fix: allow owners to cancel events even if cancellation is disabled

[Vibgitcode27]

What does this PR do?

This PR fixes an issue where event owners and internal users were unable to cancel bookings when the event type had disableCancelling enabled, even though they should have administrative privileges to do so.

Issue Description:
The handleCancelBooking function was throwing a 400 error with the message "This event type does not allow cancellations" when attempting to cancel bookings for event types with disableCancelling set to true. This restriction was blocking legitimate cancellations by event owners and internal staff members who should have the authority to cancel bookings regardless of this setting.

Root Cause:
The disableCancelling check in the cancellation handler was treating this setting as a system-wide restriction rather than a guest-facing UI restriction. The original logic prevented all cancellations when this flag was enabled, including those initiated by authorized internal users.

Solution:
Removed the disableCancelling validation check from the handleCancelBooking function. This change allows:

• Event owners to cancel their own bookings when necessary

• Internal users with access to the cancellation interface to perform administrative cancellations

• Guest-facing restrictions to remain intact at the UI level (guests don't see cancel options when disableCancelling is enabled)

• Fixes Cancel button is visible on managed event types after disabling cancellation #23457

• Fixes CAL-6353

Video Demo (if applicable):

Before Fix (Issue Reproduction):

• Video demonstrating the cancellation failure: https://drive.google.com/file/d/1e3krFAN06q1i7lbSJpcbvUIWJl0JBE5W/view?usp=sharing

After Fix (Resolution):

• Video showing successful cancellation: https://drive.google.com/file/d/1b8TEPFJvTbPxa_RS7Rhv0F11FWT3ly5M/view?usp=sharing

Image Demo (if applicable):

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

Checklist

• I haven read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
• My code does follow the style guidelines of this project
• I haven commented my code, particularly in hard-to-understand areas
• I have checked if my changes generate no new warnings

[vercel]

@Vibgitcode27 is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Walkthrough

The PR modifies packages/features/bookings/lib/handleCancelBooking.ts by removing the server-side guard that blocked cancellations when an event type had disableCancelling enabled. Specifically, it deletes the block that threw a 400 error with the message "This event type does not allow cancellations." No other exported/public signatures were changed.

Assessment against linked issues

Objective	Addressed	Explanation
Hide/remove cancel option when disableCancelling is enabled on managed event types (#23457, CAL-6353)	❌	No UI or API changes to control visibility of the cancel button.
Prevent 500 error when attempting to cancel with disableCancelling enabled; ensure correct handling (#23457, CAL-6353)	❓	Root cause of 500 is not shown; removing a 400 guard may not address the 500 source.

Possibly related PRs

• fix: Remove cancel and reschedule links from email when event type doesn't allow  #22653 — Adjusts use of disableCancelling to hide cancel/reschedule links in emails, which complements UI behavior related to the same flag.

Tip

🔌 Remote MCP (Model Context Protocol) integration is now available!

Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats.

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between d44a41c and d6cb661.

📒 Files selected for processing (1)

• packages/features/bookings/lib/handleCancelBooking.ts (0 hunks)

💤 Files with no reviewable changes (1)

• packages/features/bookings/lib/handleCancelBooking.ts

⏰ Context from checks skipped due to timeout of 180000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Tests / Unit

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[Vibgitcode27]

Hey!

If you think the disableCancelling check is necessary, just let me know and I'll add validation that the user is admin. But here only the user from session is passed:

const result = await handleCancelBooking({
 bookingData,
 userId: session?.user?.id || -1,
});

I don't feel like that check is necessary since guests don't even get the UI to cancel when it's disabled, so I just removed it. Let me know if you want me to add the admin validation instead , I can do that change quickly!

[anikdhabal]

Fixed by this:- #23479

[Vibgitcode27]

@anikdhabal Even if cancellation is disabled, shouldn’t that only apply to guests while owners should still be able to cancel the event?

[anikdhabal]

@Vibgitcode27 yeah that's a diff issue, I will open an issue after confirming from my team member. if we wanted that or not

[Vibgitcode27]

Should I open it? I will add need approval tag

[anikdhabal]

@Vibgitcode27 i will open it. No issue. Also your code not exactly fix that issue. You completely removed the logic

[Vibgitcode27]

@anikdhabal got it! I can add member check but np

[anikdhabal]

Found one pr:- #22281

[Vibgitcode27]

Yeah! @asadath1395 is still working on it I guess.