* refactor: apply biome formatting to packages/features (batch 1 - small subdirs)
Format small subdirectories in packages/features: di, flags, holidays, oauth,
settings, users, assignment-reason, selectedCalendar, hashedLink, host, form,
form-builder, availability, data-table, pbac, schedules, troubleshooter,
eventtypes, calendar-subscription, and root-level files.
Also includes straggler apps/web BookEventForm.tsx.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 2 - medium subdirs)
Format medium subdirectories in packages/features: auth, credentials,
calendars, routing-forms, routing-trace, attributes, watchlist, calAIPhone,
tasker, and webhooks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 3 - bookings + insights)
Format bookings and insights subdirectories in packages/features.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 4 - ee)
Format packages/features/ee subdirectory covering billing, workflows,
organizations, teams, managed-event-types, round-robin, dsync,
integration-attribute-sync, and payments.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 5 - booking-audit part 1)
Format booking-audit di, actions, common, dto, repository, and types
subdirectories in packages/features/booking-audit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: apply biome formatting to packages/features (batch 6 - booking-audit part 2)
Format booking-audit service subdirectory in packages/features/booking-audit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-11 15:47:14 +01:00
Peer RichelsenGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Volnei Munhozcubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* feat: add Cloudflare URL Scanner integration for malicious URL detection
- Add MALICIOUS_URL_IN_WORKFLOW to LockReason enum
- Add URL_SCANNING_ENABLED constant for feature flag
- Create urlScanner.ts utility for Cloudflare Radar URL Scanner API
- Create scanWorkflowUrls task for async URL scanning with polling
- Integrate URL scanning into scanWorkflowBody task
- Add URL scanning for event type redirect URLs
- Lock user accounts when malicious URLs are detected
- Fix pre-existing lint issues (parseInt radix, optional chaining)
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address biome lint warnings and TypeScript iterator errors
- Wrap iterators with Array.from() to fix TS2802 errors
- Add biome-ignore comments for process.env usage
- Extract helper functions to reduce function length
- Move exports to end of file per useExportsLast rule
- Remove problematic imports that cause TypeScript errors
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address cubic-dev-ai review comments for URL scanning
- Fix P0: Re-fetch workflow steps before scheduling notifications to use actual verifiedAt values from database instead of overriding with new Date()
- Fix P1: Mark workflow step as verified in submitWorkflowStepForUrlScanning when URL scanning is disabled or no URLs found
- Fix P1: Add whitelistWorkflows parameter to submitUrlForUrlScanning for consistency
- Fix P2: Preserve URL context in error results in urlScanner.ts scanUrls function
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: add select clause to Prisma query for workflow steps
Address cubic-dev-ai P2 comment: Use select to fetch only the required
fields (id, action, sendTo, emailSubject, reminderBody, template, sender,
verifiedAt) instead of fetching all columns from workflowStep table.
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: add select clause to Prisma query in scanWorkflowBody.ts
Address cubic-dev-ai P2 review comment: Use select to fetch only the
required fields (id, action, sendTo, emailSubject, reminderBody,
template, sender, verifiedAt) instead of fetching all columns.
Co-Authored-By: peer@cal.com <peer@cal.com>
* test: add unit tests for URL scanning functionality
- Add tests for urlScanner.ts (extractUrlsFromHtml, isUrlScanningEnabled)
- Add tests for scanWorkflowUrls.ts (happy/unhappy paths for URL scanning task)
- Add tests for scanWorkflowBody.ts (happy/unhappy paths for workflow body scanning)
Tests cover:
- URL extraction from HTML content
- URL normalization and deduplication
- Handling of malicious URLs and user locking
- Fail-open behavior for API errors
- Whitelisted user handling
- Iffy spam detection integration
Co-Authored-By: peer@cal.com <peer@cal.com>
* test: remove incomplete test that provides no value
Removed the 'should mark all steps as verified when neither Iffy nor URL scanning is enabled' test as it used vi.doMock() which doesn't work after module import, had no assertions, and gave false confidence in test coverage.
Co-Authored-By: peer@cal.com <peer@cal.com>
* refactor: use Cloudflare bulk scanning endpoint to reduce API quota usage
- Added submitUrlsForBulkScanning function that uses /urlscanner/v2/bulk endpoint
- Updated scanUrls to use bulk submission instead of individual URL submissions
- Bulk endpoint accepts up to 100 URLs per request, batching is handled automatically
- Reduces API quota usage as suggested by keithwillcode
Co-Authored-By: peer@cal.com <peer@cal.com>
* Update packages/features/tasker/tasks/scanWorkflowUrls.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix: address cubic-dev-ai review comments
- P1: Sanitize URLs before logging to prevent exposing sensitive query parameters
- P2: Extract handleUrlScanningForStep helper function to reduce code duplication
- P2: Use vi.stubGlobal for fetch mock in tests for proper cleanup
Co-Authored-By: peer@cal.com <peer@cal.com>
* fix: address volnei review comments on PR #26387
- Move vi.unstubAllGlobals() to afterEach hook in iffyScanBody tests
- Restore updateMany optimization when URL scanning is disabled
Co-Authored-By: peer@cal.com <peer@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Volnei Munhoz <volnei@cal.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-01-21 12:28:57 -03:00
Benny JooGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: migrate workflows utilities from trpc to features layer
Move workflow utility functions from packages/trpc/server/routers/viewer/workflows/util.ts
to packages/features/ee/workflows/lib/workflowUtils.ts to break circular dependencies.
