packages/trpc/server/routers/viewer/organizations/verifyCode.handler.ts (5)

28-36: Make verifyCode parameters required and annotate return type.

All three inputs are mandatory at runtime; model that in the type to catch mistakes at compile time and make the function easier to consume.

Apply this diff to tighten the signature:

-export const verifyCode = async ({
+export const verifyCode = async ({
   user,
   email,
   code,
-}: {
-  user?: Pick<NonNullable<TrpcSessionUser>, "role">;
-  email?: string;
-  code?: string;
-}) => {
+}: {
+  user: Pick<NonNullable<TrpcSessionUser>, "role">;
+  email: string;
+  code: string;
+}): Promise<boolean> => {

---

62-63: Simplify return; it’s always true at this point.

You throw on invalid codes; returning the variable adds no value.

-  return isValidToken;
+  return true;

---

39-42: Revise server-side E2E flag usage and lower log level

We’ve confirmed that NEXT_PUBLIC_IS_E2E is currently used in dozens of server-side modules (e.g. verifyCode.handler.ts, validateLicense.handler.ts, LicenseKeyService.ts, telemetry, CF Turnstile check, username checks, etc.), and only one place already reads a server-only process.env.IS_E2E (in twilioProvider.ts). Since NEXT_PUBLIC_* vars get baked into client bundles, it’s safer to switch all server logic to a dedicated flag (e.g. IS_E2E) and reserve NEXT_PUBLIC_IS_E2E solely for front-end feature toggles.

• Replace all process.env.NEXT_PUBLIC_IS_E2E checks in server code with process.env.IS_E2E === "1".
• In packages/trpc/server/routers/viewer/organizations/verifyCode.handler.ts, change

logger.warn(`Skipping code verification in dev/E2E environment`);

to

logger.debug(`Skipping code verification in dev/E2E environment`);

to reduce noise.
• Update your CI/E2E startup command (e.g. in playwright.config.ts) to export IS_E2E=1 alongside NEXT_PUBLIC_IS_E2E=1.

Before merging, please verify which env var your CI sets for E2E runs and ensure IS_E2E is enabled there.

---

65-65: Remove the default export in favor of the existing named export

I confirmed that verifyCodeHandler is only ever referenced via its named export in this repo—there are no default‐import sites to update. You can safely drop the final export default and rely solely on the named export for better tree-shaking and future refactors.

• File to update:

• packages/trpc/server/routers/viewer/organizations/verifyCode.handler.ts, remove line 65 (export default verifyCodeHandler;)
  • No importers need adjustment—there are zero occurrences of import … from '…/verifyCode.handler' pulling in the default export.

-export default verifyCodeHandler;

---

58-58: Extract the TOTP step into a constant and trim incoming codes

To avoid “magic numbers” and guard against stray whitespace in user-entered codes, factor out the 900-second window into a named constant and apply .trim() to the input before validation. We’ve confirmed that the email sender (packages/features/auth/lib/verifyEmail.ts) uses the same { step: 900 } setting and identical secret derivation (createHash("md5").update(email + process.env.CALENDSO_ENCRYPTION_KEY).digest("hex")), so this change stays in sync.

• packages/trpc/server/routers/viewer/organizations/verifyCode.handler.ts @ line 58
• packages/trpc/server/routers/viewer/workflows/verifyEmailCode.handler.ts @ line 28
• packages/trpc/server/routers/viewer/auth/verifyCodeUnAuthenticated.handler.ts @ line 25

Apply this diff to each handler:

-  const isValidToken = totpRawCheck(code, secret, { step: 900 });
+  const isValidToken = totpRawCheck(code.trim(), secret, { step: EMAIL_VERIFICATION_TOTP_STEP_SECONDS });

And add near the top of the file (alongside your other imports):

// TOTP validity window in seconds; must match the sender’s totp.options.step
const EMAIL_VERIFICATION_TOTP_STEP_SECONDS = 900 as const;

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

packages/trpc/server/routers/viewer/organizations/verifyCode.handler.ts (3)

6-6: Good call using PII-safe identifier.

Importing and using hashEmail is the right direction to avoid leaking raw emails in rate-limit identifiers. See my later comment about normalizing emails before hashing for consistency.

---

21-26: Nice delegation and separation of concerns.

Having the handler delegate to a reusable verifyCode function improves testability and cross-surface reuse.

---

44-47: Confirm ADMIN bypass is intended and scoped.

Bypassing verification for ADMIN is a policy choice. If you only intend to bypass for instance-level admins, verify that "ADMIN" can’t be assigned at a narrower scope. Also consider downgrading to info/debug log to avoid “warn” spam.

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/seated-bookings.e2e-spec.ts (3)

261-264: Make the guests check resilient

Same rationale as above; prefer asserting array type over strict emptiness.

-                guests: [],
+                guests: expect.any(Array),

---

276-279: Resilience: guests field

Mirror the resilient matcher here as well.

-                guests: [],
+                guests: expect.any(Array),

---

516-519: Consistent guests assertion across tests

Use the same asymmetric matcher for consistency and to reduce brittleness.

-                    guests: [],
+                    guests: expect.any(Array),

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: supalarry
PR: calcom/cal.com#23217
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts:93-94
Timestamp: 2025-08-21T13:44:06.784Z
Learning: In apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts, repository functions that use explicit Prisma select clauses (like getEventTypeWithSeats) are used for specific purposes and don't need to include all EventType fields like bookingRequiresAuthentication. These methods don't feed into the general OutputEventTypesService_2024_06_14 flow.

apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/seated-bookings.e2e-spec.ts (1)

36-36: LGTM: narrowed Prisma import to Team only

The import is scoped to just Team and aligns with actual usage in this spec. No issues.