Skip to content

fix(api): remove .ics suffix requirement from ICS feed URL validator#29507

Open
NamanYadav11 wants to merge 1 commit into
calcom:mainfrom
NamanYadav11:fix/ics-feed-url-validation
Open

fix(api): remove .ics suffix requirement from ICS feed URL validator#29507
NamanYadav11 wants to merge 1 commit into
calcom:mainfrom
NamanYadav11:fix/ics-feed-url-validation

Conversation

@NamanYadav11
Copy link
Copy Markdown

What does this PR do?

Fixes #29286

The ICS feed URL validator was enforcing a .ics suffix on all submitted URLs:

urlObject.pathname.endsWith(".ics")

RFC 5545 (iCalendar) has no requirement for a .ics file extension. Valid CalDAV feeds and dynamic export endpoints (e.g. ?format=ics, ?export=ics) were silently rejected even though they serve valid text/calendar content.

Removes the suffix check and keeps only the http/https protocol validation, which is the only meaningful constraint here. Also updates the @ApiProperty description and example to reflect the relaxed validation.

Visual Demo (For contributors especially)

N/A — validator logic change, no UI.

Before: POST /v2/calendars/ics with https://calendar.example.com/feed?format=ics → 400 "must end with .ics"

After: same request → 201 accepted

Mandatory Tasks (DO NOT REMOVE)

  • I have self-reviewed the code (A decent size PR without self-review might be rejected).
  • I have updated the developer docs if this PR makes changes that would require a documentation change. N/A — no public doc surface changed beyond the updated @ApiProperty description.
  • I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A — covered by the existing integration test suite for the calendars endpoint.

How should this be tested?

No extra environment variables needed.

Happy path:

  1. POST /v2/calendars/ics with body { "urls": ["https://calendar.example.com/feed?format=ics"] }
  2. Expected: 201 — previously rejected with 400

Still rejected (protocol guard still applies):

  • ftp://example.com/feed.ics → 400
  • not-a-url → 400

Checklist

  • I haven't read the contributing guide
  • My code doesn't follow the style guidelines of this project
  • My PR is too large (>500 lines or >10 files) and should be split into smaller PRs

RFC 5545 does not require a .ics file extension. Valid CalDAV feeds
and dynamic export endpoints (e.g. ?format=ics) were being rejected
by the overly strict pathname check. Now accepts any valid http/https URL.

Fixes calcom#29286
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 4, 2026

Welcome to Cal.diy, @NamanYadav11! Thanks for opening this pull request.

A few things to keep in mind:

  • This is Cal.diy, not Cal.com. Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will not be deployed to the Cal.com production app.
  • Please review our Contributing Guidelines if you haven't already.
  • Make sure your PR title follows the Conventional Commits format.

A maintainer will review your PR soon. Thanks for contributing!

@github-actions github-actions Bot added the 🐛 bug Something isn't working label Jun 4, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Jun 4, 2026

Review Change Stack

📝 Walkthrough

Walkthrough

This PR updates ICS feed URL validation in the calendar input module to accept any valid http:// or https:// URL rather than requiring paths to end with .ics. The validation logic and error message in IsICSUrlConstraint are modified accordingly. Swagger API documentation for CreateIcsFeedInputDto.urls is also updated to reflect the relaxed constraint with description text "ICS feed URLs (http or https)".

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main change: removing the .ics suffix requirement from the ICS URL validator.
Description check ✅ Passed The description provides clear context about the fix, explains the RFC compliance issue, and demonstrates the before/after behavior with concrete examples.
Linked Issues check ✅ Passed The PR directly addresses issue #29286 by removing the .ics suffix check and retaining only http/https protocol validation, as requested in the linked issue.
Out of Scope Changes check ✅ Passed All changes are scoped to the ICS feed URL validator and its Swagger documentation, directly addressing the linked issue without unrelated modifications.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
apps/api/v2/src/platform/calendars/input/create-ics.input.ts (1)

2-9: ⚡ Quick win

Use type import for ValidatorConstraintInterface.

ValidatorConstraintInterface is only used in a type position (implements clause at line 14). Per coding guidelines, type-only imports should use import type.

♻️ Proposed fix
 import {
   ArrayNotEmpty,
   IsBoolean,
   IsOptional,
   Validate,
   ValidatorConstraint,
-  ValidatorConstraintInterface,
 } from "class-validator";
+import type { ValidatorConstraintInterface } from "class-validator";
 import { IsNotEmpty, IsArray } from "class-validator";

As per coding guidelines: "Use import type { X } for TypeScript type imports".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/api/v2/src/platform/calendars/input/create-ics.input.ts` around lines 2
- 9, The import of ValidatorConstraintInterface is used only as a type in the
implements clause (ValidatorConstraintInterface) and should be a type-only
import; update the import statement to import type for
ValidatorConstraintInterface while leaving the other imports (ArrayNotEmpty,
IsBoolean, IsOptional, Validate, ValidatorConstraint) as value imports so the
class that implements ValidatorConstraintInterface continues to compile.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@apps/api/v2/src/platform/calendars/input/create-ics.input.ts`:
- Around line 2-9: The import of ValidatorConstraintInterface is used only as a
type in the implements clause (ValidatorConstraintInterface) and should be a
type-only import; update the import statement to import type for
ValidatorConstraintInterface while leaving the other imports (ArrayNotEmpty,
IsBoolean, IsOptional, Validate, ValidatorConstraint) as value imports so the
class that implements ValidatorConstraintInterface continues to compile.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 15ba160d-807e-4d5d-8e4d-276a57e75b24

📥 Commits

Reviewing files that changed from the base of the PR and between d1ad4ea and 73d339e.

📒 Files selected for processing (1)
  • apps/api/v2/src/platform/calendars/input/create-ics.input.ts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🐛 bug Something isn't working size/S

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ICS feed validation incorrectly requires .ics URL suffix

1 participant