fix: Consistently remove a member from organization/sub-team/team - through all the APIs and webapp actions #22806

hariombalhara · 2025-07-30T06:02:08Z

What does this PR do?

This PR fixes the organization membership deletion functionality in API V2 by properly calling the TeamService.removeMembers method instead of directly deleting the membership record. This ensures that all necessary cleanup operations are performed when removing a user from an organization.

Fixes PRI-297

Bug Fixes

When setting organizationId=null, we explicitly make username unique so that slug constraint DB error is avoided
ChildrenManaged Events weren't deleted in case of team membership deletion, that is now fixed
Even though there are multiple tables need to be cleaned up when deleting a membership from org, that is being done in an atomic(mostly) manner now.

Technical Details:

The previous implementation was directly deleting memberships which could leave orphaned data
Now uses TeamService.removeMembers({ teamIds: [organizationId], userIds: [membership.userId], isOrg: true })
Maintains backward compatibility while ensuring proper cleanup

Visual Demo (For contributors especially)

N/A - This is a backend API change with no visual components.

Mandatory Tasks (DO NOT REMOVE)

I have self-reviewed the code (A decent size PR without self-review might be rejected).
I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - This is an internal API fix that doesn't change the public API interface.
I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Prerequisites:

Set up a local Cal.com development environment
Ensure you have API V2 enabled
Create a test organization with multiple members

Testing Steps:

Membership deletion should return 200 with the deleted membership data
All related data (hosts, permissions, etc.) should be properly cleaned up
Attempting to delete a non-existent membership returns 404
Non-admin users should receive 403 when attempting to delete memberships

Checklist

I have read the contributing guide
My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have checked if my changes generate no new warnings

coderabbitai · 2025-07-30T06:02:15Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

This change refactors the logic for removing users from teams and organizations across the codebase. The main removal logic is consolidated within a new TeamService.removeMembers method, which handles deletion of memberships, associated event types, event hosts, profiles, and organization redirects. The previous removeMember function is removed, and all usages are updated to use the new service. Controller and service methods in API v2 are updated to use TeamService.removeMembers for membership deletions. Associated test fixtures are extended with new helper methods, and a comprehensive integration test suite for TeamService.removeMembers is added. Unused or redundant code and tests are deleted accordingly.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Assessment against linked issues

Objective	Addressed	Explanation
Sub Team memberships aren't removed (PRI-297)	✅
Sub Team's Events hosts aren't removed for the user (PRI-297)	✅
Sub Team's Children Managed Events for the user aren't removed also (PRI-297)	✅
Profile isn't removed (PRI-297)	✅

Assessment against linked issues: Out-of-scope changes

Code Change	Explanation
Addition of `findById` methods in test fixtures (`apps/api/v2/test/fixtures/repository/event-types.repository.fixture.ts`, `membership.repository.fixture.ts`)	These additions are general test fixture improvements and not directly required for the linked issue.
Removal of logging from `removeMember.handler.ts`	Logging removal is not directly related to the objectives of PRI-297.
Update of `@calcom/platform-libraries` version in `apps/api/v2/package.json`	Dependency version bump is not directly tied to the objectives in PRI-297.

✨ Finishing Touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix-api-v2-org-user-membership-deletion

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

github-actions · 2025-07-30T06:02:18Z

Hey there and thank you for opening this pull request! 👋🏼

We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted.

Details:

No release type found in pull request title "Fix membership deletion handling and add tests". Add a prefix to indicate what kind of release this pull request corresponds to. For reference, see https://www.conventionalcommits.org/

Available types:
 - feat: A new feature
 - fix: A bug fix
 - docs: Documentation only changes
 - style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
 - refactor: A code change that neither fixes a bug nor adds a feature
 - perf: A code change that improves performance
 - test: Adding missing tests or correcting existing tests
 - build: Changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
 - ci: Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
 - chore: Other changes that don't modify src or test files
 - revert: Reverts a previous commit

linear · 2025-07-30T06:15:49Z

PRI-297

vercel · 2025-07-30T06:17:14Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

2 Skipped Deployments

Name	Status	Preview	Comments	Updated (UTC)
cal	⬜️ Ignored (Inspect)			Aug 5, 2025 4:32am
cal-eu	⬜️ Ignored (Inspect)			Aug 5, 2025 4:32am

github-actions · 2025-07-30T06:48:55Z

E2E results are ready!

