8000 feat: Add async spam check with parallel execution and fake booking redirect by hariombalhara · Pull Request #24326 · calcom/cal.com · GitHub
[go: up one dir, main page]
Skip to content

feat: Add async spam check with parallel execution and fake booking redirect #24326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 11 commits into
base: feat/spam-block-di
Choose a base branch
from
Draft

feat: Add async spam check with parallel execution and fake booking redirect #24326

wants to merge 11 commits into from
+1,031 −35

Conversation

hariombalhara
Copy link
Member
@hariombalhara hariombalhara commented Oct 7, 2025 •
edited by devin-ai-integration bot
Loading

What does this PR do?

This PR implements an async spam blocker for Cal.com that runs spam checks in parallel with availability loading to achieve zero performance impact on legitimate bookings.

Key Features:

  • ⚡ Zero-delay spam checking: Runs in parallel with availability loading
  • 🎭 Convincing spam deception: Fake booking confirmation page for blocked emails
  • 🏗️ Clean architecture: Uses DI container and service-oriented design
  • 🔍 Dual-level blocking: Checks both global and organization-level watchlists

Stacked on: #24040 (feat: Add spam blocker DI structure)

Visual Demo

Manual testing completed for both spam and legitimate booking paths:

Spam Path Test:

  • Email spamtest@blocked.com (added to Watchlist with BLOCK action)
  • ✅ Successfully redirected to convincing fake /booking-successful page
  • ✅ Shows professional confirmation with all booking details
  • ✅ Spammers cannot detect they've been blocked

Legitimate Path Test:

  • Email legitimate@user.com (clean, not in watchlist)
  • ✅ Normal booking flow works perfectly
  • ✅ Zero performance impact from parallel spam check
  • ✅ Redirects to standard success page

Architecture

New Components

  • SpamCheckService: Orchestrates parallel global + org blocking checks
  • /booking-successful page: Fake success page that deceives spammers
  • DI container: spamCheck.ts for dependency injection
  • Translation keys: booking_confirmed_description, confirmation_email_sent

Key Flow Changes

  1. Early spam check start (line ~500 in handleNewBooking): spamCheckService.startCheck(email, orgId)
  2. Parallel execution: Spam check runs with availability loading, event processing, booking limits
  3. Pre-booking await (line ~1402): await spamCheckService.waitForCheck()
  4. Fake response generation: Complete BookingResponse with isSpamDecoy: true flag
  5. Client-side redirect: useBookings detects flag and redirects with query params

How should this be tested?

Prerequisites

Test Scenarios

Spam Detection Path:

  1. Add test email to Watchlist with action: BLOCK
  2. Submit booking form with blocked email
  3. Verify redirect to /booking-successful (not standard success page)
  4. Verify convincing confirmation page displays booking details

Legitimate User Path:

  1. Use clean email not in watchlist
  2. Submit booking form
  3. Verify normal booking creation and redirect
  4. Verify no performance degradation

Performance Testing:

  • Compare booking creation time with/without spam check
  • Should show zero additional delay for legitimate users

Checklist

Risk Areas for Review

⚠️ Fake booking response completeness: Verify the fake BookingResponse includes all required fields to pass TypeScript validation. Missing fields could cause runtime errors.

⚠️ organizationId extraction: Check that eventType.team?.parentId pattern matches existing codebase conventions for organization ID extraction.

⚠️ Parallel execution timing: Confirm spam check completion doesn't race with booking creation. The waitForCheck() call must complete before proceeding.

⚠️ Query parameter security: Review /booking-successful page for proper sanitization of URL parameters to prevent XSS.

⚠️ Base branch compatibility: Major architecture changes removed CombinedBlockingService - verify my implementation correctly uses separate GlobalBlockingService and OrganizationBlockingService.

Mandatory Tasks

  • I have self-reviewed the code
  • I have updated the developer docs (N/A - internal feature)
  • I confirm automated tests are in place (spam-booking.test.ts passes without additional mocking)

Requested by: @hariombalhara
Devin Session: https://app.devin.ai/sessions/8aaeeecf6dfc45ef90973a7e5249a2aa

@devin-ai-integration @hariombalhara
feat: Add async spam check with parallel execution and fake booking r…
6de9b73 
…edirect

- Create SpamCheckService to manage async spam checking
- Start spam check early in handleNewBooking, await before booking creation
- Generate fake booking response for blocked emails with all required fields
- Add redirect logic in useBookings to handle spam decoy bookings
- Create new /booking-successful route to display fake booking data
- Spam check runs in parallel with availability loading (zero delay)
- Spammers see convincing fake success page via query params

