e073cbd5ea54d59cd8a2bfa8e0287587d5aa692c
1633
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Amit SharmaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Keith Williams |
353f71bdc6 |
feat: Sink url shortner for sms workflow reminders (#26608)
* feat: Sink url shortner for sms workflow reminders * fix: remove hardcoded dub values * update .env.example * fix: unit tests * chore: add tests for scheduleSmsReminder and utils * review refactor * fix: type check * review refactor * fix: update test to account for smsReminderNumber fallback from main Co-Authored-By: unknown <> * feat: add feature flag for sink and more tests to verify * fix: type check * use proper feature flags for sink * Apply suggestion from @keithwillcode --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Keith Williams <keithwillcode@gmail.com> |
||
|
|
592cb4fb7b |
feat: add platform URL support for reschedule and cancel links in workflow emails (#27132)
* feat: add platform URL support for reschedule and cancel links in workflow emails Co-Authored-By: morgan@cal.com <morgan@cal.com> * feat: pass platform URL data to CalendarEventBuilder in workflow emails Co-Authored-By: morgan@cal.com <morgan@cal.com> * Revert "feat: pass platform URL data to CalendarEventBuilder in workflow emails" This reverts commit 1d4d3623c93cd4eeeef18ffdad0597fe583b6a55. * chore: provide platform metadat to workflow email task * fixup! chore: provide platform metadat to workflow email task * test: add unit tests for platform URL handling in EmailWorkflowService Co-Authored-By: morgan@cal.com <morgan@cal.com> * test: update WorkflowService tests to include platform params in tasker payload Co-Authored-By: morgan@cal.com <morgan@cal.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Hariom BalharaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Udit Takkarbot_apk |
a4621da2be |
feat: make source required on EventBusyDetails for Troubleshooter display (#27088)
* feat: make source required on EventBusyDetails for Troubleshooter display - Make source a required property on EventBusyDetails type - Update LimitManager to accept and store source when adding busy times - Add user-friendly source names for all busy time types: - 'Booking Limit' for booking limit busy times - 'Duration Limit' for duration limit busy times - 'Team Booking Limit' for team booking limit busy times - 'Buffer Time' for seated event buffer times - 'Calendar' for external calendar busy times - Ensure all entries in detailedBusyTimes have source set - Cover includeManagedEventsInLimits and teamBookingLimits branches Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * feat: add limit value and unit metadata to busy time sources - Include limit value and unit in source strings for Troubleshooter display - Booking Limit: shows as 'Booking Limit: 5 per day' - Duration Limit: shows as 'Duration Limit: 120 min per week' - Team Booking Limit: shows as 'Team Booking Limit: 10 per month' - Preserves existing calendar sources (e.g., 'google-calendar') Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * feat: enhance busy time management with new limit sources - Introduced new limit sources for busy times, including event booking and duration limits, with user-friendly titles for display. - Updated LimitManager to accept and store detailed busy time information, including title and source. - Refactored busy time addition logic across various services to utilize the new structure, improving clarity and maintainability. * fixes * feat: conditionally include source and translate busy time titles - Add withSource parameter to conditionally include/exclude source from response - Translate busy time titles on frontend using useLocale hook - Source is only included when withSource=true (for Troubleshooter display) Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * feat: enhance user availability service and busy time handling - Updated LargeCalendar component to include event ID check for enabling busy times. - Added translation for "busy" in common.json for better user experience. - Refactored getUserAvailability service to include new method for fetching user availability with busy times from limits. - Introduced parseLimits function to streamline booking and duration limit parsing. - Improved error handling in user handler for better user feedback. * refactor: remove unnecessary timeZone: undefined from addBusyTime calls Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * feat: add buffer_time and calendar translation keys for busy times Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * feat: add event source to calendar components and improve busy time handling - Updated EventList component to include event source in data attributes for better tracking. - Enhanced LargeCalendar component to pass event * fix: add missing source property to Date Override calendar event Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * fix: use 'date-override' as source for Date Override calendar events Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * Avoid type assertion * fix: pass both bookingLimits and durationLimits to getStartEndDateforLimitCheck (#27898) * test: add unit tests for getUserAvailabilityIncludingBusyTimesFromLimits Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * fix: pass both bookingLimits and durationLimits to getStartEndDateforLimitCheck - Fix bug where bookingLimits || durationLimits was passed as single param - Skip getBusyTimesForLimitChecks when eventType has no limits - Remove as never casts, use proper typing for mock dependencies - Replace expect.any(String) with exact ISO date assertions Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * refactor: replace loose assertions with exact values in tests Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: address review feedback on busy time sources - Fix t("busy") fallback to t("busy_time.busy") for correct translation lookup - Add missing title property to buffer time entries for Troubleshooter display - Use descriptive debug strings for buffer time source field - Fix import ordering in LargeCalendar.tsx Co-authored-by: Hariom Balhara <hariombalhara@gmail.com> Co-Authored-By: unknown <> * fix: preserve pre-existing busyTimesFromLimitsBookings from initialData Address review feedback from @hariombalhara (comment #30, #31): - Initialize busyTimesFromLimitsBookings from initialData instead of [] to avoid silently overwriting pre-existing data with an empty array - Use conditional spread to only include busyTimesFromLimitsBookings when it has a value - Add test verifying pre-existing busyTimesFromLimitsBookings is preserved and passed through to _getUserAvailability - Add test verifying busyTimesFromLimitsBookings is not passed when there are no limits and no initialData bookings Co-authored-by: Hariom Balhara <hariombalhara@gmail.com> Co-Authored-By: bot_apk <apk@cognition.ai> * fix: pass fetched eventType to _getUserAvailability to avoid duplicate DB query Addresses Devin Review comment r2863593564: the wrapper method fetches eventType but wasn't passing it through, causing _getUserAvailability to re-fetch the same eventType from the database. Also adds a test verifying eventType is forwarded correctly. Co-Authored-By: bot_apk <apk@cognition.ai> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com> Co-authored-by: bot_apk <apk@cognition.ai> |
||
|
|
d630556dae |
fix: remove unreachable code in deleteDomain function (#28312)
The deleteDomain function had a 'return false' statement after 'return isDomainDeleted && isDnsRecordDeleted' which could never be reached. Co-authored-by: Harshith Kumar <mharshithkumar6@gmail.com> |
||
|
Rajiv SahalGitHubamritDevanshu SharmaDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Sean Brydonbot_apk |
e2add3f2c9 |
feat: enable microsoft sign ups (#28080)
* fix: trigger lingo.dev by removing duplicate value * under progress * wow this worked * migrate schema * fix types * fix import for google login * Add onboarding tests for Azure (Microsoft sign up) * add comments back * fix failing test * fix: update Outlook login configuration and improve type safety in authentication adapter - Set OUTLOOK_LOGIN_ENABLED to false in .env.example - Refactor getServerSideProps to directly use samlTenantID and samlProductID - Update linkAccount method in next-auth-custom-adapter for better type handling - Remove redundant comment in next-auth-options related to Azure AD email verification * remove log * remove debug log from signin callback in next-auth options * fixup * chore: standardize naming * chore: add primary calendar for outlook, verify email and auto link org for outlook * chore: helper fns * chore: implement cubic feedback * cleanup * chore: implement cubic feedback again * WIP design# * feat: login design * fix: map identity provider names correctly * 32px of mt * fix: login UI * fix: type check * fix: fix type check again * chore: update OAuth login tests * fixup * fix: bad import * chore: update tests * fixup * fix: locales test * chore: implement PR feedback and fix minor issues * fix: revert token spreading change * fix: merge conflicts * chore: revert signup view changes * fixup: bring back reverted changes because of merge conflicts * fix: disable email input when microsoft sign in is in progress * chore: implement cubic feedback * cleanup: unused variables * fix: address Cubic AI review feedback (confidence >= 9/10) - Remove userId (PII) from log payloads in updateProfilePhotoMicrosoft.ts - Replace text selectors with data-testid in locale.e2e.ts and oauth-provider.e2e.ts - Restore callbackUrl redirect parameter in signup link in login-view.tsx - Add data-testid='login-subtitle' to login page subtitle element Co-Authored-By: unknown <> * fix: use empty alt for decorative icon images in login view MicrosoftIcon and GoogleIcon are decorative (adjacent to text labels), so they should have empty alt attributes per accessibility best practices. Co-Authored-By: unknown <> * chore: implement cubic feedback * cleanup * fixup * chore: implement PR feedback * chore: implement feedback * fix: address PR review feedback - type safety and centralize constants - Replace non-null assertions (!) with proper null checks for OUTLOOK_CLIENT_ID/SECRET - Replace `as any` casting with `Record<string, unknown>` for OAuth profile claims - Remove non-null assertion on account.access_token by adding conditional check - Centralize Outlook env constants in @calcom/lib/constants alongside MICROSOFT_CALENDAR_SCOPES - Add explanatory comment for getNextAuthProviderName usage in get.handler.ts Co-Authored-By: unknown <> * Revert "fix: address PR review feedback - type safety and centralize constants" This reverts commit 91ace141e6a28a23deea5897f7f9d6ad80319d84. * chore: implement feedback * chore: cleanup * chore: implement feedback * fix: merge conflicts * fix: revert formatting-only changes in packages/lib/constants.ts Co-Authored-By: unknown <> * fix: revert IdentityProvider enum location change in schema.prisma Co-Authored-By: unknown <> * chore: implement more PR feedback * fix: restore database-derived profileId from determineProfile in OAuth JWT The profileId regression was identified by Cubic AI (confidence 9/10). Previously, determineProfile's returned id was used to set profileId in the JWT via 'profileResult.id ?? token.profileId ?? null'. A recent refactor changed this to 'token.profileId ?? null', which drops the database-derived profile ID. On first OAuth login (or when profile switcher is disabled), token.profileId is likely null, so profileId would incorrectly be set to null even though determineProfile returned a valid profile with an id. This commit restores the correct priority chain: visitorProfileId ?? token.profileId ?? null Co-Authored-By: bot_apk <apk@cognition.ai> * refactor: revert pure formatting and import reordering changes Co-Authored-By: rajiv@cal.com <sahalrajiv6900@gmail.com> * fix: normalize determineProfile return type to use consistent 'id' field The determineProfile function returned a union type where one branch used 'id' and the other used 'profileId'. This caused TS2339 when destructuring 'id' from the result. Normalize the token.upId branch to also return 'id' (mapped from token.profileId) so the return type is consistent. Co-Authored-By: bot_apk <apk@cognition.ai> * chore: add tests * reveret: profileId changes should be in a separate PR * fix: avoid logging entire existingUser object in OAuth JWT callback Revert to logging only { userId, upId } instead of the full existingUser object, which contains PII (email, name, identity provider details). This restores the previous safe logging pattern. Co-Authored-By: bot_apk <apk@cognition.ai> * chore: remove profileId related tests --------- Co-authored-by: amrit <iamamrit27@gmail.com> Co-authored-by: Devanshu Sharma <devanshusharma658@gmail.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Sean Brydon <sean@cal.com> Co-authored-by: bot_apk <apk@cognition.ai> |
||
|
Eunjae LeeandGitHub
|
b7340f7151 | feat: add upgrade banners for teams and organizations (#27650) | ||
|
Udit TakkarGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Udit TakkarUdit Takkar |
4081d11fbe |
feat: workflow auto translation (#27087)
* feat: workflow auto translation * tests: add unit tests * refactor: tests and workflow * fix: type err * fix: type err * fix: remove redundant index on WorkflowStepTranslation The @@index on [workflowStepId, field, targetLocale] duplicates the @@unique constraint on the same columns. A unique index already provides efficient lookups, so the separate @@index adds storage overhead and write latency without benefit. Addresses Cubic AI review feedback (confidence 9/10). Co-Authored-By: unknown <> * fix: correct locale mapping when translation API returns null Map translations with their corresponding locales before filtering to preserve correct locale-to-translation associations. Previously, filtering out null translations would reindex the array, causing incorrect locale mappings when any translation in the batch failed. Also fixes pre-existing lint warnings: - Move exports to end of file - Add explicit return type to processTranslations - Replace ternary with if-else for upsertMany selection Co-Authored-By: udit@cal.com <udit222001@gmail.com> * fix: address review feedback for workflow auto-translation - Add change detection before creating translation tasks - Rename userLocale to sourceLocale in task props for clarity - Show source language in UI with new translation key - Extract SUPPORTED_LOCALES to shared translationConstants.ts - Fix locale mapping bug in translateEventTypeData.ts - Add WhatsApp translation support - Abstract translation lookup into shared translationLookup.ts helper - Restore if-else readability for SCANNING_WORKFLOW_STEPS Co-authored-by: Udit Takkar <udit.takkar@cal.com> Co-Authored-By: unknown <> * fix: update test to use sourceLocale instead of userLocale Co-Authored-By: unknown <> * refactor: feedback * fix: handle first time * fix: tests * fix: tests * fix: address Cubic AI review feedback (confidence 9/10 issues) - WhatsApp translation: Apply variable substitution using getSMSMessageWithVariables and clear contentSid when using translated body to ensure Twilio uses the translated text instead of the original template - update.handler.ts: Change sourceLocale assignment from ?? to || for consistency with tasker payload behavior (line 481) - ITranslationService.ts: Rename methods from plural to singular naming: - getWorkflowStepTranslations -> getWorkflowStepTranslation - getEventTypeTranslations -> getEventTypeTranslation Updated all call sites and tests accordingly Co-Authored-By: unknown <> * fix: address Cubic AI review feedback (confidence 9/10+ issues) - Fix getSMSMessageWithVariables to handle WHATSAPP_ATTENDEE action for locale and timezone (confidence 9/10) - Remove WhatsApp translation feature that set contentSid to undefined since Twilio ignores body parameter for WhatsApp and requires pre-approved Message Templates (confidence 10/10) Co-Authored-By: unknown <> * fix: translatio * Add tests: packages/features/eventTypeTranslation/repositories/EventTypeTranslationRepository.test.ts Generated by Paragon from proposal for PR #27087 * Add tests: packages/features/tasker/tasks/translateWorkflowStepData.test.ts Generated by Paragon from proposal for PR #27087 * chore: nit * chore: verfied atg * fix: set sourceLocale for new steps, add shouldDirty to checkbox, remove spec docs - Set sourceLocale fallback in addedSteps mapping to fix stale detection mismatch - Add { shouldDirty: true } to autoTranslateEnabled checkbox onChange - Remove specs/workflow-translation/ directory (planning docs, not for repo) Co-authored-by: Udit Takkar <udit.07.takkar@gmail.com> Co-Authored-By: unknown <> * chore: add specs back * fix: type error * fix: type error * fix: type err * fix: tests * refactor: feedback * fix: type err * refactor --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Udit Takkar <udit.takkar@cal.com> Co-authored-by: Udit Takkar <udit.07.takkar@gmail.com> |
