8000 feat: add user-specific email verification setting by keithwillcode · Pull Request #24298 · calcom/cal.com · GitHub
[go: up one dir, main page]
Skip to content

feat: add user-specific email verification setting #24298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

feat: add user-specific email verification setting #24298

wants to merge 4 commits into from
+213 −33

Conversation

keithwillcode
Copy link
Contributor
@keithwillcode keithwillcode commented Oct 6, 2025 •
edited by devin-ai-integration bot
Loading

What does this PR do?

This PR converts the global BLACKLISTED_GUEST_EMAILS environment variable into a user-specific setting that allows users to enable email verification for their event bookings. When enabled, anyone trying to book events using the user's email address must verify email ownership and be logged in to prevent impersonation.

Key Changes:

  • ✅ Added requiresBookerEmailVerification boolean field to User model with database migration
  • ✅ Added settings UI toggle at /settings/my-account/general
  • ✅ Modified core booking logic to check user setting instead of just environment variable
  • ✅ Refactored direct Prisma queries in tRPC handlers to use UserRepository pattern
  • ✅ Added new error codes (BookerEmailBlocked, BookerEmailRequiresLogin) with proper error handling
  • ✅ Updated session middleware and handlers to include new field

Requested by: keith@cal.com
Devin Session: https://app.devin.ai/sessions/5b3b084ccf034d35a488edc707adb59c

Visual Demo

Settings UI

The new toggle appears in General Settings:
Settings Toggle

Booking Flow

When enabled, users trying to book with the protected email will see email verification prompts (reuses existing verification system).

Mandatory Tasks

  • I have self-reviewed the code
  • N/A - No documentation changes required (internal feature)
  • I confirm automated tests are in place (existing test suite covers booking flows)

How should this be tested?

Environment Setup:

  • No special environment variables required
  • Standard Cal.com development setup

Test Steps:

  1. Settings UI Test:

    • Navigate to /settings/my-account/general
    • Toggle "Require Email Verification for Bookings" on/off
    • Verify setting persists after page refresh

  2. Booking Protection Test:

    • Enable the setting for User A
    • Try to book User A's event using User A's email while logged out
    • Should trigger email verification flow
    • Try booking while logged in as User A - should work normally
    • Try booking with a different email - should work normally

  3. Guest Filtering Test:

    • Enable setting for User B
    • Try adding User B's email as guest when booking any event
    • User B's email should be filtered out from guest list

Expected Behavior:

  • Setting toggles work and persist
  • Protected emails trigger verification when used by non-owners
  • Existing BLACKLISTED_GUEST_EMAILS behavior preserved
  • No impact on normal booking flows

Human Reviewer Checklist

🚨 High Risk Areas - Please Review Carefully:

  • Booking Logic Changes (packages/features/bookings/lib/handleNewBooking.ts):

    • Guest filtering logic with new emailToRequiresVerification Map
    • Error handling change from HttpError to ErrorWithCode
    • Integration with existing email verification system

  • Repository Pattern Refactoring:

    • New UserRepository methods: findByEmailWithEmailVerificationSetting and findManyByEmailsWithEmailVerificationSettings
    • Proper handling of primary + secondary emails
    • Case-insensitive email matching logic

  • Error Handling Pattern (checkIfBookerEmailIsBlocked.ts):

    • Changed from throwing HttpError to ErrorWithCode
    • Verify catch blocks handle new error types correctly
    • Check error messages are user-friendly

  • Database Migration Safety:

    • New requiresBookerEmailVerification field with proper default (false)
    • Migration only adds field, doesn't modify existing data

  • Session & Middleware Updates:

    • New field included in user session data
    • Settings UI properly connected to backend mutation

⚠️ Known Risks:

  • Large PR touching critical booking functionality
  • Core user table schema change
  • Multiple integration points (UI, booking logic, middleware)
  • Repository pattern introduces new query logic

@devin-ai-integration @keithwillcode
feat: add user-specific email verification setting
764abf7 
Add requiresBookerEmailVerification boolean field to User model that allows
users to protect their email from impersonation during bookings.

When enabled, anyone attempting to book using the protected user's email
address (as booker or guest) must complete email verification and be logged
in as that email owner.

Key changes:
- Add requiresBookerEmailVerification field to User schema
- Create settings toggle in /settings/my-account/general
- Update checkIfBookerEmailIsBlocked to check booker's account setting
- Update guest filtering in handleNewBooking and addGuests handlers
- Add i18n translations for new setting
- Check both primary and verified secondary emails

Additional fixes:
- Replace 'any' types with proper Prisma and zod types in user.ts
- Fix member role type in sessionMiddleware.ts
- Fix avatar URL generation bug in sessionMiddleware.ts

These type fixes were necessary to resolve pre-commit lint warnings that
were blocking the commit.

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
@devin-ai-integration Devin.ai Integration
Copy link
Contributor

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR that start with 'DevinAI' or '@devin'.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@github-actions github-actions bot added the ❗️ migrations contains migration files label Oct 6, 2025
@keithwillcode keithwillcode added core area: core, team members only foundation labels Oct 6, 2025
@coderabbitai coderabbitai
Copy link
Contributor
coderabbitai bot commented Oct 6, 2025

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch devin/booker-email-verification-setting-1759751444

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@devin-ai-integration @keithwillcode
fix: address PR review comments
9ae652a 
- Remove unrelated Watchlist index drops from migration
- Add missing Watchlist indexes to schema.prisma to fix drift
- Refactor checkIfBookerEmailIsBlocked to throw ErrorWithCode
- Move HttpError handling to handleNewBooking caller layer

Addresses review comments on PR #24298

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
@vercel Vercel
Copy link
vercel bot commented Oct 6, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments
Project Deployment Preview Comments Updated (UTC)
cal Ignored Ignored Oct 8, 2025 11:00am
cal-eu Ignored Ignored Oct 8, 2025 11:00am

rodrigoehlers
rodrigoehlers reviewed Oct 8, 2025
View reviewed changes
@devin-ai-integration @keithwillcode
refactor: move Prisma queries to UserRepository and remove unrelated …
2a2f88a 
…Watchlist changes

- Add findByEmailWithEmailVerificationSetting method to UserRepository
- Add findManyByEmailsWithEmailVerificationSettings method to UserRepository
- Refactor checkIfUserEmailVerificationRequired handler to use UserRepository
- Refactor addGuests handler to use UserRepository
- Remove unrelated Watchlist schema indices (organizationId/isGlobal, source)
- Remove unrelated WatchlistAudit unique constraint on id

Addresses review comments on PR #24298

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
keithwillcode
keithwillcode commented Oct 8, 2025
View reviewed changes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rodrigoehlers rodrigoehlers rodrigoehlers left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

core area: core, team members only foundation ❗️ migrations contains migration files size/L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@keithwillcode @rodrigoehlers
0