fix: platform library export-verifyEmailCodeUnAuthenticated#23814
fix: platform library export-verifyEmailCodeUnAuthenticated#23814
Conversation
Walkthrough
Possibly related PRs
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hbjORbj
changed the title
|
@CodeRabbit write a PR description |
dosubot
bot
added
platform
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainI'll examine the changes in this PR to write a comprehensive description for you. 🏁 Script executed: Unrecoverable error: Failed to clone repository Let me search for more information about this specific function and the platform library structure to understand what this PR is likely fixing. Let me search for more specific information about Cal.com's platform library structure and common export issues. Based on the PR title and typical issues with library exports, I can provide a comprehensive PR description. Let me write one that addresses the likely scenario of a missing or incorrect export for the @hbjORbj Here's a comprehensive PR description for your fix: What does this PR do?This PR fixes a missing export for the ProblemThe
Solution
Impact
Testing
Note: You may want to fill in the specific CAL ticket number in place of "CAL-[FILL IN]" if you have the associated Jira/Linear ticket reference. 🌐 Web query: 💡 Result: Short answer: this is almost certainly caused by Cal.com's package exports/Build/TypeScript export configuration (named export not included in package.json "exports"), not your code. Workarounds: import the package default (or specific server package), upgrade/downgrade to a release that fixes exports, or import the function directly from the package’s source path or server package. See below. Evidence & links
Recommended actions
References
If you want, tell me: which package & version you're using and the exact import/stack trace — I can give the precise import workaround or a patch you can apply. 🌐 Web query: 💡 Result: Short answer: inspect the published package entry points — @calcom/platform-libraries publishes a single top-level module that re-exports the library functions/types from its package root (see package.json/exports and the distributed index
If you want, I can:
Which would you prefer (published package contents for a specific version, or the current GitHub source)? Sources: Perfect! The web search confirms this is a common issue with Cal.com's package exports configuration. Let me write a more accurate PR description based on this information: @hbjORbj Here's a comprehensive PR description based on the confirmed export configuration issue: What does this PR do?This PR fixes a missing named export for the ProblemThe
This is part of a broader known issue with Cal.com packages where TypeScript named exports aren't properly configured in the exports field. Root Cause
Solution
Impact
Testing
This addresses the systematic export configuration issue that affects multiple Cal.com packages and ensures proper API accessibility for platform library consumers. 🧠 Learnings used |
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
|
||
| export { verifyPhoneNumber, sendVerificationCode }; | ||
|
|
||
| export { verifyCodeUnAuthenticated } from "@calcom/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler"; |
There was a problem hiding this comment.
verifyCodeUnAuthenticated doesn't exist in verifyCodeUnAuthenticated.handler
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/api/v2/src/modules/atoms/services/verification-atom.service.ts (1)
28-41: Confirm new call signature and tighten error handlingSignature is correct — verifyCodeUnAuthenticated(email, code) is defined at packages/trpc/server/routers/viewer/auth/util.ts. However util.ts throws plain Error("Email and code are required") while apps/api/v2/src/modules/atoms/services/verification-atom.service.ts checks error.message for "invalid_code" and "BAD_REQUEST" — those won't match and will fall through to the generic "Verification failed". Update one side so they use a stable, typed error (e.g. throw TRPCError / set error.code or error.name) or change the service to inspect a stable property (TRPCError.code or error.code) instead of error.message. Files to change: packages/trpc/server/routers/viewer/auth/util.ts and apps/api/v2/src/modules/atoms/services/verification-atom.service.ts (lines ~28-41).
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
apps/api/v2/src/modules/atoms/controllers/atoms.verification.controller.ts(1 hunks)apps/api/v2/src/modules/atoms/services/verification-atom.service.ts(1 hunks)packages/platform/libraries/index.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (4)
**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
**/*.ts: For Prisma queries, only select data you need; never useinclude, always useselect
Ensure thecredential.keyfield is never returned from tRPC endpoints or APIs
Files:
packages/platform/libraries/index.tsapps/api/v2/src/modules/atoms/services/verification-atom.service.tsapps/api/v2/src/modules/atoms/controllers/atoms.verification.controller.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js
.utc()in hot paths like loops
Files:
packages/platform/libraries/index.tsapps/api/v2/src/modules/atoms/services/verification-atom.service.tsapps/api/v2/src/modules/atoms/controllers/atoms.verification.controller.ts
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
Flag default exports and encourage named exports. Named exports provide better tree-shaking, easier refactoring, and clearer imports. Exempt main components like pages, layouts, and components that serve as the primary export of a module.