||
|
Udit TakkarGitHubKeith WilliamsDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
e3a9f54ba5 |
feat: Configure cancellation reason (#26872)
* feat: Configure cancellation reason * fix: use enums * tests: add unit tests * fix: type error * chore: remove duplicate dialog * fix: type erro * refator: improvements * refator: improvements --------- Co-authored-by: Keith Williams <keithwillcode@gmail.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
c9abc556ba |
fix: improve getIP header resolution for CF → Vercel setup (#28152)
Co-Authored-By: unknown <> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Benny JooandGitHub
|
648ad72a54 | refactor: extract dedicated @calcom/i18n package (#28141) | ||
|
|
f1e8e3fa58 |
fix(caldav): consistent UIDs and VTIMEZONE in iCalendar output (#28115)
* fix(caldav): use consistent UIDs and inject VTIMEZONE in iCalendar output Two remaining CalDAV interop issues from #9485: 1. UID consistency: use the booking's canonical UID (event.uid) instead of always generating a new random UUID. CalDAV servers use UID as the event identifier — different UIDs cause duplicate calendar entries. 2. VTIMEZONE injection: the ics library generates UTC times with no VTIMEZONE block. CalDAV servers like Fastmail read this as UTC and send scheduling emails with wrong times. Per RFC 5545 §3.6.5, DTSTART with TZID requires a matching VTIMEZONE component. We now build a proper VTIMEZONE using binary-searched DST transitions for the event's year, handling Northern/Southern hemisphere correctly. * fix: use pre-transition offset for VTIMEZONE DTSTART per RFC 5545 The DTSTART in VTIMEZONE components must represent the local time interpreted with the pre-transition offset (TZOFFSETFROM), not the post-transition offset. For example, US Eastern spring forward DTSTART should be 02:00 (EST), not 03:00 (EDT). * Remove comments on UID handling in createEvent Removed comments about UID handling for calendar events. * Revise injectVTimezone documentation Update injectVTimezone function documentation to clarify UTC handling. --------- Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> |
||
|
|
4dbe044ecc |
refactor: remove unused imports and stale TODO comment from caleventparser.ts (#28096)
* refactor: replace manual provider logic with getAppFromLocationValue * chore: revert changes and remove stale comment --------- Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com> |
||
|
|
f8a93414a5 |
chore: remove companion app (moved to calcom/companion) (#27957)
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Aritra DeyandGitHub
|
9d4cb08c55 |
fix: Correct hours-to-days conversion in convertToNewDurationType (#27964)
Signed-off-by: Aritra Dey <adey01027@gmail.com> |
||
|
|
ea0c92a267 |
fix: use maxLength parameter in truncateOnWord instead of hardcoded value (#27961)
Signed-off-by: Aritra Dey <adey01027@gmail.com> Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com> |
||
|
Anik Dhabal BabuandGitHub
|
c21281a55c | preserve customReplyToEmail (#27941) | ||
|
|
e2119879ae |
refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880)
* refactor: apply biome formatting to small packages + packages/lib Format packages/sms, packages/prisma, packages/platform/libraries, packages/platform/examples, packages/platform/types, packages/emails, and packages/lib. Excludes packages/platform/examples/base/src/pages/[bookingUid].tsx due to pre-existing lint errors. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * revert: remove packages/platform formatting changes Revert biome formatting for packages/platform as requested. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Eunjae LeeGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> |
1b6b91b0ad |
fix: display phone numbers and localized timezone in BookingDetailsSheet (#27909)
* fix: display phone numbers and localized timezone in BookingDetailsSheet Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: replace selectAll with explicit column selects for Attendee query Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * Update apps/web/modules/bookings/components/BookingDetailsSheet.tsx Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * Add tests: packages/lib/dayjs/formatToLocalizedTimezone.test.ts Generated by Paragon from proposal for PR #27909 * Revert "refactor: replace selectAll with explicit column selects for Attendee query" This reverts commit f810ba801c900c8f065e5e1ce1d02a1700322257. --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> |
||
|
Anik Dhabal BabuandGitHub
|
285f6d54a3 | fix: unable to add and remove org banner (#27848) | ||
|
|
f4abbb2de1 |
feat: refactor billing to strategy implemention (#27828)
* factory and statergie * chore: use correct method of DI * feat: add onchagne * add logic to HWM stat * add webhook resolver methods to each statergy * move seat tracking + webhooks over to own statergy * Move to factory base approach * move logic to correct class * rename create -> createByTeamId * fix: remove debug `true ||` overrides from IS_STRIPE_ENABLED and IS_TEAM_BILLING_ENABLED Remove accidentally committed debug overrides that short-circuited IS_STRIPE_ENABLED and IS_TEAM_BILLING_ENABLED to always be true, bypassing Stripe credential checks. This would break self-hosted instances without Stripe configured. Identified by cubic (https://cubic.dev) Co-Authored-By: unknown <> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
96bec9f7b9 |
refactor: Move repositories from @calcom/lib to @calcom/features domain folders (#27570)
* refactor: move repositories from lib to features domain folders - Move HolidayRepository to features/holidays/repositories - Move PrismaTrackingRepository to features/bookings/repositories - Move PrismaBookingPaymentRepository to features/bookings/repositories - Move PrismaRoutingFormResponseRepository to features/routing-forms/repositories - Move PrismaAssignmentReasonRepository to features/assignment-reason/repositories - Move VerificationTokenRepository to features/auth/repositories - Move WorkspacePlatformRepository to features/workspace-platform/repositories - Move DTO files to their respective feature domains - Merge lib DestinationCalendarRepository into features version - Merge lib SelectedCalendarRepository into features version - Update all import paths across the codebase This follows the vertical slice architecture pattern by organizing repositories by domain rather than by technical layer. Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update VerificationTokenService import path to new location Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update test file imports to use new repository locations Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * mv * fix structure * fix * refactor: merge unit tests for SelectedCalendarRepository into single file Co-Authored-By: benny@cal.com <sldisek783@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
a8ede7761f |
fix: use LOGO_DARK constant for generic OG image instead of hardcoded value (#27705)
* fix: use LOGO constant for generic OG image instead of hardcoded value Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * test: add unit tests for OgImages module Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: remove unused LOGO import from OgImages test Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix * test: update OgImages tests to reflect LOGO_DARK constant Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * add comment --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
cb36fc201f |
fix: add URL validation to webhook endpoints (#26593)
Validates webhook URLs on create and update: - HTTPS required (HTTP allowed for self-hosted and E2E) - Blocks private IP ranges and localhost - Blocks cloud metadata endpoints Existing webhooks are preserved: validation only applies when URL is created or changed. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Eunjae LeeGitHubClaude Opus 4.5Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
2364cff54d |
feat: custom feedback dialog for feature opt-in (#27578)
* feat: add delayed formbricks tracking for feature opt-in Adds delayed Formbricks survey tracking for feature opt-in. When a user opts into a feature, this allows triggering a Formbricks action after a configurable delay (e.g., 24 hours later) to collect feedback once they've had time to use the feature. Key changes: - Added `formbricks` config option to `OptInFeatureConfig` interface with `actionName` and `delayMs` properties - Created `useFormbricksOptInTracking` hook that handles the delayed tracking logic - Added `isFeatureTracked` / `setFeatureTracked` storage helpers to prevent duplicate tracking - Integrated the tracking hook into `useFeatureOptInBanner` Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * upgrade formbricks * feat: replace formbricks popup with custom feedback dialog Instead of using Formbricks' built-in popup, we now show a custom Cal.com-styled feedback dialog that submits responses directly to Formbricks API via tRPC mutation. - Add FeedbackDialog component with emoji rating selector - Add feedback tRPC router for server-side Formbricks submission - Update useFormbricksOptInTracking to return dialog state - Add survey config fields (surveyId, questions) to config Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: position feedback dialog at bottom-right corner - Use base-ui Dialog primitives for custom positioning - Position dialog at bottom-right to avoid Intercom overlap - Use z-index 10000 (below Intercom's high z-index) - Keep blocking backdrop for modal behavior - Use i18n keys for title/description - Add survey IDs for bookings-v3 feedback Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: add i18n keys for feedback dialog title/description Allow each feature to specify custom i18n keys for the feedback dialog title and description via the formbricks config. - Add titleKey/descriptionKey to formbricks config interface - Pass i18n keys through feedbackDialogProps - Add bookings_v3_feedback_title/description translation keys Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: move FeedbackDialog into FeatureOptInBannerWrapper Better encapsulation - consumers of the feature opt-in banner no longer need to handle the feedback dialog separately. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: add 5 second delay before showing feedback dialog Ensures the page has time to finish loading before showing the feedback dialog, avoiding showing it while skeletons are still visible. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: simplify feedback dialog UI - Remove redundant question labels - Add "(optional)" to comment placeholder Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: remove emoji button borders and add footer gap - Remove borders from rating emoji buttons - Add proper gap between textarea and footer (pb-4) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: delayMs is opt-in waiting period, not setTimeout delay delayMs represents the minimum time that must pass since opt-in before showing the feedback form (e.g., 3 days). If not enough time has passed, we skip showing the form entirely instead of setting a long setTimeout. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: custom feedback dialog for feature opt-in - Replace Formbricks popup with Cal.com-styled dialog - Add configurable delay (waitAfterDays) before showing feedback - Position dialog at bottom-right, non-blocking - Add localStorage tracking to prevent duplicate feedback - Add device targeting (showOn: desktop/mobile/all) - Create tRPC endpoint for Formbricks API submission - Use proper logger for error handling Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: rename tracking terminology to feedback - Rename useFormbricksOptInTracking → useOptInFeedback - Rename FormbricksOptInTrackingResult → OptInFeedbackState - Rename formbricksTracking property → feedback - Rename FormbricksTrackingState → FeedbackState We no longer "track" events to Formbricks. Instead, we show our custom feedback dialog when conditions are met. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: set waitAfterDays to 3 for production feedback delay Co-Authored-By: unknown <> * fix: update formbricks JS SDK usage for v3.0.0 The @formbricks/js SDK v3.0.0 changed its API: - setup() no longer accepts debug, userId, or attributes - Use setUserId() and setAttributes() after setup instead - track() now expects { hiddenFields: ... } or undefined Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Rajiv SahalandGitHub
|
efcbc3a07b |
fix: avatar URL breaking for team/orgs in BookerEmbed atom (#27424)
* fix: avatar URL breaking for team/orgs in booker embed * fix: api v2 breaking because of type mismatch * fix: atoms build * chore: implement PR feedback |
||
|
|
c0f6a1b088 |
feat: add redirect option for non-routed visits to event types (#27468)
* feat: add redirect option for non-routing form bookings Add a new event type option that redirects to a custom URL when the booking was not made through a routing form (no cal.routingFormResponseId or cal.queuedFormResponseId query parameters). Changes: - Add redirectUrlOnNoRoutingFormResponse field to EventType schema - Add UI toggle in Advanced tab to configure the redirect URL - Implement redirect logic in bookingSuccessRedirect hook - Add translations for new UI strings Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirectUrlOnNoRoutingFormResponse to test builder Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirectUrlOnNoRoutingFormResponse to BookerEvent type Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirectUrlOnNoRoutingFormResponse to getPublicEventSelect Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirect logic to getServerSideProps for non-routing form bookings Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: remove redirectUrlOnNoRoutingFormResponse from booking success flow Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: use 'in' operator for type narrowing on redirectUrlOnNoRoutingFormResponse Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: exclude redirectUrlOnNoRoutingFormResponse from test assertions Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: include redirectUrlOnNoRoutingFormResponse in test assertions and update description Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirectUrlOnNoRoutingFormResponse to mockUpdatedEventType Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: remove redirect logic from instant meetings Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirectUrlOnNoRoutingFormResponse to EventTypeRepository select Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirectUrlOnNoRoutingFormResponse to form default values Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * Reword string * fix: bust tRPC cache for redirectUrlOnNoRoutingFormResponse Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: guard redirect when rescheduleUid or bookingUid is present Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add redirectUrlOnNoRoutingFormResponse to dynamicEvent defaults Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: add bookingUid guard to team getServerSideProps redirect Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Alex van AndelandGitHub
|
fc9c26e8dd |
feat: add encryptedKey column to Credential table for calendar integrations (#27154)
Adds encrypted credential storage using a new keyring system: - New `encryptedKey` column with AES-256-GCM encryption - Decryption in getCalendarsEvents with fallback to legacy `key` - buildCredentialCreateData service for credential creation - Phase 1: Google Calendar only, other integrations follow |
||
|
|
e625308881 |
fix: Improve the error handling in Stripe collectCard method (#27249)
