packages/lib/server/service/InsightsBookingBaseService.ts (1)

331-337: Trim operands and optionally escape wildcard characters in ILIKE filters.

Functionally OK and parameterized (safe). For better UX and predictability:

• Trim operands; ignore empty strings to avoid adding no-op conditions.
• Optionally escape % and _ if you intend a literal substring match rather than allowing user-supplied wildcards.

Apply minimal trimming (keeps current wildcard behavior):

-    if (id === "userEmail" && isTextFilterValue(value)) {
-      return Prisma.sql`"userEmail" ILIKE ${`%${value.data.operand}%`}`;
-    }
+    if (id === "userEmail" && isTextFilterValue(value)) {
+      const operand = value.data.operand.trim();
+      if (!operand) return null;
+      return Prisma.sql`"userEmail" ILIKE '%' || ${operand} || '%'`;
+    }
@@
-    if (id === "userName" && isTextFilterValue(value)) {
-      return Prisma.sql`"userName" ILIKE ${`%${value.data.operand}%`}`;
-    }
+    if (id === "userName" && isTextFilterValue(value)) {
+      const operand = value.data.operand.trim();
+      if (!operand) return null;
+      return Prisma.sql`"userName" ILIKE '%' || ${operand} || '%'`;
+    }

If you prefer strict literal substring matching, I can provide a small escapeLikeForIlike() helper and add ESCAPE '\\'.

On large datasets, consider trigram GIN indexes to keep these ILIKE scans fast:

• CREATE EXTENSION IF NOT EXISTS pg_trgm;
• CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_bts_useremail_trgm ON "BookingTimeStatusDenormalized" USING gin ("userEmail" gin_trgm_ops);
• Same for "userName".

packages/features/insights/hooks/useInsightsBookings.ts (1)

86-111: Text filter columns are consistent; consider a tiny helper to avoid duplication.

Both columns share identical config except id/header/accessor/size. Optional: extract a small factory to reduce repetition.

Example helper (outside this block) and replacement use:

// helper near top of file
const textFilterCol = <K extends keyof DummyTableRow>(key: K, id: string, header: string, size = 200) =>
  columnHelper.accessor(key, {
    id,
    header,
    size,
    meta: { filter: { type: ColumnFilterType.TEXT } },
    enableColumnFilter: true,
    enableSorting: false,
    cell: () => null,
  });

// inside columns:
textFilterCol("userEmail", "userEmail", t("user_email"));
textFilterCol("userName", "userName", t("user_name"));

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: eunjae-lee
PR: calcom/cal.com#22106
File: packages/features/insights/components/RoutingFunnel.tsx:15-17
Timestamp: 2025-07-15T12:58:40.539Z
Learning: In the insights routing funnel component (packages/features/insights/components/RoutingFunnel.tsx), the useColumnFilters exclusions are intentionally different from the general useInsightsParameters exclusions. RoutingFunnel specifically excludes only ["createdAt"] while useInsightsParameters excludes ["bookingUserId", "formId", "createdAt", "eventTypeId"]. This difference is by design.

Learnt from: eunjae-lee
PR: calcom/cal.com#22702
File: packages/lib/server/service/insightsBooking.ts:120-124
Timestamp: 2025-07-24T08:39:06.185Z
Learning: In the InsightsBookingService (packages/lib/server/service/insightsBooking.ts), the constructor stores null for invalid options or filters but this is handled safely through null checks in buildFilterConditions() and buildAuthorizationConditions() methods. The service uses defensive programming to return safe fallback conditions (null or NOTHING_CONDITION) rather than throwing errors on invalid inputs.

Learnt from: eunjae-lee
PR: calcom/cal.com#22106
File: packages/lib/server/service/insightsRouting.ts:367-368
Timestamp: 2025-07-15T13:02:17.403Z
Learning: In the InsightsRoutingService (packages/lib/server/service/insightsRouting.ts), multi-select filter data is already validated by zod before reaching the buildFormFieldSqlCondition method, so null/undefined values are not present in filterValue.data arrays and don't need to be filtered out.

Learnt from: bandhan-majumder
PR: calcom/cal.com#23192
File: packages/lib/server/service/InsightsBookingBaseService.ts:814-816
Timestamp: 2025-08-22T16:38:00.182Z
Learning: In the InsightsBookingBaseService (packages/lib/server/service/InsightsBookingBaseService.ts), when filtering for "accepted" bookings in getMembersStatsWithCount(), using `endTime <= now()` in the SQL condition should be avoided as it conflicts with existing date filtering logic. The components already handle completion filtering by setting `endDate: currentTime` in their query parameters, making additional SQL-level endTime filtering unnecessary and potentially problematic.

Learnt from: alishaz-polymath
PR: calcom/cal.com#23247
File: packages/features/webhooks/lib/factory/WebhookPayloadFactory.ts:274-282
Timestamp: 2025-08-21T12:28:42.000Z
Learning: In BookingPaymentInitiatedDTO and other webhook DTOs in packages/features/webhooks/lib/dto/types.ts, the booking field is a restricted structure containing only specific fields (id, eventTypeId, userId) rather than the full database booking object, so there are no security or PII leakage concerns when passing the booking object to buildEventPayload.

packages/features/insights/hooks/useInsightsBookingFacetedUniqueValues.ts (1)

73-77: Ensure “free” i18n key exists across locales.

The UI labels t("paid") and t("free") are correct, but prior checks showed “free” missing in several locale JSONs. Add/verify "free" in all locales to avoid runtime fallbacks.

Run to confirm coverage:

#!/bin/bash
# Verify presence of keys in locale files
rg -nP '"(paid|free)"\s*:' apps/web/public/static/locales -S -g '!**/node_modules/**'

packages/features/insights/hooks/useInsightsBookings.ts (1)

100-112: i18n keys for “user_email” and “user_name”.

Headers use t("user_email") and t("user_name"). Prior scans indicated these keys were missing in some locales. Add them across locales to avoid untranslated labels.

Check coverage:

#!/bin/bash
rg -nP '"(user_email|user_name)"\s*:' apps/web/public/static/locales -S -g '!**/node_modules/**'

packages/features/insights/hooks/useInsightsBookings.ts (3)

15-18: Double-check nullability for “paid”; align with data source.

If BookingTimeStatusDenormalized.paid can be null (unknown/NA), consider typing as boolean | null to avoid accidental narrowing. If it’s guaranteed non-null in the denormalized view, ignore.

Optional type tweak:

-  paid: boolean;
+  paid: boolean | null;

---

113-125: Confirm “rating” column belongs in this PR; ensure end-to-end support.

This adds a rating filter/column not mentioned in the PR objectives. Confirm product intent, ensure i18n for t("rating") exists, and verify the backend implements columnId === "rating" handling.

If keeping it, consider constraining the domain in types:

-  rating: number | null;
+  rating: 1 | 2 | 3 | 4 | 5 | null;

---

33-36: Reduce duplication of cell: () => null and filter meta boilerplate.

Consider a small helper to DRY column creation for “filter-only” columns (no cell renderer, sorting disabled), improving readability and consistency.

Example helper (outside this diff scope):

const filterOnly = <T,>(c: ColumnDef<T>) => ({ enableSorting: false, cell: () => null, ...c });

Then wrap each column def with filterOnly({...}).

Also applies to: 62-73, 74-126

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.