* fix: use relative redirects in booking confirmation routes to fix localhost redirect issue
When Cal.com runs behind a reverse proxy, request.url may return the internal
server URL (localhost:3000) instead of the external URL. This causes users to
be redirected to localhost after confirming bookings via email links.
This fix changes the redirect URLs from using url.origin (which could be
localhost) to using relative URLs via new URL(path, request.url). This ensures
the browser resolves the redirect against whatever domain the user actually
requested, fixing the issue for self-hosted deployments behind proxies.
Fixes#20358
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test: add tests for booking confirmation redirect URL construction
Add unit tests for verify-booking-token and link API routes to ensure:
- Redirect URLs preserve the request origin (not hardcoded localhost)
- Redirect URLs use the correct booking path (/booking/{uid})
- Error messages are properly encoded in query params
- POST handler returns correct 303 status code
These tests verify the fix for #20358 where users were redirected to
localhost:3000 instead of the proper production URL after confirming
bookings via email links.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add second argument to GET/POST calls in test files to fix type errors
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: show hidden badge on mobile view for event types
* fix: update event type hidden toggle in infinite list
---------
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* feat: highlight recurring bookings with time shift badge across DST
* Update packages/lib/__tests__/timeShift.test.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* refactor: show time shift badge only on first shift in bookings view and occurrences
* refactor: update recurring bookings display logic and wrap booking title text
* refactor: add getFirstShiftFlags helper for time shift flags and update components
---------
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix(settings): improve spacing between navigation child items
* chore: removing prettier formatting
* style: update dropdown item class names for consistent rounding
* style: add spacing and hover margin to navigation items
* style: add hover margin top to navigation item
* apply same ui changes for team profile menu
---------
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
* feat: ooo message on booking page
* make ooo days selectable even when no redirect booking
* handle long notes
* remove unused i18n key
* Private notes stay private on the server, No accidental data leaks through client-side payloads
* address cubics comments
* fix: replace toggle with checkbox for OOO note visibility
- Replace Switch with Checkbox for "show note publicly" option
- Remove "OOO Message:" prefix from displayed notes on booking page
- Update i18n text to "Show note on public booking page"
- Remove unused ooo_message i18n key
* fix the accessibility issue by using proper htmlFor and id association
* only allow selecting OOO dates when the note is public
* fix: cloudflare turnstile token reset
* fix: silently reset turnstile on invalid token error
* refactor: remove unused forwardRef logic from Turnstile component
- Remove forwardRef, useImperativeHandle, and useRef imports
- Remove unused TurnstileInstance type export
- Simplify to a plain function component
- The ref-based reset was replaced by key-based remount in signup-view
* refactor: remove redundant cfToken validation check
The submit button is already disabled when cfToken is missing,
making this defensive check unreachable during normal form flow.
* revert prettier formatiing
* chore: revert yarn.lock changes
* refactor(auth): use shared constant for cloudflare token error message
Replace hardcoded "Invalid cloudflare token" string with an exported
constant to prevent silent breakage if the error message changes.
