Alex Dunmow 3967fa955a fix: rebuild admin claims from trusted headers — v2.0.4 ...

Context does not cross the wasm ABI, so requireAdmin's
auth.GetUserFromContext only sees claims if the guest rebuilds them from
the host-stamped X-Bn-Verified-* headers. 2.0.3 never mounted
auth.TrustedHeaderMiddleware, so every admin endpoint (settings save,
event-types, test, rotate) returned 401 for real admins — the settings
panel could not store the Cal.com API key. Mount the middleware on the
router and pin the contract with a header-driven test (viewer headers
must reach requireAdmin and 403, never 401): the existing admin tests
injected claims straight into context, which is exactly the path wasm
does not have.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-08 00:03:28 +08:00

internal

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

schemas

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

web

chore: register @ninja/calcomblock scope; commit web/pnpm-lock.yaml

2026-07-05 03:05:23 +08:00

.gitignore

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

block_resolver_test.go

fix!: absolute routes + live captcha requirement — v2.0.3

2026-07-07 23:47:59 +08:00

block_resolver.go

fix!: absolute routes + live captcha requirement — v2.0.3

2026-07-07 23:47:59 +08:00

block.go

chore: migrate from block/core to block/pluginsdk (keep core for captcha)

2026-07-07 11:03:57 +08:00

booking_errors_test.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

booking_errors.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

booking_templ.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

booking.templ

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

captcha_widget_templ.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

captcha_widget.templ

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

CLAUDE.md

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

client_test.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

client.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

countries.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

dategrid_alignment_test.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

errors.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

field_routing_test.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

go.mod

fix!: absolute routes + live captcha requirement — v2.0.3

2026-07-07 23:47:59 +08:00

go.sum

fix!: absolute routes + live captcha requirement — v2.0.3

2026-07-07 23:47:59 +08:00

handler_captcha_test.go

feat!: captcha via host-stamped X-Bn-Verified-Captcha; drop block/core entirely

2026-07-07 23:00:10 +08:00

handler_integration_test.go

chore: migrate from block/core to block/pluginsdk (keep core for captcha)

2026-07-07 11:03:57 +08:00

handler_test.go

chore: rename dev host localdev.blockninjacms.com -> blockninja.dev

2026-07-05 20:50:21 +08:00

handler.go

fix: rebuild admin claims from trusted headers — v2.0.4

2026-07-08 00:03:28 +08:00

main.go

chore: migrate from block/core to block/pluginsdk (keep core for captcha)

2026-07-07 11:03:57 +08:00

phone_region.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

plugin.mod

fix: rebuild admin claims from trusted headers — v2.0.4

2026-07-08 00:03:28 +08:00

ratelimit_test.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

ratelimit.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

register.go

chore: migrate from block/core to block/pluginsdk (keep core for captcha)

2026-07-07 11:03:57 +08:00

registration.go

chore: migrate from block/core to block/pluginsdk (keep core for captcha)

2026-07-07 11:03:57 +08:00

router_paths_test.go

fix: rebuild admin claims from trusted headers — v2.0.4

2026-07-08 00:03:28 +08:00

settings_store.go

chore: migrate from block/core to block/pluginsdk (keep core for captcha)

2026-07-07 11:03:57 +08:00

timezone_test.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

types.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

tzdata.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

webhook_handler.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

webhook_test.go

Extract calcomblock into a standalone wasm plugin repo

2026-07-05 03:04:18 +08:00

Description

Cal.com Booking — embeddable booking calendar block for BlockNinja CMS with captcha, rate limiting, and webhook receiver (standalone wasm plugin)

3.9 MiB

Languages

Go 80.3%

templ 10.5%

TypeScript 9%

AMPL 0.1%