* fix: improve error handling in Stripe collectCard method - Add CollectCardFailure error code for better error categorization - Replace generic error with ErrorWithCode for consistent error handling - Add error mappings for common Stripe errors (customer not found, invalid API key, rate limit, etc.) - Include Stripe error message when available for better debugging - Follow the same pattern used in chargeCard method Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add CollectCardFailure to getHttpStatusCode mapping This ensures the error returns 400 instead of 500 when collectCard fails. Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * docs: add comments explaining ChargeCardFailure vs CollectCardFailure Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * refactor: simplify collectCard error handling Remove complex error mapping logic per code review feedback. Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * test: add CollectCardFailure to HTTP status code tests Co-Authored-By: benny@cal.com <sldisek783@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Peer RichelsenGitHubpeer@cal.com <peer@cal.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>pasqualevitiello |
7dcc2fe78a |
feat: add multi-step download app dropdown with platform-specific options (#27211)
Co-authored-by: peer@cal.com <peer@cal.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: pasqualevitiello <pasqualevitiello@gmail.com> |
||
|
|
0ad4367005 |
feat: Custom host location (#25916)
* chore: save progress * chore: * feat: add input dialog * fix: type error * feat: mass apply dialog * test: per host location * test: fix test * fix: address Cubic AI review feedback (confidence >= 9/10) - Remove PII (address, phone number) from tracing logs in RegularBookingService.ts - Constrain HostLocation.type to EventLocationType["type"] for compile-time validation Co-Authored-By: unknown <> * fix: translation * refactor: improvements * fix: correct grammar in custom host locations tooltip Change 'custom host locations is enabled' to 'custom host locations are enabled' (plural subject requires plural verb). Addresses Cubic AI review feedback (confidence 9/10). Co-Authored-By: unknown <> * refactor: improvements * fix: auth * fix: check * refactor: improvements * fix: address Cubic AI review feedback (confidence >= 9/10) - Add scheduleId to newly created hosts in update.handler.ts to persist host-specific schedules during create operations - Change host location deletion filter from !host.location to host.location === null to only delete when explicitly set to null - Fix static-link per-host locations to use actual link instead of type in locationBodyString for bookingLocationService.ts Co-Authored-By: unknown <> * fix: preserve existing host scheduleId when not explicitly provided Change scheduleId handling for existing hosts from 'host.scheduleId ?? null' to 'host.scheduleId === undefined ? undefined : host.scheduleId' so that when the client doesn't provide a scheduleId, the existing value is preserved instead of being cleared to null. Co-Authored-By: unknown <> * fix; type erro * fix; type erro * fix; type erro * refactor: move repository * refactor: move repository * fix: add singular/plural translations for location_applied_to_hosts Addresses Cubic AI review feedback (confidence 9/10) to fix '1 hosts' rendering as '1 host' by using i18next plural format with _one and _other suffixes. Co-Authored-By: unknown <> * refactor: feedback * fix: type err * fix: use uuid in schema and remove attendee locaiton * fix: type err * fix: type err * fix: validate eventTypeId as integer in massApplyHostLocation schema Co-Authored-By: unknown <> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Alex van AndelandGitHub
|
7efd9a43c9 |
chore: drop deprecated user.startTime and user.endTime columns (#27146)
## What does this PR do? Follow-up to #27085 and #27092 - creates the database migration to drop the deprecated `startTime` and `endTime` columns from the `users` table. These columns were marked as `// DEPRECATED - TO BE REMOVED` in the Prisma schema. The prerequisite PRs removed all code references to these columns, making it safe to now drop them from the database. **Changes:** - Remove `startTime` and `endTime` fields from the `User` model in `schema.prisma` - Add migration to drop both columns from the `users` table - Remove `startTime` and `endTime` from test builder (`packages/lib/test/builder.ts`) ## Mandatory Tasks (DO NOT REMOVE) - [x] I have self-reviewed the code (A decent size PR without self-review might be rejected). - [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - internal schema cleanup - [x] I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A - schema migration only, existing tests should continue to pass ## How should this be tested? 1. Verify PRs #27085 and #27092 have been merged (prerequisite) 2. Run `yarn prisma generate` - should complete without errors 3. Run `yarn type-check:ci --force` - should pass (no code references these columns anymore) 4. Apply migration to a test database and verify columns are dropped ## Checklist - [x] My code follows the style guidelines of this project - [x] I have checked if my changes generate no new warnings ## Human Review Checklist - [ ] Confirm PRs #27085 and #27092 are merged before merging this PR - [ ] Verify no remaining code references to `user.startTime` or `user.endTime` in the codebase - [ ] ⚠️ **Breaking change**: This permanently drops data from the `users` table. Ensure no external systems depend on these columns. --- Link to Devin run: https://app.devin.ai/sessions/c5a10684d905496fbce66a0b464a73a5 Requested by: @emrysal |
||
|
Eunjae LeeGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Volnei Munhoz |
aa8804e498 |
feat(flags): add @Memoize and @Unmemoize decorators for declarative caching (#27063)
* feat(flags): add @Memoize and @Unmemoize decorators for declarative caching - Add @Memoize decorator for caching method results with Zod validation - Add @Unmemoize decorator for cache invalidation on mutations - Create UserFeatureRepository using decorators as example implementation - Add comprehensive tests with 80%+ coverage (19 tests) - Add DI module and tokens for UserFeatureRepository - Enable experimentalDecorators in packages/features/tsconfig.json Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(cache): use lazy Redis lookup in decorators - Decorators now access Redis via getRedisService() instead of this.redis - UserFeatureRepository no longer has redis property or direct redis calls - findByUserIdAndFeatureIds now uses decorated findByUserIdAndFeatureId - DI module simplified to only pass prisma dependency - Tests updated to call setRedisService() in beforeEach This ensures the repository only knows about Prisma, with all caching handled transparently by the decorators. Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * feat(flags): add FeatureRepository and TeamFeatureRepository with decorator-based caching - Add FeatureRepository with @Memoize decorators for findAll, findBySlug, getFeatureFlagMap - Add TeamFeatureRepository with @Memoize/@Unmemoize decorators for all CRUD operations - Add comprehensive Zod schemas for Feature, TeamFeatures, and AppFlags validation - Add DI modules and tokens for both repositories - Add comprehensive test coverage (33 tests) for both repositories - Maintain backward compatibility with existing FEATURES_REPOSITORY tokens Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(cache): use DI container pattern for Redis service - Create packages/features/di/containers/Redis.ts with getRedisService() - Update Memoize and Unmemoize decorators to import from DI container - Remove setRedisService() and IRedisService from types.ts exports - Update all tests to mock the container's getRedisService - Fix import ordering issues from biome Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(cache): remove barrel import and add root-level cache export - Remove packages/features/cache/decorators/index.ts barrel file - Add packages/features/cache/index.ts as root-level export for cache feature - Update repository imports to use direct imports from source files - Follows the pattern: avoid barrel imports at nested levels, keep at feature root Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(flags): minimize repository methods and address PR feedback - Remove unnecessary methods from FeatureRepository, TeamFeatureRepository, and UserFeatureRepository - Keep only methods needed by FeatureOptInService - Update imports to use @calcom/features/cache public API instead of relative paths - Handle redis.del() errors gracefully in Unmemoize decorator - Update tests to match simplified repositories Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(cache): use Promise.allSettled for cache invalidation Cleaner approach than Promise.all with individual .catch() handlers Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * feat(flags): add setAutoOptIn methods and replace featuresRepository usage in _router.ts - Add setAutoOptIn method to TeamFeatureRepository with @Unmemoize decorator - Add setAutoOptIn method to UserFeatureRepository with @Unmemoize decorator - Replace featuresRepository usage in featureOptIn/_router.ts with new repositories - TeamFeatureRepository.setAutoOptIn unmemoizes KEY.autoOptInByTeamId(teamId) - UserFeatureRepository.setAutoOptIn unmemoizes KEY.autoOptInByUserId(userId) Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(flags): use DI containers for TeamFeatureRepository and UserFeatureRepository - Create TeamFeatureRepository.ts container with getTeamFeatureRepository() - Create UserFeatureRepository.ts container with getUserFeatureRepository() - Update _router.ts to use DI containers instead of direct instantiation Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(feature-opt-in): use DI containers for FeatureOptInService dependencies - Update FeatureOptInService to use IFeatureOptInServiceDeps with 3 repositories - Add helper functions teamFeatureToState() and userFeatureToState() - Update DI module to use depsMap pattern with featureRepo, teamFeatureRepo, userFeatureRepo - Create FeatureRepository container file - Replace all FeaturesRepository method calls with new repository methods Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * test(feature-opt-in): update FeatureOptInService tests for new IFeatureOptInServiceDeps interface - Update mock structure to use featureRepo, teamFeatureRepo, userFeatureRepo - Add helper functions createMockTeamFeature and createMockUserFeature - Update all test cases to use new repository method names - Add explicit types to satisfy biome lint rules Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor(flags): use DTOs at repository boundaries to prevent Prisma type leakage - Create FeatureDto, TeamFeaturesDto, UserFeaturesDto in packages/lib/dto/ - Update repository interfaces to return DTOs instead of Prisma types - Add toDto() transformation methods in repository implementations - Update FeatureOptInService to use DTOs instead of Prisma types - Follow data-dto-boundaries.md guidelines for architectural boundaries Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * fix(flags): update TeamFeatureRepository tests to match DTO structure Remove assignedAt from test mock data since TeamFeaturesDto only includes: teamId, featureId, enabled, assignedBy, and updatedAt Co-Authored-By: unknown <> * fix(cache): make Redis failures non-blocking in @Memoize decorator Wrap Redis get and set operations in try-catch blocks to ensure Redis failures don't break the application flow. If cache read fails, proceed to fetch from source. If cache write fails, silently ignore and return the result. Co-Authored-By: unknown <> * fix(cache): add logging for Redis failures and remove barrel import - Add warning logs for Redis failures in @Memoize and @Unmemoize decorators - Remove packages/lib/dto/index.ts barrel import file - Update all imports to use direct file paths instead of barrel imports Co-Authored-By: unknown <> * fix(cache): sanitize log messages to avoid exposing sensitive data - Remove cacheKey from log messages (may contain PII like user/team IDs) - Log only error.message instead of raw error objects - Addresses Cubic AI feedback (confidence 9/10) Co-Authored-By: unknown <> * sanitize log --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Volnei Munhoz <volnei@cal.com> |
||
|
sean-brydonGitHubClaude Sonnet 4.5Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
3af533e2c8 |
feat: add monthly proration processing (#27002)
* feat: add seat tracking infrastructure for monthly proration Add seat change logging infrastructure with operationId for idempotency. This PR adds the foundation for monthly proration billing by tracking seat additions and removals, gated behind the monthly-proration feature flag. - Add operationId field to SeatChangeLog for idempotency - Update SeatChangeLogRepository to support upsert with operationId - Add feature flag guard in SeatChangeTrackingService - Integrate seat tracking in team member invites - Integrate seat tracking in bulk user deletions - Integrate seat tracking in team service operations - Integrate seat tracking in DSYNC user creation When monthly-proration feature flag is disabled, seat logging is skipped and behavior remains unchanged. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * feat: add monthly proration processing Add monthly proration billing processing that works on top of the seat tracking infrastructure. This PR implements the core proration logic, webhook handlers, and integration with Stripe billing. - Enhance MonthlyProrationService to process seat change logs - Add payment webhook handlers (invoice.payment_succeeded, invoice.payment_failed) - Update subscription webhook to sync billing period on renewals - Update TeamBillingService to skip real-time updates when proration enabled - Enhance StripeBillingService with proration capabilities - Add Tasker enhancements for processing queues - Update team creation/upgrade routes Depends on: feat/monthly-proration-seat-tracking Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: remove unused logger from SeatChangeTrackingService * fix: description for calculation * fix null check on trial * chore: no more prisma calls * add feature flag check * fix stub --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
f9d40e083f |
feat: store utm tags in stripe on signup (#26838)
* feat: store utm params in stripe on signup * fix: fallback to cookie when query params don't contain valid UTM data Changed from else-if to separate if statement so that when query params exist but don't contain valid UTM data, the cookie fallback is still tried. Previously, any request with non-UTM query params would skip the stored cookie data entirely. Co-Authored-By: unknown <> * fix: e2e --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
45ea59ceb8 |
fix: prevent CalDAV duplicate invitations with RFC-compliant SCHEDULE-AGENT (#22434)
* fix: prevent CalDAV duplicate invitations with RFC-compliant SCHEDULE-AGENT Fixes #9485 Adds SCHEDULE-AGENT=CLIENT to ATTENDEE lines in CalDAV createEvent and updateEvent operations per RFC 6638 Section 7.1. This tells CalDAV servers (Fastmail, NextCloud, etc.) that the client handles scheduling, preventing duplicate invitation emails. Implementation includes: - RFC 5545 compliant line folding (max 75 octets per line) - UTF-8 aware byte counting for international names - Proper handling of :mailto: format in ATTENDEE lines - Skips lines that already have SCHEDULE-AGENT parameter * fix: address Cubic review - unfold lines and case-insensitive matching - Add unfoldLines() to handle RFC 5545 folded lines before processing - Use case-insensitive regex (gim flag) per RFC 5545 spec - Simplify regex to properly capture params and value separately * fix: only unfold/refold ATTENDEE lines, preserve other lines - Match ATTENDEE lines including folded continuations - Unfold only the matched ATTENDEE line - Re-fold after adding SCHEDULE-AGENT=CLIENT - Other iCal lines remain untouched (no RFC 5545 violation) * fix: check SCHEDULE-AGENT only in params, not value Only check for existing SCHEDULE-AGENT in the params portion, not the value (which contains email/CN). This prevents false positives when email contains "schedule-agent" substring. * fix: handle quoted colons and exact SCHEDULE-AGENT matching 1. Colon parsing: Match :mailto:/:http:/:urn: patterns, or fallback to finding colon not inside quotes 2. SCHEDULE-AGENT check: Use regex to match exact parameter name (preceded by ; or at start), not substring match * add tests * Update .env.example --------- Co-authored-by: Anik Dhabal Babu <adhabal2002@gmail.com> Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> |
