feat(demo): auto-confirm demo bookings that came through the verified form and decline the rest by waleedlatif1 · Pull Request #9976 · simstudioai/sim

waleedlatif1 · 2026-11-13T03:36:53Z

Summary

The Cal.com demo event is public, so bots booked it directly and skipped the form. The event now requires confirmation, and a signed Cal.com webhook decides each request:
- Confirms it when the attendee's email passed the demo form's Turnstile check.
- Leaves it pending for manual review when the form ran without a checkable token, e.g. the widget was blocked.
- Declines it when no form submission vouches for the email.
/api/demo-requests gains the same honeypot and Turnstile handling as /api/contact. It records the outcome per email in Redis, keyed by a SHA-256 hash, for 24h, consumed by the first booking that claims it.
New /api/demo-requests/bookings webhook verifies x-cal-signature-256 (HMAC-SHA256 of the raw body) before acting. It calls Cal.com's confirm/decline API with one retry on network or 5xx errors.
The demo form opens the calendar only after the server has recorded the request, so a booking can never outrun its record. The invisible challenge is capped at 5s, Turnstile mounts on first focus, and the sales email goes out in after(). The scheduler and its preload are unchanged. A failed record write answers 503 and the form shows an inline error.
Webhook decisions are claimed per booking UID, so a repeated delivery reuses the first decision.
/team and the upgrade page's sales button now go to /demo instead of the raw Cal.com link, so every booking path passes the form.
New env: CAL_API_KEY and CAL_WEBHOOK_SECRET. With either unset, the webhook is off or leaves every request pending, so nothing is auto-declined.

Type of Change

New feature

Testing

biome on the changed files; type-check, audits and tests run in CI
Manual plan once deployed: subscribe the webhook to BOOKING_REQUESTED on the demo event. Then book once through /demo (confirmed) and once through the raw Cal.com link (declined).

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

… form and decline the rest

vercel · 2026-11-13T03:36:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 13, 2026 3:56am UTC

greptile-apps · 2026-11-13T03:40:02Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with no new actionable issues found.

Summary

Adds automatic review of demo bookings using the form’s Turnstile result.

Cal.com bookings now follow the demo form's verification result.
The demo form records each request before opening the scheduler.
Sales links now send visitors through the demo form.

The previous findings are addressed or retracted. waleedlatif1 declined the external-fetch annotation because the rule does not cover this server-side external call; Greptile accepted that explanation and retracted the finding. All supplied previous threads were unnumbered, so none appear in previousFindings.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Visitor submits demo form] --> B[Save email status in Redis]
  B -->|Write fails| C[Keep form open with error]
  B -->|Saved| D[Open calendar]
  D --> E[Signed booking webhook]
  E --> F[Atomically claim email status for booking]
  F -->|Verified| G[Confirm booking]
  F -->|Unverified or unavailable| H[Leave pending]
  F -->|Unseen| I[Decline booking]

_{Reviews (4) · Last reviewed commit: "fix(demo): claim booking records atomica..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 9 files

_{Turn on auto-fix | Re-trigger cubic}

…eep webhook decisions stable

waleedlatif1 · 2026-11-13T03:46:40Z

@greptile

waleedlatif1 · 2026-11-13T03:46:41Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-13T03:46:49Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 10 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…ubmitting

waleedlatif1 · 2026-11-13T03:56:13Z

@greptile

waleedlatif1 · 2026-11-13T03:56:14Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-13T03:56:19Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 10 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

feat(demo): auto-confirm demo bookings that came through the verified…

eafa244

… form and decline the rest

greptile-apps Bot reviewed Nov 13, 2026

View reviewed changes

Comment thread apps/sim/app/api/demo-requests/route.ts Resolved

cubic-dev-ai Bot reviewed Nov 13, 2026

View reviewed changes

Comment thread apps/sim/app/(landing)/demo/components/demo-form/demo-form.tsx Resolved

Comment thread apps/sim/lib/demo-booking/review.ts Resolved

Comment thread apps/sim/app/api/demo-requests/route.ts Resolved

fix(demo): open the calendar only after the request is recorded and k…

2415354

…eep webhook decisions stable

vercel Bot temporarily deployed to Preview November 13, 2026 03:45 Inactive

greptile-apps Bot reviewed Nov 13, 2026

View reviewed changes

Comment thread apps/sim/lib/demo-booking/bookers.ts Resolved

cubic-dev-ai Bot reviewed Nov 13, 2026

View reviewed changes

Comment thread apps/sim/app/(landing)/demo/components/demo-form/demo-form.tsx Resolved

fix(demo): claim booking records atomically and lock the form while s…

c3019a7

…ubmitting

vercel Bot temporarily deployed to Preview November 13, 2026 03:56 Inactive

cubic-dev-ai Bot reviewed Nov 13, 2026

View reviewed changes

waleedlatif1 merged commit 6c6e020 into staging Nov 13, 2026
62 checks passed

waleedlatif1 deleted the feat/demo-booking-verification branch November 13, 2026 03:59

Conversation

waleedlatif1 commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 13, 2026

Uh oh!

waleedlatif1 commented Nov 13, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 13, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 13, 2026

Uh oh!

waleedlatif1 commented Nov 13, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 13, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Nov 13, 2026 •

edited

Loading

vercel Bot commented Nov 13, 2026 •

edited

Loading

greptile-apps Bot commented Nov 13, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading