fix(security): prevent team webhook IDOR by enforcing ADMIN/OWNER role check (#29982)

[jihadMo]

Closes #29982

Summary of Changes

• Added teamId selection and explicit authorization verification in createWebhookProcedure() middleware (packages/trpc/server/routers/viewer/webhook/util.ts).
• When a webhook belongs to a team (webhook.teamId), the middleware checks prisma.membership.findFirst({ where: { teamId: webhook.teamId, userId: ctx.user.id, accepted: true, role: { in: ["ADMIN", "OWNER"] } } }) and throws TRPCError with FORBIDDEN if the caller lacks administrative rights on the owning team.
• Prevents authorization bypass / IDOR vulnerability where regular team members could modify team webhooks and exfiltrate future booking payloads.

Verification

• Verified that individual user webhooks continue to require webhook.userId === ctx.user.id.
• Verified that event-type webhooks continue to require eventType.userId === ctx.user.id.
• Verified that team webhooks now strictly enforce ADMIN or OWNER membership.

[github-actions]

Welcome to Cal.diy, @jihadMo! Thanks for opening this pull request.

A few things to keep in mind:

• This is Cal.diy, not Cal.com. Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will not be deployed to the Cal.com production app.
• Please review our Contributing Guidelines if you haven't already.
• Make sure your PR title follows the Conventional Commits format.

A maintainer will review your PR soon. Thanks for contributing!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4bf6a1f4-fa5c-4a07-9132-9a5c523d0491

📥 Commits

Reviewing files that changed from the base of the PR and between 176037d and 40099c9.

📒 Files selected for processing (1)

• packages/trpc/server/routers/viewer/webhook/util.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

Webhook lookup results now include teamId. For webhooks without an event type, authorization accepts users with accepted ADMIN or OWNER membership in the associated team. When no team is associated, authorization falls back to individual ownership validation.

Merge Risk: ⚪ Minimal · up to 40099

The change adds ADMIN/OWNER authorization for team webhook access while preserving existing ownership checks; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the security fix and the required ADMIN/OWNER role check for team webhooks.
Description check	✅ Passed	The description accurately explains the authorization bypass, implemented fix, preserved checks, and verification scope.
Linked Issues check	✅ Passed	The changes satisfy issue #29982 by enforcing accepted ADMIN or OWNER membership for team webhooks while preserving existing ownership checks.
Out of Scope Changes check	✅ Passed	The described changes are limited to webhook authorization and directly support the requirements in issue #29982.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request shows signs of AI-generated slop (redundant_comments). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

[CLAassistant]

All committers have signed the CLA.