fix: (booking-audit) Remove IS_PRODUCTION gate and add feature flag check in producer by hariombalhara · Pull Request #26524 · calcom/cal.com

hariombalhara · 2026-01-07T06:08:31Z

What does this PR do?

Removes the IS_PRODUCTION check from BookingAuditTaskerProducerService and adds a feature flag check in the producer to avoid creating unnecessary audit tasks when the booking-audit feature is disabled.

Why derive the feature flag early?

The isBookingAuditEnabled flag is derived very early, before calling BookingEventHandlerService methods. This design allows callers to query the booking-audit feature flag alongside other feature flags (like booking-email-sms-tasker) using Promise.all(), reducing the total number of sequential DB queries and keeping the booking flow fast.

For example, in RegularBookingService:

const [isBookingEmailSmsTaskerEnabled, isBookingAuditEnabled] = await Promise.all([
  deps.featuresRepository.checkIfTeamHasFeature(orgId, "booking-email-sms-tasker"),
  deps.featuresRepository.checkIfTeamHasFeature(orgId, "booking-audit"),
]);

This parallel querying pattern ensures that adding the booking-audit check has minimal impact on booking latency.

Changes

Removed IS_PRODUCTION gate from BookingAuditTaskerProducerService
Made isBookingAuditEnabled: boolean required in all BookingAuditProducerService interface methods
Updated all callers to query the feature flag using orgId and pass it to BookingEventHandlerService:
- RegularBookingService, RecurringBookingService, handleSeats
- handleCancelBooking, handleConfirmation
- roundRobinReassignment, roundRobinManualReassignment
- tRPC handlers: addGuests, confirm, editLocation, requestReschedule
- API V2: BookingLocationService_2024_08_13, RecurringBookingService
Added debug logging when skipping audit (logs organizationId, bookingUid, and action)
Updated tests to include isBookingAuditEnabled in expected call assertions

Updates since last revision

Fixed organization ID source in addGuests.handler.ts: Changed from using user.organizationId (actor's org) to booking.user?.profiles?.[0]?.organizationId (booking's org). This ensures the feature flag is checked against the booking's organization, consistent with other handlers in this PR. (Addresses Cubic AI review feedback)

Mandatory Tasks (DO NOT REMOVE)

I have self-reviewed the code (A decent size PR without self-review might be rejected).
I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - no documentation changes needed.
I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Verify booking audits are queued when the booking-audit feature flag is enabled for the organization
Verify booking audits are NOT queued when the feature flag is disabled (check debug logs)
Test all flows: regular booking, recurring booking, seat booking, cancellation, confirmation, reassignment, location change, add guests, request reschedule

Human Review Checklist

Verify addGuests.handler.ts uses booking.user?.profiles?.[0]?.organizationId consistently with other handlers (e.g., editLocation.handler.ts, booking-location.service.ts)
Confirm the feature flag check pattern is consistent across all updated files

Checklist

My code follows the style guidelines of this project
I have checked if my changes generate no new warnings

Link to Devin run

https://app.devin.ai/sessions/43f5c78d649d47139d4f9bd4cc3d8599

Requested by

@hariombalhara

Remove the IS_PRODUCTION check that was preventing booking audits from being queued in production. Audits are still properly gated by: 1. Organization check: Audits are skipped for non-organization bookings (organizationId === null) 2. Feature flag: The BookingAuditTaskConsumer checks if the 'booking-audit' feature is enabled for the organization via featuresRepository.checkIfTeamHasFeature() The IS_PRODUCTION gate was intentionally added to prevent logs from being created in production while the action data versioning was being actively reviewed and finalized. Without proper versioning handling, the Booking History UI could crash when encountering unversioned data. Now that the versioning system is in place, this gate can be safely removed. Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

devin-ai-integration · 2026-01-07T06:08:34Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR that start with 'DevinAI' or '@devin'.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

vercel · 2026-01-07T06:10:54Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
cal	Ignored		Jan 7, 2026 6:21am
cal-companion	Ignored	Preview	Jan 7, 2026 6:21am
cal-eu	Ignored		Jan 7, 2026 6:21am

Reverts the unintended formatting changes from the previous commit. Only removes the IS_PRODUCTION gate without changing indentation. Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

github-actions · 2026-01-18T00:30:49Z

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

…ction-gate-booking-audit-1767765908

…essary task creation - Query booking-audit and booking-email-sms-tasker flags in parallel before fireBookingEvents - Pass isBookingAuditEnabled through BookingEventHandler to producer's queueTask method - Add conditional check in queueTask with debug log when skipping audit - Reuse pre-queried isBookingEmailSmsTaskerEnabled flag instead of querying again Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

…king audit flows - Make isBookingAuditEnabled a required property in BookingAuditProducerService interface - Update all BookingEventHandler methods to require isBookingAuditEnabled - Add feature flag check in all flows that call booking audit: - handleSeats (seat booking/rescheduling) - RecurringBookingService (bulk bookings) - handleCancelBooking (booking cancellation) - handleConfirmation (booking acceptance) - roundRobinReassignment (automatic reassignment) - roundRobinManualReassignment (manual reassignment) - trpc handlers: addGuests, confirm, editLocation, requestReschedule - Skip queueing audit tasks when feature is disabled with debug logging Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