Also fix pre-existing lint warnings in useBookings.ts:
- Remove unused catch parameter
- Convert optional chaining expressions to if statements
- Remove eslint-disable comments for non-existent rule

Stacked on PR #24040

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration Devin.ai Integration
Copy link
Contributor

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR that start with 'DevinAI' or '@devin'.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@keithwillcode keithwillcode added core area: core, team members only enterprise area: enterprise, audit log, organisation, SAML, SSO labels Oct 7, 2025
@coderabbitai coderabbitai
Copy link
Contributor
coderabbitai bot commented Oct 7, 2025

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch devin/spam-async-check-1759840597

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@pull-request-size pull-request-size bot removed the size/L label Oct 7, 2025
@vercel Vercel
Copy link
vercel bot commented Oct 7, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments Ignored Ignored
Project Deployment Preview Comments Updated (UTC)
cal Ignored Ignored Oct 8, 2025 7:23am
cal-eu Oct 8, 2025 7:23am

@devin-ai-integration @hariombalhara
fix: Configure DI container with proper Prisma and logger bindings
938dd7e 
- Import and load prismaModule in watchlist container for PrismaClient binding
- Fix loggerServiceModule to use synchronous factory (matches prismaModule pattern)
- Resolves 'logger.getSubLogger is not a function' error in tests
- spam-booking.test.ts now passes successfully

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration @hariombalhara
docs: Update spam-check-flow.mermaid architecture notes to reflect ac…
16beaf6 
…tual implementation

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration @hariombalhara
fix: Correct Icon import path and add missing translations for bookin…
57db386 
…g-successful page

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration @hariombalhara
fix: Correct Icon import path and add missing translations for bookin…
eb9900b 
…g-successful page

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@hariombalhara hariombalhara force-pushed the devin/spam-async-check-1759840597 branch from 57db386 to eb9900b Compare October 8, 2025 05:43
devin-ai-integration bot and others added 4 commits October 8, 2025 05:54
@devin-ai-integration @hariombalhara
Merge origin/feat/spam-block-di into devin/spam-async-check-1759840597
38cbc72 
- Resolved merge conflict in watchlist.ts by keeping DI_TOKENS import (required for line 20)
- Updated spam-check-flow.mermaid architecture notes to reflect base branch changes:
  - GlobalBlockingService now takes orgRepo instead of auditService
  - OrganizationBlockingService has optional audit logging

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration @hariombalhara
fix: Resolve merge conflicts and fix TypeScript errors
8c9a2c0 
- Resolve merge conflict in watchlist.ts by keeping DI_TOKENS import
- Add optional chaining to searchParams in booking-successful page
- Add missing iCalUID, paymentId, and luckyUsers properties to fake booking response
- Update CombinedBlockingService and OrganizationBlockingService per base branch changes
  (audit logging now only in CombinedBlockingService)
- Prefix unused organizationId parameter with underscore per linting rules

All type checks and linting passing with 0 errors.

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration @hariombalhara
Merge remote changes: Refactor to remove CombinedBlockingService
56d6637 
The remote branch refactored the spam check architecture:
- Removed CombinedBlockingService.ts (logic moved to SpamCheckService)
- SpamCheckService now directly uses GlobalBlockingService and OrganizationBlockingService
- Added SpamCheckService.container.ts for DI setup
- Enhanced spam-booking.test.ts with comprehensive test coverage
- Improved OrganizationBlockingService with better email normalization

This is a cleaner architecture that simplifies the service layer.

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration @hariombalhara
fix: Align with base branch architecture changes in watchlist services
5a027b9 
- Updated OrganizationBlockingService to match base branch (removed audit logging)
- Updated mappers.ts to match base branch (removed extra types and functions)
- Fixed TypeScript errors caused by merge conflict resolution
- All type checks now passing

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@devin-ai-integration @hariombalhara
docs: Update mermaid diagram to reflect actual architecture
649e0c2 
- Removed reference to CombinedBlockingService (doesn't exist in base branch)
- Updated to show SpamCheckService directly calling GlobalBlockingService and OrganizationBlockingService
- Clarified parallel execution flow
- Updated architecture notes to match actual implementation

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
@hariombalhara hariombalhara force-pushed the devin/spam-async-check-1759840597 branch from 89258f0 to 649e0c2 Compare October 8, 2025 07:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
core area: core, team members only enterprise area: enterprise, audit log, organisation, SAML, SSO size/XXL
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@hariombalhara @keithwillcode
0