@agent-native/scheduling 0.2.4 → 0.2.5-nightly-20260929152122

package/src/server/booking-service.spec.ts

@@ -15,6 +15,11 @@ import {
 } from "./booking-service.js";
 import { getBookingByUid, insertBooking } from "./bookings-repo.js";
 import { setSchedulingContext } from "./context.js";
+import {
+  onBookingCreated,
+  onBookingNoShow,
+  onBookingRescheduled,
+} from "./hooks.js";
 import {
   registerCalendarProvider,
   registerVideoProvider,
@@ -218,6 +223,34 @@ beforeEach(async () => {
       visibility TEXT NOT NULL DEFAULT 'private'
     );
   `);
+  await execute(`
+    CREATE TABLE workflow_shares (
+      id TEXT PRIMARY KEY,
+      resource_id TEXT NOT NULL,
+      principal_type TEXT NOT NULL,
+      principal_id TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'viewer',
+      created_by TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL,
+      notified_at TEXT
+    );
+  `);
+  await execute(`
+    CREATE TABLE workflow_steps (
+      id TEXT PRIMARY KEY,
+      workflow_id TEXT NOT NULL,
+      "order" INTEGER NOT NULL DEFAULT 0,
+      action TEXT NOT NULL,
+      offset_minutes INTEGER NOT NULL DEFAULT 0,
+      send_to TEXT,
+      email_subject TEXT,
+      email_body TEXT,
+      sms_body TEXT,
+      webhook_url TEXT,
+      template TEXT,
+      created_at TEXT NOT NULL
+    );
+  `);
   await execute(`
     CREATE TABLE webhooks (
       id TEXT PRIMARY KEY,
@@ -235,6 +268,18 @@ beforeEach(async () => {
       visibility TEXT NOT NULL DEFAULT 'private'
     );
   `);
+  await execute(`
+    CREATE TABLE webhook_deliveries (
+      id TEXT PRIMARY KEY,
+      webhook_id TEXT NOT NULL,
+      triggered_at TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      response_status INTEGER,
+      response_body TEXT,
+      success BOOLEAN NOT NULL DEFAULT false,
+      attempts INTEGER NOT NULL DEFAULT 0
+    );
+  `);
   await execute(`
     CREATE TABLE scheduled_reminders (
       id TEXT PRIMARY KEY,
@@ -354,7 +399,7 @@ async function seedEventType(eventType: EventType): Promise<void> {
       eventType.createdAt,
       eventType.updatedAt,
       eventType.ownerEmail ?? "local@localhost",
-      null,
+      eventType.orgId ?? null,
       "private",
     ],
   });
@@ -419,7 +464,419 @@ describe("insertBooking", () => {
   });
 });
 
