Files
calendar/apps/api/v2
Lauris SkraucisGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>Rajiv Sahal
fc602d3b03 feat: OAuth 2.0 support for atoms (#27158)
* fix: useOAuthClient support OAuth 2.0

* fix: cannot read properties of undefined (reading NEXT_PUBLIC_IS_E2E)

* fix: allow OAuth 2.0 token to connect gcal or ms calendar

* fix: allow OAuth 2.0 token to save gcal or ms calendar credentials

* refactor: dont set oauth id header for OAuth 2.0

* fix: calendar events not showing and emails not sent

* feat: CalOAuth2Provider

* chore: make OAuth 2.0 work in examples app

* chore: refresh OAuth 2.0 tokens

* docs: running examples app with oauth 2.0

* fix: remove sensitive console.log statements that leak secrets

Remove logging of:
- OAuth authorization codes (oauth2-user.ts)
- Token-bearing exchange responses (oauth2-user.ts)
- /me response data containing PII (oauth2-user.ts)
- OAuth2 refresh response with tokens (refresh.ts)
- Response payload with access tokens (_app.tsx)

Addresses Cubic AI review feedback for issues with confidence >= 9/10

Co-Authored-By: unknown <>

* docs: update readme

* fix: implemente cubic feedback

* fix: seed script import

* fix: seed script pkce

* fix: correct typos and SQLite capitalization in OAuth2 README (#27176)

Co-authored-by: cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>

* refactor: dont return name in public oauth endpoint

* docs: CalOAuthProvider

* chore: add NEXT_PUBLIC_IS_E2E constant to test

* docs: fix duplicated 'or' in Cal OAuth Provider documentation (#27177)

Co-authored-by: cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>

* revert: is e2e constant

* fix: typecheck

* refactor: example app users select

* update readme

* chore: update oauth atoms readme

* refactor: enable booking managed event types with user.username instead of profile.username

* fix: EventTypeSettings when viewing round robin

* test: add e2e tests for atoms-oauth2 controller

Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>

* fix: correct error message path in atoms-oauth2 e2e test

Co-Authored-By: lauris@cal.com <lauris.skraucis@gmail.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Rajiv Sahal <sahalrajiv-extc@atharvacoe.ac.in>
2026-02-04 12:54:15 +01:00
..
2026-02-03 13:43:26 +00:00

Cal.com api v2 is a Nest.js project.

Local development

This setup will allow you to develop with api v2 locally. If you want to also test atoms locally with platform's example app, then proceed to apps/api/v2/README-PLATFORM.md instead.

  1. Install dependencies
$ yarn install
  1. Download and install Docker on your computer and then make sure it is running. You simply need to open Docker dashboard.
  2. Make sure that mailhog is running - it is used by v2 to send emails locally. You can start it by:
$ cd packages/emails && yarn dx
  1. Setup api v2 environment - make a copy of apps/api/v2/.env.example and rename it to apps/api/v2/.env - it has almost all the required values setup - ones you need to add will be explained below.
  • Then copy the value of NEXTAUTH_SECRET from there to the root .env NEXTAUTH_SECRET. If you have NEXTAUTH_SECRET already in the root .env then you can paste that value in apps/api/v2/.env.
Note: make sure that the value of `NEXTAUTH_SECRET` is the same in both the root `.env` and in the api v2 `.env`.
  1. Setup license key. In the Deployment table in database create the following entry:
id, logo, theme, licenseKey, agreedLicenseAt:-
1, null, null, '00000000-0000-0000-0000-000000000000', '2023-05-15 21:39:47.611'

Then in the apps/api/v2/.env set the license key environment variable:

CALCOM_LICENSE_KEY="00000000-0000-0000-0000-000000000000"
  1. (optional) Prisma setup and database seeding - if you need to setup and seed database you can do it:
$ cd packages/prisma
$ yarn prisma generate
$ yarn prisma migrate dev
$ yarn db-seed
  1. Proceed to the next section to start api v2

Running api v2

Start api v2 using:

$ yarn dev

Sometimes it happens that v2 api restarts because some unrelated log of build files changed if you are running it while cal web app is running. If it happens and is annoying you, you can just build it and then run without watch mode:

cd apps/api/v2
yarn dev:build
yarn start

Api v2 depends on various platform packages "platform-libraries, platform-constants, platform-enums, platform-utils, platform-types" so if any of them change you might need to restart api v2 so it rebuild these dependencies and picks up the changes.

Notably, you can run following command(in different terminal) to ensure that any change in any of the dependencies is rebuilt and detected. It watches platform-libraries, platform-constants, platform-enums, platform-utils, platform-types.

$ yarn run dev:build:watch

OR if you don't want to use docker, you can run following command.

$ yarn dev:no-docker

Test

# unit tests
$ yarn run test

# e2e tests
$ yarn run test:e2e

# run specific e2e test file in watch mode
$ yarn run test:e2e some-file.e2e-spec.ts

# test coverage
$ yarn run test:cov

Conventions

Guards

  1. In case a guard would return "false" for "canActivate" instead throw ForbiddenException with an error message containing guard name and the error.
  2. In case a guard would return "false" for "canActivate" DO NOT cache the result in redis, because we don't want that someone is forbidden, updates whatever was the problem, and then has to wait for cache to expire. We only cache in redis guard results where "canAccess" is "true".
  3. If you use ApiAuthGuard but want that only specific auth method is allowed, for example, api key, then you also need to add @ApiAuthGuardOnlyAllow(["API_KEY"]) under the @UseGuards(ApiAuthGuard). Shortly, use ApiAuthGuardOnlyAllow to specify which auth methods are allowed by ApiAuthGuard. If ApiAuthGuardOnlyAllow is not used or nothing is passed to it or empty array it means that all auth methods are allowed.