fix: Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled #22281

asadath1395 · 2025-07-07T06:03:50Z

What does this PR do?

Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled

Fixes Disable cancellation feature disables the option for the host as well #22271 (GitHub issue number)
Fixes CAL-XXXX (Linear issue number - should be visible at the bottom of the GitHub issue description)

Visual Demo (For contributors especially)

Before

https://www.loom.com/share/bf768bc270e04c48b37ec8d9379a8a0a?sid=c4fa7153-8794-47ef-8320-f42252c880b3

After

https://www.loom.com/share/5b130406f3364ec591764672e8a9660a?sid=6c02726f-84c4-4862-b08b-aed83d956c4f

Mandatory Tasks (DO NOT REMOVE)

I have self-reviewed the code (A decent size PR without self-review might be rejected).
I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Check the videos above

…eduling/Cancelling is enabled

vercel · 2025-07-07T06:03:57Z

@asadath1395 is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

graphite-app · 2025-07-07T06:05:11Z

Graphite Automations

"Add consumer team as reviewer" took an action on this PR • (07/07/25)

1 reviewer was added to this PR based on Keith Williams's automation.

"Add community label" took an action on this PR • (07/07/25)

1 label was added to this PR based on Keith Williams's automation.

cubic-dev-ai

cubic found 2 issues across 6 files. Review them in cubic.dev

_{React with 👍 or 👎 to teach cubic. Tag @cubic-dev-ai to give specific feedback.}

apps/web/lib/reschedule/[uid]/getServerSideProps.ts

cubic-dev-ai · 2025-07-07T06:08:23Z

apps/web/playwright/booking-pages.e2e.ts

+    const [user] = users.get();
+    await user.apiLogin();
+
+    await page.goto(`/booking/${bookingId}`);


Rule violated: E2E Tests Best Practices

Missing expect(page).toHaveURL() after navigation. According to the E2E Best Practices guideline, tests must assert the final URL immediately after page.goto to fail fast on unexpected redirects.

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

kart1ka

Along with the host, Team/Org Admin and Owner should also be able to reschedule or cancel the booking.

kart1ka · 2025-07-07T17:38:45Z

Hi @asadath1395, Left a comment. There is a type check failing, pls address that as well.

…able-rescheduling-cancelling

…e disabled in event type

…com/asadath1395/cal.com into fix/disable-rescheduling-cancelling

…able-rescheduling-cancelling

cubic-dev-ai

cubic found 2 issues across 9 files. Review them in cubic.dev

_{React with 👍 or 👎 to teach cubic. Tag @cubic-dev-ai to give specific feedback.}

cubic-dev-ai · 2025-07-09T02:55:07Z

apps/web/lib/reschedule/[uid]/getServerSideProps.ts

+    }
+  }
+
+  const isHostOrOwner = !!userIsHost || !!userIsOwnerOfEventType || !!hasTeamOrOrgPermissions;


The permission-calculation logic (userIsHost / userIsOwnerOfEventType / hasTeamOrOrgPermissions) is duplicated later in the same function, causing two additional database calls (isTeamAdmin, isOrganisationAdmin) per request. This hurts performance and maintainability; consider extracting a helper or computing once and re-using the result.

cubic-dev-ai · 2025-07-09T02:55:08Z

apps/web/lib/team/[slug]/[type]/getServerSideProps.tsx

+      }
+    }
+  }
+  const isHostOrOwner =


Authorization relies on eventData.hosts which is limited to the first 3 hosts (because of take: 3 in the Prisma query). If an event has more than three hosts, legitimate hosts outside this slice will fail the check and be redirected, effectively blocking them from rescheduling/cancelling their own event.

Nice catch, fixed it by querying it separately

cubic-dev-ai

cubic found 2 issues across 9 files. Review them in cubic.dev

_{React with 👍 or 👎 to teach cubic. Tag @cubic-dev-ai to give specific feedback.}

apps/web/lib/reschedule/[uid]/getServerSideProps.ts

apps/web/lib/team/[slug]/[type]/getServerSideProps.tsx

…er is the host and fix type error

asadath1395 · 2025-07-09T03:22:01Z

Along with the host, Team/Org Admin and Owner should also be able to reschedule or cancel the booking.