…module Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

Keep feature flag check only in main flows (handleSeats, RegularBookingService, RecurringBookingService) which are frequently triggered. For other flows (handleCancelBooking, handleConfirmation, roundRobinReassignment, etc.), rely on the existing consumer-level check. Changes: - Revert feature flag check from non-main flows - Make isBookingAuditEnabled optional in interface for non-main flow methods - Keep isBookingAuditEnabled required for main flow methods (queueCreatedAudit, queueRescheduledAudit, queueSeatBookedAudit, queueSeatRescheduledAudit, queueBulkCreatedAudit, queueBulkRescheduledAudit) - Update BookingEventHandlerService to use required params for main flows and optional for non-main flows Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

…ervice methods - Add isBookingAuditEnabled as required parameter in all BookingAuditProducerService interface methods - Update BookingAuditTaskerProducerService to use simplified check (!params.isBookingAuditEnabled) - Update BookingEventHandlerService to require isBookingAuditEnabled in all methods - Update all callers to query booking-audit feature flag and pass isBookingAuditEnabled: - handleCancelBooking - handleConfirmation - roundRobinReassignment - roundRobinManualReassignment - addGuests.handler - confirm.handler - editLocation.handler - requestReschedule.handler - Inject featuresRepository in API V2's booking-location.service.ts Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

…abled Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

…uditEnabled Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

github-actions · 2026-02-02T12:36:00Z

E2E results are ready!

Workflow #103290.1 latest results

…ction-gate-booking-audit-1767765908

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

…t-1767765908

devin-ai-integration

Devin Review found 1 potential issue.

View issue and 5 additional flags in Devin Review.

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts

cubic-dev-ai

1 issue found across 21 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts">

<violation number="1" location="packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:93">
P2: Feature-flag gating is based on the actor’s orgId, so attendee users without an org will disable audit for bookings that belong to an org with booking-audit enabled. Use the booking’s organization when checking the flag.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts

github-actions · 2026-02-03T04:42:15Z

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session

…andler Use booking.user?.profiles?.[0]?.organizationId instead of user.organizationId to check the booking-audit feature flag. This ensures the feature flag is checked against the booking's organization rather than the actor's organization, which is consistent with other handlers in this PR. Addresses Cubic AI review feedback (confidence 9/10). Co-Authored-By: unknown <>

…8' of github.com:calcom/cal.com into devin/remove-is-production-gate-booking-audit-1767765908

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts

packages/features/bookings/lib/onBookingEvents/BookingEventHandlerService.ts

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

devin-ai-integration

Devin Review found 1 new potential issue.

View 9 additional findings in Devin Review.

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts">

<violation number="1" location="packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:93">
P2: The booking-audit feature flag is now checked against the actor’s organization rather than the booking’s organization, which can skip or misapply audit logging for cross-org actions. Use the booking’s org ID instead.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts

github-actions · 2026-02-06T09:54:52Z

Devin AI is addressing Cubic AI's review feedback

New feedback has been sent to the existing Devin session.

View Devin Session

✅ Pushed commit 34c76ee

… handler Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

…s handler Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts">

<violation number="1" location="packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:93">
P2: Feature flag check should use the booking’s organization, not the acting user’s org, otherwise audit can be skipped or enabled incorrectly for cross-org actions. Align this with booking context by deriving orgId from the booking.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts

github-actions · 2026-02-06T10:06:25Z

Devin AI is addressing Cubic AI's review feedback

New feedback has been sent to the existing Devin session.

View Devin Session

✅ No changes pushed (confidence score 8.5/10 is below 9/10 threshold, and user explicitly confirmed using user.organizationId is correct because the actor is in the same organization as the booking)

…t-1767765908

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

volnei

Great work! 🚀

pull-request-size bot added the size/XL label Jan 7, 2026

vercel bot deployed to Preview – dev January 7, 2026 06:18 View deployment

fix: revert formatting, keep only IS_PRODUCTION removal

66197d1

Reverts the unintended formatting changes from the previous commit. Only removes the IS_PRODUCTION gate without changing indentation. Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

pull-request-size bot added size/XS and removed size/XL labels Jan 7, 2026

vercel bot deployed to Preview – dev January 7, 2026 06:28 View deployment

keithwillcode added the core area: core, team members only label Jan 10, 2026

github-actions bot added the Stale label Jan 18, 2026

devin-ai-integration bot and others added 2 commits February 2, 2026 06:02

Merge remote-tracking branch 'origin/main' into devin/remove-is-produ…

6bcbc98

…ction-gate-booking-audit-1767765908

pull-request-size bot added size/M and removed size/XS labels Feb 2, 2026

devin-ai-integration bot changed the title ~~fix: remove IS_PRODUCTION gate from BookingAuditProducer~~ fix: remove IS_PRODUCTION gate and add feature flag check in producer Feb 2, 2026