* use booking.uid instead of booking.id for url param
* show timezone on calendar
* fix type
* restore horizontal tab and remove header and subtitle
* clean up sidebar items
* fix event propagation from attendees
* fetch all statuses except for cancelled on calendar view
* clean up styles of the badges on BookingListItem
* fix useMediaQuery
* add close button to the header
* add assignment reason to the details sheet
* use separator row
* use ToggleGroup for the top bookings tab
* move ViewToggleButton
* resize the action button
* remove wrong prop
* fix type error
* fix type error
* hide view toggle button on mobile (and fix the breakpoint)
* remove unused e2e tests
* fix e2e tests
* hide toggle button when feature flag is off
* update skeleton
* improve attendees on booking list item and slide over
* improve attendee dropdown
* fix type error
* move query to containers
* select attendee email
* infinite fetching for calendar view
* update styles
* fix compatibility
* fix: add backward compatibility for status field in getAllUserBookings
* increase calendar height
* fix type error
* support Member filter only for admin / owners
* add debug log (TEMP)
* add event border color
* show Reject / Accept buttons on BookingDetailsSheet
* move description section to the top
* update When section
* update style of Who section
* add CancelBookingDialog WIP
* fix CancelBookingDialog
* increase clickable area
* add schedule info section WIP
* fix flaky reject button
* fixing reschedule info WIP
* add fromReschedule index to Booking
* improve rescheduled information
* improve reassignment
* fix type error
* fix unit test
* respect user's weekStart value on the booking calendar view
* update debug log
* improve payment section
* clean up
* fix log message
* reposition filters on list view
* fix bookings controller api2 e2e test
* clean up file by extracting logic into custom hooks
* rename files
* merge BookingCalendar into its container
* extract logic into separate hook files
* remove redundant logic
* rearrange items on calendar view
* add WeekPicker
* extract filter button
* responsive header on list view
* horizontal scroll for ToggleGroup WIP
* fix type error
* fix cancelling recurring event
* address feedback
* fix e2e tests
* fix unit test
* fix e2e tests
* make hover style more visible for ToggleGroup
* fix margin on CancelBookingDialog
* update styles on the slide over (mostly font weight)
* update style of CancelBookingDialog
* update styles
* update margin top for the header
* refactor getBookingDetails handler
* fix gap in who section
* auto-filter the current user on the calendar view
* calculate calendar height considering top banners
* improve booking details sheet interaction without overlay
* update calendar event styles
* update reject dialog style
* put uid first in the query params
* fix class name
* memoize functions in useMediaQuery
* query attendee with id instead of email
* update margins
* replace TRPCError with ErrorWithCode
* move calculation outside loop
* remove dead code
* feat: add hostSubsetIds parameter for round robin host filtering
Add support for filtering round robin event type hosts via API v2.
When hostSubsetIds is provided, only the specified hosts are considered
for availability calculation and booking assignment.
Changes:
- Add hostSubsetIds to slots API input (GET /slots/available)
- Add hostSubsetIds to booking API input (POST /bookings)
- Update _findQualifiedHostsWithDelegationCredentials to filter by hostSubsetIds
- Pass hostSubsetIds through all layers: API -> tRPC -> slots/booking services
This allows API consumers to request availability and create bookings
for a subset of hosts within a round robin event type.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* chore: add e2e tests
* chore: add enableHostSubset team event-type setting
* fixup! chore: add enableHostSubset team event-type setting
* fix tests
* fix tests
* improve isWithinRRHostSubset
* rename to rrHost subset
* fix ai review
* fix: add booker platform wrapper rrHostSubsetIds prop
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Alex van AndelGitHubjoe@cal.com <j.auyeung419@gmail.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Joe Au-YeungDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add toggle to opt out of booking title translation in instant meetings (#25547)
* feat: add toggle to opt out of booking title translation in instant meetings
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateTitleEnabled to test builder
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: respect autoTranslateTitleEnabled toggle in InstantBookingCreateService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: fetch autoTranslateTitleEnabled directly in InstantBookingCreateService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: rename autoTranslateTitleEnabled to autoTranslateInstantMeetingTitleEnabled
- Renamed field to clarify it only applies to instant meeting title translation
- Moved Prisma query to EventTypeRepository.findInstantMeetingConfigById()
- Removed title translation logic from update.handler.ts (flag only controls instant meeting title)
- Updated all references across the codebase
- Added new i18n translation keys for the renamed field
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateInstantMeetingTitleEnabled to test destructuring patterns
