feat(reschedule): check guest availability when host reschedules by sirrodgepodge · Pull Request #28229 · calcom/cal.com

sirrodgepodge · 2026-03-01T19:42:49Z

When a host reschedules a booking, the slot picker now filters out time slots that conflict with the guests' (attendees') existing accepted bookings — preventing double-booking guests.

Changes

`packages/features/bookings/repositories/BookingRepository.ts`

Add getAcceptedBookingsByAttendeeEmails() to query bookings where any attendee email appears in a given list, within a date range, excluding the booking being rescheduled
Uses overlap semantics (startTime < windowEnd AND endTime > windowStart) for correct boundary detection

`packages/trpc/server/routers/viewer/slots/util.ts`

In calculateHostsAndAvailabilities(): when rescheduleUid is present, look up the original booking's attendees via BookingRepository
Filter out host emails (booking owner + event type hosts) to isolate guest-only emails
Fetch their accepted bookings in the slot search window, excluding the booking being rescheduled
Pass as guestBusyTimes through initialData

`packages/features/availability/lib/getUserAvailability.ts`

Add optional guestBusyTimes field to GetUserAvailabilityInitialData
Spread guestBusyTimes into detailedBusyTimes so guest conflicts block slot availability

How it works

Host clicks reschedule → slot picker calls getSchedule with rescheduleUid
We look up the original booking's attendees and identify which are guests (not hosts)
We query all accepted bookings where those guest emails appear as attendees
Those bookings become busy times that block slots, just like host busy times

Fixes #16378
/claim #28164

When a host reschedules a booking, the slot picker now filters out time slots that conflict with the guests' (attendees') existing accepted bookings — preventing double-booking guests. Changes: - BookingRepository: add getAcceptedBookingsByAttendeeEmails() to query bookings where any attendee email appears in a given list, within a date range, excluding the booking being rescheduled - AvailableSlotsService.calculateHostsAndAvailabilities(): when rescheduleUid is present, look up the original booking's attendees, filter out host emails to get guest-only emails, fetch their accepted bookings in the slot search window, and pass them as guestBusyTimes - GetUserAvailabilityInitialData: add optional guestBusyTimes field - getUserAvailability(): spread guestBusyTimes into detailedBusyTimes so guest conflicts are treated as busy time during availability calculation Fixes calcom#16378

graphite-app · 2026-03-01T19:45:15Z

Graphite Automations

"Send notification to Community team when bounty PR opened" took an action on this PR • (03/01/26)

2 teammates were notified to this PR based on Keith Williams's automation.

cubic-dev-ai

No issues found across 3 files

Copilot

Pull request overview

Adds guest-conflict awareness to the reschedule slot picker so hosts can’t reschedule into times where non-host attendees already have an accepted booking.

Changes:

Add BookingRepository.getAcceptedBookingsByAttendeeEmails() to fetch accepted bookings for a set of attendee emails in a time window (with overlap + excluded booking semantics).
In slots availability calculation, fetch the original booking’s guest emails on reschedule and inject their accepted bookings as guestBusyTimes.
Extend getUserAvailability initialData to accept guestBusyTimes and merge them into detailedBusyTimes to block conflicting slots.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
`packages/trpc/server/routers/viewer/slots/util.ts`	Collect guest attendee emails during reschedule and pass guest-derived busy intervals into availability calculation.
`packages/features/bookings/repositories/BookingRepository.ts`	New Prisma query to find accepted bookings by attendee emails with overlap/exclusion filtering.
`packages/features/availability/lib/getUserAvailability.ts`	Accept `guestBusyTimes` in `initialData` and include them in busy-time subtraction.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-01T19:48:35Z

packages/trpc/server/routers/viewer/slots/util.ts

+      const rescheduleBooking = await bookingRepo.findByUidIncludeEventTypeAttendeesAndUser({
+        bookingUid: input.rescheduleUid,
+      });
+      if (rescheduleBooking) {


getSchedule is a public endpoint, and this code uses the client-provided rescheduleUid to look up a booking and then query other accepted bookings for the booking’s attendee emails. Without an explicit authorization/gating check (e.g., only run when the requester is the booking owner/host), this can become a privacy leak (inferring attendees’ busy times) if a rescheduleUid is disclosed. Consider gating guest-conflict lookups to authenticated host reschedules and/or verifying the requester is allowed to access the booking before querying attendee-based conflicts.