||
|
|
ddcac4b3b1 |
fix: make linting required for CI (#27091)
* fix: make linting required for CI - Remove continue-on-error from lint workflow so CI fails on lint errors - Fix 2 lint errors: avoid importing from @trpc/server in lib package - Add trpcErrorUtils.ts to handle TRPC errors without circular dependencies - Update lint-staged to show warnings but not block commits Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> * fix: add message field validation to isTRPCErrorLike type guard Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Peer RichelsenGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Volnei Munhozcubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> |
cfb1db45b2 |
feat: add Cloudflare URL Scanner for malicious URL detection (#26387)
* feat: add Cloudflare URL Scanner integration for malicious URL detection - Add MALICIOUS_URL_IN_WORKFLOW to LockReason enum - Add URL_SCANNING_ENABLED constant for feature flag - Create urlScanner.ts utility for Cloudflare Radar URL Scanner API - Create scanWorkflowUrls task for async URL scanning with polling - Integrate URL scanning into scanWorkflowBody task - Add URL scanning for event type redirect URLs - Lock user accounts when malicious URLs are detected - Fix pre-existing lint issues (parseInt radix, optional chaining) Co-Authored-By: peer@cal.com <peer@cal.com> * fix: address biome lint warnings and TypeScript iterator errors - Wrap iterators with Array.from() to fix TS2802 errors - Add biome-ignore comments for process.env usage - Extract helper functions to reduce function length - Move exports to end of file per useExportsLast rule - Remove problematic imports that cause TypeScript errors Co-Authored-By: peer@cal.com <peer@cal.com> * fix: address cubic-dev-ai review comments for URL scanning - Fix P0: Re-fetch workflow steps before scheduling notifications to use actual verifiedAt values from database instead of overriding with new Date() - Fix P1: Mark workflow step as verified in submitWorkflowStepForUrlScanning when URL scanning is disabled or no URLs found - Fix P1: Add whitelistWorkflows parameter to submitUrlForUrlScanning for consistency - Fix P2: Preserve URL context in error results in urlScanner.ts scanUrls function Co-Authored-By: peer@cal.com <peer@cal.com> * fix: add select clause to Prisma query for workflow steps Address cubic-dev-ai P2 comment: Use select to fetch only the required fields (id, action, sendTo, emailSubject, reminderBody, template, sender, verifiedAt) instead of fetching all columns from workflowStep table. Co-Authored-By: peer@cal.com <peer@cal.com> * fix: add select clause to Prisma query in scanWorkflowBody.ts Address cubic-dev-ai P2 review comment: Use select to fetch only the required fields (id, action, sendTo, emailSubject, reminderBody, template, sender, verifiedAt) instead of fetching all columns. Co-Authored-By: peer@cal.com <peer@cal.com> * test: add unit tests for URL scanning functionality - Add tests for urlScanner.ts (extractUrlsFromHtml, isUrlScanningEnabled) - Add tests for scanWorkflowUrls.ts (happy/unhappy paths for URL scanning task) - Add tests for scanWorkflowBody.ts (happy/unhappy paths for workflow body scanning) Tests cover: - URL extraction from HTML content - URL normalization and deduplication - Handling of malicious URLs and user locking - Fail-open behavior for API errors - Whitelisted user handling - Iffy spam detection integration Co-Authored-By: peer@cal.com <peer@cal.com> * test: remove incomplete test that provides no value Removed the 'should mark all steps as verified when neither Iffy nor URL scanning is enabled' test as it used vi.doMock() which doesn't work after module import, had no assertions, and gave false confidence in test coverage. Co-Authored-By: peer@cal.com <peer@cal.com> * refactor: use Cloudflare bulk scanning endpoint to reduce API quota usage - Added submitUrlsForBulkScanning function that uses /urlscanner/v2/bulk endpoint - Updated scanUrls to use bulk submission instead of individual URL submissions - Bulk endpoint accepts up to 100 URLs per request, batching is handled automatically - Reduces API quota usage as suggested by keithwillcode Co-Authored-By: peer@cal.com <peer@cal.com> * Update packages/features/tasker/tasks/scanWorkflowUrls.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * fix: address cubic-dev-ai review comments - P1: Sanitize URLs before logging to prevent exposing sensitive query parameters - P2: Extract handleUrlScanningForStep helper function to reduce code duplication - P2: Use vi.stubGlobal for fetch mock in tests for proper cleanup Co-Authored-By: peer@cal.com <peer@cal.com> * fix: address volnei review comments on PR #26387 - Move vi.unstubAllGlobals() to afterEach hook in iffyScanBody tests - Restore updateMany optimization when URL scanning is disabled Co-Authored-By: peer@cal.com <peer@cal.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Volnei Munhoz <volnei@cal.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> |
||
|
Dhairyashil ShindeandGitHub
|
bea542b310 |
fix: correct bookingUrl for EU instance in API responses (#27046)
* fix: use WEBAPP_URL for booking URLs when domains differ For EU deployments where WEBAPP_URL (app.cal.eu) differs from WEBSITE_URL (cal.com), use WEBAPP_URL for non-org booking URLs. This fixes incorrect bookingUrl in API responses for EU instance. * Created new shared utility getTldPlus1 and updated code to use shared function instead of inline copy * use same comment |
||
|
|
e620264848 |
fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
Dhairyashil ShindeGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>peer@cal.com <peer@cal.com> |
da91152365 |
feat: standalone page config to use in companion (#27018)
* feat: hide navigation when ?standalone=true URL parameter is present Co-Authored-By: peer@cal.com <peer@cal.com> * feat: standalone page config to use in companion --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: peer@cal.com <peer@cal.com> |
||
|
Syed Ali ShahbazandGitHub
|
c1d0a6bb1b |
fix: Stores the DateRange in UTC instead of user machine that caused the bug (#26900)
* fix init * remove comment * fix to v2 * type fix * edge case * test fix to suit the date storage method * fix for atoms * backward compatibility * fix test mock * test fix? * testing a theory * address cubic |
||
|
|
bca6615da9 |
test: add unit tests for Tasker class (#26975)
- Test that params are properly passed to async tasker methods - Test that params are passed in correct order - Test fallback to sync tasker when async tasker fails - Test params are passed correctly to sync tasker fallback - Test error handling when both taskers fail - Test logging of dispatch information with args - Test behavior when async tasker is disabled (missing env vars) - Test error details logging Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
9fcddbf27b |
refactor: calEventParser CalendarEvent ISP (#25890)
* refactor: calEventParser CalendarEvent ISP
* update
* fix: complete CalEventParser ISP refactoring - update call sites and fix type errors
- Update getUid call sites to pass only uid instead of whole CalendarEvent
- Update getLocation call sites to pass narrow shape with videoCallData, additionalInformation, location, uid
- Update narrow input shapes to accept null for location (matching CalendarEvent type)
- Update recurringEvent type to accept RecurringEvent | null instead of boolean
- Update videoCallData type to be more flexible ({ type?: string; url?: string })
- Fix ManageLink.tsx to pass recurringEvent directly instead of converting to boolean
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* test: update CalEventParser tests to use narrow input shapes
- Update getPublicVideoCallUrl test to pass uid instead of calEvent
- Update getVideoCallPassword tests to pass videoCallData instead of calEvent
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* few fix
* fix type error
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
|
||
|
|
442779d08d |
feat: monthly-proration-tasker (#26870)
* feat: monthly-proration-taskerh * remove cronjob from tasker implementation * feat: add DI for MonthlyProrationService and TriggerDevLoggerServiceModule - Create TriggerDevLoggerServiceModule for DI injection of TriggerDevLogger - Add tokens for TriggerDevLogger in shared.tokens.ts - Create MonthlyProrationService DI module and container - Update processMonthlyProrationBatch.ts to use DI container - Use redactError in Tasker.ts to avoid logging sensitive information Co-Authored-By: sean@cal.com <Sean@brydon.io> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
25f7381393 |
fix: add ensureProtocol helper to handle URLs without protocol (#26667)
* fix(event-types): keep slug in sync with title until manually edited Changed from checking `touchedFields` to `dirtyFields` when deciding whether to sync the slug with the title. This fixes the issue where merely focusing on the slug field would stop the sync, even if the user didn't actually edit it. Now the slug stays in sync with the title until the user actually modifies the slug value. Note: The hardcoded "Slug" label for platform users was preserved from the original code. Localizing it would be a separate enhancement. Fixes #26265 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: add ensureProtocol helper to handle URLs without protocol Some container orchestration tools (like Coolify) strip the protocol from URL environment variables. This causes `new URL()` to throw `ERR_INVALID_URL` because strings like "sub.domain.com" are invalid without a protocol prefix. This fix adds an `ensureProtocol` helper function that: - Returns empty string for null/undefined URLs - Preserves URLs that already have http:// or https:// - Prepends https:// to URLs missing the protocol Applied to WEBAPP_URL, WEBSITE_URL, and CAL_URL env var parsing. Fixes #25774 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Clarify URL protocol handling in comments Updated comment to clarify handling of URLs. * Refactor slug handling in CreateEventTypeForm --------- Co-authored-by: simiondolha <simiondolha@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> |
||
|
Anik Dhabal BabuandGitHub
|
a8d559d331 |
fix: hide team members details when hideOrganizerEmail is enabled (#26833)
* fix: hide organizer email * update |
||
|
|
53395695b4 |
fix: resolve useLiteralKeys biome lint issues (#26851)
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
92d2b59946 |
fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|
|
2881961859 |
feat: add custom calendar reminder for Google Calendar events (#26078)
* feat: add custom calendar reminder for Google Calendar events Allows users to set default reminder notifications (10, 30, or 60 minutes) for events created via Cal.com bookings in Google Calendar. This addresses the issue where Google Calendar's default reminders don't apply to API-created events. - Add customCalendarReminder field to DestinationCalendar model - Create reminder selector UI in destination calendar settings - Update GoogleCalendarService to apply custom reminders (popup + email) - Add TRPC endpoint for updating reminder settings * fix: address code review feedback - Use z.union with literal values (10, 30, 60) for stricter schema validation - Add localization for toast messages using t() - Fix test data to use null for customCalendarReminder to match test intent * fix: add customCalendarReminder to DestinationCalendar types Update manually-defined DestinationCalendar types to include the new customCalendarReminder field added in the previous commit. This fixes type mismatches when passing Prisma-persisted destination calendars to functions using these local type definitions. * fix: update customCalendarReminder type in test to match Prisma schema The customCalendarReminder field is defined as a non-nullable Int with default value of 10 in the Prisma schema. Changed test value from null to 10 to fix TS2345 type error. * feat: add 'just in time' reminder option for Google Calendar events - Add 0 (just in time) as a valid reminder option alongside 10, 30, 60 minutes - Update TRPC schema to accept 0 as valid reminder value - Add 'Just in time' option to reminder dropdown selector UI - Add translation for 'just_in_time' key in English locale - Include comprehensive test case for 0-minute (just in time) reminders - Remove unused import from test file This addresses reviewer feedback to provide flexible 'just in time' option that allows reminders to fire at exact event start time. 🤖 Generated with Claude Code * fix: add customCalendarReminder to calendars service mock - Add missing customCalendarReminder field to destination calendar mock - Matches the Prisma schema requirement - Fixes type error in calendars controller e2e test * fix: add customCalendarReminder to destination calendars controller test - Add missing customCalendarReminder field to mock destination calendar - Matches Prisma schema requirement - Fixes type error in destination-calendars controller e2e test * fix: cast customCalendarReminder to ReminderMinutes type - Add type cast for reminderValue to ensure type safety - Use nullish coalescing (??) to preserve 0 as valid reminder value - Ensures database number type is properly cast to ReminderMinutes union * refactor: simplify translation logic in DestinationReminderSelector - Remove conditional check for 'just_in_time' label - Pass count parameter to all translations uniformly - Translation function handles unused parameters gracefully Addresses review feedback from @Khaan25 * refactor: make custom calendar reminder opt-in and use repository pattern - Change default from 10 to null (opt-in feature) - Add DestinationCalendarRepository to avoid direct Prisma usage - Add 'Use default reminders' option to UI * refactor: remove redundant migration file The original migration already creates customCalendarReminder as nullable, so this second migration to make it nullable is not needed. * fix: type error for customCalendarReminder in destination calendar settings * refactor: validate customCalendarReminder with Zod schema instead of type casting * refactor: use instance methods in DestinationCalendarRepository Changed from static to instance methods with getInstance() pattern as requested in review. * refactor: replace singleton with DI for DestinationCalendarRepository - Remove getInstance() singleton pattern - Add DI tokens, module, and container - Update GoogleCalendarService and tRPC handler to use DI --------- Co-authored-by: Volnei Munhoz <volnei@cal.com> Co-authored-by: Keith Williams <keithwillcode@gmail.com> Co-authored-by: Eunjae Lee <hey@eunjae.dev> |
||
|
+47Hariom BalharaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Ram ShuklaPedro CastroAlex van AndelManas KengeDhairyashil ShindeJoe Au-YeungEesh MidhaBetoshashank-100Kartik LabhshetwarAbhay MishraKeith WilliamsAnik Dhabal BabuPallavRyukemeisterRajiv SahalPeer RichelsenUdit Takkarsean-brydoncal-com-ci[bot] <247290566+cal-com-ci[bot]@users.noreply.github.com>Lingo.devBenny JooEunjae LeeVolnei MunhozAnshumancanrockMorganAmit Sharmacubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>KartikDhairyashilVolnei MunhozAdarsh TiwariDylan TarreClaude Opus 4.5Amin JaouiCarina WollendorferCarinaWolliAnik Dhabal BabuSyed Ali ShahbazMehmet SungurxDipzzPasquale Vitiellopasquale@cal.com <pasquale@cal.com>cal.comAnas NajamBandhan Majumdermintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>Kartik SainiAbhisheksusan@cal.com <susan@cal.com>Bailey PumfleetsimiondolhasimiondolhaKirankumar Ambati |
a7a8c78494 |
chore: [Booking Cancellation Refactor - 2] Inject repositories and use them instead of Prisma in cancellation flow (#24159)