Files:
packages/platform/libraries/index.tsapps/api/v2/src/modules/atoms/services/verification-atom.service.tsapps/api/v2/src/modules/atoms/controllers/atoms.verification.controller.ts
**/*.{service,repository}.ts
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
Avoid dot-suffixes like
.service.tsor.repository.tsfor new files; reserve.test.ts,.spec.ts,.types.tsfor their specific purposes
Files:
apps/api/v2/src/modules/atoms/services/verification-atom.service.ts
🧠 Learnings (1)
📚 Learning: 2025-08-21T16:34:10.839Z
Learnt from: Udit-takkar
PR: calcom/cal.com#22995
File: packages/trpc/server/routers/viewer/phoneNumber/delete.handler.ts:13-24
Timestamp: 2025-08-21T16:34:10.839Z
Learning: In calcom/cal.com PR #22995, the deletePhoneNumber function in packages/trpc/server/routers/viewer/phoneNumber/delete.handler.ts is only used for imported phone numbers that don't have active Stripe subscriptions. Purchased phone numbers with subscriptions use a separate cancellation flow first (per maintainer Udit-takkar).
Applied to files:
packages/platform/libraries/index.ts
🧬 Code graph analysis (1)
apps/api/v2/src/modules/atoms/services/verification-atom.service.ts (1)
packages/platform/libraries/index.ts (1)
verifyCodeUnAuthenticated(131-131)
🔇 Additional comments (1)
packages/platform/libraries/index.ts (1)
131-131: Export source verified — symbol exists; no circular deps foundverifyCodeUnAuthenticated is exported from packages/trpc/server/routers/viewer/auth/util.ts as an async const with signature (email: string, code: string). No occurrences of '@calcom/platform-libraries' were found under packages/trpc.
apps/api/v2/src/modules/atoms/controllers/atoms.verification.controller.ts
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
apps/api/v2/package.json (1)
41-41: Don't switch to workspace:^0.0.358 — local package version is 0.0.0packages/platform/libraries/package.json reports version 0.0.0, so workspace:^0.0.358 will not satisfy semver. Options:
- For local hot-reload: bump packages/platform/libraries/package.json to 0.0.358 and use workspace:^0.0.358, or use "workspace:*" to always resolve to the local workspace package.
- If you intentionally dogfood the published package, keep "npm:@calcom/platform-libraries@0.0.358".
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
apps/api/v2/package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 180000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Tests / Unit
- GitHub Check: Linters / lint
- GitHub Check: Type check / check-types
- GitHub Check: Codacy Static Code Analysis
🔇 Additional comments (1)
apps/api/v2/package.json (1)
41-41: Confirm export and resolve duplicate workspace/npm installations"@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.358",
- Verified local export: packages/platform/libraries/index.ts:131 exports verifyCodeUnAuthenticated.
- apps/api/v2/package.json declares the npm alias (above).
- yarn.lock contains both the npm entry for @calcom/platform-libraries@0.0.358 and a workspace entry (workspace:packages/platform/libraries -> 0.0.0-use.local) — this produces duplicate resolutions/installs.
- Action: pick one resolution and consolidate. If you intend to use the published package, keep the npm alias and reinstall to update yarn.lock; if you need local workspace linking during dev, change the dependency to the workspace protocol (workspace:packages/platform/libraries) or remove the npm alias, then reinstall so the lockfile resolves to a single entry.
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/trpc/server/routers/viewer/auth/util.ts (1)
17-19: Do not fallback to empty CALENDSO_ENCRYPTION_KEY (weak secret).If the env var is unset, the secret degrades to md5(email), making TOTP derivable by anyone with the email. Fail fast instead.
- const secret = createHash("md5") - .update(email + (process.env.CALENDSO_ENCRYPTION_KEY || "")) - .digest("hex"); + const encKey = process.env.CALENDSO_ENCRYPTION_KEY; + if (!encKey) { + throw new Error("Server misconfig: CALENDSO_ENCRYPTION_KEY is not set"); + } + const secret = createHash("md5").update(email + encKey).digest("hex");
🧹 Nitpick comments (1)
packages/trpc/server/routers/viewer/auth/util.ts (1)
7-10: Minor hardening: trim/normalize inputs and narrow error for invalid code format.Trim inputs and optionally validate code format (e.g., 6 digits) before TOTP check to avoid false negatives due to whitespace.
