feat: add calendar cache status and actions (#22532)

[akshayutture-augment]

Test 1

---

Replicated from ai-code-review-evaluation/cal.com-greptile#11

[akshayutture-augment]

@claude review this PR

[akshayutture-augment]

@claude review this PR

[claude]

Claude finished @akshayutture-augment's task —— View job

---

Code Review Complete ✅

• Read repository guidelines (CLAUDE.md)
• Review database schema changes
• Review new calendar cache repository methods
• Review new CredentialActionsDropdown component
• Review deleteCache handler and tRPC router changes
• Review UI integration changes
• Review test script
• Compile and post comprehensive feedback

---

Overview

This PR adds calendar cache status display and deletion capabilities to the Cal.com UI. The implementation allows users to see when their Google Calendar cache was last updated and provides an option to manually delete cached data.

Positive Aspects ✨

1. Well-structured architecture - Clean separation of concerns with repository pattern
2. Security-conscious - Proper authorization checks in deleteCache.handler.ts:17-26
3. User experience - Nice UI with cache status visibility and confirmation dialogs
4. Backward compatibility - Migration handles existing rows with a default value

Critical Issues 🔴

1. Security: Missing Authorization for Team Credentials (High Priority)

File: packages/trpc/server/routers/viewer/calendars/deleteCache.handler.ts:17-22

The handler only checks if the credential belongs to the user:

const credential = await prisma.credential.findFirst({
  where: {
    id: credentialId,
    userId: user.id,
  },
});

Problem: This doesn't handle team credentials (teamId field). A user could potentially delete cache for team credentials they don't have access to.

Recommendation:

const credential = await prisma.credential.findFirst({
  where: {
    id: credentialId,
    OR: [
      { userId: user.id },
      {
        teamId: {
          in: user.teams.map(t => t.teamId)
        }
      }
    ]
  },
});

2. Type Safety: Missing Return Type (Medium Priority)

File: packages/features/calendar-cache/calendar-cache.repository.ts:173-188

The getCacheStatusByCredentialIds method lacks an explicit return type annotation.

Recommendation:

async getCacheStatusByCredentialIds(
  credentialIds: number[]
): Promise<{ credentialId: number; updatedAt: Date | null }[]> {

3. Database Performance: Missing Index (Medium Priority)

File: packages/prisma/schema.prisma:1719

The migration adds updatedAt field but doesn't add an index. The getCacheStatusByCredentialIds method uses groupBy on credentialId with _max.updatedAt, which could be slow for large datasets.

Recommendation: Consider adding a composite index:

@@index([credentialId, updatedAt])

Major Issues 🟡

4. Error Handling: Generic Error Messages (Medium Priority)

File: packages/trpc/server/routers/viewer/calendars/deleteCache.handler.ts:25

throw new Error("Credential not found or access denied");

Problem: This generic error message doesn't distinguish between "credential not found" and "access denied", making debugging harder and potentially leaking information.

Recommendation: Use specific error types:

if (!credential) {
  throw new TRPCError({
    code: "NOT_FOUND",
    message: "Credential not found"
  });
}

5. Code Quality: Unused Method in Mock (Low Priority)

File: packages/features/calendar-cache/calendar-cache.repository.mock.ts:23-25

The mock includes deleteManyByCredential() method which isn't in the interface (ICalendarCacheRepository).

Recommendation: Remove it or add it to the interface if needed.

6. UI/UX: No Loading State (Low Priority)

File: packages/features/apps/components/CredentialActionsDropdown.tsx:42-50

The delete cache mutation doesn't show a loading state while the operation is in progress.

Recommendation: Add loading state to the button:

const [isDeleting, setIsDeleting] = useState(false);
// ... in mutation
onMutate: () => setIsDeleting(true),
onSettled: () => setIsDeleting(false),

Minor Issues 🔵

7. Code Consistency: Inconsistent Date Formatting (Low Priority)

File: packages/features/apps/components/CredentialActionsDropdown.tsx:89-92

The date formatting is hardcoded to "en-US" locale, but the app uses useLocale() hook which should provide the user's locale.

Recommendation:

{t("cache_last_updated", {
  timestamp: new Intl.DateTimeFormat(locale, {
    dateStyle: "short",
    timeStyle: "short",
  }).format(new Date(cacheUpdatedAt)),
})}

8. Documentation: Missing JSDoc Comments (Low Priority)

File: packages/features/calendar-cache/calendar-cache.repository.ts:173

The getCacheStatusByCredentialIds method is a public API but lacks documentation.

Recommendation: Add JSDoc:

/**
 * Retrieves the most recent cache update time for each credential.
 * @param credentialIds - Array of credential IDs to check
 * @returns Array of objects containing credentialId and updatedAt timestamp
 */
async getCacheStatusByCredentialIds(credentialIds: number[])

9. Test Script: macOS-Specific sed Command (Low Priority)

File: scripts/test-gcal-webhooks.sh:68

sed -i '' -E "s|^GOOGLE_WEBHOOK_URL=.*|GOOGLE_WEBHOOK_URL=$TUNNEL_URL|" "$ENV_FILE"

The -i '' syntax is macOS-specific. This won't work on Linux.

Recommendation:

# Portable version
sed -i.bak -E "s|^GOOGLE_WEBHOOK_URL=.*|GOOGLE_WEBHOOK_URL=$TUNNEL_URL|" "$ENV_FILE" && rm "$ENV_FILE.bak"

10. Database Migration: Default Value Comment Mismatch (Low Priority)

File: packages/prisma/migrations/20250715160635_add_calendar_cache_updated_at/migration.sql:2-4

The warning says "without a default value" but the code shows DEFAULT NOW() is added. The comment is misleading.

Testing Recommendations 🧪

1. Test team credential deletion - Verify authorization works for team credentials
2. Test concurrent deletions - What happens if multiple users try to delete the same cache?
3. Test with large datasets - Verify performance with many credentials
4. Test error scenarios - Invalid credential IDs, network failures, etc.

Summary

Overall, this is a solid feature addition with good code quality. The main concerns are:

1. Security fix needed for team credential authorization
2. Performance consideration for the database query
3. Minor improvements for error handling and UX

The changes follow the existing codebase patterns and introduce useful functionality for users to manage their calendar cache.

---

[github-actions]

This PR is being marked as stale due to inactivity.