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: use Prisma.TeamCreateInput type for metadata in test helper
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateInstantMeetingTitleEnabled to mockUpdatedEventType in test
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: use generic findByIdMinimal instead of business-specific method
- Add autoTranslateInstantMeetingTitleEnabled to eventTypeSelect constant
- Remove findInstantMeetingConfigById from EventTypeRepository
- Update InstantBookingCreateService to use findByIdMinimal
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: remove autoTranslateInstantMeetingTitleEnabled from eventTypeSelect (not needed for findByIdMinimal)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat: add autoTranslateInstantMeetingTitleEnabled to event type form defaults
- Rename shouldTranslateTitle to shouldAutoTranslateInstantMeetingTitle for clarity
- Add autoTranslateInstantMeetingTitleEnabled to findById and findByIdForOrgAdmin selects
- Add autoTranslateInstantMeetingTitleEnabled to useEventTypeForm defaultValues
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: only update autoTranslateInstantMeetingTitleEnabled when explicitly provided
Fixes issue where omitting the field in update requests would overwrite
the saved opt-out setting with the default value (true). Now the field
is only included in the update payload when explicitly provided.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: Create standard for rate limits
---------
Co-authored-by: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: block Google Meet installation without Google Calendar dependency
- Prevent users from installing Google Meet when Google Calendar is not connected
- Update AppDependencyComponent to show error state for unmet dependencies
- Fix InstallAppButtonChild to respect disabled prop from dependencies check
- Ensure consistent dependency validation across App Store and app detail pages
Fixes#25497
* test: add unit tests for dependency validation
- Add tests for AppDependencyComponent (8 tests)
- Add tests for InstallAppButtonChild (5 tests)
- Cover dependency blocking behavior
- Test visual state changes (bg-error/bg-subtle)
* test: resolve type-check error in InstallAppButtonChild tests
- Add complete MockCredential type definition
- Create factory function to generate typed mock credentials
- Eliminate code duplication across test cases
* fix: remove redundant disabled prop assignment
Disabled state is already passed through via props.disableInstall
which gets converted to props.disabled in InstallAppButtonWithoutPlanCheck.
This change addresses the review comment to avoid unnecessary duplication
---------
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* feat: add toggle to opt out of booking title translation in instant meetings
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateTitleEnabled to test builder
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: respect autoTranslateTitleEnabled toggle in InstantBookingCreateService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: fetch autoTranslateTitleEnabled directly in InstantBookingCreateService
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: rename autoTranslateTitleEnabled to autoTranslateInstantMeetingTitleEnabled
- Renamed field to clarify it only applies to instant meeting title translation
- Moved Prisma query to EventTypeRepository.findInstantMeetingConfigById()
- Removed title translation logic from update.handler.ts (flag only controls instant meeting title)
- Updated all references across the codebase
- Added new i18n translation keys for the renamed field
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateInstantMeetingTitleEnabled to test destructuring patterns
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: use Prisma.TeamCreateInput type for metadata in test helper
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: add autoTranslateInstantMeetingTitleEnabled to mockUpdatedEventType in test
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: use generic findByIdMinimal instead of business-specific method
- Add autoTranslateInstantMeetingTitleEnabled to eventTypeSelect constant
- Remove findInstantMeetingConfigById from EventTypeRepository
- Update InstantBookingCreateService to use findByIdMinimal
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* refactor: remove autoTranslateInstantMeetingTitleEnabled from eventTypeSelect (not needed for findByIdMinimal)
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* feat: add autoTranslateInstantMeetingTitleEnabled to event type form defaults
- Rename shouldTranslateTitle to shouldAutoTranslateInstantMeetingTitle for clarity
- Add autoTranslateInstantMeetingTitleEnabled to findById and findByIdForOrgAdmin selects
- Add autoTranslateInstantMeetingTitleEnabled to useEventTypeForm defaultValues
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* fix: only update autoTranslateInstantMeetingTitleEnabled when explicitly provided
Fixes issue where omitting the field in update requests would overwrite
the saved opt-out setting with the default value (true). Now the field
is only included in the update payload when explicitly provided.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## What does this PR do?