Suggested change

if (rescheduleBooking) {

// Only consider guest conflicts if the reschedule booking belongs to one of the

// current hosts/users participating in this scheduling flow. This prevents

// unauthorized callers from probing guest availability using arbitrary UIDs.

if (rescheduleBooking && rescheduleBooking.userId && allUserIds.includes(rescheduleBooking.userId)) {

Copilot · 2026-03-01T19:48:36Z

packages/trpc/server/routers/viewer/slots/util.ts

+          guestBusyTimes = guestBookings.map((b) => ({
+            start: b.startTime.toISOString(),
+            end: b.endTime.toISOString(),
+            title: b.title ?? undefined,


guestBusyTimes is populated with title from bookings that belong to the guests. This will flow into getUserAvailability's busy output and debug logs, and may expose private meeting titles unrelated to the host/reschedule flow. Consider omitting the title (or replacing with a generic label) for guest-derived busy times.

Suggested change

title: b.title ?? undefined,

// Do not leak guest-owned meeting titles; use a generic label instead.

title: "Busy",

Copilot · 2026-03-01T19:48:36Z

packages/trpc/server/routers/viewer/slots/util.ts

+        // Guest emails = attendees that are NOT hosts
+        const guestEmails = rescheduleBooking.attendees
+          .map((a) => a.email)
+          .filter((email) => !hostEmails.has(email));
+
+        if (guestEmails.length > 0) {
+          const guestBookings = await bookingRepo.getAcceptedBookingsByAttendeeEmails({
+            attendeeEmails: guestEmails,
+            startDate: startTimeDate,


guestEmails can contain duplicates (and potentially empty strings, depending on upstream data). Deduplicating/filtering before calling getAcceptedBookingsByAttendeeEmails will reduce the size of the SQL IN (...) list and avoid unnecessary DB work.

Copilot · 2026-03-01T19:48:36Z

packages/trpc/server/routers/viewer/slots/util.ts

        busyTimesFromLimits: busyTimesFromLimitsMap,
        eventTypeForLimits: eventType && (bookingLimits || durationLimits) ? eventType : null,
        teamBookingLimits: teamBookingLimitsMap,
        teamForBookingLimits: teamForBookingLimits,
+        guestBusyTimes,
      },


guestBusyTimes is passed via initialData and then appended into every host's detailedBusyTimes. For multi-host event types this duplicates the same guest busy intervals across all users (and into debug logs), which can inflate memory/CPU for large teams or wide date windows. Consider applying guest conflicts once at the aggregated availability stage (global blocker) or otherwise avoiding per-user duplication.

Copilot · 2026-03-01T19:48:36Z

packages/features/bookings/repositories/BookingRepository.ts

+  async getAcceptedBookingsByAttendeeEmails({
+    attendeeEmails,
+    startDate,
+    endDate,
+    excludedUid,
+  }: {
+    attendeeEmails: string[];
+    startDate: Date;
+    endDate: Date;
+    excludedUid?: string | null;
+  }) {
+    if (attendeeEmails.length === 0) return [];
+    return this.prismaClient.booking.findMany({
+      where: {
+        status: BookingStatus.ACCEPTED,
+        // Use overlap semantics: any booking whose time range intersects [startDate, endDate].
+        startTime: { lt: endDate },
+        endTime: { gt: startDate },
+        ...(excludedUid ? { uid: { not: excludedUid } } : {}),
+        attendees: {
+          some: {
+            email: { in: attendeeEmails },
+          },
+        },
+      },
+      select: {
+        id: true,
+        startTime: true,
+        endTime: true,
+        title: true,
+        uid: true,
+        userId: true,
+      },
+    });


This new query method introduces important overlap/exclusion semantics but doesn't appear to be covered by repository tests. Since BookingRepository.integration-test.ts already sets up real bookings/attendees, adding coverage for overlap boundaries (touching endpoints), multiple emails, and excludedUid would help prevent regressions.

