fix: Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled#22281
fix: Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled#22281asadath1395 wants to merge 39 commits intocalcom:mainfrom
Conversation
…eduling/Cancelling is enabled
|
@asadath1395 is attempting to deploy a commit to the cal Team on Vercel. A member of the Team first needs to authorize it. |
Graphite Automations"Add consumer team as reviewer" took an action on this PR • (07/07/25)1 reviewer was added to this PR based on Keith Williams's automation. "Add community label" took an action on this PR • (07/07/25)1 label was added to this PR based on Keith Williams's automation. |
There was a problem hiding this comment.
cubic found 2 issues across 6 files. Review them in cubic.dev
React with 👍 or 👎 to teach cubic. Tag @cubic-dev-ai to give specific feedback.
| const [user] = users.get(); | ||
| await user.apiLogin(); | ||
|
|
||
| await page.goto(`/booking/${bookingId}`); |
There was a problem hiding this comment.
Rule violated: E2E Tests Best Practices
Missing expect(page).toHaveURL() after navigation. According to the E2E Best Practices guideline, tests must assert the final URL immediately after page.goto to fail fast on unexpected redirects.
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
kart1ka
left a comment
There was a problem hiding this comment.
Along with the host, Team/Org Admin and Owner should also be able to reschedule or cancel the booking.
|
Hi @asadath1395, Left a comment. There is a type check failing, pls address that as well. |
…able-rescheduling-cancelling
…e disabled in event type
…com/asadath1395/cal.com into fix/disable-rescheduling-cancelling
…able-rescheduling-cancelling
There was a problem hiding this comment.
cubic found 2 issues across 9 files. Review them in cubic.dev
React with 👍 or 👎 to teach cubic. Tag @cubic-dev-ai to give specific feedback.
| } | ||
| } | ||
|
|
||
| const isHostOrOwner = !!userIsHost || !!userIsOwnerOfEventType || !!hasTeamOrOrgPermissions; |
There was a problem hiding this comment.
The permission-calculation logic (userIsHost / userIsOwnerOfEventType / hasTeamOrOrgPermissions) is duplicated later in the same function, causing two additional database calls (isTeamAdmin, isOrganisationAdmin) per request. This hurts performance and maintainability; consider extracting a helper or computing once and re-using the result.
| } | ||
| } | ||
| } | ||
| const isHostOrOwner = |
There was a problem hiding this comment.
Authorization relies on eventData.hosts which is limited to the first 3 hosts (because of take: 3 in the Prisma query). If an event has more than three hosts, legitimate hosts outside this slice will fail the check and be redirected, effectively blocking them from rescheduling/cancelling their own event.
There was a problem hiding this comment.
Nice catch, fixed it by querying it separately
There was a problem hiding this comment.
cubic found 2 issues across 9 files. Review them in cubic.dev
React with 👍 or 👎 to teach cubic. Tag @cubic-dev-ai to give specific feedback.
…er is the host and fix type error
@kart1ka Thanks for flagging this. I have fixed it and added tests too. Please test this again and let me know if you find anything |
…able-rescheduling-cancelling
…able-rescheduling-cancelling
@asadath1395 Using different subdomains makes no difference here. |
…able-rescheduling-cancelling
…able-rescheduling-cancelling
…idual event types when both are disabled
…com/asadath1395/cal.com into fix/disable-rescheduling-cancelling
Can you create a new issue for this? Let's not increase the scope of this PR
@kart1ka Mind testing this again. I have added tests too. |
dhairyashiil
left a comment
There was a problem hiding this comment.
could you resolve the merge conflicts? making it a draft until then
|
Closing the PR due to staleness. |
What does this PR do?
Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled
Visual Demo (For contributors especially)
Before
https://www.loom.com/share/bf768bc270e04c48b37ec8d9379a8a0a?sid=c4fa7153-8794-47ef-8320-f42252c880b3
After
https://www.loom.com/share/5b130406f3364ec591764672e8a9660a?sid=6c02726f-84c4-4862-b08b-aed83d956c4f
Mandatory Tasks (DO NOT REMOVE)
How should this be tested?
Check the videos above