to mock DI container properly
- Update teamService.test.ts to mock getTeamBillingServiceFactory() instead of TeamBilling.findAndInit
- Update teamService.alternative.test.ts to mock DI container
- Update credit-service.test.ts to mock getBillingProviderService() and use SubscriptionStatus enum values
- Update OrganizationPaymentService.test.ts to mock DI container instead of direct StripeBillingService import
- Remove all 'as any' type casting to comply with Cal.com coding standards
- Fix unused variable warnings by prefixing with underscore
All 53 tests now passing (16 + 1 + 30 + 6)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: update remaining unit tests to use DI pattern
- Fix StripeBillingService.test.ts to inject mock Stripe client directly
- Fix teamBillingFactory.test.ts to mock getTeamBillingServiceFactory() from DI container
- Fix skipTeamTrials.test.ts to mock DI container and use SubscriptionStatus enum
All 11 previously failing tests now pass (5 + 5 + 1)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Undo changes made to Prisma module
* fix: address test-related PR comments
- Fix OrganizationPaymentService.test.ts mock path from @calcom/ee to @calcom/features/ee
- Refactor teamBillingFactory.test.ts to test real factory logic instead of mocking container
- Remove duplicate teamBillingService.test..ts file with incorrect double-dot filename
All three test files now pass successfully with proper DI patterns.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Address feedback
* fix: update teamService integration test to mock new DI factory pattern
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: remove duplicate imports in credit-service.test.ts
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* Remove unused index file
* `getBySubscriptionId` to return team or null
* Address feedback
* Merge fix
* Refactor file names
* fix: correct mockStripe variable name to stripeMock in StripeBillingService.test.ts
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: update internal-team-billing.test.ts to use new DI structure with TeamBillingService
- Replace InternalTeamBilling with TeamBillingService
- Use constructor injection with mock dependencies instead of factory pattern
- Remove BillingRepositoryFactory mock and import
- Update all test cases to use mockBillingProviderService, mockTeamBillingDataRepository, and mockBillingRepository
- Simplify saveTeamBilling tests to focus on repository.create calls
- All 11 tests now pass with the new DI structure
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: update createWithPaymentIntent.handler.test.ts to mock DI container's getBillingProviderService
- OrganizationPaymentService now uses getBillingProviderService() from DI container
- Test was mocking @calcom/features/ee/payments/server/stripe directly, which no longer works
- Added mock for @calcom/features/ee/billing/di/containers/Billing module
- Mock returns fake billing provider that delegates to mockSharedStripe
- Preserves all existing test assertions and helpers
- Fixed lint error by prefixing unused lastCreatedSessionId with underscore
- All 11 tests now pass (1 skipped as expected)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com>
2025-11-19 10:21:22 -05:00
MorganGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>hbjORbj
* refactor: Split EmailManager into focused service files
- Created separate service files for different email categories:
- auth-email-service.ts: Authentication and verification emails
- organization-email-service.ts: Organization and team emails
- billing-email-service.ts: Payment and credit-related emails
- integration-email-service.ts: Integration and app-related emails
- workflow-email-service.ts: Workflow and custom emails
- recording-email-service.ts: Recording and transcript emails
- Refactored email-manager.ts to keep only core booking lifecycle functions
- Removed unused imports from email-manager.ts
- Updated index.ts to export from all new service files
- Updated all imports across the codebase to use package root (@calcom/emails)
- Fixed lint warnings in handleChildrenEventTypes.ts
This reduces the import cost of EmailManager by allowing consumers to import only the specific email services they need.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: Update all imports to use direct service file paths
- Update 49 files to import directly from service files instead of barrel file
- Update packages/emails/index.ts to keep only email-manager and renderEmail exports
- Fix dynamic import in passwordResetRequest.ts
- Update renderEmail imports to use direct path
- Update test file to import from specific service module
- Fix ESLint warnings in modified files (unused variables, unused expressions)
This ensures consumers only import the specific email services they need,
reducing import cost by avoiding the barrel file pattern for service files.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: Use default import for renderEmail
renderEmail is exported as a default export, not a named export.