+describe("booking webhook dispatch", () => {
+  it("runs private workflows scoped to the booking team", async () => {
+    const now = new Date().toISOString();
+    await execute({
+      sql: `INSERT INTO workflows (
+        id, name, trigger, team_id, disabled, active_on_event_type_ids,
+        created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "workflow-team-private",
+        "Team booking workflow",
+        "new-booking",
+        "team-b",
+        false,
+        '["event-type-1"]',
+        now,
+        now,
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO workflow_steps (
+        id, workflow_id, action, offset_minutes, created_at
+      ) VALUES (?, ?, ?, ?, ?)`,
+      args: [
+        "workflow-step-team",
+        "workflow-team-private",
+        "email-host",
+        0,
+        now,
+      ],
+    });
+
+    await createBooking({
+      eventType: makeEventType({
+        schedulingType: "round-robin",
+        teamId: "team-b",
+        orgId: "org-b",
+      }),
+      hostEmail: "team-host@example.com",
+      startTime: "2026-08-03T11:00:00.000Z",
+      endTime: "2026-08-03T11:30:00.000Z",
+      timezone: "UTC",
+      attendee: { email: ATTENDEE_EMAIL, name: "Attendee One" },
+    });
+
+    const { rows } = await execute(
+      "SELECT workflow_step_id FROM scheduled_reminders",
+    );
+    expect(rows.map((row) => row.workflow_step_id)).toEqual([
+      "workflow-step-team",
+    ]);
+  });
+
+  it("excludes another member's private webhook but preserves org-visible webhooks", async () => {
+    const now = new Date().toISOString();
+    const eventTypes = JSON.stringify(["event-type-1"]);
+    await execute({
+      sql: `INSERT INTO workflows (
+        id, name, trigger, disabled, active_on_event_type_ids,
+        created_at, updated_at, owner_email, org_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?), (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "workflow-user-a",
+        "Booking workflow",
+        "new-booking",
+        false,
+        eventTypes,
+        now,
+        now,
+        "user-a@example.com",
+        "org-a",
+        "workflow-user-b",
+        "Booking workflow",
+        "new-booking",
+        false,
+        eventTypes,
+        now,
+        now,
+        "user-b@example.com",
+        "org-b",
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO workflow_steps (
+        id, workflow_id, action, offset_minutes, created_at
+      ) VALUES (?, ?, ?, ?, ?), (?, ?, ?, ?, ?)`,
+      args: [
+        "workflow-step-user-a",
+        "workflow-user-a",
+        "email-host",
+        0,
+        now,
+        "workflow-step-user-b",
+        "workflow-user-b",
+        "email-host",
+        0,
+        now,
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO webhooks (
+        id, subscriber_url, event_triggers, created_at, updated_at,
+        owner_email, org_id, visibility
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?), (?, ?, ?, ?, ?, ?, ?, ?),
+        (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "webhook-user-a-private",
+        "https://example.test/webhook",
+        '["BOOKING_CREATED"]',
+        now,
+        now,
+        "user-a@example.com",
+        "org-b",
+        "private",
+        "webhook-user-a-org",
+        "https://example.test/webhook",
+        '["BOOKING_CREATED"]',
+        now,
+        now,
+        "user-a@example.com",
+        "org-b",
+        "org",
+        "webhook-user-b",
+        "https://example.test/webhook",
+        '["BOOKING_CREATED"]',
+        now,
+        now,
+        "user-b@example.com",
+        "org-b",
+        "private",
+      ],
+    });
+
+    const booking = await insertBooking({
+      eventTypeId: "event-type-1",
+      hostEmail: "user-b@example.com",
+      ownerEmail: "user-b@example.com",
+      orgId: "org-b",
+      title: "Private booking",
+      startTime: "2026-08-03T10:00:00.000Z",
+      endTime: "2026-08-03T10:30:00.000Z",
+      timezone: "UTC",
+      attendees: [{ email: ATTENDEE_EMAIL, name: "Attendee One" }],
+    });
+    expect(booking.cancelToken).toBeTruthy();
+    expect(booking.rescheduleToken).toBeTruthy();
+
+    await onBookingCreated(booking);
+
+    const { rows } = await execute(
+      "SELECT webhook_id FROM webhook_deliveries ORDER BY webhook_id",
+    );
+    expect(rows.map((row) => row.webhook_id)).toEqual([
+      "webhook-user-a-org",
+      "webhook-user-b",
+    ]);
+    const { rows: deliveries } = await execute(
+      "SELECT payload FROM webhook_deliveries",
+    );
+    for (const delivery of deliveries) {
+      const payload = JSON.parse(String(delivery.payload));
+      expect(payload.booking).not.toHaveProperty("cancelToken");
+      expect(payload.booking).not.toHaveProperty("rescheduleToken");
+    }
+    const { rows: reminders } = await execute(
+      "SELECT workflow_step_id FROM scheduled_reminders ORDER BY workflow_step_id",
+    );
+    expect(reminders.map((row) => row.workflow_step_id)).toEqual([
+      "workflow-step-user-b",
+    ]);
+  });
+
+  it("keeps team scope when a persisted booking is rescheduled", async () => {
+    const now = new Date().toISOString();
+    const eventType = makeEventType({
+      id: "team-event",
+      orgId: "org-b",
+      teamId: "team-b",
+    });
+    await seedEventType(eventType);
+    await execute({
+      sql: `INSERT INTO webhooks (
+        id, subscriber_url, event_triggers, created_at, updated_at,
+        owner_email, org_id, visibility, team_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "team-webhook",
+        "https://example.test/webhook",
+        '["BOOKING_RESCHEDULED","BOOKING_NO_SHOW"]',
+        now,
+        now,
+        "team-owner@example.com",
+        "org-b",
+        "org",
+        "team-b",
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO workflows (
+        id, name, trigger, disabled, active_on_event_type_ids,
+        created_at, updated_at, owner_email, org_id, team_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "team-no-show-workflow",
+        "Team no-show workflow",
+        "no-show",
+        false,
+        '["team-event"]',
+        now,
+        now,
+        "team-owner@example.com",
