feat: take into account guest availability when rescheduling

[openclaw12-dev]

/claim #16378

Fixes #16378

What does this PR do?

When a host reschedules a booking, this PR checks whether any of the attendees (guests/bookers) are registered Cal.com users. If they are, their availability is fetched and intersected with the host's availability so the reschedule picker only shows time slots that work for both parties.

Important: Guest availability is only checked for host-initiated reschedules. When a guest reschedules themselves (via email link or while logged in as an attendee), they can freely pick any slot on the host's calendar — per this comment.

Changes

1. BookingRepository.ts — Added findBookingAttendeesByUid() to fetch attendee emails and organizer userId from a booking UID.

2. UserRepository.ts — Added findUsersByEmailsForAvailability() using raw SQL UNION (matching findVerifiedUsersByEmailsRaw pattern) to check both primary and verified secondary emails. No LOWER() (avoids sequential scan), includes locked = FALSE on both legs.

3. slots/util.ts — Added _getGuestAvailabilityForReschedule() method:

   • Host-vs-guest detection: Checks ctx.session.user.email — if no session (guest via email link) or logged-in user is an attendee → skips guest availability check
   • Fetches original booking attendees
   • Looks up if any are registered Cal.com users (via primary OR secondary email)
   • Filters out the host (avoids double-counting)
   • Fetches the guest's available date ranges
   • Intersects host + guest availability using existing intersect() from date-ranges
   • Non-fatal error handling: if guest lookup fails, falls back to host-only availability

4. types.ts — Extended ContextForGetSchedule with optional session type for host detection.

5. Tests (getGuestAvailabilityForReschedule.test.ts) — 331 lines covering:

   • Host-vs-guest distinction: no session → skip, no user email → skip, logged-in attendee → skip, host logged in → proceed
   • Booking not found / empty attendees
   • External (non-Cal.com) attendees
   • Attendee is the host (filtered out)
   • Successful guest availability fetch
   • Multiple attendees (uses first non-host Cal.com user)

How to test

1. Create two Cal.com users (User A and User B)
2. User A books User B
3. User B (host) reschedules → available slots should respect User A's availability
4. User A (guest) reschedules via email link → should see all of User B's available slots (no restriction)
5. Book with an external email → reschedule works normally

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

ec2-user seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[graphite-app]

Graphite Automations

"Send notification to Community team when bounty PR opened" took an action on this PR • (02/25/26)

2 teammates were notified to this PR based on Keith Williams's automation.

[cubic-dev-ai]

2 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/trpc/server/routers/viewer/slots/util.ts">

<violation number="1" location="packages/trpc/server/routers/viewer/slots/util.ts:1044">
P1: Custom agent: **Avoid Logging Sensitive Information**

Guest email addresses (PII) are logged directly via `guestEmails: guests.map((g) => g.email)`. Avoid logging sensitive information such as emails. Use user IDs or obfuscated identifiers instead.</violation>
</file>

<file name="packages/features/users/repositories/UserRepository.ts">

<violation number="1" location="packages/features/users/repositories/UserRepository.ts:1469">
P2: findUsersByEmailsForAvailability ignores verified SecondaryEmail records, so guests who booked with a secondary email won’t be matched and their availability won’t be intersected during reschedule.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Custom agent: Avoid Logging Sensitive Information

Guest email addresses (PII) are logged directly via guestEmails: guests.map((g) => g.email). Avoid logging sensitive information such as emails. Use user IDs or obfuscated identifiers instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/trpc/server/routers/viewer/slots/util.ts, line 1044:

<comment>Guest email addresses (PII) are logged directly via `guestEmails: guests.map((g) => g.email)`. Avoid logging sensitive information such as emails. Use user IDs or obfuscated identifiers instead.</comment>

<file context>
@@ -990,6 +990,102 @@ export class AvailableSlotsService {
+    }
+
+    loggerWithEventDetails.debug("Found Cal.com guest user(s) for reschedule", {
+      guestEmails: guests.map((g) => g.email),
+    });
+
</file context>

Suggested change

	guestEmails: guests.map((g) => g.email),
	guestUserIds: guests.map((g) => g.id),