Build

* feat: add abuse scoring schema, types, and data model

Foundational layer for the abuse scoring pipeline:

- Extend WatchlistType enum (SPAM_KEYWORD, SUSPICIOUS_DOMAIN, EMAIL_PATTERN, REDIRECT_DOMAIN)
- Add dedicated User columns: abuseScore (Int) + abuseData (Json?)
- Use dedicated columns instead of metadata JSONB to prevent API data leakage
- Define abuseMetadataSchema owned by the feature (zero @calcom/prisma dependency)
- Derive types via z.infer with Zod safeParse validation
- Register abuse-scoring feature flag in AppFlags

* fix: tighten abuseMetadata schema and seed feature flag

- Fix zod import to named import (codebase convention)
- Add .datetime() validation on at/lockedAt/lastAnalyzedAt fields
- Document why REDIRECT_DOMAIN is excluded from flags enum
- Seed abuse-scoring feature flag (enabled: false)

* feat: add scoring engine, alert system, and DTOs

- Pure calculateScore() function with seven signal types (signup flags, malicious redirects, forward params, content spam, high/elevated booking velocity, self-booking pattern). Signal caps prevent stacking
- Score range 0-100 with thresholds at 50 (alert) and 80 (lock)
- Slack alerter with admin user link and DI interface for testability
- Zod-validated DTOs at repository-service boundary
- 20 tests, zero mocks for scoring (pure function), full coverage for alert payloads and error resilience

* fix: tighten scoring types and parse abuseData at DTO boundary

- Add const arrays as source of truth for flag/signal/lockedReason types
- Use z.enum() in abuseMetadataSchema from const arrays
- Parse abuseData at DTO boundary with .catch(null) (fail-open)
- Remove getAbuseMetadata indirection from scoring — DTO handles it
- Type ABUSE_SIGNAL_CAPS with AbuseSignalType

* refactor: inject webhook URL into SlackAbuseAlerter via constructor

* feat: add abuse scoring repository, service, and DI wiring

- AbuseScoringRepository with Zod-validated DTOs at output boundary
- AbuseScoringService with checkSignup (Gate 1), shouldCheckEventType (Gate 2), checkBookingVelocity (Gate 3), shouldMonitor, and analyzeUser
- DI layer: tokens, modules (repository, service, alerter), container
- Service uses Pick<> on concrete types for type-safe dependency injection
- analyzeUser consolidates watchlist queries and wraps in try/catch (fail-open)
- 50 unit tests covering service methods and edge cases

* refactor: remove getAbuseMetadata, resolve webhook URL via DI module

* feat: add abuse scoring watchlist types to blocklist create modal

Replace ToggleGroup with grouped Select dropdown supporting all
WatchlistType values. Two groups: Blocking (Email, Domain, Username)
and Abuse Scoring (Spam Keyword, Suspicious Domain, Email Pattern,
Redirect Domain). Per-type validation and placeholders included.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: display all watchlist types in blocklist table

Update type badge column to handle all 7 WatchlistType values
instead of only EMAIL and DOMAIN.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add abuse scoring tasker pattern and DI wiring

Adds the async/sync dispatch infrastructure for abuse scoring analysis
following the established Tasker pattern (calendars, webhooks, bookings).

- AbuseScoringTasker extends base Tasker with analyzeUser method
- Trigger.dev schemaTask with queue (concurrency 5), retry (3x), OOM bump
- Sync fallback via AbuseScoringTaskService delegating to AbuseScoringService
- Full DI wiring: tokens, modules, containers in di/tasker/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add abuse scoring event hooks for Gates 2 and 3

Adds hook functions that PR 5 will wire into EventType and booking handlers:

- onEventTypeChange: Gate 2 — checks shouldCheckEventType, dispatches analysis
- onBookingCreated: Gate 3 — two paths: flagged users via shouldMonitor,
  unflagged users via checkBookingVelocity

Both are fire-and-forget with fail-open error handling.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: register abuse-scoring task in trigger.config.ts

Adds the abuse-scoring trigger directory to the dirs array so
Trigger.dev discovers the analyze-user task.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add onSignup hook and wire Gate 1 into signup handlers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: wire Gate 2 and Gate 3 hooks into EventType and booking handlers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: remove unrelated diff noise from alerts.ts and types.ts

* feat: add scoring engine, alert system, and DTOs (#9)

* feat: add scoring engine, alert system, and DTOs

- Pure calculateScore() function with seven signal types (signup flags, malicious redirects, forward params, content spam, high/elevated booking velocity, self-booking pattern). Signal caps prevent stacking
- Score range 0-100 with thresholds at 50 (alert) and 80 (lock)
- Slack alerter with admin user link and DI interface for testability
- Zod-validated DTOs at repository-service boundary
- 20 tests, zero mocks for scoring (pure function), full coverage for alert payloads and error resilience

* fix: tighten scoring types and parse abuseData at DTO boundary

- Add const arrays as source of truth for flag/signal/lockedReason types
- Use z.enum() in abuseMetadataSchema from const arrays
- Parse abuseData at DTO boundary with .catch(null) (fail-open)
- Remove getAbuseMetadata indirection from scoring — DTO handles it
- Type ABUSE_SIGNAL_CAPS with AbuseSignalType

* refactor: inject webhook URL into SlackAbuseAlerter via constructor

* Migrate user abuse score to it's own table

* Move to separate data table

* Write abuse score to table for new users

* Fix `abuseMetadataSchema` to not expect db fields

* Rename method to `shouldCheckUsersEventType`

* fix: resolve type errors in scoring.ts and AbuseScoringRepository.ts

Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>

* fix: rename shouldCheckEventType to shouldUsersCheckEventType in tests

Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>

---------

Co-authored-by: Pedro Castro <pedro@cal.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>