* chore: Inject repositories instead of Prisma in canellation flow * simplify * simplify * fix formatting issue * chore: resolve merge conflicts for PR #24159 (#26820) * matched colour of icons across website (#26394) * fix(auth): resolve session user by token subject ID (#26399) * fix(auth): align session user resolution with token subject * test(auth): add unit tests for getServerSession user resolution * chore: release v6.0.7 * fix: Custom time input for availability (#26373) * add custom time input * add unit test * add validation logic * feat(companion): Add DropdownMenu and Alert Dialog for Android (#26385) * feat(companion): add DropdownMenu for Android event types list Replace Alert.alert with react-native-reusables DropdownMenu component for Android event type list items, providing a native-feeling menu experience that matches iOS functionality. Changes: - Install react-native-reusables dropdown-menu component and dependencies (lucide-react-native, tailwindcss-animate, class-variance-authority, clsx, tailwind-merge) - Create EventTypeListItem.android.tsx with DropdownMenu implementation - Single ellipsis button triggers dropdown menu - Menu includes: Preview, Copy link, Edit, Duplicate, Delete - Delete action marked as destructive variant - Proper safe area insets handling - Add PortalHost to app/_layout.tsx for portal rendering support - Create lib/utils.ts with cn() helper for className merging - Update global.css with theme CSS variables (popover, border, accent, destructive, etc.) for dropdown menu styling - Update tailwind.config.js with theme colors and tailwindcss-animate plugin - Update metro.config.js with inlineRem: 16 for proper rem unit handling - Remove Android Alert.alert fallback from event types index.tsx - Fix lint issues in generated dropdown-menu.tsx (remove unnecessary fragments) The Android experience now matches iOS with a single menu button that opens a dropdown containing all event type actions, replacing the previous Alert.alert dialog and separate action buttons. Refs: https://reactnativereusables.com/docs/components/dropdown-menu * adjust with of menu * feat(companion): add DropdownMenu for Android booking and availability list items - Add BookingListItem.android.tsx with DropdownMenu for booking actions - Add BookingDetailScreen.android.tsx with DropdownMenu in header - Add AvailabilityListItem.android.tsx with DropdownMenu for schedule actions Actions include: Reschedule, Edit Location, Add Guests, View Recordings, Meeting Session Details, Mark as No-Show, Report Booking, Cancel Event for bookings; Set as Default, Duplicate, Delete for availability schedules. * fix lint issues * feat(android): replace native alerts with AlertDialog and Toast in event types - Install AlertDialog and Alert components from react-native-reusables - Create Android-specific event types screen (index.android.tsx) - Replace native Alert.alert() with AlertDialog for delete confirmation - Add inline validation errors (red border + error text) in create modal - Implement Toast snackbar for success/error notifications (no layout shift) - Auto-dismiss toast after 2.5 seconds - Fix React Compiler compatibility by removing animated refs This provides a more consistent and polished UI experience on Android, matching the design system used in other parts of the app. * feat(android): add AlertDialog for availability delete and booking cancel - Add index.android.tsx for availability with AlertDialog for delete confirmation - Add index.android.tsx for bookings with AlertDialog for cancel (with reason input) - Both screens include Toast snackbar for success/error notifications - Follows the same pattern as event types Android implementation * feat(companion): add DropdownMenu and AlertDialog for Android - Replace native Alert.alert context menus with DropdownMenu component for event types, bookings, and availability lists - Replace FullScreenModal with AlertDialog for create/delete/cancel flows - Add toast notifications for success/error feedback on Android - Set consistent 380px max-width for all AlertDialogs - Fix layout headers showing "index" text on event-types and availability - Create Android-specific More screen with AlertDialog logout confirmation Uses react-native-reusables components for polished Android UI * better code * fix cubics comments * refactor(android): revert delete confirmations to native Alert.alert() - Logout: reverted to native Alert.alert() (simple yes/no) - Event Types Delete: reverted to native Alert.alert() (simple yes/no) - Availability Delete: reverted to native Alert.alert() (simple yes/no) Keep AlertDialog only where user input is needed: - Event Types Create (has TextInput for title) - Availability Create (has TextInput for name) - Bookings Cancel (has TextInput for cancellation reason) * refactor(android): remove redundant index.android.tsx files The main index.tsx files already handle Android via Platform.OS checks. Android-specific behavior for actions is in the list item components: - EventTypeListItem.android.tsx - BookingListItem.android.tsx - AvailabilityListItem.android.tsx This consolidates the code and reduces duplication. * corrected the implementation both native and alert dialog * address cubics comments * fix lint issue and address cubic comments * chore: add logging in next-auth (#26404) * Add logging in next-auth * Add logging at other return * fix: Make incomplete booking form mobile-responsive (#26413) * fix: update bundle identifier (#26402) * fix: patch React 19 vulnerabilities by upgrading to 19.2.3 (#26411) * security: patch React 19 vulnerabilities by upgrading to 19.2.3 * chore: revert lingo.dev upgrade * refactor(companion): event type details screen improvements (#26415) * refactor(companion): move EventTypeDetail component to a new file and update routing * refactor(companion): format code for better readability in TabLayout and EventTypeDetail components * refactor(companion): improve code formatting and readability in EventTypeDetail component * refactor(companion): enhance code readability and formatting in EventTypeDetail component * refactor(companion): improve code formatting and readability in EventTypeDetail component * refactor(companion): enhance code formatting and readability in EventTypeDetail component * refactor(companion): improve code formatting and readability in TabLayout component * fix: add vertical spacing when hovered (#26419) * fix(seed): add missing Host entries for seeded round‑robin team events (#26426) * feat(companion): new availability detail and actions pages for ios (#26424) * version 1 * version 1.1 * better code * covered all edge cases * address cubics comments * address cubics comments * fix(auth): enhance SAML login handling by introducing userId field and updating JWT token structure (#26428) * fix(ci): delete old prod build caches on cache miss (#26437) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): add yarn prisma generate before cache key generation (#26439) This ensures consistent cache keys between the Build Web App job and E2E shards by running yarn prisma generate before generating the cache key. The issue was that packages/prisma/enums/index.ts is: 1. Generated by yarn prisma generate 2. In .gitignore (not committed to git) 3. Included in the SOURCE_HASH (matches packages/**/**.[jt]s) 4. NOT excluded from the hash E2E jobs already run yarn prisma generate before cache-build, but the Build Web App job did not, causing different cache keys in the same workflow run. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: show empty screen from event type availability tab (#26396) * fix * update * fix * Remove copying of App Store static files step Removed step to copy App Store static files from the workflow. * feat: queue or cancel payment reminder flow (#24889) Co-authored-by: Pallav <90088723+Pallava-Joshi@users.noreply.github.com> Co-authored-by: Ryukemeister <sahalrajiv6900@gmail.com> Co-authored-by: Rajiv Sahal <sahalrajiv-extc@atharvacoe.ac.in> Co-authored-by: Peer Richelsen <peeroke@gmail.com> * feat: integrate BookingHistory with Bookings V3 design (#26301) * Integrate BookingHistory with Bookings V3 design * Enhance booking features by integrating booking audit functionality - Updated the booking page to retrieve user feature statuses for "bookings-v3" and "booking-audit". - Modified BookingDetailsSheet and BookingListContainer components to accept and utilize the new bookingAuditEnabled prop. - Adjusted the BookingHistory display logic to conditionally render based on the bookingAuditEnabled state. - Refactored SegmentedControl to support generic types for better type safety. This change improves the user experience by allowing conditional access to booking audit features based on user permissions. * Refactor BookingDetailsSheet to manage active segment state with Zustand store - Removed local state management for active segment in BookingDetailsSheet and integrated Zustand store for better state synchronization. - Introduced useActiveSegmentFromUrl hook to sync active segment with URL query parameters. - Updated BookingDetailsSheet to handle derived active segment logic based on bookingAuditEnabled state. - Adjusted SegmentedControl to ensure it defaults to "info" when activeSegment is null. This refactor enhances the maintainability and responsiveness of the booking details component. * refactor: rename useBiDirectionalSyncBetweenZustandAndNuqs to useBiDirectionalSyncBetweenStoreAndUrl Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> --------- Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat: create BookingHistoryViewerService to combine audit logs with routing form submissions (#26045) * feat: create BookingHistoryViewerService to combine audit logs with routing form submissions Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * refactor(booking): rename audit log query and enhance type safety - Updated the booking logs view to use the new getBookingHistory query instead of getAuditLogs. - Introduced DisplayBookingAuditLog type for improved clarity in BookingAuditViewerService. - Refactored BookingHistoryViewerService to utilize the new DisplayBookingAuditLog type and added sorting functionality for history logs. - Adjusted related types and methods to ensure consistency across services. * refactor(routing-forms): streamline imports and enhance type definitions - Consolidated type exports and imports from the features library for better organization. - Removed redundant type definitions and functions in zod.ts, findFieldValueByIdentifier.ts, getFieldIdentifier.ts, and parseRoutingFormResponse.ts. - Introduced new utility functions for handling field responses and parsing routing form responses. - Improved type safety and clarity across routing form response handling. * fix: remove double prefix from uniqueId in form submission entry Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> * 1c97f9cc5d50416788c01876fe539bcc9750e9b2 (#26453) --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: Ensure that uuid is available in server session[Booking Audit Prerequisite] (#25963) ## What does this PR do? Similar to #25721, adds uuid in session so that BookingAudit has it readily available Adds the user's UUID to the booking metadata by: 1. Extending the NextAuth `User` interface to include an optional `uuid` property from PrismaUser 2. Making `uuid` required on `Session.user` via intersection type (`User & { uuid: PrismaUser["uuid"] }`) 3. Adding `uuid` to the session user object in `getServerSession.ts` 4. Adding `uuid` to the `AdapterUser` transformation in `next-auth-custom-adapter.ts` 5. Passing `userUuid` from the session to the booking creation flow 6. Updating the API key verification flow to include `uuid` in the user data (repository, service, and type definitions) 7. Adding `req.userUuid` as a required field on the request object (like `req.userId`) 8. Adding `uuid` to mock session objects in web app routes and test context 9. Adding `uuid` to the `findByEmailAndIncludeProfilesAndPassword` query in UserRepository Also removes commented-out code that was placeholder for future work and fixes lint warnings for unused variables. ## Mandatory Tasks (DO NOT REMOVE) - [x] I have self-reviewed the code (A decent size PR without self-review might be rejected). - [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed. - [x] I confirm automated tests are in place that prove my fix is effective or that my feature works. ## How should this be tested? 1. Verify that the NextAuth session callback is already populating the `uuid` field on the user object 2. Create a booking and confirm `userUuid` is included in the booking metadata 3. Test API v1 endpoints (`/api/invites` POST and `/api/teams/[teamId]/publish`) to verify they receive the uuid from the authenticated user 4. Check that the booking flow works correctly with the new parameter 5. Test SAML login flow to verify session still works correctly (uuid is resolved from database after authentication) ## Human Review Checklist - [ ] Verify the NextAuth session callback populates `uuid` - if not, this change will pass `undefined` at runtime - [ ] Confirm `userUuid` is consumed downstream in the booking service - [ ] Verify that `PrismaApiKeyRepository.findByHashedKey()` correctly fetches the user's uuid from the database - [ ] Verify the discriminated union type in `ApiKeyService.ts` ensures `result.user` is always defined when `result.valid` is true - [ ] Confirm all API v1 endpoints using `req.userUuid` go through the `verifyApiKey` middleware - [ ] Verify `UserRepository.findByEmailAndIncludeProfilesAndPassword()` includes `uuid` in the select clause - [ ] Verify SAML login still works correctly - uuid is now optional on User interface so SAML providers don't need to supply it at profile stage ## Updates since last revision - **Made uuid optional on User, required on Session**: Changed the type strategy so `uuid` is optional on the NextAuth `User` interface but required on `Session.user` via intersection type. This allows SAML providers to not supply uuid at the profile stage while ensuring uuid is always present on the session after the user is resolved from the database. - **Removed uuid from SAML functions**: Since uuid is now optional on User, the SAML profile and authorize functions no longer need to include it. --- Link to Devin run: https://app.devin.ai/sessions/97e5603b719a420b9b35041252c9db26 Requested by: hariom@cal.com (@hariombalhara) * fix: add @calcom/trpc#build dependency to @calcom/web#dev task (#26460) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(auth): make identityProviderId lookup case-insensitive (#26405) SAML IdPs may send NameIDs with different casing than stored, causing login failures. Aligns with the existing case-insensitive email lookup pattern * fix: cancel running CI workflow before re-triggering and allow trusted GitHub Apps (#26461) * fix: cancel running CI workflow before re-triggering and allow trusted bots Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: remove hardcoded bot allowlist, keep only cancel-and-rerun improvement Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: add app_id verification for trusted GitHub Apps (Graphite) Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: simplify trusted bot check to use sender type, login, and installation context Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * chore: remove unnecessary comments Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat: update translations via @LingoDotDev (#26445) Co-authored-by: Lingo.dev <support@lingo.dev> Co-authored-by: Keith Williams <keithwillcode@gmail.com> * fix: remove installation requirement from trusted bot check (#26466) * fix: remove installation requirement from trusted bot check The installation object is not present in the webhook payload when GitHub Apps add labels via pull_request_target events. This caused graphite-app[bot] to fail the authorization check and fall through to the human permission check, which doesn't work for bots. The fix removes the installation requirement and relies on: - sender.type === 'Bot' - sender.login matching the trusted bot list This is secure because the sender fields come from GitHub's webhook payload and cannot be forged by contributors. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * chore: add extra logging about sender type Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * chore: remove senderId from logging Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * Update run-ci.yml --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: Move trpc-dependent components from features to web [2] (#26420) * fix * move event types components to web * update import paths * mv apps components * migrate form builder * fix * mv sso * fix * mv * update import paths * update import paths * mv * mv * mv * fix * update Booker * fix * fix * fix * fix * mv video * mv embed components to web * update import paths * mv calendar weekly view components * update import paths * fix * fixp * fix * fix * fix * fix: update FormBuilder imports to use @calcom/features/form-builder Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update broken import paths after file migrations Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: correct import paths for platform atoms and moved components Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: apply CSS type fixes and add missing atoms exports Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: resolve type errors in test files after component migrations Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: resolve remaining type errors in test files Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix * migrate * fix: resolve type errors in test and mock files - Add missing bookingForm, bookerFormErrorRef, instantConnectCooldownMs to Booker.test.tsx bookings prop - Add all required BookerEvent properties to event.mock.ts - Add vi import from vitest to all mock files - Fix date parameter types in packages/dayjs/__mocks__/index.ts - Add verificationCode and setVerificationCode to test-utils.tsx mock store - Remove children.type access in Section.tsx mock to fix type error - Fix lint issues: remove unused React imports, use import type where needed, add return types - Add biome-ignore comments for pre-existing lint warnings in test files Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * migrate * migrate * migrate * update import paths * update import paths * update import paths * fix * migrate data table * migrate data table * fix * fix * fix * migrate insights components * migrate insights components * fix * mv * update import paths * fix * fix * fix * fix * fix * fix: resolve type errors in test mocks - Booker.test.tsx: Add all required UseFormReturn methods to bookingForm mock - event.mock.ts: Fix entity, subsetOfHosts, instantMeetingParameters, fieldTranslations, image types - dayjs/__mocks__/index.ts: Use Object.assign for proper typing of mock properties - Section.tsx: Change 'class' to 'className' in JSX with biome-ignore comment Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing hasDataErrors and dataErrors to bookings.errors mock Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing loadingStates properties to bookings mock Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing slots properties (setTentativeSelectedTimeslots, tentativeSelectedTimeslots, slotReservationId) Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: update quickAvailabilityChecks to include utcEndIso and use valid status type Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing bookerForm properties (formName, beforeVerifyEmail, formErrors) Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing UseFormReturn properties to bookerForm.bookingForm mock Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add hasFormErrors and formErrors to bookerForm.formErrors mock Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add hasFormErrors and formErrors to bookerForm.errors mock Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing isError property to mockEvent Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: use complete BookerEvent mock in Booker.test.tsx Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: use branded bookingFields type in event mock Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: add missing schedule mock properties (isError, isSuccess, isLoading, dataUpdatedAt) Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * revert * fix * fix * fix * fix build * fix * fix * fix * fix: correct AddMembersWithSwitch test wrapper to use initial assignAllTeamMembers value - Fixed test wrapper to initialize useState with componentProps.assignAllTeamMembers instead of hardcoded false, allowing tests to properly test different states - Updated test expectations for ALL_TEAM_MEMBERS_ENABLED_AND_SEGMENT_NOT_APPLICABLE state to match actual component behavior (toggle should be present and checked) - Fixed 'should show Segment when toggled on' test to start with assignAllTeamMembers: false to properly test the flow of enabling it - Added explicit types to satisfy biome lint requirements Co-Authored-By: benny@cal.com <sldisek783@gmail.com> * fix: use JSX.Element instead of React.JSX.Element for type compatibility Co-Authored-By: benny@cal.com <sldisek783@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore(deps): update dependencies and add version constraints (#26390) - Update sanitize-html to 2.17.0 - Remove unused Storybook dependencies from @calcom/ui - Add resolutions for consistent dependency versions - Clean up packageExtensions * feat: add lightweight E2E session warmup page (#26451) * feat: add lightweight E2E session warmup endpoint - Add /api/__e2e__/session-warmup endpoint that triggers NextAuth session loading - Update apiLogin fixture to use the new endpoint instead of navigating to /settings/my-account/profile - The endpoint is gated by NEXT_PUBLIC_IS_E2E=1 (already set in playwright.config.ts) - This reduces overhead in E2E tests by avoiding loading a full UI page just to warm up the session Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: move session warmup endpoint to App Router - Move /api/__e2e__/session-warmup from pages/api to app/api - Use App Router patterns (NextResponse, buildLegacyRequest) - Maintains same functionality for E2E session warming Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * rename path * refactor: switch from API route to minimal SSR page (Option 2) - Replace /api/e2e/session-warmup API route with /e2e/session-warmup page - Use App Router page pattern with getServerSession for session warmup - Update apiLogin fixture to navigate to the page instead of API request Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * revert users fixture but with a new url * render nothing on success * clean up * trying something * Revert "trying something" This reverts commit 2ae2f7dcb42612e54eb072a9f09857272020889a. --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Keith Williams <keithwillcode@gmail.com> * Disable noReactSpecificProps as we use react (#26479) * fix(auth): fix SAML tenant extraction and validation (#26482) - Extract tenant from userInfo in saml-idp (IdP-initiated) - Add profile.requested?.tenant fallback for OAuth (SP-initiated) - Block invalid tenant format in hosted (security) * fix: atoms build by updating import paths (#26489) * fix build * fix build * fix: "New" button sizing inconsistent between Workflows and Event Types pages (#26066) * fix: consistent button sizing between fab and button variants on desktop * fix: consistent button sizing between fab and button variants on desktop * fix(ui): align New button sizing across pages * fix: New button sizing inconsistent between Workflows and Event Types pages * Update Button.tsx * test: fix unit test flake (#25557) * fix: revalidate teams cache after accepting invite via token When a user accepts a team invite via token on the /teams page, the teams cache was not being invalidated. This caused the page to show stale data (empty list) while the sidebar correctly showed the teams. This fix adds a call to revalidateTeamsList() after processing an invite token, ensuring the cache is invalidated and fresh data is fetched immediately. Co-Authored-By: anik@cal.com <adhabal2002@gmail.com> * fix: revalidate teams cache after creating team in onboarding flow Co-Authored-By: anik@cal.com <adhabal2002@gmail.com> * Remove comments on teams cache revalidation Removed comments about revalidating teams cache after invite processing. * fix unit test flake * Remove unused import in useCreateTeam hook Removed unused import for revalidateTeamsList. * Remove unused import for revalidateTeamsList --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: Add impersonation context support to booking audit (#26014) ## What does this PR do? Adds infrastructure to track impersonation context in booking audit records and displays it in the UI. When an admin impersonates another user and performs booking actions, the audit system now: - Records the **admin** as the actor (who actually performed the action) - Stores the **impersonated user's UUID** in a separate `context` field - Displays **"Impersonated By"** in the booking logs UI when viewing audit details This separation ensures audit trail integrity (the admin is accountable) while preserving full context about whose account was being used. ### Changes - Added `uuid` to `impersonatedBy` session object for actor identification - Added `uuid` to top-level `User` type in next-auth types for session enrichment - Added `context Json?` field to `BookingAudit` Prisma model - Added `BookingAuditContextSchema` for type-safe context handling with `actingAsUserUuid` field - Updated producer service interface and implementation to pass context through all queue methods - Updated consumer service to persist context to database - Updated repository to store and fetch context in BookingAudit records - Added `impersonatedBy` field to `EnrichedAuditLog` type in `BookingAuditViewerService` - Added `enrichImpersonationContext` method to resolve impersonated user details - Updated booking logs UI to display "Impersonated By" in expanded details - Added `impersonated_by` translation key Link to Devin run: https://app.devin.ai/sessions/3f1252527aef4ead9401bdf055c0817b Requested by: hariom@cal.com (@hariombalhara) ## Mandatory Tasks (DO NOT REMOVE) - [x] I have self-reviewed the code (A decent size PR without self-review might be rejected). - [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - internal infrastructure change - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works. ## How should this be tested? 1. Verify type checks pass: `yarn type-check:ci --force` 2. Verify existing audit tests still pass: `TZ=UTC yarn test` 3. To fully test impersonation context display: - Have an admin impersonate a user - Perform a booking action (create, cancel, reschedule) - Navigate to the booking's audit logs - Expand the details for the action - Verify "Impersonated By" row appears showing the impersonated user's name - Verify the BookingAudit record has: - `actorId` pointing to the admin's AuditActor - `context` containing `{ actingAsUserUuid: "<impersonated-user-uuid>" }` ## Human Review Checklist - [ ] Verify the `context` field schema design is appropriate for future extensibility - [ ] Confirm the `uuid` addition to User type in next-auth doesn't break existing auth flows - [ ] Check that the optional `context` parameter doesn't break existing queue method callers - [ ] Verify no migration file is needed (or if squashing is handled separately) - [ ] Verify the UI displays "Impersonated By" correctly when impersonation context is present - [ ] Confirm `enrichImpersonationContext` handles edge cases (null context, invalid context, deleted user) ## Checklist - [x] My code follows the style guidelines of this project - [x] I have commented my code, particularly in hard-to-understand areas - [x] I have checked if my changes generate no new warnings * perf: improve cal video webhook (#26495) * perf: improve cal video webhook * save format * refactor: use errorMs * chore: change API codeowner to Foundation (#26504) * chore(auth): add error logging for saml-idp silent failures (#26484) * chore(auth): add error logging for saml-idp silent failures * chore(auth): add warn-level logging for saml-idp silent failures * chore(auth): change 'No user found' log to warn level * chore(auth): add warn-level logging for silent auth failures - saml-idp authorize: credentials, code, token, userInfo, user lookup - callbacks:signIn: account type, email, name, catch-all - callbacks:jwt: unknown account type (info → warn) - saml:profile: missing email from IdP - getServerSession: user not found for valid token * feat(api): add team event-types webhooks controller (#26449) * feat(api): add team event-types webhooks controller - Add TeamsEventTypesWebhooksController for managing webhooks on team event types - Add IsTeamEventTypeWebhookGuard for authorization - Add TeamEventTypeWebhooksService for business logic - Register new controller in TeamsEventTypesModule - Enable unsafeParameterDecoratorsEnabled in biome.json for NestJS support Co-Authored-By: morgan@cal.com <morgan@cal.com> * test(api): add e2e tests for team event-types webhooks controller Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api): restrict team event-type webhooks to admins/owners only Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api): use regular imports instead of type imports for DI and DTOs Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api): use regular imports for DI in guard file Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: circular depndency in modules * delete teams in test * fix roles guard * fix biome * fix guard * resolve type import * resolve review feedback --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: remove Mintlify AI chat from CMD+K widget (#26485) * chore: remove Mintlify AI chat from CMD+K widget - Remove MintlifyChat component and related state from Kbar.tsx - Delete packages/features/mintlify-chat directory (MintlifyChat.tsx, util.ts) - Delete apps/web/app/api/mintlify-chat API routes and tests - Delete packages/lib/server/mintlifyChatValidation.ts - Remove Mintlify-related env vars from .env.example and turbo.json - Refactor Kbar.tsx to fix lint issues (explicit types, exports at end) Co-Authored-By: peer@cal.com <peer@cal.com> * fix: use ReactNode import instead of JSX from react The JSX type is not exported from 'react' module. Use the global JSX.Element type (available in React projects) and import ReactNode for the children prop type. Co-Authored-By: peer@cal.com <peer@cal.com> * feat: add all event-types and upcoming bookings to KBar - Increase event types limit from 10 to 100 to show more event types - Add useUpcomingBookingsAction hook to fetch and display upcoming bookings - Bookings show title, date, and time in KBar search results - Navigate to booking details page when selecting a booking Co-Authored-By: peer@cal.com <peer@cal.com> * Revert "feat: add all event-types and upcoming bookings to KBar" This reverts commit 69d03397e3820e45e7207eb55b38117d269eae5e. --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat: update translations via @LingoDotDev (#26497) Co-authored-by: Lingo.dev <support@lingo.dev> * feat: implement FeatureOptInService (#25805) * feat: implement FeatureOptInService WIP * clean up * feat: consolidate feature repositories and add updateFeatureForUser - Implement updateFeatureForUser in FeaturesRepository (similar to updateFeatureForTeam) - Move getUserFeatureState and getTeamFeatureState from PrismaFeatureOptInRepository to FeaturesRepository - Update FeatureOptInService to use only FeaturesRepository - Add setUserFeatureState and setTeamFeatureState methods to FeatureOptInService - Update _router.ts to remove PrismaFeatureOptInRepository usage - Remove PrismaFeatureOptInRepository.ts and FeatureOptInRepositoryInterface.ts - Update features.repository.interface.ts and features.repository.mock.ts - Add integration tests for updateFeatureForUser, getUserFeatureState, getTeamFeatureState - Update service.integration-test.ts to use FeaturesRepository Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: rename updateFeatureForUser to setUserFeatureState Rename to match the convention used for setTeamFeatureState Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: return FeatureState type from getUserFeatureState and getTeamFeatureState * fix integration tests * clean up logics * update services and router * refactor: change getUserFeatureState and getTeamFeatureState to accept featureIds array - Renamed getUserFeatureState to getUserFeatureStates - Renamed getTeamFeatureState to getTeamFeatureStates - Changed parameter from featureId: string to featureIds: string[] - Changed return type from FeatureState to Record<string, FeatureState> - Updated FeatureOptInService to use the new batch methods - Added tests for querying multiple features in a single call - Optimized listFeaturesForTeam to fetch all feature states in one query Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * feat: add getFeatureStateForTeams for batch querying multiple teams - Added getFeatureStateForTeams method to query a single feature across multiple teams in one call - Updated FeatureOptInService.resolveFeatureStateAcrossTeams to use the new batch method - Replaces N+1 queries with a single database query for team states - Added comprehensive integration tests for the new method Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: combine org and team state queries into single call - Include orgId in the teamIds array passed to getFeatureStateForTeams - Extract org state and team states from the combined result - Reduces database queries from 3 to 2 in resolveFeatureStateAcrossTeams Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: use team.isOrganization and clarify computeEffectiveState comment Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * refactor: use MembershipRepository.findAllByUserId with isOrganization Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * feat: add featureId validation using isOptInFeature type guard Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * less queries * add fallback value * fix type error * move files * add autoOptInFeatures column * use autoOptInFeatures flag within FeatureOptInService * add setUserAutoOptIn and setTeamAutoOptIn * fix computeEffectiveState logic * rewrite computeEffectiveState * clean up integration tests * clean up in afterEach * fix type error * refactor: use FeaturesRepository methods instead of direct Prisma calls Replace all manual userFeatures and teamFeatures Prisma operations with the new setUserFeatureState and setTeamFeatureState repository methods. Changes include: - Admin handlers (assignFeatureToTeam, unassignFeatureFromTeam) - Test fixtures and integration tests - Playwright fixtures - Development scripts This ensures consistent feature flag management through the repository pattern and supports the new tri-state semantics (enabled/disabled/inherit). Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * clean up * fix the logic * extract some logic into applyAutoOptIn() * remove wrong code * refactor: convert setUserFeatureState and setTeamFeatureState to object params with discriminated union - Convert multiple positional parameters to single object parameter - Use discriminated union types: assignedBy required for enabled/disabled, omitted for inherit - Update all callers across repository, service, handlers, fixtures, and tests * fix type error * use Promise.all * fix --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat: add organization banner to user profile page (#26514) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat: Hubspot write to meeting object (#26039) * feat: Hubspot write to meeting object * fix: translate hardcoded strings and remove debug console.log Co-Authored-By: amit@cal.com <samit91848@gmail.com> * refactor * fix: improve static value detection for placeholder replacement - Changed condition from startsWith/endsWith to includes('{') to properly detect embedded placeholders - Strings like 'Hello {name}!' are now correctly processed for placeholder replacement - Pure placeholder tokens that can't be resolved return null - Partially resolved values are returned as-is Co-Authored-By: amit@cal.com <samit91848@gmail.com> * refactor: split WriteToObjectSettings into types and utils files - Extract interfaces, enums, and type definitions to WriteToObjectSettings.types.ts - Extract constants and utility functions to WriteToObjectSettings.utils.ts - Update main component to use the new utility functions - Improves code organization and maintainability Co-Authored-By: amit@cal.com <samit91848@gmail.com> * revert: restore original static value detection logic Per user request - the startsWith/endsWith check was intentional Co-Authored-By: amit@cal.com <samit91848@gmail.com> * test: add unit tests for HubSpot CRM service Tests cover: - ensureFieldsExistOnMeeting: field validation against HubSpot properties - getTextValueFromBookingTracking: UTM parameter extraction - getTextValueFromBookingResponse: placeholder replacement - getDateFieldValue: date field resolution for different date types - getFieldValue: main field value resolution for all field types - generateWriteToMeetingBody: write-to-meeting body generation - getContacts: contact search functionality Co-Authored-By: amit@cal.com <samit91848@gmail.com> * fix: correct type errors in HubSpot CRM service tests - Import WhenToWrite enum from crm-enums - Replace string literals with WhenToWrite.EVERY_BOOKING enum values - Add missing whenToWrite property to field config objects Co-Authored-By: amit@cal.com <samit91848@gmail.com> * fix: use type casting for intentional type errors in tests - Cast numeric fieldValue to string for testing non-string handling - Cast invalid field type string to CrmFieldType for testing unsupported types Co-Authored-By: amit@cal.com <samit91848@gmail.com> * fix: prevent unhandled promise rejections in HubSpot CRM tests - Re-apply mockGetAppKeysFromSlug implementation in beforeEach to ensure mock is always set correctly after clearAllMocks - Change vi.resetAllMocks() to vi.clearAllMocks() to preserve mock implementations between tests - Add explicit types to satisfy biome lint rules - This fixes the 'Cannot read properties of undefined (reading client_id)' errors that were causing CI to fail with exit code 1 Co-Authored-By: amit@cal.com <samit91848@gmail.com> * refactor: convert HubSpot tests to black-box testing through public methods Co-Authored-By: amit@cal.com <samit91848@gmail.com> * fix: properly type mock CalendarEvent in HubSpot tests Co-Authored-By: amit@cal.com <samit91848@gmail.com> * fix: properly type TFunction in mock CalendarEvent Co-Authored-By: amit@cal.com <samit91848@gmail.com> * chore: graceful owner fail test * refactor * fix: type check * fix: remove null fields * Update packages/app-store/hubspot/lib/CrmService.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * docs: add DTO location and naming conventions to knowledge base (#26478) * docs: add DTO location and naming conventions to knowledge base Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * docs: clarify DTO location rules for new features vs refactored code Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * docs: simplify DTO location - all DTOs go in packages/lib/dto/ Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: convert PrismaAttributeToUserRepository to accept Prisma as dependency (#26515) * refactor: convert PrismaAttributeToUserRepository to accept Prisma as dependency Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> * fix: use Prisma types from generated client instead of custom types Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: handle existing users on invite token flow (#26217) * fix(auth): validate user before signup with invite token Validate if user already exists before creating account when signing up with team or organization invite tokens. Existing users are redirected to login to accept the invitation. - Add user existence check in signup handlers - Return 409 for existing users with redirect to login - Extract signup fetch logic to dedicated module - Add e2e test coverage * fix(auth): address code review feedback - Fix fetchSignup tests to use vi.spyOn for proper mock restoration - Add content-type validation before parsing JSON response - Guard against undefined error in Stripe callback - Use t() for localized error message - Fix race condition in handlers by catching P2002 on create * fix(auth): address additional code review feedback - Add INVALID_SERVER_RESPONSE constant to follow established pattern - Check error.meta.target includes email before returning USER_ALREADY_EXISTS to avoid false positives from other unique constraint violations - Add select: { id: true } to user.create calls since downstream functions only need the user id * test: add unit tests for P2002 handling in signup handlers - Add shared test suite covering all P2002 edge cases - Ensure 409 only for email constraint violations - Fix non-token paths to use atomic create + catch pattern * fix: update error message copy per review feedback * fix(auth): address code review feedback and prevent orphan Stripe customers - Add user existence check before Stripe customer creation (token flow) - Add select clause to user.create for consistency - Fix showToast argument order (pre-existing bug) - Use toHaveURL instead of waitForURL in E2E tests * fix(auth): resolve 500 errors by fixing Prisma error detection across module boundaries The instanceof check for PrismaClientKnownRequestError fails when different Prisma client instances are loaded. Added fallback check by constructor name * fix(auth): validate invitedTo before upsert on team invite signup * test(auth): update P2002 tests for new invite flow P2002 tests now use non-token flow since token flow uses upsert Added tests for invitedTo validation on invite signup * fix(auth): add guards and P2002 handling per review feedback - Guard existingUser check with if (foundToken?.teamId) - Guard username check with if (username) for premium flow - Add `select` clause to findFirst/findUnique queries - Add try-catch on upsert for race condition P2002 errors * fix(auth): narrow P2002 handling to email/username targets * chore: release v6.0.8 * fix: Support 10-digit phone numbers for Ivory Coast (+225) (#26465) * fix: update ivory coast mask to 10 digits * update formating for Benin numbers --------- Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com> Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com> * fix(ci): use env vars for input interpolation in workflow run steps (#26520) Co-authored-by: Alex van Andel <me@alexvanandel.com> * refactor: use structured logger in video adapters (#26285) - Remove debug console.log/console.error statements - Add logger.debug for observability (meeting lifecycle events) - Add logger.error with safe error pattern (message + name only) - Fix error messages to avoid exposing response details - Remove redundant try/catch blocks (errors propagate naturally) * fix: validate owner email on platform org creation (#26286) Remove isPlatform bypass from owner verification to ensure users can only create organizations where they are the designated owner. Add test coverage for create and intentToCreateOrg handlers: - Regression tests for isPlatform bypass fix - Happy path for admin creating org for another user * perf: batch booking queries in output service (#25900) Replace N sequential queries with single batch queries in: - getOutputRecurringBookings - getOutputRecurringSeatedBookings Uses existing batch repository methods. Reduces database roundtrips from O(n) to O(1) for recurring booking lookups Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com> * Make booking-audit integration test utils reusable (#26526) * fix: generate compliant passwords using meeting_password_requirement (#26148) * fix(zoomvideo): generate compliant passwords using meeting_password_requirement - Add meetingPasswordRequirementSchema to parse Zoom's password policy settings - Implement validatePasswordAgainstRequirements() to check if a password meets the policy - Implement generateCompliantPassword() to create passwords that comply with the policy - Update translateEvent() to use getCompliantPassword() which validates the default password or generates a new compliant one based on meeting_password_requirement - Add meeting_password_requirement to the settings API filter - Improve error handling for non-JSON responses in OAuthManager (XML validation errors) This fixes the frequent 'Error in JSON parsing Zoom API response' errors caused by Zoom returning XML validation errors when the password doesn't comply with the account's password policy (e.g., numeric-only requirement). Co-Authored-By: anik@cal.com <adhabal2002@gmail.com> * refactor: use cleaner single-pass consecutive character check - Replace nested-loop O(n*k) implementation with single-pass O(n) helper - Add proper guard for consecutiveLength < 4 (Zoom allows 0, 4-8) - Move consecutive check before only_allow_numeric to apply it for all cases - Fix edge-case bug where consecutiveLength 1-3 could incorrectly reject passwords Co-Authored-By: anik@cal.com <adhabal2002@gmail.com> * Optimize OAuth response handling Refactor OAuth response validation to read body only once. * Improve error handling in Zoom API response parsing Refactor error handling for Zoom API response parsing to improve logging and clarity. * Improve compliant password generation logic Enhance password generation to avoid consecutive characters when numeric only is required. * Remove password requirement handling from VideoApiAdapter Removed meeting password requirement schema and related functions for password validation and generation. --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: Clean up the /tests in the root (#26525) * refactor: Delete mockTRPCContext and mockData, and relocate mockStripeSubscription to stripe mock. * chore: Delete unused Stripe, video client, and reminder scheduler mock files. * feat(companion): UI Enhancements for Android and Extension (#26434) * feat: companion-android-ui-upgrade version 1 * recurrings and unconfirmed booking filter and page implementation * add badge and links to event type list page * address cubics comments * feat(companion): unify dropdown menu for Android and extension (#26486) * feat(companion): unify dropdown menu for Android and extension - Merge Android-specific dropdown implementations into base component files - EventTypeListItem: Add DropdownMenu with Preview, Copy link, Edit, Duplicate, Delete actions - BookingListItem: Add DropdownMenu with booking actions (reschedule, edit location, add guests, etc.) - RecurringBookingListItem: Add DropdownMenu with recurring booking actions - AvailabilityListItem: Add DropdownMenu with Set as Default, Duplicate, Delete actions - BookingDetailScreen: Add DropdownMenu in header for Android with AlertDialog for cancel confirmation - Delete all .android.tsx files as implementations are now unified * fix(companion): fix typecheck errors after dropdown unification - Remove unused props from EventTypeListItem.ios.tsx (copiedEventTypeId, handleEventTypeLongPress) - Remove unused onActionsPress prop from BookingListItem.ios.tsx - Remove copiedEventTypeId and handleEventTypeLongPress props from index.ios.tsx and index.tsx - Remove onLongPress and onActionsPress props from BookingListScreen.tsx - Remove handleScheduleLongPress, setSelectedSchedule, setShowActionsModal props from AvailabilityListScreen.tsx - Fix BookingDetailScreen.tsx to use correct action property names (reschedule.visible instead of canReschedule, etc.) * fix(companion): remove unused code after dropdown unification - Remove unused handleEventTypeLongPress function and ActionSheetIOS import from index.ios.tsx - Remove unused copiedEventTypeId state, handleEventTypeLongPress function, and ActionSheetIOS import from index.tsx - Prefix unused setSelectedBooking with underscore in BookingListScreen.tsx - Remove unused handleScheduleLongPress function and ActionSheetIOS import from AvailabilityListScreen.tsx * feat(companion): unify booking filter UI for Android and extension - Remove SegmentedControl from web/extension booking list page - Use Header dropdown for booking status filter on both Android and web - Use unified event type filter dropdown for both platforms - Remove unused showFilterModal state and related code - Pass filterOptions, activeFilter, and onFilterChange to Header for all platforms * fix(companion): add header padding for web/extension to prevent button clipping - Add headerLeftContainerStyle and headerRightContainerStyle with 12px padding for web platform - Applied to root Stack and all nested tab Stack layouts - Fixes issue where header buttons were touching edges and getting chopped off on extension/web - Android remains unaffected as the fix is web-only * fix(companion): add HeaderButtonWrapper for web-only header padding - Create HeaderButtonWrapper component that adds 12px margin on web only - Wrap all header buttons with HeaderButtonWrapper to prevent clipping - Revert invalid screenOptions changes that caused typecheck errors - Apply fix to all screens with native header buttons: - reschedule.tsx, edit-location.tsx, add-guests.tsx - mark-no-show.tsx, view-recordings.tsx, meeting-session-details.tsx - event-type-detail.tsx, BookingDetailScreen.tsx, profile-sheet.tsx - edit-availability-day.tsx, edit-availability-name.tsx, edit-availability-override.tsx * update more ui-ux * address cubics comments * address cubics comments & open event type list page first for inttial render of app * chore: Integrate booking cancellation audit (#26458) ## What does this PR do? > **⚠️ Note: This PR does not enable booking audit in production.