Functions migrated:
- isAuthorized
- getAllWorkflowsFromEventType
- scheduleWorkflowNotifications
- scheduleBookingReminders
Changes:
- Created new workflowUtils.ts in features layer with migrated functions
- Added getBookingsForWorkflowReminders to WorkflowRepository (no prisma outside repositories)
- Updated all imports in features layer to use new location
- Updated trpc util.ts to re-export from features for backward compatibility
- Fixed pre-existing lint warning (any -> unknown) in handleMarkNoShow.ts
This is part of the effort to remove circular dependencies between
packages/features and packages/trpc.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* refactor: remove re-exports from trpc util.ts, update imports to use features layer
Per user request, removed the backward compatibility re-exports from
packages/trpc/server/routers/viewer/workflows/util.ts and updated all
imports in the trpc package to import directly from the features layer.
Files updated to import from @calcom/features/ee/workflows/lib/workflowUtils:
- confirm.handler.ts (getAllWorkflowsFromEventType)
- delete.handler.ts (isAuthorized)
- update.handler.ts (isAuthorized, scheduleWorkflowNotifications)
- getAllActiveWorkflows.handler.ts (getAllWorkflowsFromEventType)
- get.handler.ts (isAuthorized)
- util.test.ts (isAuthorized)
- delete.handler.test.ts (isAuthorized)
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: update test imports to use features layer for workflow utilities
Updated test files to import scheduleBookingReminders and
scheduleWorkflowNotifications from @calcom/features/ee/workflows/lib/workflowUtils
instead of @calcom/trpc/server/routers/viewer/workflows/util.
Files updated:
- packages/features/ee/workflows/lib/test/workflows.test.ts
- packages/features/tasker/tasks/scanWorkflowBody.test.ts
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* refactor: split workflowUtils.ts into individual files
Split the monolithic workflowUtils.ts into separate files for each function:
- isAuthorized.ts - Authorization check for workflow access
- getAllWorkflowsFromEventType.ts - Get workflows for an event type
- scheduleWorkflowNotifications.ts - Schedule workflow notifications
- scheduleBookingReminders.ts - Schedule booking reminders
The workflowUtils.ts now re-exports from these individual files for
backward compatibility.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix import
* fix more
* wip
* wip
* remove workflowUtils
* wip
* refactor deleteRemindersOfActiveOnIds
* fix
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix deleting reminders
* schedule reminders if iffy is disabled
* fix unit test
* clean up code
---------
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
* Add Iffy API key variable
* WIP using Iffy to scan comments
* Use Iffy for workflow body scanning
* Update entity
* Clean up
* Update test
* Fix client id
* Fix test
* Add whitelistWorkflows to user
* Do not autolock whitelisted users
* Add endpoint to whitelist a user
* Get users data - include whitelistWorkflows
* Whitelist a user on the user admin page
* Fix typo
* Add test
* Use translations
* Add `updateWhitelistWorkflows` to `UserRepository`
* Use i18 for strings
* Rename to whitelistWorkflows
---------
Co-authored-by: Benny Joo <sldisek783@gmail.com>
* Add translations in respective files
* implement multilingual support for email templates
* fix: indentation in common.js & typos in common.js and update.handler.ts
* Add akismet package to tasker
* Create scanWorkflowBody task
* Schedule workflow body scan
* Add AKISMET_API_KEY .env
* Auto lock user if spam is detected
* Uncommit key
* Add safe param to workflow step
* Migration for safe field
* Do not process workflow steps is `safe` is false
* Update migration to set previous records to true
* Address comments
* Refactor `scheduleWorkflowNotifications` to accept an object
* If new steps or editing old ones send to tasker
* Call `scheduleWorkflowNotifications` in task
* Fix `IS_SELF_HOSTED`
* Remove unused function
* Make `safe` optional in schema
* Type fix
* Revert "Make `safe` optional in schema"
This reverts commit d0964702affa87c35562300301473d25635c565b.
* Revert "Type fix"
This reverts commit d9a031303269a2994ae46f576ab2a3d31e4d977b.
* Type fixes
* Type fixes
* Address comments
* Fix tests
* Add tests
* Update tests
* Typo fix
* Update `safe` to `verifiedAt`
* feat: Compare workflow reminder bodies to default template (#19060)
* Add `getTemplateForAction` function
* Use `getTemplateForAction` when creating a new step
* Use `getTemplateForAction` when action changes
* Have `emailReminderTemplate` accept an object as a param
* Rename `getTemplateForAction` to `getTemplateBodyForAction`
* Simplify changing body when changing templates
* Create `compareReminderBodyToTemplate`
* In task, compare if reminderBody is a template
* Linting
* Add tests
* refactor: `emailReminderTemplate` to accept object as param (#19288)
* Add `getTemplateForAction` function
* Use `getTemplateForAction` when creating a new step
* Use `getTemplateForAction` when action changes
* Have `emailReminderTemplate` accept an object as a param
* Rename `getTemplateForAction` to `getTemplateBodyForAction`
* Simplify changing body when changing templates
* Create `compareReminderBodyToTemplate`
* In task, compare if reminderBody is a template
* Linting
* Add tests
* Refactor `scheduleEmailReminders`
* Refactor `create.handler` for new workflows
* Refactor `emailReminderManager`
* Refactor `getEmailTemplateText`
* Fix typo
* Type fix - whatsapp plain text template imports
* Type fix - no template found
* Type fix - add `isBrandingDisabled` to `emailReminderTemplate`
* Add workflow and user to prisma mock
* Fix imports for akismet dependencies
* Record user lock reason
* Undo linting changes
* Fix tests
* New workflow, at verify created step
* Handle if `SCANNING_WORKFLOW_STEPS` is toggled
* Move `verifiedAt` checks to specific schedule functions
- `scheduleWhatsappReminder`
- `scheduleEmailReminder`
- `scheduleSMSReminder`
* Update logic
* Do not fallback verifiedAt
* Add comment to next.config.js
