feat(calcom): added calcom

[waleedlatif1]

Summary

• added calcom tools and triggers
• moved copy URL for triggers webhook URL to be above the subblock
• updated regex in script for releases to be more lenient

Type of Change

• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jan 30, 2026 4:32am

[greptile-apps]

Greptile Overview

Greptile Summary

This PR adds comprehensive Cal.com integration to the Sim platform, enabling users to manage bookings, event types, and schedules through 20 new tools and 9 webhook triggers.

Key Changes:

• OAuth Integration: Implements Cal.com OAuth provider with PKCE flow and token refresh support (no client secret required per Cal.com's OAuth design)
• Tool Suite: 20 Cal.com tools covering bookings (create, list, get, cancel, reschedule, confirm, decline), event types (CRUD operations), schedules (CRUD operations), and availability slots
• Webhook Triggers: 9 webhook triggers for booking lifecycle events (created, cancelled, rescheduled, requested, rejected, paid) and meeting events (ended, recording ready)
• Security Enhancements: Adds HMAC SHA-256 webhook signature validation using timing-safe comparison to prevent timing attacks; refactors existing webhook validators to use centralized safeCompare function
• UI Improvements: Adds copy-to-clipboard functionality for webhook URLs in trigger configuration
• Code Quality: Refactors require() statements to top-level imports for better tree-shaking

Integration Architecture:
The Cal.com integration follows the established pattern used by other OAuth providers in the codebase (Google, Microsoft, Slack, etc.) with proper separation of concerns across blocks, tools, triggers, and authentication layers.

Confidence Score: 5/5

• This PR is safe to merge with no critical issues identified
• The implementation follows established patterns throughout the codebase, includes proper security measures (HMAC validation, timing-safe comparison), uses appropriate OAuth flow with PKCE, and maintains consistency with existing integrations
• No files require special attention

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/calcom.ts	comprehensive Cal.com block configuration with 20 tools covering bookings, event types, and schedules
apps/sim/lib/oauth/oauth.ts	adds Cal.com OAuth provider with token refresh support (no client secret required)
apps/sim/lib/auth/auth.ts	implements Cal.com OAuth provider with PKCE, proper user profile fetching
apps/sim/lib/webhooks/utils.server.ts	adds Cal.com webhook signature validation using HMAC SHA-256 and timing-safe comparison, refactors require() to import
apps/sim/lib/webhooks/processor.ts	integrates Cal.com webhook signature verification into the webhook processor
apps/sim/tools/calcom/create_booking.ts	implements create booking tool with proper OAuth and parameter structure
apps/sim/triggers/calcom/booking_created.ts	defines booking created trigger with webhook setup instructions
apps/sim/lib/core/security/encryption.ts	adds safeCompare function for timing-safe string comparison to prevent timing attacks

Sequence Diagram

sequenceDiagram
    participant User
    participant SimUI as Sim UI
    participant SimBackend as Sim Backend
    participant CalCom as Cal.com API
    participant Webhook as Webhook Handler

    Note over User,CalCom: OAuth Authentication Flow
    User->>SimUI: Connect Cal.com account
    SimUI->>SimBackend: Initiate OAuth (PKCE)
    SimBackend->>CalCom: Authorization request
    CalCom->>User: Login & consent
    User->>CalCom: Approve
    CalCom->>SimBackend: Authorization code
    SimBackend->>CalCom: Exchange code for tokens
    CalCom->>SimBackend: Access token + refresh token
    SimBackend->>SimBackend: Encrypt & store tokens
    SimBackend->>SimUI: OAuth complete

    Note over User,CalCom: Tool Execution (e.g., Create Booking)
    User->>SimUI: Configure booking details
    SimUI->>SimBackend: Execute create_booking tool
    SimBackend->>SimBackend: Decrypt access token
    SimBackend->>SimBackend: Check token expiry
    alt Token expired
        SimBackend->>CalCom: Refresh token request
        CalCom->>SimBackend: New access token
        SimBackend->>SimBackend: Update stored token
    end
    SimBackend->>CalCom: POST /v2/bookings
    CalCom->>SimBackend: Booking created response
    SimBackend->>SimUI: Return booking data

    Note over User,Webhook: Webhook Trigger Flow
    User->>SimUI: Configure booking_created trigger
    SimUI->>SimBackend: Save trigger with webhook URL
    User->>CalCom: Configure webhook in Cal.com
    CalCom->>Webhook: POST webhook event (X-Cal-Signature-256)
    Webhook->>Webhook: Validate HMAC signature (timing-safe)
    alt Signature valid
        Webhook->>SimBackend: Process webhook payload
        SimBackend->>SimBackend: Execute workflow
        Webhook->>CalCom: 200 OK
    else Invalid signature
        Webhook->>CalCom: 401 Unauthorized
    end

Loading

[greptile-apps]

_{7 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[waleedlatif1]

@greptile

[greptile-apps]

_{8 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}