* fix: use relative redirects in booking confirmation routes to fix localhost redirect issue
When Cal.com runs behind a reverse proxy, request.url may return the internal
server URL (localhost:3000) instead of the external URL. This causes users to
be redirected to localhost after confirming bookings via email links.
This fix changes the redirect URLs from using url.origin (which could be
localhost) to using relative URLs via new URL(path, request.url). This ensures
the browser resolves the redirect against whatever domain the user actually
requested, fixing the issue for self-hosted deployments behind proxies.
Fixes#20358
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test: add tests for booking confirmation redirect URL construction
Add unit tests for verify-booking-token and link API routes to ensure:
- Redirect URLs preserve the request origin (not hardcoded localhost)
- Redirect URLs use the correct booking path (/booking/{uid})
- Error messages are properly encoded in query params
- POST handler returns correct 303 status code
These tests verify the fix for #20358 where users were redirected to
localhost:3000 instead of the proper production URL after confirming
bookings via email links.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add second argument to GET/POST calls in test files to fix type errors
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: Add async spam check integration and decoy booking response
- Integrate SpamCheckService with handleNewBooking workflow
- Implement parallel spam check execution for minimal performance impact
- Add decoy booking response with localStorage-based success page
- Extract organization ID from event type for org-specific blocking
- Add comprehensive test coverage for spam detection scenarios
- Create reusable components for booking success cards
- Implement fail-open behavior to never block legitimate bookings
This builds on the spam blocker DI infrastructure from PR #24040 by
adding the actual integration into the booking flow and implementing
the decoy response mechanism to avoid revealing spam detection to
malicious actors.
Related: #24040
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Do checks in paralle
* Fix leaking host name in title
* Reduce expoiry time localstorage
* refactor: Use sessionStorage instead of localStorage for decoy booking data
- Replace localStorage with sessionStorage for automatic expiration on tab close
- Remove timestamp tracking and TTL logic (no longer needed)
- Improve privacy by auto-clearing data when browser tab/window closes
- Update documentation to reflect sessionStorage behavior
This change addresses privacy concerns by ensuring decoy booking data
(including attendee email) is automatically removed when the user closes
the tab, rather than persisting for 5 minutes or requiring manual cleanup.
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* feat: Add sessionStorage wrapper to webstorage module
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
* Reset RegularBookingService.ts to main's version exactly
* feat: Add 5-minute expiration timeout to decoy booking data
- Adds timestamp to DecoyBookingData interface
- Checks expiration when retrieving booking data
- Automatically removes expired data from sessionStorage
- Provides defense-in-depth against potential misuse
- Works alongside sessionStorage auto-clear on tab close
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: hide insights submenu for free users
* fix: allow navigation access while plan pending
* refactor: update upgrade link to insights in navigation
* fix: addressed all the issues
* fix: prevent flash of premium features for free users during loading
Change from optimistic to pessimistic loading so free users don't
briefly see the Insights submenu while plan status is being fetched.
---------
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
* fix: show hidden badge on mobile view for event types
* fix: update event type hidden toggle in infinite list
---------
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* feat: highlight recurring bookings with time shift badge across DST
* Update packages/lib/__tests__/timeShift.test.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* refactor: show time shift badge only on first shift in bookings view and occurrences
* refactor: update recurring bookings display logic and wrap booking title text
* refactor: add getFirstShiftFlags helper for time shift flags and update components
---------
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix(settings): improve spacing between navigation child items
* chore: removing prettier formatting
* style: update dropdown item class names for consistent rounding
* style: add spacing and hover margin to navigation items
* style: add hover margin top to navigation item
* apply same ui changes for team profile menu
---------
Co-authored-by: Dhairyashil <dhairyashil10101010@gmail.com>
* feat: add embed prerendering support and enhance event handling
- Introduced `useIsEmbedPrerendering` hook to determine if the embed is in prerender mode.
- Updated `useAvailabilityEvents` to prevent firing events during prerendering.
- Added `bookerLoadedEvent` and `availabilityRefreshed` types to `EventDataMap`.
- Implemented `useFirebookerLoadedEvent` to manage firing the booker loaded event conditionally.
- Refactored event firing logic in `useSchedule` and `BookerWebWrapper` components to utilize new hooks.
* feat: add embed prerendering support and enhance event handling
- Introduced `useIsEmbedPrerendering` hook to determine if the embed is in prerender mode.