Workflow #70549.1 latest results

…embership-deletion

socket-security · 2025-07-30T09:29:50Z

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

…ic methods - Moved removeMember and all related helper functions from separate file into TeamService class - Made all functions private static methods instead of exporting them - Deleted the original removeMember.ts file since it's no longer needed - Updated imports to use the new location - All integration tests pass successfully

- Renamed memberId parameter to userId in removeMember private method - Renamed memberIds parameter to userIds in removeMembers public method - Updated all calls to removeMembers to use userIds instead of memberIds - Parameter names now accurately reflect that they are user IDs, not membership IDs

…letion - Add unit tests for membership deletion services - Remove redundant deletion behavior tests from controllers - Keep only happy path tests in e2e controller tests - Fix unused imports and variables

graphite-app · 2025-07-31T10:35:12Z

Graphite Automations

"Add consumer team as reviewer" took an action on this PR • (07/31/25)

1 reviewer was added to this PR based on Keith Williams's automation.

coderabbitai

Actionable comments posted: 1

🔭 Outside diff range comments (2)

apps/api/v2/src/modules/teams/memberships/controllers/teams-memberships.controller.ts (1)

112-137: Fix duplicate membership updates and incorrect return value

The method updates the membership twice with the same parameters and returns the result from the first update instead of the second. This appears to be unintentional code duplication.

Apply this diff to fix the logic:

  async updateTeamMembership(
    @Param("teamId", ParseIntPipe) teamId: number,
    @Param("membershipId", ParseIntPipe) membershipId: number,
    @Body() body: UpdateTeamMembershipInput
  ): Promise<UpdateTeamMembershipOutput> {
-    const membership = await this.teamsMembershipsService.updateTeamMembership(teamId, membershipId, body);
-
    const currentMembership = await this.teamsMembershipsService.getTeamMembership(teamId, membershipId);

    const updatedMembership = await this.teamsMembershipsService.updateTeamMembership(
      teamId,
      membershipId,
      body
    );
    if (!currentMembership.accepted && updatedMembership.accepted) {
      try {
        await updateNewTeamMemberEventTypes(updatedMembership.userId, teamId);
      } catch (err) {
        this.logger.error("Could not update new team member eventTypes", err);
      }
    }
    return {
      status: SUCCESS_STATUS,
-      data: plainToClass(TeamMembershipOutput, membership, { strategy: "excludeAll" }),
+      data: plainToClass(TeamMembershipOutput, updatedMembership, { strategy: "excludeAll" }),
    };
  }

packages/lib/server/service/teamService.ts (1)

84-112: Consider error handling strategy for batch removals

The current implementation uses Promise.all for member removals, which will reject entirely if any single removal fails. This could leave the operation in a partially completed state.

Consider using Promise.allSettled to handle failures gracefully and provide detailed results:

  static async removeMembers({
    teamIds,
    userIds,
    isOrg = false,
  }: {
    teamIds: number[];
    userIds: number[];
    isOrg?: boolean;
  }) {
    const deleteMembershipPromises: Promise<RemoveMemberResult>[] = [];

    for (const userId of userIds) {
      for (const teamId of teamIds) {
        deleteMembershipPromises.push(
          TeamService.removeMember({
            teamId,
            userId,
            isOrg,
          })
        );
      }
    }

-    await Promise.all(deleteMembershipPromises);
+    const results = await Promise.allSettled(deleteMembershipPromises);
+    
+    // Log failures but continue with billing updates
+    const failures = results.filter((r) => r.status === 'rejected');
+    if (failures.length > 0) {
+      log.error('Some membership removals failed', { failures });
+    }

    const teamsBilling = await TeamBilling.findAndInitMany(teamIds);
    const teamBillingPromises = teamsBilling.map((teamBilling) => teamBilling.updateQuantity());
    await Promise.allSettled(teamBillingPromises);
+    
+    // Optionally, throw an aggregate error if any removals failed
+    if (failures.length > 0) {
+      throw new Error(`Failed to remove ${failures.length} membership(s)`);
+    }
  }

🧹 Nitpick comments (4)

packages/platform/libraries/package.json (1)
3-3: Consider using semantic versioning instead of 9.9.9.

The version jump from "0.0.0" to "9.9.9" is unusual and doesn't follow typical semantic versioning practices. For a significant refactor introducing new TeamService functionality, consider using a more appropriate version like "1.0.0" (major version for breaking changes) or "0.1.0" (minor version if maintaining pre-1.0 status).
-  "version": "9.9.9",
+  "version": "1.0.0",
apps/api/v2/package.json (1)

41-41: Dependency version update aligns with package changes.

The update to "@calcom/platform-libraries@9.9.9" is consistent with the version bump in the libraries package. However, consider using proper semantic versioning (e.g., "1.0.0") instead of "9.9.9" for better version management practices.

packages/lib/server/service/teamService.ts (1)

195-270: Consider implementing the TODO: Move fetch methods to repositories

The TODO comments correctly identify that these fetch methods should be moved to their respective repository classes for better separation of concerns and adherence to the repository pattern.

Consider creating:

MembershipRepository for fetchMembershipOrThrow

Update existing TeamRepository for fetchTeamOrThrow

UserRepository for fetchUserOrThrow

This would improve code organization and make the service layer focus on business logic rather than data access.
packages/lib/server/service/__tests__/teamService.integration-test.ts (1)
174-178: Simplify the membership deletion query.