@kart1ka Thanks for flagging this. I have fixed it and added tests too. Please test this again and let me know if you find anything

kart1ka

Left some comments. Also I have noticed that the cancel and reschedule buttons are not displayed for host, team and org admin/owners as can be seen in the image below. Pls fix that as well.

kart1ka · 2025-07-09T04:22:37Z

apps/web/lib/reschedule/[uid]/getServerSideProps.ts

-  if (isDisabledRescheduling) {
+  // Check if user is a host or owner of the event type
+  const userId = session?.user?.id;
+  const userIsHost = booking?.eventType?.hosts?.find((host) => host.user.id === userId);


It does not make sense to let all the hosts cancel/reschedule the booking that do not belong to them.

This is how we should check for permission:

cal.com/apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx

Line 158 in 6410687

const checkIfUserIsHost = (userId?: number | null) => {

@kart1ka I am not sure which one is correct, i can see both implementations in code, check https://github.com/calcom/cal.com/blob/main/packages/features/bookings/lib/handleInternalNote.ts#L23-L25, https://github.com/calcom/cal.com/blob/main/apps/web/lib/video/%5Buid%5D/getServerSideProps.ts#L81-L104 and the one you tagged above

pls use the reference I have mentioned.

kart1ka · 2025-07-09T04:23:20Z

apps/web/server/lib/[user]/[type]/getServerSideProps.ts

-  if (booking?.eventType?.disableRescheduling) {
+  // Check if user is a host or owner of the event type
+  const userId = session?.user?.id;
+  const userIsHost = booking?.eventType?.hosts?.find((host) => host.userId === userId);


kart1ka · 2025-07-09T04:28:01Z

apps/web/lib/team/[slug]/[type]/getServerSideProps.tsx

+  if (userId && !isHostOrOwner) {
+    const hostCheck = await prisma.host.findFirst({
+      where: {
+        userId,
+        eventTypeId: eventData.id,
+      },
+    });
+    isHostOrOwner = !!hostCheck;
+  }


same issue here

kart1ka · 2025-07-09T04:30:51Z

apps/web/lib/reschedule/[uid]/getServerSideProps.ts

+    const isTeamAdminResult = await isTeamAdmin(userId, booking.eventType.team.id);
+    if (isTeamAdminResult) {
+      hasTeamOrOrgPermissions = true;
+    } else if (booking.eventType.team.parentId) {
+      const isOrgAdminResult = await isOrganisationAdmin(userId, booking.eventType.team.parentId);
+      if (isOrgAdminResult) {
+        hasTeamOrOrgPermissions = true;
+      }


Since, we are checking for team or org admin/owner in many place, I would prefer to abstract this check into its own function and then reuse that in all the places we are performing this check.

kart1ka · 2025-07-09T04:39:27Z

packages/features/bookings/lib/handleCancelBooking.ts

@@ -106,7 +108,28 @@ async function handler(input: CancelBookingInput) {
    throw new HttpError({ statusCode: 400, message: "User not found" });
  }

-  if (bookingToDelete.eventType?.disableCancelling) {
+  // Check if user is a host or owner of the event type
+  const userIsHost = bookingToDelete.eventType?.hosts?.find((host) => host.user.id === userId);


same issue here as well.

coderabbitai · 2025-07-16T16:03:35Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing Touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

github-actions · 2025-07-31T00:27:40Z

This PR is being marked as stale due to inactivity.

kart1ka · 2025-08-05T17:28:12Z

@asadath1395 Are you working on this PR?

asadath1395 · 2025-08-06T05:45:19Z

@kart1ka Yes, i have addressed most of the comments, have couple more to fix. Will find some time this week to address those.