This PR introduces the booking audit infrastructure with a viewer service to fetch, enrich, and format audit logs. This is the first iteration that includes only the CREATED action with versioned schema
Note: Additional audit actions, UI improvements to match with Figma will be taken care of in followup PRs, to ensure the PR size remains as small as possible(as it is large enough already)
Demo - Loom - https://www.loom.com/share/22c2f38b052b480b8be3716e1608eaf6
### Key Changes
**New Booking Audit Package** (`packages/features/booking-audit/`):
- `BookingAuditViewerService` - Fetches, enriches, and formats audit logs for display
- `BookingAuditTaskConsumer` - Processes audit tasks asynchronously via Tasker
- `CreatedAuditActionService` (v1) - Handles RECORD_CREATED action with versioned schema
**Repository Layer**:
- `BookingAuditRepository` - CRUD operations for audit records
- `AuditActorRepository` - Actor management (users, guests, system)
- `UserRepository.findByUuid()` - User lookup for actor enrichment
**UI Components**:
- New page at `/booking/logs/[bookinguid]` for viewing audit history
- Filterable audit log list with search, type, and actor filters
- Expandable log entries showing detailed change information
**Infrastructure**:
- `bookingAudit` Tasker task type for async processing
- `booking-audit` feature flag (disabled by default)
- tRPC endpoint `viewer.bookings.getAuditLogs`
### Updates since last revision
- **Refactored `Task` class to `TaskRepository`**: Converted all static methods to instance methods following the repository pattern. A singleton `Task` is exported for backward compatibility, so existing call sites continue to work unchanged.
### Important Notes for Reviewers
- **Permission check is TODO**: `checkPermissions()` in `BookingAuditViewerService` is not yet implemented
- **Only CREATED action supported**: Other actions will throw an error - additional actions will be added iteratively in follow-up PRs
- **Feature flag controlled**: System is behind `booking-audit` flag, disabled by default
- **UI strings need i18n**: Some UI text in `booking-logs-view.tsx` may need translation
### Human Review Checklist
- [ ] Verify permission enforcement strategy for audit log access
- [ ] Review DI wiring in module files
- [ ] Confirm error handling in `BookingAuditTaskConsumer` is appropriate for retry scenarios
- [ ] Check if UI strings need to be added to translation files
- [ ] Verify `TaskRepository` refactoring maintains backward compatibility (singleton export `Task` should work for all existing call sites)
## Mandatory Tasks (DO NOT REMOVE)
- [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - internal infrastructure
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works.
## How should this be tested?
Run the integration tests:
```bash
TZ=UTC yarn test packages/features/booking-audit/lib/service/BookingAuditViewerService.integration-test.ts
TZ=UTC yarn test packages/features/booking-audit/lib/service/BookingAuditTaskConsumer.integration-test.ts
```
To test the UI:
1. Enable the `booking-audit` feature flag in the database
2. Create a booking (only CREATED action is supported in this PR)
3. Navigate to `/booking/logs/{bookingUid}` to view the audit trail
## Checklist
- [x] I have read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
- [x] My code follows the style guidelines of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have checked if my changes generate no new warnings
<!-- Link to Devin run: https://app.devin.ai/sessions/a8ae61c253b549429401c9651dcbcf44 -->
<!-- Requested by: hariom@cal.com (@hariombalhara) -->
* perf: link old event-type with workflows using create/findMany
* test: fix handleChildrenEventTypes test mocks for new workflow linking implementation
Update test to match the new implementation that uses findMany + createMany
instead of upsert for linking workflows to old event types.
- Add mock for workflowsOnEventTypes.findMany to return empty array
- Update assertion from upsert to findMany + createMany
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-08 13:11:21 +02:00
MorganGitHubmorgan@cal.com <morgan@cal.com>morgan@cal.com <morgan@cal.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: auto-scroll sidebar to active team on navigation
When navigating to team settings via "Edit team" from the teams list,
the sidebar now scrolls to show the selected team and expands its section.
- Extract team ID from URL path (/settings/teams/{id}/...)
- Use existing aria-controls attribute to find team element
- Scroll with smooth behavior centered in viewport
* revert formatting changes by prettier
---------
Co-authored-by: Pallav <90088723+Pallava-Joshi@users.noreply.github.com>
