…-attendees

feat: adds availabilities and attendees endpoints

Fixes identified issues while maintaining PR objective of removing
@calcom/web dependencies from packages via dependency injection:

1. Code Duplication (Comment #2):
   - Extracted buildLegacyRequest to packages/lib/legacy-request.ts
   - Uses generic interfaces (HeadersLike, CookiesLike) instead of Next.js types
   - Both apps/web and packages can now import from shared location
   - Removed unused NextApiRequest import from calcomHandler.ts

2. Missing Cache Revalidation (Comments #3, #5, #8):
   - Added onInvalidate prop to NewWebhookView and wired from webhooks/new page
   - Added onInvalidate prop to EventWebhooksTab (needs wiring from apps/web)
   - Added onInvalidate prop to DuplicateDialog (needs wiring from apps/web)
   - Pattern: server actions with revalidatePath at call sites

3. Promise Handling Bug (Comments #6, #12):
   - Fixed MemberInvitationModal clipboard promise to handle rejections
   - Added reject handler to prevent promise hanging on mutateAsync failure

Note: EventWebhooksTab and DuplicateDialog onInvalidate props are added
but not yet wired from apps/web pages. This requires threading through
multiple component layers and will be completed in follow-up commits.

Platform DI changes (UserDropdown, PlatformMembersView, InviteMemberModal)
were reverted in previous commit to prevent regressions.

Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>

- Fix #1: Weekly schedule now shows multiple time slots per day in AvailabilityTab
- Fix #2: Allow numeric input fields to be empty with proper validation
- Fix #3: Add native iOS date picker for date range in Limits tab
- Fix #4: Change 'Email verification' to 'Booker email verification' in Advanced tab
- Fix #5: Fix Requires confirmation comparison logic in buildPartialUpdatePayload
- Fix #6: Forward parameters toggle already working, verified wiring
- Fix #7: Add toggles for redirect booking URL and interface language in Advanced tab
- Fix #8: Increase scroll padding at bottom from 200 to 350 for better keyboard access

* fix(companion): iOS event type detail fixes

- Fix #1: Weekly schedule now shows multiple time slots per day in AvailabilityTab
- Fix #2: Allow numeric input fields to be empty with proper validation
- Fix #3: Add native iOS date picker for date range in Limits tab
- Fix #4: Change 'Email verification' to 'Booker email verification' in Advanced tab
- Fix #5: Fix Requires confirmation comparison logic in buildPartialUpdatePayload
- Fix #6: Forward parameters toggle already working, verified wiring
- Fix #7: Add toggles for redirect booking URL and interface language in Advanced tab
- Fix #8: Increase scroll padding at bottom from 200 to 350 for better keyboard access

* fix(companion): conditional scroll padding for limits and advanced tabs only

* fix(companion): remove static date text from iOS date picker, keep only picker

* fix(companion): simplify iOS date picker to match RescheduleScreen pattern

* update code

* feat: add abuse scoring schema, types, and data model

Foundational layer for the abuse scoring pipeline:

- Extend WatchlistType enum (SPAM_KEYWORD, SUSPICIOUS_DOMAIN, EMAIL_PATTERN, REDIRECT_DOMAIN)
- Add dedicated User columns: abuseScore (Int) + abuseData (Json?)
- Use dedicated columns instead of metadata JSONB to prevent API data leakage
- Define abuseMetadataSchema owned by the feature (zero @calcom/prisma dependency)
- Derive types via z.infer with Zod safeParse validation
- Register abuse-scoring feature flag in AppFlags

* fix: tighten abuseMetadata schema and seed feature flag

- Fix zod import to named import (codebase convention)
- Add .datetime() validation on at/lockedAt/lastAnalyzedAt fields
- Document why REDIRECT_DOMAIN is excluded from flags enum
- Seed abuse-scoring feature flag (enabled: false)

* feat: add scoring engine, alert system, and DTOs (#9)

* feat: add scoring engine, alert system, and DTOs

- Pure calculateScore() function with seven signal types (signup flags, malicious redirects, forward params, content spam, high/elevated booking velocity, self-booking pattern). Signal caps prevent stacking
- Score range 0-100 with thresholds at 50 (alert) and 80 (lock)
- Slack alerter with admin user link and DI interface for testability
- Zod-validated DTOs at repository-service boundary
- 20 tests, zero mocks for scoring (pure function), full coverage for alert payloads and error resilience

* fix: tighten scoring types and parse abuseData at DTO boundary

- Add const arrays as source of truth for flag/signal/lockedReason types
- Use z.enum() in abuseMetadataSchema from const arrays
- Parse abuseData at DTO boundary with .catch(null) (fail-open)
- Remove getAbuseMetadata indirection from scoring — DTO handles it
- Type ABUSE_SIGNAL_CAPS with AbuseSignalType

* refactor: inject webhook URL into SlackAbuseAlerter via constructor

* Migrate user abuse score to it's own table

---------

Co-authored-by: Joe Au-Yeung <j.auyeung419@gmail.com>
Co-authored-by: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>