fix: Hosts not able to cancel/reschedule the event when Disable Resch…

6b0cbc8

…eduling/Cancelling is enabled

asadath1395 requested a review from a team as a code owner July 7, 2025 06:03

graphite-app bot added the community Created by Linear-GitHub Sync label Jul 7, 2025

graphite-app bot requested a review from a team July 7, 2025 06:03

github-actions bot added Public 🐛 bug Something isn't working 🧹 Improvements Improvements to existing features. Mostly UX/UI labels Jul 7, 2025

dosubot bot added the bookings area: bookings, availability, timezones, double booking label Jul 7, 2025

cubic-dev-ai bot reviewed Jul 7, 2025

View reviewed changes

asadath1395 and others added 2 commits July 7, 2025 11:42

Fix logic bypass

fe5cc0b

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

Fix cubic comment

cb4fb4c

kart1ka requested changes Jul 7, 2025

View reviewed changes

kart1ka marked this pull request as draft July 7, 2025 17:38

Merge branch 'main' of https://github.com/calcom/cal.com into fix/dis…

9fad7a2

…able-rescheduling-cancelling

anikdhabal mentioned this pull request Jul 8, 2025

fix: allow hosts to cancel bookings when disableCancelling is enabled #22310

Closed

anikdhabal and others added 6 commits July 8, 2025 18:25

Merge branch 'main' into fix/disable-rescheduling-cancelling

f4adb8d

Fix team/org admins/owners mot able to reschedule/cancel when they ar…

8edc297

…e disabled in event type

Merge branch 'fix/disable-rescheduling-cancelling' of https://github.…

8542dca

…com/asadath1395/cal.com into fix/disable-rescheduling-cancelling

Fix type error

2e8b63b

Merge branch 'main' of https://github.com/calcom/cal.com into fix/dis…

a88aa94

…able-rescheduling-cancelling

Improve imports and function params typing

15a5262

asadath1395 marked this pull request as ready for review July 9, 2025 02:50

cubic-dev-ai bot reviewed Jul 9, 2025

View reviewed changes

apps/web/lib/reschedule/[uid]/getServerSideProps.ts Show resolved Hide resolved

apps/web/lib/team/[slug]/[type]/getServerSideProps.tsx Outdated Show resolved Hide resolved

asadath1395 added 2 commits July 9, 2025 08:39

Remove duplicate permission check, fix auth logic to check whether us…

b134b7a

…er is the host and fix type error

Remove duplicate permission check

bab5c12

asadath1395 requested a review from kart1ka July 9, 2025 03:22

kart1ka requested changes Jul 9, 2025

View reviewed changes

kart1ka marked this pull request as draft July 9, 2025 04:43

Extract checkTeamOrOrgPermissions into a separate function

4ae3d00

anikdhabal added the Medium priority Created by Linear-GitHub Sync label Jul 16, 2025

github-actions bot added the Stale label Jul 31, 2025

Merge branch 'main' into fix/disable-rescheduling-cancelling

1d2888f

Merge branch 'main' into fix/disable-rescheduling-cancelling

63f7b5f

kart1ka mentioned this pull request Aug 6, 2025

fix: allow organizer/host to cancel/reschedule even when booking options are disabled #22807

Closed

3 tasks

fix: Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled #22281

Are you sure you want to change the base?

fix: Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled #22281

Uh oh!

Conversation

asadath1395 commented Jul 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Visual Demo (For contributors especially)

Mandatory Tasks (DO NOT REMOVE)

How should this be tested?

Uh oh!

vercel bot commented Jul 7, 2025

Uh oh!

graphite-app bot commented Jul 7, 2025

Graphite Automations

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

kart1ka left a comment

Choose a reason for hiding this comment

Uh oh!

kart1ka commented Jul 7, 2025

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

asadath1395 commented Jul 9, 2025

Uh oh!

kart1ka left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Review skipped

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

asadath1395 commented Jul 7, 2025 •

edited

Loading

coderabbitai bot commented Jul 16, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)