pull-request-size bot added size/L and removed size/M labels Feb 2, 2026

devin-ai-integration bot and others added 6 commits February 2, 2026 08:25

fix: add featuresRepository dependency to RecurringBookingService DI …

7bf9dfe

…module Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

refactor: remove isBookingAuditEnabled from non-main flow methods

102c149

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

test: update roundRobinReassignment tests to include isBookingAuditEn…

e3d3b0d

…abled Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

test: update roundRobinManualReassignment tests to include isBookingA…

1031170

…uditEnabled Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

hariombalhara added the ready-for-e2e label Feb 2, 2026

devin-ai-integration bot and others added 2 commits February 2, 2026 12:38

Merge remote-tracking branch 'origin/main' into devin/remove-is-produ…

5446f0a

…ction-gate-booking-audit-1767765908

fix: inject featuresRepository in API V2 RecurringBookingService

a9a44e8

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

hariombalhara marked this pull request as ready for review February 3, 2026 04:35

hariombalhara requested a review from a team as a code owner February 3, 2026 04:35

Merge branch 'main' into devin/remove-is-production-gate-booking-audi…

5ea6374

…t-1767765908

graphite-app bot requested a review from a team February 3, 2026 04:36

graphite-app bot added the enterprise area: enterprise, audit log, organisation, SAML, SSO label Feb 3, 2026

hariombalhara changed the title ~~fix: remove IS_PRODUCTION gate and add feature flag check in producer~~ fix: (booking-audit) Remove IS_PRODUCTION gate and add feature flag check in producer Feb 3, 2026

devin-ai-integration bot reviewed Feb 3, 2026

View reviewed changes

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts Show resolved Hide resolved

cubic-dev-ai bot reviewed Feb 3, 2026

View reviewed changes

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts Show resolved Hide resolved

devin-ai-integration bot and others added 3 commits February 3, 2026 04:48

Add comment

196e579

Merge branch 'devin/remove-is-production-gate-booking-audit-176776590…

695fd2f

…8' of github.com:calcom/cal.com into devin/remove-is-production-gate-booking-audit-1767765908

Udit-takkar reviewed Feb 6, 2026

View reviewed changes

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts Outdated Show resolved Hide resolved

Udit-takkar reviewed Feb 6, 2026

View reviewed changes

packages/features/bookings/lib/onBookingEvents/BookingEventHandlerService.ts Show resolved Hide resolved

fix: use user.organizationId for feature flag check in addGuests handler

a2c38fe

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

devin-ai-integration bot reviewed Feb 6, 2026

View reviewed changes

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts Show resolved Hide resolved

cubic-dev-ai bot reviewed Feb 6, 2026

View reviewed changes

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts Show resolved Hide resolved

devin-ai-integration bot and others added 2 commits February 6, 2026 09:58

fix: use booking's organizationId for feature flag check in addGuests…

34c76ee

… handler Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

fix: revert to user.organizationId for feature flag check in addGuest…

8599c31

…s handler Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

cubic-dev-ai bot reviewed Feb 6, 2026

View reviewed changes

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts Show resolved Hide resolved

hariombalhara and others added 3 commits February 6, 2026 18:00

Merge branch 'main' into devin/remove-is-production-gate-booking-audi…

b4ce580

…t-1767765908

fix: add isBookingAuditEnabled to onNoShowUpdated calls after main merge

afecec0

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

fix: add isBookingAuditEnabled to onNoShowUpdated calls and update tests

9080921

Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>

hariombalhara requested a review from Udit-takkar February 9, 2026 08:12

Udit-takkar approved these changes Feb 9, 2026

View reviewed changes

volnei approved these changes Feb 9, 2026

View reviewed changes

volnei merged commit e04a394 into main Feb 9, 2026
56 checks passed

volnei deleted the devin/remove-is-production-gate-booking-audit-1767765908 branch February 9, 2026 12:25

Conversation

hariombalhara commented Jan 7, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Why derive the feature flag early?

Changes

Updates since last revision

Mandatory Tasks (DO NOT REMOVE)

How should this be tested?

Human Review Checklist

Checklist

Link to Devin run

Requested by

Uh oh!

devin-ai-integration bot commented Jan 7, 2026

🤖 Devin AI Engineer

Uh oh!

vercel bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 18, 2026

Uh oh!

github-actions bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E results are ready!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 3, 2026

Devin AI is addressing Cubic AI's review feedback

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 6, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Devin AI is addressing Cubic AI's review feedback

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 6, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Devin AI is addressing Cubic AI's review feedback

Uh oh!

volnei left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hariombalhara commented Jan 7, 2026 •

edited by devin-ai-integration bot

Loading

vercel bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Feb 2, 2026 •

edited

Loading

github-actions bot commented Feb 6, 2026 •

edited by devin-ai-integration bot

Loading

github-actions bot commented Feb 6, 2026 •

edited by devin-ai-integration bot

Loading