+        "org-b",
+        "team-b",
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO workflow_steps (
+        id, workflow_id, action, offset_minutes, created_at
+      ) VALUES (?, ?, ?, ?, ?)`,
+      args: [
+        "team-no-show-step",
+        "team-no-show-workflow",
+        "email-host",
+        0,
+        now,
+      ],
+    });
+    const created = await createBooking({
+      eventType,
+      hostEmail: "user-b@example.com",
+      startTime: "2026-08-03T10:00:00.000Z",
+      endTime: "2026-08-03T10:30:00.000Z",
+      timezone: "UTC",
+      attendee: { email: ATTENDEE_EMAIL, name: "Attendee One" },
+    });
+    const persisted = await getBookingByUid(created.uid);
+
+    expect(created.teamId).toBe("team-b");
+    expect(persisted?.teamId).toBeUndefined();
+    await onBookingRescheduled(persisted!, created);
+    await onBookingNoShow(persisted!);
+
+    const { rows } = await execute("SELECT webhook_id FROM webhook_deliveries");
+    expect(rows.map((row) => row.webhook_id)).toEqual([
+      "team-webhook",
+      "team-webhook",
+    ]);
+    const { rows: reminders } = await execute(
+      "SELECT workflow_step_id FROM scheduled_reminders",
+    );
+    expect(reminders.map((row) => row.workflow_step_id)).toEqual([
+      "team-no-show-step",
+    ]);
+  });
+
+  it("keeps a booking in its event type org and excludes another member's private hooks", async () => {
+    const now = new Date().toISOString();
+    const eventTypes = JSON.stringify(["event-type-1"]);
+    await execute({
+      sql: `INSERT INTO workflows (
+        id, name, trigger, disabled, active_on_event_type_ids,
+        created_at, updated_at, owner_email, org_id, visibility
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?), (?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
+        (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "workflow-user-a-private",
+        "Private workflow",
+        "new-booking",
+        false,
+        eventTypes,
+        now,
+        now,
+        "user-a@example.com",
+        "org-b",
+        "private",
+        "workflow-user-a-org",
+        "Org workflow",
+        "new-booking",
+        false,
+        eventTypes,
+        now,
+        now,
+        "user-a@example.com",
+        "org-b",
+        "org",
+        "workflow-user-b",
+        "User B workflow",
+        "new-booking",
+        false,
+        eventTypes,
+        now,
+        now,
+        "user-b@example.com",
+        "org-b",
+        "private",
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO workflow_steps (
+        id, workflow_id, action, offset_minutes, created_at
+      ) VALUES (?, ?, ?, ?, ?), (?, ?, ?, ?, ?), (?, ?, ?, ?, ?)`,
+      args: [
+        "workflow-step-user-a-private",
+        "workflow-user-a-private",
+        "email-host",
+        0,
+        now,
+        "workflow-step-user-a-org",
+        "workflow-user-a-org",
+        "email-host",
+        0,
+        now,
+        "workflow-step-user-b",
+        "workflow-user-b",
+        "email-host",
+        0,
+        now,
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO webhooks (
+        id, subscriber_url, event_triggers, created_at, updated_at,
+        owner_email, org_id, visibility
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?), (?, ?, ?, ?, ?, ?, ?, ?),
+        (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "webhook-user-a-private",
+        "https://example.test/webhook",
+        '["BOOKING_CREATED"]',
+        now,
+        now,
+        "user-a@example.com",
+        "org-b",
+        "private",
+        "webhook-user-a-other-org",
+        "https://example.test/webhook",
+        '["BOOKING_CREATED"]',
+        now,
+        now,
+        "user-a@example.com",
+        "org-a",
+        "org",
+        "webhook-user-b",
+        "https://example.test/webhook",
+        '["BOOKING_CREATED"]',
+        now,
+        now,
+        "user-b@example.com",
+        "org-b",
+        "private",
+      ],
+    });
+    await execute({
+      sql: `INSERT INTO webhooks (
+        id, subscriber_url, event_triggers, created_at, updated_at,
+        owner_email, org_id, visibility, team_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "webhook-user-b-other-team",
+        "https://example.test/webhook",
+        '["BOOKING_CREATED"]',
+        now,
+        now,
+        "user-b@example.com",
+        "org-b",
+        "private",
+        "team-a",
+      ],
+    });
+
+    await createBooking({
+      eventType: makeEventType({ orgId: "org-b", teamId: "team-b" }),
+      orgId: "org-b",
+      hostEmail: "user-b@example.com",
+      startTime: "2026-08-03T10:00:00.000Z",
+      endTime: "2026-08-03T10:30:00.000Z",
+      timezone: "UTC",
+      attendee: { email: ATTENDEE_EMAIL, name: "Attendee One" },
+    });
+
+    const { rows: bookingRows } = await execute(
+      "SELECT org_id FROM bookings WHERE host_email = 'user-b@example.com'",
+    );
+    expect(bookingRows.map((row) => row.org_id)).toEqual(["org-b"]);
+    const { rows: deliveries } = await execute(
+      "SELECT webhook_id FROM webhook_deliveries ORDER BY webhook_id",
+    );
+    expect(deliveries.map((row) => row.webhook_id)).toEqual(["webhook-user-b"]);
+    const { rows: reminders } = await execute(
+      "SELECT workflow_step_id FROM scheduled_reminders ORDER BY workflow_step_id",
+    );
+    expect(reminders.map((row) => row.workflow_step_id)).toEqual([
+      "workflow-step-user-a-org",
+      "workflow-step-user-b",
+    ]);
+  });
+});
+
 describe("createBooking", () => {
+  it("rejects a legacy org id absent from the event type", async () => {
+    await expect(
+      createBooking({
+        eventType: makeEventType(),
+        orgId: "org-b",
+        hostEmail: HOST_EMAIL,
+        startTime: "2026-08-03T10:00:00.000Z",
+        endTime: "2026-08-03T10:30:00.000Z",
+        timezone: "UTC",
+        attendee: { email: ATTENDEE_EMAIL, name: "Attendee One" },
+      }),
+    ).rejects.toThrow("Booking orgId must match the event type organization");
+  });
+
   it("creates a booking with attendees and references on a free slot", async () => {
     const now = new Date().toISOString();
     await execute({