- Updated `useAvailabilityEvents` to prevent firing events during prerendering.
- Added `bookerLoadedEvent` and `availabilityRefreshed` types to `EventDataMap`.
- Implemented `useFirebookerLoadedEvent` to manage firing the booker loaded event conditionally.
- Refactored event firing logic in `useSchedule` and `BookerWebWrapper` components to utilize new hooks.
* feat: enhance embed event handling and introduce link reopening detection
- Added `useEmbedReopened` hook to track when the embed is reopened.
- Updated `BookerWebWrapper` to reset event firing state upon embed reopening.
- Refactored event firing logic to use `bookerViewed` instead of `bookerLoadedEvent`.
- Introduced scheduling for event firing in `useSchedule` to ensure correct order of events during prerendering.
* feat: add lifecycle diagrams for inline and modal embeds
- Introduced `inline-embed-lifecycle.mermaid` and `modal-embed-lifecycle.mermaid` files to visualize the lifecycle events and states of inline and modal embeds.
- Updated `LIFECYCLE.md` to reference the new diagrams and provide a clearer explanation of the embed lifecycle processes.
- Added `modal-prerendering-flow.mermaid` to illustrate the prerendering flow for modal embeds.
- Enhanced the routing playground with new features and improved event handling for availability and booking events.
* refactor: update event handling for booker lifecycle events
- Replaced `availabilityLoaded` event with `bookerReady` to better reflect the state when the booker view is fully loaded and ready for interaction.
- Updated related documentation and diagrams to reflect changes in event triggers and descriptions.
- Adjusted internal state management to track `viewId` instead of `reopenCount` for distinguishing between initial views and reopens.
- Added tests for new event handling logic to ensure correct firing of `bookerViewed`, `bookerReopened`, and `bookerReady` events.
* refactor: enhance embed event handling and state management
- Updated event handling for booker lifecycle events, replacing `resetViewVariables` with `resetPageData` to manage page-specific state.
- Introduced new utility functions for managing event firing states and reload initiation.
- Refactored `fireBookerViewedEvent` and `fireBookerReadyEvent` to utilize the new state management functions.
- Added comprehensive tests for the updated event handling logic and state resets to ensure correct functionality across various scenarios.
* refactor: update embed iframe configuration and utility functions
- Reduced `slotsStaleTimeMs` from 30 seconds to 10 seconds and `iframeForceReloadThresholdMs` from 100 seconds to 30 seconds for improved responsiveness.
- Refactored utility functions to use `isBrowser` for client-side checks instead of `isClientSide`.
- Removed unused `isPrerendering` function and updated related documentation for clarity.
- Enhanced event handling by exporting `useBookerEmbedEvents` from the appropriate module for better accessibility.
* refactor: update embed iframe configuration and utility functions
- Reduced `slotsStaleTimeMs` from 30 seconds to 10 seconds and `iframeForceReloadThresholdMs` from 100 seconds to 30 seconds for improved responsiveness.
- Refactored utility functions to use `isBrowser` for client-side checks instead of `isClientSide`.
- Removed unused `isPrerendering` function and updated related documentation for clarity.
- Enhanced event handling by exporting `useBookerEmbedEvents` from the appropriate module for better accessibility.
* fix cubic feedback
- Add early return when only one user is available
- Prevents unnecessary database queries, calendar API calls, and OOO checks
- Add comprehensive test to verify optimization works correctly
Fixes#19503 [CAL-5212]
* feat: ooo message on booking page
* make ooo days selectable even when no redirect booking
* handle long notes
* remove unused i18n key
* Private notes stay private on the server, No accidental data leaks through client-side payloads
* address cubics comments
* fix: replace toggle with checkbox for OOO note visibility
- Replace Switch with Checkbox for "show note publicly" option
- Remove "OOO Message:" prefix from displayed notes on booking page
- Update i18n text to "Show note on public booking page"
- Remove unused ooo_message i18n key
* fix the accessibility issue by using proper htmlFor and id association
* only allow selecting OOO dates when the note is public
* fix: cloudflare turnstile token reset
* fix: silently reset turnstile on invalid token error
* refactor: remove unused forwardRef logic from Turnstile component
- Remove forwardRef, useImperativeHandle, and useRef imports
- Remove unused TurnstileInstance type export
- Simplify to a plain function component
- The ref-based reset was replaced by key-based remount in signup-view
* refactor: remove redundant cfToken validation check
The submit button is already disabled when cfToken is missing,
making this defensive check unreachable during normal form flow.