Changed from 'import { renderEmail }' to 'import renderEmail'.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: Update test mocks to use direct service file imports
- Update handleNoShowFee.test.ts to mock @calcom/emails/billing-email-service
- Update credit-service.test.ts to mock @calcom/emails/billing-email-service
- These tests were failing because they were mocking the barrel file @calcom/emails
which no longer exports service functions after the refactoring
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: unit test spy
* fix: unit test mock
* address cubic comments
* fix: type error sendMonthlyDigestEmail
* remove barrel file and sendEmail unused task
* fixup! remove barrel file and sendEmail unused task
* fixup! fixup! remove barrel file and sendEmail unused task
* fix: integration test mock emails
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: hbjORbj <sldisek783@gmail.com>
* fix: APIV2 team membership addition
* feat: Add trimming for email domain and orgAutoAcceptEmail in auto-accept logic
- Trim whitespace from both user email domain and orgAutoAcceptEmail
- Ensures consistent matching even with accidental whitespace
- Addresses feedback from PR review
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* simplify
* feat: Use shared OrganizationMembershipService in TRPC for consistent auto-accept logic
- Create OrganizationMembershipService.container.ts for DI in TRPC
- Update getOrgConnectionInfo to apply trimming + case-insensitive comparison
- Precompute auto-accept decisions in createNewUsersConnectToOrgIfExists using the service
- Use service in handleNewUsersInvites for consistent auto-accept determination
- Ensures both API v2 and TRPC paths use identical trimming and normalization logic
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Revert "feat: Use shared OrganizationMembershipService in TRPC for consistent auto-accept logic"
This reverts commit 0b2bd28b6e32e8c1d3dea139ca8ff9cbf402ac00.
* refactor: Unify OrganizationRepository and remove duplicate PrismaOrganizationRepository (#24869)
* refactor: Convert OrganizationRepository from static to instance methods
- Add constructor accepting deps object with prismaClient
- Convert all static methods to instance methods
- Add getOrganizationAutoAcceptSettings method
- Create singleton instance export in repository barrel file
- Update API v2 OrganizationsRepository to extend from OrganizationRepository
- Update all call sites to use singleton instance
- Add platform-libraries organizations.ts export
- Fix mock imports to use repository barrel
- Fix unsafe optional chaining in next-auth-options.ts
- Fix any types in test files with proper type inference
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update all imports to use OrganizationRepository barrel export
- Update imports from direct OrganizationRepository file to barrel export
- This ensures mocks work correctly in tests
- Fixes 202 failing tests related to organizationRepository mock
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update test mocks to use partial mock pattern
- Convert organizationMock to partial mock that preserves real class
- Add proper prisma mocks to failing test files
- Remove old OrganizationRepository mocks from test files
- This fixes test failures related to mock interception
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Export mocked singleton and update tests to use it directly
- Export mockedSingleton as organizationRepositoryMock from organizationMock
- Update delegationCredential.test.ts to import and use the exported mock
- This fixes 'vi.mocked(...).mockResolvedValue is not a function' errors
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Use platform-libraries import for API v2 OrganizationRepository
API v2 should import shared features through @calcom/platform-libraries
instead of directly from @calcom/features to maintain proper architectural
boundaries and packaging/licensing separation.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: Implement DI pattern for OrganizationRepository
- Create OrganizationRepository.module.ts and .container.ts for DI
- Replace singleton pattern with getOrganizationRepository() across 20 files
- Update platform-libraries to export getOrganizationRepository
- Delete duplicate PrismaOrganizationRepository.ts
- Remove singleton export file (repositories/index.ts)
- Update test mocks to use DI container pattern
- All type checks and unit tests passing
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Implement read/write client separation in OrganizationRepository
- Updated OrganizationRepository constructor to accept optional prismaWriteClient parameter
- Routed all write operations (create, update) through prismaWrite client
- Routed all read operations (find, get) through prismaRead client
- Updated API v2 OrganizationsRepository to pass both dbRead.prisma and dbWrite.prisma to super()
- Optimized getOrganizationRepository() calls by storing in local variables to avoid repeated function calls
- This fixes the critical issue where API v2 was passing read-only client to base class with write methods
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Fix mock setup and optimize getOrganizationRepository() calls
- Fixed verify-email.test.ts mock to return mocked repository instance instead of scenario helper object
- Added mockReset to organizationMock.ts beforeEach to properly reset mock implementations between tests
- Added local variables in page.tsx to store getOrganizationRepository() result for consistency
This fixes the issue where getOrganizationRepository() was returning organizationScenarios.organizationRepository (scenario helper) instead of the actual mocked repository instance, causing findUniqueNonPlatformOrgsByMatchingAutoAcceptEmail to be undefined.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* refactor: Simplify OrganizationRepository to use single prismaClient
- Updated base OrganizationRepository constructor to accept only { prismaClient } instead of { prismaClient, prismaWriteClient? }
- Replaced this.prismaRead and this.prismaWrite with single this.prismaClient property
- Updated API v2 OrganizationsRepository to pass only dbWrite.prisma as prismaClient
- Removed unused PrismaReadService import from API v2
- All read and write operations now use the same client instance
This simplifies the architecture as requested - API v2 uses write client for all operations, and apps/web uses the client from DI container.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: Match OrganizationsRepository.findById signature with base class
The findById method in OrganizationsRepository was using a different signature
than the base OrganizationRepository class, causing type errors in CI.
