* refactor: apply biome formatting to small packages + packages/lib
Format packages/sms, packages/prisma, packages/platform/libraries,
packages/platform/examples, packages/platform/types, packages/emails,
and packages/lib.
Excludes packages/platform/examples/base/src/pages/[bookingUid].tsx
due to pre-existing lint errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* revert: remove packages/platform formatting changes
Revert biome formatting for packages/platform as requested.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-13 07:39:01 -03:00
Pedro CastroGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Validates webhook URLs on create and update:
- HTTPS required (HTTP allowed for self-hosted and E2E)
- Blocks private IP ranges and localhost
- Blocks cloud metadata endpoints
Existing webhooks are preserved: validation only applies when URL is created or changed.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(auth): add URL validation for organization logo fields
- Add URL validation utility for server-side fetched URLs
- Validate logo URLs in tRPC organization schema
- Validate logo URLs in API v2 team DTOs
- Add graceful fallback in logo route for invalid URLs
- Only allow HTTPS and image data URLs
- Add unit tests for URL validation
* fix: add missing IP range and type validation
- Add RFC 6598 CGNAT range (100.64.0.0/10) to blocked IPs
- Add @IsString() decorator before custom URL validators
- Add boundary tests for new IP range
* fix: address review feedback
- Export validateUrlForSSRFSync via @calcom/platform-libraries
- Fix nullable/optional order in Zod schema
* fix: block localhost hostname and explicit null check
- Add localhost to BLOCKED_HOSTNAMES for sync validation
- Use explicit null check (url == null) instead of falsy check
* fix: allow empty string in URL validation
* refactor: extract shared validation logic
- Extract validateUrlCore() to eliminate duplication between sync/async versions
- Add JSDoc to all exported functions for better discoverability
- Remove redundant comments that repeated function names
- Simplify existing comments to be more concise
* fix: reject empty strings in URL validator
Previously if (!url) allowed empty strings to bypass validation.
Now explicitly checks for null/undefined only
2026-01-08 22:03:54 +00:00
Keith WilliamsGitHubkeith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: move eventTypeSlug and eventTypeLocations to @calcom/lib/zod
Move shared Zod schemas from @calcom/prisma/zod-utils to @calcom/lib/zod
to avoid prisma imports in non-repository code.
Changes:
- Create packages/lib/zod/eventType.ts with eventTypeSlug, eventTypeLocations,
and EventTypeLocation type
- Re-export from @calcom/prisma/zod-utils for backwards compatibility
- Update packages/features/eventtypes/lib/schemas.ts to import from @calcom/lib/zod
- Remove unused slugify function from zod-utils.ts
This allows files like schemas.ts to avoid importing from @calcom/prisma,
which helps maintain the architectural boundary that prisma should only
be imported in repository code.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: remove barrel file and use explicit imports
Address PR feedback:
- Delete packages/lib/zod/index.ts barrel file
- Update imports to use explicit path @calcom/lib/zod/eventType
- Simplify EventTypeLocation type to use z.infer
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: use explicit type definition with z.ZodType for eventTypeLocations
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