* revert prettier formatiing
* chore: revert yarn.lock changes
* refactor(auth): use shared constant for cloudflare token error message
Replace hardcoded "Invalid cloudflare token" string with an exported
constant to prevent silent breakage if the error message changes.
* fix(validation): disallow whitespace-only team name
* fix validation at team profile
* fix validation for title at event type
---------
Co-authored-by: Dhairyashil Shinde <93669429+dhairyashiil@users.noreply.github.com>
* use booking.uid instead of booking.id for url param
* show timezone on calendar
* fix type
* restore horizontal tab and remove header and subtitle
* clean up sidebar items
* fix event propagation from attendees
* fetch all statuses except for cancelled on calendar view
* clean up styles of the badges on BookingListItem
* fix useMediaQuery
* add close button to the header
* add assignment reason to the details sheet
* use separator row
* use ToggleGroup for the top bookings tab
* move ViewToggleButton
* resize the action button
* remove wrong prop
* fix type error
* fix type error
* hide view toggle button on mobile (and fix the breakpoint)
* remove unused e2e tests
* fix e2e tests
* hide toggle button when feature flag is off
* update skeleton
* improve attendees on booking list item and slide over
* improve attendee dropdown
* fix type error
* move query to containers
* select attendee email
* infinite fetching for calendar view
* update styles
* fix compatibility
* fix: add backward compatibility for status field in getAllUserBookings
* increase calendar height
* fix type error
* support Member filter only for admin / owners
* add debug log (TEMP)
* add event border color
* show Reject / Accept buttons on BookingDetailsSheet
* move description section to the top
* update When section
* update style of Who section
* add CancelBookingDialog WIP
* fix CancelBookingDialog
* increase clickable area
* add schedule info section WIP
* fix flaky reject button
* fixing reschedule info WIP
* add fromReschedule index to Booking
* improve rescheduled information
* improve reassignment
* fix type error
* fix unit test
* respect user's weekStart value on the booking calendar view
* update debug log
* improve payment section
* clean up
* fix log message
* reposition filters on list view
* fix bookings controller api2 e2e test
* clean up file by extracting logic into custom hooks
* rename files
* merge BookingCalendar into its container
* extract logic into separate hook files
* remove redundant logic
* rearrange items on calendar view
* add WeekPicker
* extract filter button
* responsive header on list view
* horizontal scroll for ToggleGroup WIP
* fix type error
* fix cancelling recurring event
* address feedback
* fix e2e tests
* fix unit test
* fix e2e tests
* make hover style more visible for ToggleGroup
* fix margin on CancelBookingDialog
* update styles on the slide over (mostly font weight)
* update style of CancelBookingDialog
* update styles
* update margin top for the header
* refactor getBookingDetails handler
* fix gap in who section
* auto-filter the current user on the calendar view
* calculate calendar height considering top banners
* improve booking details sheet interaction without overlay
* update calendar event styles
* update reject dialog style
* put uid first in the query params
* fix class name
* memoize functions in useMediaQuery
* query attendee with id instead of email
* update margins
* replace TRPCError with ErrorWithCode
* move calculation outside loop
* remove dead code
2025-12-10 13:40:04 +00:00
Eunjae LeeGitHubeunjae@cal.com <hey@eunjae.dev>eunjae@cal.com <hey@eunjae.dev>eunjae@cal.com <hey@eunjae.dev>eunjae@cal.com <hey@eunjae.dev>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add hostSubsetIds parameter for round robin host filtering
Add support for filtering round robin event type hosts via API v2.
When hostSubsetIds is provided, only the specified hosts are considered
for availability calculation and booking assignment.
Changes:
- Add hostSubsetIds to slots API input (GET /slots/available)
- Add hostSubsetIds to booking API input (POST /bookings)
- Update _findQualifiedHostsWithDelegationCredentials to filter by hostSubsetIds
- Pass hostSubsetIds through all layers: API -> tRPC -> slots/booking services
This allows API consumers to request availability and create bookings
for a subset of hosts within a round robin event type.
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* chore: add e2e tests
* chore: add enableHostSubset team event-type setting
* fixup! chore: add enableHostSubset team event-type setting
* fix tests
* fix tests
* improve isWithinRRHostSubset
* rename to rrHost subset
* fix ai review
* fix: add booker platform wrapper rrHostSubsetIds prop
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
