cal.com icon indicating copy to clipboard operation
cal.com copied to clipboard

fix(api): return original email without OAuth suffix in bookings

Open pedroccastro opened this issue 3 weeks ago • 1 comments

What does this PR do?

This PR fixes a bug in API v2 (2024-08-13) where emails in booking API responses contained the OAuth client ID as a suffix (+{cuid}). This suffix exists to prevent email collisions between managed users of different OAuth clients.

Fixes #25494 | Linear: CAL-6843

Problem:

Solution: To avoid breaking changes for platform customers who may rely on the original email format, we preserve the original email field and add a new displayEmail field with the CUID suffix removed.

Key Changes:

  • Add getDisplayEmail() helper to strip CUID suffix from emails
  • Add displayEmail field to all relevant response objects
  • Keep original email field unchanged for backwards compatibility

Regex pattern used: /\+[a-zA-Z0-9]{25}/ (CUID format, consistent with google-calendar.service.ts)

Affected Fields

Field Value
hosts[].email bob+{cuid}@example.com (unchanged)
hosts[].displayEmail [email protected] (new)
attendees[].email bob+{cuid}@example.com (unchanged)
attendees[].displayEmail [email protected] (new)
bookingFieldsResponses.email bob+{cuid}@example.com (unchanged)
bookingFieldsResponses.displayEmail [email protected] (new)
bookingFieldsResponses.guests[] guest+{cuid}@example.com (unchanged)
bookingFieldsResponses.displayGuests[] [email protected] (new)
reassignedTo.email bob+{cuid}@example.com (unchanged)
reassignedTo.displayEmail [email protected] (new)

How should this be tested?

Test Scenario 1 - Managed user as HOST:

  1. Create an event type using managed user's access token
  2. Create booking on that event type (external user booking managed user)
  3. GET /v2/bookings/{uid} with header Cal-Api-Version: 2024-08-13
  4. Verify hosts[].email returns original email with suffix
  5. Verify hosts[].displayEmail returns email without suffix

Test Scenario 2 - Managed user as ATTENDEE:

  1. Create booking where attendee is a managed user
  2. GET /v2/bookings/{uid} with header Cal-Api-Version: 2024-08-13
  3. Verify attendees[].email returns original email with suffix
  4. Verify attendees[].displayEmail returns email without suffix

Test Scenario 3 - Self-booking:

  1. Managed user books their own event type
  2. Verify both email and displayEmail fields are present and correct

Expected result: email fields preserve original value, displayEmail fields return clean email without +{cuid} suffix

Mandatory Tasks

  • [x] I have self-reviewed the code
  • [ ] I have updated the developer docs in /docs if this PR makes changes that would require a documentation change.
  • [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.

pedroccastro avatar Dec 03 '25 17:12 pedroccastro

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Review Updated (UTC)
cal Ignored Ignored Dec 19, 2025 9:09pm
cal-companion Ignored Ignored Preview Dec 19, 2025 9:09pm
cal-eu Ignored Ignored Dec 19, 2025 9:09pm

vercel[bot] avatar Dec 09 '25 00:12 vercel[bot]

E2E results are ready!

github-actions[bot] avatar Dec 16 '25 15:12 github-actions[bot]