feat: blocking booker email or domain

[alishaz-polymath]

What does this PR do?

This PR introduces organization-level email and domain blocking functionality, allowing organization Admins and Owners to prevent specific email addresses or entire domains from making bookings. Blocked users experience a "shadow ban" where they see a fake success page but no real booking actions are triggered.

• Fixes Block Emails #22699
• Fixes CAL-6141 (Linear issue number - should be visible at the bottom of the GitHub issue description)

What's New

🚫 Spam Blocklist Management

• New Settings Page: Added spam blocklist management directly in Organization Settings → Privacy
• Inline Table: Professional data table with search, pagination, and sorting (matching the members table design)
• Add/Remove Entries: Simple dialog to add email addresses or domains to the blocklist
• Visual Feedback: Clear badges showing blocked status and entry types

🔒 Organization-Scoped Blocking

• Per-Organization Rules: Each organization maintains its own blocklist, isolated from others
• Role-Based Access: Only OWNER and ADMIN roles can manage blocked entries
• Email & Domain Support: Block specific emails (spam@example.com) or entire domains (@spammer.com)

📊 Professional UI/UX

• Data Table: Same advanced table system as organization members with:
  • Search functionality across emails/domains and descriptions
  • Pagination for handling large blocklists
  • Column sorting capabilities
  • Responsive design
• Member-Style Display: "Blocked By" column shows user avatar, name, and email (matching members table format)
• Consistent Design: Follows Cal.com design system and patterns

🗄️ Database Schema

• Extended Watchlist Model: Added organizationId and action fields to existing Watchlist table
• New Action Types: REPORT (existing) and BLOCK (new) for different blocking behaviors
• Audit Logging: New BlockedBooking model to track blocked booking attempts for compliance
• Proper Indexing: Optimized database queries with composite indexes

🔧 Technical Implementation

• Repository Pattern: Clean separation between data access and business logic
• Service Layer: Centralized blocking logic with email/domain matching strategies
• TRPC Integration: Type-safe API endpoints for blocklist CRUD operations
• React Hook Form: Proper form validation and error handling

API Changes

New TRPC Endpoints

• organizations.listSpamBlocklist - Get paginated blocklist entries
• organizations.createSpamBlocklistEntry - Add new blocked email/domain
• organizations.deleteSpamBlocklistEntry - Remove blocklist entry

Database Changes

• Watchlist table: Added organizationId (nullable) and action enum fields
• BlockedBooking table: New audit table for tracking blocked attempts
• Team relations: Added reverse relations for watchlist entries

Security & Privacy

• Shadow Ban: Blocked users see fake success pages, unaware they're blocked
• Audit Trail: All blocked booking attempts are logged for compliance
• Data Isolation: Organization blocklists are completely isolated
• Permission Enforcement: Strict role-based access control

Future Considerations

• The booking flow integration is prepared but commented out for future activation
• Decoy booking response system is implemented but not yet integrated
• Global-level blocking could be added later if needed

Testing

• All new components include proper TypeScript typing
• Form validation prevents invalid email/domain formats
• Error handling for edge cases (missing users, network failures)
• Responsive design tested across different screen sizes

---

This feature provides organizations with powerful spam prevention tools while maintaining a professional user experience and following Cal.com's established design patterns.

Visual Demo (For contributors especially)

A visual demonstration is strongly recommended, for both the original and new change (video / image - any one).

Video Demo (if applicable):

• Show screen recordings of the issue or feature.
• Demonstrate how to reproduce the issue, the behavior before and after the change.

Image Demo (if applicable):

• Add side-by-side screenshots of the original and updated change.
• Highlight any significant change(s).

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

• Are there environment variables that should be set?
• What are the minimal test data to have?
• What is expected (happy path) to have (input and output)?
• Any other important info that could help to test that PR

Checklist

• I haven't read the contributing guide
• My code doesn't follow the style guidelines of this project
• I haven't commented my code, particularly in hard-to-understand areas
• I haven't checked if my changes generate no new warnings

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/blocking-booker-email-or-domain

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[linear]

CAL-6141 Block Emails

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
cal	Ignored			Sep 22, 2025 9:59am
cal-eu	Ignored			Sep 22, 2025 9:59am

[github-actions]

This PR is being marked as stale due to inactivity.

[alishaz-polymath]

Closed in favor of #24040