package/src/server/booking-service.ts

@@ -59,6 +59,9 @@ export async function createBooking(
   input: CreateBookingInput,
 ): Promise<Booking> {
   const eventType = input.eventType;
+  if (input.orgId !== undefined && input.orgId !== eventType.orgId) {
+    throw new Error("Booking orgId must match the event type organization");
+  }
   const title =
     input.title ??
     eventType.eventName?.replace("{attendeeName}", input.attendee.name) ??
@@ -72,24 +75,27 @@ export async function createBooking(
     afterEventBuffer: eventType.afterEventBuffer,
     excludeBookingUid: input.fromReschedule,
   });
-  const booking = await insertBooking({
-    eventTypeId: eventType.id,
-    hostEmail: input.hostEmail,
-    title,
-    description: input.description,
-    startTime: input.startTime,
-    endTime: input.endTime,
-    timezone: input.timezone,
-    status: eventType.requiresConfirmation ? "pending" : "confirmed",
-    location: input.location ?? eventType.locations[0],
-    attendees,
-    customResponses: input.customResponses,
-    iCalUid: input.iCalUid,
-    iCalSequence: input.iCalSequence,
-    fromReschedule: input.fromReschedule,
-    ownerEmail: input.hostEmail,
-    orgId: input.orgId,
-  });
+  const booking = {
+    ...(await insertBooking({
+      eventTypeId: eventType.id,
+      hostEmail: input.hostEmail,
+      title,
+      description: input.description,
+      startTime: input.startTime,
+      endTime: input.endTime,
+      timezone: input.timezone,
+      status: eventType.requiresConfirmation ? "pending" : "confirmed",
+      location: input.location ?? eventType.locations[0],
+      attendees,
+      customResponses: input.customResponses,
+      iCalUid: input.iCalUid,
+      iCalSequence: input.iCalSequence,
+      fromReschedule: input.fromReschedule,
+      ownerEmail: input.hostEmail,
+      orgId: eventType.orgId,
+    })),
+    teamId: eventType.teamId,
+  };
 
   let usableZoomMeeting = false;
 