Copilot · 2026-03-01T19:48:37Z

packages/features/availability/lib/getUserAvailability.ts

    const detailedBusyTimes: EventBusyDetails[] = [
      ...busyTimes.map((a) => ({
        ...a,
        start: dayjs(a.start).toISOString(),
        end: dayjs(a.end).toISOString(),
        title: a.title,
        source: params.withSource ? a.source : undefined,
      })),
      ...busyTimesFromLimits,
      ...busyTimesFromTeamLimits,
+      // Guest busy times from the booking being rescheduled: prevents double-booking guests.
+      ...(initialData?.guestBusyTimes ?? []),
    ];


guestBusyTimes is now merged into detailedBusyTimes, but there are no tests asserting that guest conflicts actually remove slots during rescheduling. Given the existing test suite around availability calculations, adding a unit test that injects initialData.guestBusyTimes and verifies dateRanges subtraction/slot filtering would improve confidence in this behavior.

Moses-main · 2026-03-02T18:18:57Z

Hi team, I'd like to contribute. Please assign!

romitg2 · 2026-03-02T18:20:54Z

Hi team, I'd like to contribute. Please assign!

Hey @Moses-main stop commenting on PRs, you can pick up any issue form https://github.com/calcom/cal.com/issues and raise a PR for fixing that issue, avoid issue with "needs approval" label.

Moses-main · 2026-03-02T19:55:46Z

Hi @romitg2, you're absolutely right! Thanks for the guidance. I'll directly pick up an open issue, implement the fix, and create a PR instead of asking to be assigned.

Going forward, I'll:

Find open issues without 'needs approval' label
Fork, clone, and fix the issue
Create a PR directly

Appreciate the feedback! 🙏

Copilot AI review requested due to automatic review settings March 1, 2026 19:42

sirrodgepodge requested a review from a team as a code owner March 1, 2026 19:42

algora-pbc bot added the 🙋 Bounty claim label Mar 1, 2026

pull-request-size bot added the size/M label Mar 1, 2026

github-actions bot added $200 bookings area: bookings, availability, timezones, double booking Medium priority Created by Linear-GitHub Sync ✨ feature New feature or request 💎 Bounty A bounty on Algora.io 🧹 Improvements Improvements to existing features. Mostly UX/UI labels Mar 1, 2026

graphite-app bot added the community Created by Linear-GitHub Sync label Mar 1, 2026

Copilot started reviewing on behalf of sirrodgepodge March 1, 2026 19:43 View session

cubic-dev-ai bot reviewed Mar 1, 2026

View reviewed changes

Copilot AI reviewed Mar 1, 2026

View reviewed changes

romitg2 closed this Mar 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(reschedule): check guest availability when host reschedules#28229

feat(reschedule): check guest availability when host reschedules#28229
sirrodgepodge wants to merge 1 commit intocalcom:mainfrom
sirrodgepodge:feat/reschedule-guest-availability

sirrodgepodge commented Mar 1, 2026

Uh oh!

graphite-app bot commented Mar 1, 2026

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Moses-main commented Mar 2, 2026

Uh oh!

romitg2 commented Mar 2, 2026

Uh oh!

Moses-main commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

-      if (rescheduleBooking) {
+      // Only consider guest conflicts if the reschedule booking belongs to one of the
+      // current hosts/users participating in this scheduling flow. This prevents
+      // unauthorized callers from probing guest availability using arbitrary UIDs.
+      if (rescheduleBooking && rescheduleBooking.userId && allUserIds.includes(rescheduleBooking.userId)) {

	title: b.title ?? undefined,
	// Do not leak guest-owned meeting titles; use a generic label instead.
	title: "Busy",

Conversation

sirrodgepodge commented Mar 1, 2026

Changes

packages/features/bookings/repositories/BookingRepository.ts

packages/trpc/server/routers/viewer/slots/util.ts

packages/features/availability/lib/getUserAvailability.ts

How it works

Uh oh!

graphite-app bot commented Mar 1, 2026

Graphite Automations

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Moses-main commented Mar 2, 2026

Uh oh!

romitg2 commented Mar 2, 2026

Uh oh!

Moses-main commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

`packages/features/bookings/repositories/BookingRepository.ts`

`packages/trpc/server/routers/viewer/slots/util.ts`

`packages/features/availability/lib/getUserAvailability.ts`