fix: preserve API-provided email when email field is hidden

[Shikhar-8]

What does this PR do?

Problem

When email field is hidden and phone confirmation is enabled, API booking creation was overwriting provided emails with auto-generated phone emails (e.g., [email protected]).

Solution

Added conditional check && !responses["email"] to only clear email when not explicitly provided via API. This preserves API-provided emails while maintaining session email protection.

Testing

• Added unit test verifying email preservation when explicitly provided via API
• Test covers hidden email field + required phone field scenario
• Ensures backward compatibility with existing behavior

Closes #25432

• Fixes #XXXX (GitHub issue number)
• Fixes CAL-XXXX (Linear issue number - should be visible at the bottom of the GitHub issue description)

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Tests Run
Unit tests: Added and ran test case hidden email field should preserve explicitly provided email from API in getBookingResponsesSchema.test.ts
Type checking: Ran yarn type-check to ensure no TypeScript errors
Linting: Ran yarn lint:fix to ensure code style compliance
How to Test :
Run the specific test: yarn test packages/features/bookings/lib/getBookingResponsesSchema.test.ts

Run all booking-related tests: yarn test packages/features/bookings

Environment Variables
No special environment variables required - uses standard Cal.com test configuration.

Minimal Test Data
The test creates an event type with:

hidden: true on the email field
required: true on the attendee phone number field
API booking request with explicit email: "[email protected]"
Expected Behavior (Happy Path)
Input:
{
"responses": {
"email": "[email protected]",
"attendeePhoneNumber": "+919999999999"
},
"eventType": {
"bookingFields": [
{
"name": "email",
"type": "email",
"hidden": true,
"required": false
},
{
"name": "attendeePhoneNumber",
"type": "phone",
"hidden": false,
"required": true
}
]
}
}

Expected Output:

{
"data": {
"email": "[email protected]", // ✅ Preserved from API input
"attendeePhoneNumber": "+919999999999"
}
}

Before Fix (Broken Behavior):

{
"data": {
"email": "[email protected]", // ❌ Overwritten with phone email
"attendeePhoneNumber": "+919999999999"
}
}

Additional Testing Notes
Test verifies the fix works when email is explicitly provided via API
Ensures backward compatibility when no email is provided (falls back to phone email generation)
No database changes required - pure logic fix
Test is isolated and doesn't require external services

Checklist

• I haven't read the contributing guide
• My code doesn't follow the style guidelines of this project
• I haven't commented my code, particularly in hard-to-understand areas
• I haven't checked if my changes generate no new warnings

[CLAassistant]

All committers have signed the CLA.

[vercel]

@Shikhar-8 is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (all 1 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/platform/types/calendars/inputs/busy-times.input.ts">

<violation number="1" location="packages/platform/types/calendars/inputs/busy-times.input.ts:28">
`@Validate` is a property decorator; applying it to the class prevents the TimezoneRequiredValidator from ever running, so both timezone fields become optional and requests without any timezone now pass validation.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

@Validate is a property decorator; applying it to the class prevents the TimezoneRequiredValidator from ever running, so both timezone fields become optional and requests without any timezone now pass validation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/platform/types/calendars/inputs/busy-times.input.ts, line 28:

<comment>`@Validate` is a property decorator; applying it to the class prevents the TimezoneRequiredValidator from ever running, so both timezone fields become optional and requests without any timezone now pass validation.</comment>

<file context>
@@ -14,14 +14,37 @@ export class Calendar {
+  }
+}
+
+@Validate(TimezoneRequiredValidator)
 export class CalendarBusyTimesInput {
   @ApiProperty({
</file context>