-export const verifyCodeUnAuthenticated = async (email: string, code: string) => { - if (!email || !code) { +export const verifyCodeUnAuthenticated = async (email: string, code: string) => { + const e = email?.trim(); + const c = code?.trim(); + if (!e || !c) { throw new Error("Email and code are required"); } @@ - await checkRateLimitAndThrowError({ + await checkRateLimitAndThrowError({ rateLimitingType: "core", - identifier: `emailVerifyCode.${hashEmail(email)}`, + identifier: `emailVerifyCode.${hashEmail(e)}`, }); @@ - const isValidToken = totpRawCheck(code, secret, { step: 900 }); + // Optional: enforce numeric 6-digit code + // if (!/^\d{6}$/.test(c)) throw new Error("Invalid verification code"); + const isValidToken = totpRawCheck(c, secret, { step: 900 });Also applies to: 21-25
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
packages/trpc/server/routers/viewer/auth/util.ts(1 hunks)packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
**/*.ts: For Prisma queries, only select data you need; never useinclude, always useselect
Ensure thecredential.keyfield is never returned from tRPC endpoints or APIs
Files:
packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.tspackages/trpc/server/routers/viewer/auth/util.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js
.utc()in hot paths like loops
Files:
packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.tspackages/trpc/server/routers/viewer/auth/util.ts
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
Flag default exports and encourage named exports. Named exports provide better tree-shaking, easier refactoring, and clearer imports. Exempt main components like pages, layouts, and components that serve as the primary export of a module.
Files:
packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.tspackages/trpc/server/routers/viewer/auth/util.ts
🧠 Learnings (1)
📓 Common learnings
Learnt from: Udit-takkar
PR: calcom/cal.com#22995
File: packages/features/calAIPhone/providers/retellAI/services/AgentService.ts:83-88
Timestamp: 2025-08-26T20:23:28.396Z
Learning: In calcom/cal.com PR #22995, the workflow update handler in packages/trpc/server/routers/viewer/workflows/update.handler.ts includes workflow-level authorization via isAuthorized(userWorkflow, ctx.user.id, "workflow.update") which validates the user can update the workflow before calling updateToolsFromAgentId (per maintainer Udit-takkar).
🧬 Code graph analysis (1)
packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.ts (2)
packages/trpc/server/routers/viewer/auth/util.ts (1)
verifyCodeUnAuthenticated(7-28)packages/platform/libraries/index.ts (1)
verifyCodeUnAuthenticated(131-131)
🔇 Additional comments (3)
packages/trpc/server/routers/viewer/auth/util.ts (1)
27-27: Return type change to Promise — verified.No callers pass the old single-object input or expect Promise; usages either await/return the boolean or ignore the return. Only test mocks resolve undefined (update mocks if you want stricter typing).
Call sites to check:
- packages/trpc/server/routers/viewer/auth/util.ts (definition)
- packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.ts:14 (returned by handler)
- packages/features/bookings/lib/handleNewBooking.ts:513 (awaited)
- packages/platform/libraries/index.ts:131 (re-export)
- packages/features/bookings/lib/handleNewBooking/test/email-verification-booking.test.ts:165 (vi.mocked(...).mockResolvedValue(undefined))
- packages/features/bookings/Booker/components/hooks/useVerifyCode.ts:34 (trpc mutation onSuccess)
packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.ts (2)
14-14: Good:return awaitensures thecatchmaps async rejections.Keeps error mapping consistent with the try/catch.
15-17: Differentiate error responses (rate limit vs invalid code vs bad input)Catching everything as
invalid_codehides rate limits and validation/input errors — map known error types to appropriate TRPCError codes so callers can react (TOO_MANY_REQUESTS for rate limits, BAD_REQUEST for missing/invalid input, etc.).File: packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.ts (catch block ~lines 15–17)
Suggested change:
- } catch (error) { - throw new TRPCError({ code: "BAD_REQUEST", message: "invalid_code" }); + } catch (error: any) { + // Example — adjust to actual error types thrown in your codebase + if (error?.name === "RateLimitError") { + throw new TRPCError({ code: "TOO_MANY_REQUESTS", message: "rate_limited" }); + } + if (error?.message === "Email and code are required") { + throw new TRPCError({ code: "BAD_REQUEST", message: "invalid_input" }); + } + throw new TRPCError({ code: "BAD_REQUEST", message: "invalid_code" }); }Verification notes:
- Found re-export: packages/platform/libraries/index.ts —
export { verifyCodeUnAuthenticated } from "@calcom/trpc/server/routers/viewer/auth/util";(around line 131).- Package.json "exports" check in the prior script failed with jq errors; confirm packages/platform/libraries/package.json exposes the module path so the util is publicly exported.
E2E results are ready! |
2 participants
What does this PR do?
This PR fixes a missing export for the
verifyEmailCodeUnAuthenticatedfunction in the Cal.com platform library, ensuring it's properly accessible to external consumers.Problem
The
verifyEmailCodeUnAuthenticatedfunction was implemented but not properly exported from the platform library's public API. This caused:Solution
verifyEmailCodeUnAuthenticatedfunction in the platform libraryImpact
verifyEmailCodeUnAuthenticated