Changed from: findById(organizationId: number)
Changed to: findById({ id }: { id: number })
This matches the base class signature and resolves the CI unit test failures.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Update all findById call sites to use object parameter
Fixed 6 call sites in API v2 that were calling findById with a number
instead of the required { id: number } object parameter:
- is-org.guard.ts
- is-admin-api-enabled.guard.ts
- is-webhook-in-org.guard.ts
- organizations.service.ts
- managed-organizations.service.ts (2 call sites)
This resolves the API v2 build failure caused by the signature change
in OrganizationsRepository.findById to match the base class.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* fix: Remove redundant findById override from OrganizationsRepository
The findById method was duplicating the base class OrganizationRepository
implementation. Both methods had identical logic (filtering by isOrganization: true),
so the override was unnecessary.
Since OrganizationsRepository extends OrganizationRepository and passes
dbWrite.prisma to the base constructor, the base class method already
provides the exact same functionality.
This resolves the API v2 build failure by eliminating the duplicate method
that was causing conflicts.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Remove unncessary changes
* Store in variable
* Revert "Remove unncessary changes"
This reverts commit af9351786a21616c9508c441191c17f2374fb2cc.
* Revert dbRead/dbWrite changes
* Add organizations library to tsconfig.json
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
## What does this PR do?
Currently we load /event-types for a few seconds while the onboarding hook catches up. This adds that logic to the serverside and not just client side to ensure onboarding is triggered
Adds server-side onboarding redirect checks to prevent users from accessing event types pages before completing onboarding. This implementation:
- Creates a new `checkOnboardingRedirect` utility function in a dedicated file
- Applies the redirect check on both the root page and event-types page
- Optimizes performance by using organizationId from session when available
- Handles email verification requirements before redirecting to onboarding
- Supports both legacy and v3 onboarding paths based on feature flags
## How should this be tested?
- Create a new user account that hasn't completed onboarding
- Attempt to access the root page or event-types page directly
- Verify you're redirected to the appropriate onboarding flow
- Test with email verification feature flag enabled/disabled
- Test with onboarding-v3 feature flag enabled/disabled
- Verify users who have completed onboarding can access event-types normally
- Verify organization users aren't redirected to onboarding
## Video Demo
Before:
[CleanShot 2025-10-30 at 10.54.41.mp4 <span class="graphite__hidden">(uploaded via Graphite)</span> <img class="graphite__hidden" src="https://app.graphite.dev/user-attachments/thumbnails/8282decc-a00d-4bc8-9215-fe1c4809fd8f.mp4" />](https://app.graphite.dev/user-attachments/video/8282decc-a00d-4bc8-9215-fe1c4809fd8f.mp4)
After
## [CleanShot 2025-10-30 at 10.54.06.mp4 <span class="graphite__hidden">(uploaded via Graphite)</span> <img class="graphite__hidden" src="https://app.graphite.dev/user-attachments/thumbnails/2acc7601-6c8c-496a-af4d-08dadef9aa2d.mp4" />](https://app.graphite.dev/user-attachments/video/2acc7601-6c8c-496a-af4d-08dadef9aa2d.mp4)
## Checklist
- [x] I have self-reviewed the code
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a documentation change
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works
