calendar

Files

T

Pedro CastroandGitHub 51639e38d7 fix(auth): block OAuth linking for unverified accounts (#26598 )

* fix(auth): sanitize unverified accounts during OAuth linking

- Add AccountSanitizationService for secure account cleanup
- Clear webhooks, API keys, credentials, and sessions for unverified accounts
- Reset password and 2FA settings during OAuth conversion
- Nullify redirect URLs on event types

Only affects accounts that never completed email verification

* fix(auth): block OAuth linking for unverified accounts

  Replace sanitization with simpler blocking approach:
  - Unverified CAL accounts cannot link to OAuth (Google/SAML)
  - Add user-friendly error message with recovery path
  - Remove AccountSanitizationService (no data loss risk)

2026-01-09 11:04:39 +00:00

__mocks__

fix(auth): resolve session user by token subject ID (#26399 )

2026-01-02 16:31:08 +00:00

lib

fix(auth): block OAuth linking for unverified accounts (#26598 )

2026-01-09 11:04:39 +00:00

signup

refactor: remove @calcom/web imports from @calcom/features and add @calcom/testing package (#26480 )

2026-01-08 16:59:11 +09:00

package.json

chore: lock all package versions to match yarn.lock (#26204 )