** The `BookingAuditTaskerProducerService` has an [`IS_PRODUCTION` guard](https://github.com/calcom/cal.com/blob/integrate-booking-creation-reschedule-audit/packages/features/booking-audit/lib/service/BookingAuditTaskerProducerService.ts#L106-L108) that skips audit task queueing in production environments. This allows the integration to be tested in development before enabling it in production. Integrates audit logging for booking cancellations, following the pattern established in PR #26046 for booking creation/rescheduling audit. - Related to #25125 (Booking Audit Infrastructure) ### Changes: - Add audit logging for single booking cancellation via `onBookingCancelled` - Add audit logging for bulk recurring booking cancellation via `onBulkBookingsCancelled` - Pass `userUuid` and `actionSource` from webapp cancel route (WEBAPP) - Pass `userUuid` and `actionSource` from API-v2 bookings service (API_V2) - Create `getAuditActor` helper to derive actor from userUuid or create synthetic guest actor - Add `getUniqueIdentifier` helper for generating unique actor identifiers - Add warning log when `actionSource` is "UNKNOWN" for observability - Add integration tests for booking cancellation audit ### Audit Data Captured: - `cancellationReason` (simple string value) - `cancelledBy` (simple string value) - `status` (old → new, e.g., "ACCEPTED" → "CANCELLED") ### Updates since last revision: - Simplified `CancelledAuditActionService` schema: `cancellationReason` and `cancelledBy` are now stored as simple nullable strings instead of change objects (old/new), since cancellation is a one-time event where tracking previous values doesn't apply - Added integration tests for cancelled booking audit in `booking-audit-cancelled.integration-test.ts` - Added `getUniqueIdentifier` helper function in actor.ts for generating unique identifiers with prefixes ## Mandatory Tasks (DO NOT REMOVE) - [x] I have self-reviewed the code (A decent size PR without self-review might be rejected). - [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed. - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works. ## How should this be tested? 1. Cancel a single booking via the webapp - verify audit record is created with actor and actionSource="WEBAPP" 2. Cancel a single booking via API v2 - verify audit record is created with actionSource="API_V2" 3. Cancel all remaining bookings in a recurring series - verify bulk audit records are created with shared operationId 4. Cancel via unauthenticated cancel link - verify guest actor is created with synthetic email (prefixed with "param-" or "fallback-") 5. Run integration tests: `yarn test packages/features/booking-audit/lib/service/__tests__/booking-audit-cancelled.integration-test.ts` ## Human Review Checklist - [ ] Verify `onBookingCancelled` and `onBulkBookingsCancelled` methods exist in `BookingEventHandlerService` - [ ] Review the `getAuditActor` fallback logic - creates synthetic email with "fallback-" or "param-" prefix when no userUuid available - [ ] Confirm the simplified schema for `cancellationReason`/`cancelledBy` (no longer tracking old→new) is intentional - [ ] Note: Audit logging calls are awaited directly - if audit service fails, the cancellation will fail. Confirm this is the desired behavior. - [ ] Verify `CancelledAuditDisplayData` type no longer includes `previousReason` and `previousCancelledBy` fields --- Link to Devin run: https://app.devin.ai/sessions/42404e76a66946fe9e46fa07fb12e779 Requested by: @hariombalhara (hariom@cal.com) * feat: OAuth2 controller api v2 + refactor oAuth Trpc handlers (#25989) * feat(api-v2): add OAuth2 controller skeleton for auth module - Add new OAuth2 module under /auth with controller, service, repository, and DTOs - Implement skeleton endpoints: - GET /v2/auth/oauth2/clients/:clientId - Get OAuth client info - POST /v2/auth/oauth2/clients/:clientId/authorize - Generate authorization code - POST /v2/auth/oauth2/clients/:clientId/exchange - Exchange code for tokens - POST /v2/auth/oauth2/clients/:clientId/refresh - Refresh access token - Create input DTOs for authorize, exchange, and refresh operations - Create output DTOs for client info, authorization code, and tokens - Register OAuth2Module in endpoints.module.ts Co-Authored-By: morgan@cal.com <morgan@cal.com> * chore: add missing functions to platform libraries * feat(api-v2): integrate OAuthService from platform-libraries into OAuth2 controller - Add OAuthService export to platform-libraries - Refactor OAuth2Service to use OAuthService.validateClient() and OAuthService.verifyPKCE() - Remove duplicate local implementations of validateClient and verifyPKCE methods Co-Authored-By: morgan@cal.com <morgan@cal.com> * feat(api-v2): use local validateClient and verifyPKCE implementations - Remove OAuthService export from platform-libraries (will be deprecated) - Reimplement validateClient and verifyPKCE methods locally in OAuth2Service - Use verifyCodeChallenge and generateSecret from platform-libraries directly Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor(api-v2): separate repositories for OAuth2, access codes, and teams - Create AccessCodeRepository for access code Prisma operations - Add findTeamBySlugWithAdminRole method to TeamsRepository - Move generateAuthorizationCode, createTokens, verifyRefreshToken to OAuth2Service - Update OAuth2Repository to only contain OAuth client operations - Update OAuth2Module to import TeamsModule and provide AccessCodeRepository Addresses PR review comments to properly separate concerns Co-Authored-By: morgan@cal.com <morgan@cal.com> * feat(api-v2): implement JWT token creation and verification for OAuth2 - Implement createTokens method using jsonwebtoken to sign access and refresh tokens - Implement verifyRefreshToken method to verify JWT refresh tokens - Add ConfigService injection for CALENDSO_ENCRYPTION_KEY access - Import ConfigModule in OAuth2Module for dependency injection Based on logic from apps/web/app/api/auth/oauth/token/route.ts and apps/web/app/api/auth/oauth/refreshToken/route.ts Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: refactor and dayjs import fix * feat(api-v2): add ApiAuthGuard to getClient endpoint and e2e tests for OAuth2 - Add @UseGuards(ApiAuthGuard) to getClient endpoint for authentication - Add comprehensive e2e tests for all OAuth2 endpoints: - GET /v2/auth/oauth2/clients/:clientId - POST /v2/auth/oauth2/clients/:clientId/authorize - POST /v2/auth/oauth2/clients/:clientId/exchange - POST /v2/auth/oauth2/clients/:clientId/refresh - Tests cover happy paths and error cases (invalid client, invalid code, etc.) Co-Authored-By: morgan@cal.com <morgan@cal.com> * chore(api-v2): hide OAuth2 endpoints from Swagger documentation Co-Authored-By: morgan@cal.com <morgan@cal.com> * hide endpoints from doc * fix(api-v2): address PR feedback for OAuth2 controller - Fix P0 critical bug: token_type field name mismatch in DecodedRefreshToken interface - Add @Equals('authorization_code') validation to exchange.input.ts grantType - Add @Equals('refresh_token') validation to refresh.input.ts grantType - Add @IsNotEmpty() validation to get-client.input.ts clientId - Add @Expose() decorators to all output DTOs for proper serialization - Add security test assertion to verify clientSecret is not returned in response Co-Authored-By: morgan@cal.com <morgan@cal.com> * feat(api-v2): implement redirect behavior for OAuth2 authorize endpoint - Update authorize endpoint to return HTTP 303 redirect with authorization code - Add exact match validation for redirect URI (security requirement) - Implement error handling with redirect to redirect URI and error query params - Add state parameter support for CSRF protection - Update e2e tests to verify redirect behavior (303 status, Location header, error redirects) Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor(api-v2): address PR feedback for OAuth2 authorize endpoint - Make redirectUri a required input parameter (remove optional fallback) - Move buildRedirectUrl and mapErrorToOAuthError to oauth2Service - Add return statements to res.redirect() calls - Simplify controller by delegating redirect URL building to service Co-Authored-By: morgan@cal.com <morgan@cal.com> * wip move code outside of api v2 * feat(oauth): wire up dependency injection for OAuthService and repositories Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor: oAuthService used in routes * fix imports * fix(api-v2): return 404 for invalid client ID instead of redirect in authorize endpoint Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api-v2): fix E2E test URL paths and remove bootstrap() in authenticated section - Remove bootstrap() call in authenticated section to match working test pattern - Change URL paths from /api/v2/... to /v2/... in authenticated section - Keep bootstrap() and /api/v2/... paths in unauthenticated section Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix(api-v2): mock getToken from next-auth/jwt for E2E tests - Add jest.mock for next-auth/jwt getToken function - Mock returns null for unauthenticated tests - Mock returns { email: userEmail } for authenticated tests - Remove withNextAuth helper since ApiAuthGuard uses ApiAuthStrategy which calls getToken directly, not NextAuthStrategy Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix tests and code review * cleanup generate secrets * cleanup controller * chore: remove console.log from OAuthService.validateClient Co-Authored-By: morgan@cal.com <morgan@cal.com> * Update apps/web/app/api/auth/oauth/refreshToken/route.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * fix(api-v2): add bootstrap() to authenticated E2E tests and update URL paths to /api/v2/ Co-Authored-By: morgan@cal.com <morgan@cal.com> * Merge remote-tracking branch 'origin/devin/oauth2-controller-skeleton-1765988792' and remove console.log from token route Co-Authored-By: morgan@cal.com <morgan@cal.com> * chore: remove dead code * refactor * refactor: generateAuthCode trpc handler and getClient trpc handler * remove pkce check for refreshToken endpoint * Update packages/trpc/server/routers/viewer/oAuth/getClient.handler.ts Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * refactor: error handling * refactor: error handling * refactor: error handling * remove console log * provide redirectUri in generateAuthCodeHandler * provide redirectUri in authorize view * refactor: replace HttpError with ErrorWithCode in OAuth files - Update OAuthService to use ErrorWithCode instead of HttpError - Update mapErrorToOAuthError to check ErrorCode instead of status codes - Update token/route.ts and refreshToken/route.ts to use ErrorWithCode - Add ErrorWithCode export to platform-libraries - Use getHttpStatusCode to map ErrorCode to HTTP status codes Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: update generateAuthCode handler to use ErrorWithCode instead of HttpError The handler was still checking for HttpError in its catch block, but OAuthService now throws ErrorWithCode. This caused the error messages to be lost and replaced with 'server_error' instead of the specific error messages. Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: update OAuth2 controller to use ErrorWithCode instead of HttpError The controller was still checking for HttpError in its catch blocks, but OAuthService now throws ErrorWithCode. This caused all errors to return 500 Internal Server Error instead of the correct HTTP status codes (400, 401, 404). Also added getHttpStatusCode export to platform-libraries. Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: add explicit unknown type annotation to catch blocks in OAuth2 controller Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: change NotFoundException to HttpException in authorize endpoint Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: handle err with ErrorWithCode in authorize endpoint catch block Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: move errorWithCode * fix: error code rfc * fix: no need to handle errors there is a middleware * refactor errors * refactor errors * refactor redirecturi and state from api * refactor: address PR comments for OAuth2 controller - Remove unused GetOAuth2ClientInput class - Change API tag from 'Auth / OAuth2' to 'OAuth2' - Move OAuthClientFixture to separate fixture file (oauth2-client.repository.fixture.ts) - Add 'type' property to OAuth2ClientDto for confidential/public client type - Rename 'clientId' to 'id' in OAuth2ClientDto (using @Expose mapping) - Clean up duplicate provider declaratio… * fix: remove duplicate onBookingCancelled call Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com> --------- Signed-off-by: Bandhan Majumder <bandhanmajumder16@gmail.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Ram Shukla <codewithrex@gmail.com> Co-authored-by: Pedro Castro <pedro@cal.com> Co-authored-by: Alex van Andel <me@alexvanandel.com> Co-authored-by: Manas Kenge <man.kng02@gmail.com> Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com> Co-authored-by: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com> Co-authored-by: Eesh Midha <72607015+eeshm@users.noreply.github.com> Co-authored-by: Beto <43630417+betomoedano@users.noreply.github.com> Co-authored-by: shashank-100 <shashank.telkhade@gmail.com> Co-authored-by: Kartik Labhshetwar <kartik.labhshetwar@gmail.com> Co-authored-by: Abhay Mishra <grabhaymishra@gmail.com> Co-authored-by: Keith Williams <keithwillcode@gmail.com> Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> Co-authored-by: Pallav <90088723+Pallava-Joshi@users.noreply.github.com> Co-authored-by: Ryukemeister <sahalrajiv6900@gmail.com> Co-authored-by: Rajiv Sahal <sahalrajiv-extc@atharvacoe.ac.in> Co-authored-by: Peer Richelsen <peeroke@gmail.com> Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com> Co-authored-by: sean-brydon <55134778+sean-brydon@users.noreply.github.com> Co-authored-by: cal-com-ci[bot] <247290566+cal-com-ci[bot]@users.noreply.github.com> Co-authored-by: Lingo.dev <support@lingo.dev> Co-authored-by: Benny Joo <sldisek783@gmail.com> Co-authored-by: Eunjae Lee <hey@eunjae.dev> Co-authored-by: Volnei Munhoz <volnei@cal.com> Co-authored-by: Anshumancanrock <109489361+Anshumancanrock@users.noreply.github.com> Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com> Co-authored-by: Amit Sharma <74371312+Amit91848@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: Kartik <103111467+kartik-212004@users.noreply.github.com> Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com> Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com> Co-authored-by: Adarsh Tiwari <adarshtiwari797023@gmail.com> Co-authored-by: Dylan Tarre <timecreepsby@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Amin Jaoui <101276751+aminjaoui@users.noreply.github.com> Co-authored-by: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com> Co-authored-by: CarinaWolli <wollencarina@gmail.com> Co-authored-by: Anik Dhabal Babu <adhabal2002@gmail.com> Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com> Co-authored-by: Mehmet Sungur <mehmetsungurmutlu@gmail.com> Co-authored-by: xDipzz <155362028+xDipzz@users.noreply.github.com> Co-authored-by: Pasquale Vitiello <pasqualevitiello@gmail.com> Co-authored-by: pasquale@cal.com <pasquale@cal.com> Co-authored-by: cal.com <morgan@cal.com> Co-authored-by: Anas Najam <129951478+anzz14@users.noreply.github.com> Co-authored-by: Bandhan Majumder <133476557+bandhan-majumder@users.noreply.github.com> Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> Co-authored-by: Kartik Saini <41051387+kart1ka@users.noreply.github.com> Co-authored-by: Abhishek <abhiifour@gmail.com> Co-authored-by: susan@cal.com <susan@cal.com> Co-authored-by: Bailey Pumfleet <bailey@pumfleet.co.uk> Co-authored-by: simiondolha <34995943+simiondolha@users.noreply.github.com> Co-authored-by: simiondolha <simiondolha@users.noreply.github.com> Co-authored-by: Kirankumar Ambati <kiran.chinna12520@gmail.com> |