The current OR mapping can be simplified.
-  await prisma.membership.deleteMany({
-    where: {
-      OR: teamIds.map((teamId) => ({ teamId })),
-    },
-  });
+  await prisma.membership.deleteMany({
+    where: {
+      teamId: { in: teamIds },
+    },
+  });

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3601a9a and 0d1c0f9.

⛔ Files ignored due to path filters (1)

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (17)

apps/api/v2/package.json (1 hunks)
apps/api/v2/src/modules/organizations/memberships/services/organizations-membership.service.ts (2 hunks)
apps/api/v2/src/modules/organizations/teams/memberships/organizations-teams-memberships.controller.ts (0 hunks)
apps/api/v2/src/modules/organizations/teams/memberships/services/organizations-teams-memberships.service.ts (2 hunks)
apps/api/v2/src/modules/teams/event-types/services/teams-event-types.service.ts (0 hunks)
apps/api/v2/src/modules/teams/memberships/controllers/teams-memberships.controller.ts (1 hunks)
apps/api/v2/src/modules/teams/memberships/services/teams-memberships.service.ts (2 hunks)
apps/api/v2/test/fixtures/repository/event-types.repository.fixture.ts (1 hunks)
apps/api/v2/test/fixtures/repository/membership.repository.fixture.ts (1 hunks)
packages/features/ee/dsync/lib/removeUserFromOrg.ts (1 hunks)
packages/features/ee/teams/lib/removeMember.ts (0 hunks)
packages/lib/server/service/__tests__/teamService.integration-test.ts (1 hunks)
packages/lib/server/service/teamService.ts (3 hunks)
packages/platform/libraries/index.ts (1 hunks)
packages/platform/libraries/package.json (1 hunks)
packages/trpc/server/routers/viewer/teams/removeMember.handler.ts (1 hunks)
packages/trpc/server/routers/viewer/teams/removeMember.test.ts (0 hunks)

💤 Files with no reviewable changes (4)

apps/api/v2/src/modules/teams/event-types/services/teams-event-types.service.ts
packages/features/ee/teams/lib/removeMember.ts
apps/api/v2/src/modules/organizations/teams/memberships/organizations-teams-memberships.controller.ts
packages/trpc/server/routers/viewer/teams/removeMember.test.ts

🧰 Additional context used

📓 Path-based instructions (4)

**/*.{service,repository}.ts

📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)

Avoid dot-suffixes like .service.ts or .repository.ts for new files; reserve .test.ts, .spec.ts, .types.ts for their specific purposes

Files:

apps/api/v2/src/modules/teams/memberships/services/teams-memberships.service.ts
apps/api/v2/src/modules/organizations/memberships/services/organizations-membership.service.ts
apps/api/v2/src/modules/organizations/teams/memberships/services/organizations-teams-memberships.service.ts

**/*.ts

📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)

**/*.ts: For Prisma queries, only select data you need; never use include, always use select
Ensure the credential.key field is never returned from tRPC endpoints or APIs

Files:

apps/api/v2/src/modules/teams/memberships/services/teams-memberships.service.ts
apps/api/v2/test/fixtures/repository/event-types.repository.fixture.ts
apps/api/v2/test/fixtures/repository/membership.repository.fixture.ts
packages/platform/libraries/index.ts
packages/trpc/server/routers/viewer/teams/removeMember.handler.ts
apps/api/v2/src/modules/organizations/memberships/services/organizations-membership.service.ts
packages/features/ee/dsync/lib/removeUserFromOrg.ts
apps/api/v2/src/modules/teams/memberships/controllers/teams-memberships.controller.ts
apps/api/v2/src/modules/organizations/teams/memberships/services/organizations-teams-memberships.service.ts
packages/lib/server/service/__tests__/teamService.integration-test.ts
packages/lib/server/service/teamService.ts

**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)

Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js .utc() in hot paths like loops

Files:

apps/api/v2/src/modules/teams/memberships/services/teams-memberships.service.ts
apps/api/v2/test/fixtures/repository/event-types.repository.fixture.ts
apps/api/v2/test/fixtures/repository/membership.repository.fixture.ts
packages/platform/libraries/index.ts
packages/trpc/server/routers/viewer/teams/removeMember.handler.ts
apps/api/v2/src/modules/organizations/memberships/services/organizations-membership.service.ts
packages/features/ee/dsync/lib/removeUserFromOrg.ts
apps/api/v2/src/modules/teams/memberships/controllers/teams-memberships.controller.ts
apps/api/v2/src/modules/organizations/teams/memberships/services/organizations-teams-memberships.service.ts
packages/lib/server/service/__tests__/teamService.integration-test.ts
packages/lib/server/service/teamService.ts

**/*Service.ts

📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)

Service files must include Service suffix, use PascalCase matching exported class, and avoid generic names (e.g., MembershipService.ts)

Files:

packages/lib/server/service/teamService.ts

🧠 Learnings (6)

apps/api/v2/src/modules/teams/memberships/services/teams-memberships.service.ts (1)