@@ -141,7 +147,7 @@ export async function createBooking(
 
   const final = await getBookingByUid(booking.uid);
   if (!final) throw new Error("Booking disappeared after creation");
-  return final;
+  return { ...final, teamId: eventType.teamId };
 }
 
 export async function rescheduleBooking(input: {
@@ -247,7 +253,8 @@ export async function cancelBooking(input: {
     }
   }
 
-  await onBookingCancelled(booking);
+  const eventType = await getEventTypeById(booking.eventTypeId);
+  await onBookingCancelled({ ...booking, teamId: eventType?.teamId });
   return (await getBookingByUid(input.uid))!;
 }
 

package/src/server/bookings-repo.ts

@@ -1,5 +1,15 @@
 import { accessFilter } from "@agent-native/core/sharing";
-import { eq, and, gte, lt, or, desc, asc, isNotNull } from "drizzle-orm";
+import {
+  eq,
+  and,
+  gte,
+  lt,
+  or,
+  desc,
+  asc,
+  isNotNull,
+  isNull,
+} from "drizzle-orm";
 import { nanoid } from "nanoid";
 
 import type {
@@ -21,6 +31,8 @@ function rowToBooking(
     uid: row.uid,
     eventTypeId: row.eventTypeId,
     hostEmail: row.hostEmail,
+    ownerEmail: row.ownerEmail ?? row.hostEmail,
+    orgId: row.orgId ?? null,
     title: row.title,
     description: row.description ?? undefined,
     startTime: row.startTime,
@@ -74,6 +86,7 @@ function parseJson<T = any>(s: string | null | undefined): T | undefined {
 export async function getBookingByUid(uid: string): Promise<Booking | null> {
   const { getDb, schema } = getSchedulingContext();
   const db = getDb();
+  // guard:allow-unscoped — opaque booking UID is an authorization lookup; all public callers verify host or bearer token before exposing or mutating the row
   const rows = await db
     .select()
     .from(schema.bookings)
@@ -167,9 +180,11 @@ export async function listBookings(
 }
 
 export async function countBookingsByHostInRange(
+  eventTypeId: string,
   hostEmail: string,
   fromIso: string,
   toIso: string,
+  orgId?: string | null,
 ): Promise<number> {
   const { getDb, schema } = getSchedulingContext();
   const rows = await getDb()
@@ -178,6 +193,11 @@ export async function countBookingsByHostInRange(
     .where(
       and(
         eq(schema.bookings.hostEmail, hostEmail),
+        eq(schema.bookings.ownerEmail, hostEmail),
+        orgId
+          ? eq(schema.bookings.orgId, orgId)
+          : isNull(schema.bookings.orgId),
+        eq(schema.bookings.eventTypeId, eventTypeId),
         gte(schema.bookings.startTime, fromIso),
         lt(schema.bookings.startTime, toIso),
         eq(schema.bookings.status, "confirmed"),

package/src/server/event-types-repo.ts

@@ -31,6 +31,7 @@ function rowToEventType(row: any): EventType {
     position: row.position,
     schedulingType: row.schedulingType,
     ownerEmail: row.ownerEmail ?? undefined,
+    orgId: row.orgId ?? undefined,
     teamId: row.teamId ?? undefined,
     scheduleId: row.scheduleId ?? undefined,
     locations: parseJson<Location[]>(row.locations) ?? [],
@@ -297,10 +298,23 @@ export async function updateEventType(
 
   dbPatch.updatedAt = new Date().toISOString();
 
-  await db
+  const updatedRows = await db
     .update(schema.eventTypes)
     .set(dbPatch)
-    .where(eq(schema.eventTypes.id, id));
+    .where(
+      and(
+        eq(schema.eventTypes.id, id),
+        accessFilter(
+          schema.eventTypes,
+          schema.eventTypeShares,
+          undefined,
+          "editor",
+        ),
+      ),
+    )
+    .returning({ id: schema.eventTypes.id });
+  if (updatedRows.length === 0)
+    throw new Error("Event type not found or not editable");
   const updated = await getEventTypeById(id);
   if (!updated) throw new Error("Failed to update event type");
   return updated;