Skip to content

fix: preserve array query parameters in redirect logic#28734

Open
TheBhowmik wants to merge 10 commits into
calcom:mainfrom
TheBhowmik:fix/issue-28687-serialization
Open

fix: preserve array query parameters in redirect logic#28734
TheBhowmik wants to merge 10 commits into
calcom:mainfrom
TheBhowmik:fix/issue-28687-serialization

Conversation

@TheBhowmik
Copy link
Copy Markdown

What does this PR do?

This PR fixes the incorrect serialization of array query parameters within the getServerSideProps redirect logic.

Previously, the code used an unsafe type cast (as Record<string, string>) when initializing URLSearchParams. This caused query parameters with multiple values (e.g., ?test=a&test=b) to be merged into a single string separated by a comma (e.g., ?test=a,b) during server-side redirects.

Changes:

Removed the unsafe type casting that forced arrays into strings.

Implemented a robust loop that iterates through context.query entries.

Used URLSearchParams.append() to ensure that each value in an array is preserved as an individual key-value pair in the resulting query string.

Fixes #28687

Visual Demo (For contributors especially)

Image Demo :

Before Fix (Buggy)
.../15min?test=apple,banana

After Fix (Correct)
.../15min?test=apple&test=banana

Mandatory Tasks (DO NOT REMOVE)

  • I have self-reviewed the code
  • N/A
  • I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Screenshot 2026-04-04 025356 Screenshot 2026-04-04 155624
  1. Start the development server and navigate to a user profile page with repeated query parameters: http://localhost:3000/wow?test=apple&test=banana

  2. Click on any event type card (e.g., "15 min meeting") to trigger the server-side redirect logic in getServerSideProps.ts.

  3. Expected Result: The final redirected URL should preserve the ampersand separator: localhost:3000/wow/15min?test=apple&test=banana&...

  4. Original Buggy Behavior: The URL would incorrectly squash the values into a single string: localhost:3000/wow/15min?test=apple,banana&...

  • Are there environment variables that should be set?
    No. This is a logic fix for standard URL serialization.

  • What are the minimal test data to have?
    A local user profile (e.g., /wow) and at least one active Event Type (e.g., "15 min meeting").

  • What is expected (happy path) to have (input and output)?
    Input: Navigating to /[user]?test=a&test=b and clicking an event card.
    Output: Redirecting to /[user]/[event]?test=a&test=b (preserving the & separator).

  • Any other important info that could help to test that PR
    This fix replaces an unsafe type cast that was causing URLSearchParams to treat arrays as single comma-separated strings.

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Apr 4, 2026

CLA assistant check
All committers have signed the CLA.

@github-actions github-actions Bot added the 🐛 bug Something isn't working label Apr 4, 2026
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/web/server/lib/[user]/getServerSideProps.ts">

<violation number="1" location="apps/web/server/lib/[user]/getServerSideProps.ts:118">
P2: Scalar empty-string query parameters are silently dropped by the new `if (value)` filter, changing redirect query semantics (e.g., `?foo=` is removed).</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.

Comment thread apps/web/server/lib/[user]/getServerSideProps.ts Outdated
@TheBhowmik
Copy link
Copy Markdown
Author

@cubic-dev-ai I have addressed this in my latest commit by explicitly checking for null and undefined. Please re-verify.

@cubic-dev-ai
Copy link
Copy Markdown
Contributor

cubic-dev-ai Bot commented Apr 4, 2026

@cubic-dev-ai I have addressed this in my latest commit by explicitly checking for null and undefined. Please re-verify.

@TheBhowmik I have started the AI code review. It will take a few minutes to complete.

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Copy link
Copy Markdown
Member

@sahitya-chandra sahitya-chandra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you clean up the comments

@TheBhowmik
Copy link
Copy Markdown
Author

"Done! I've removed the comments, cleaned up the unused imports/variables, and updated the branch with the latest changes from main. Ready for another look!"

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 6, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c6a94044-a223-4819-b936-b9dc39f08990

📥 Commits

Reviewing files that changed from the base of the PR and between 9b48b28 and 01b1b93.

📒 Files selected for processing (1)
  • apps/web/server/lib/[user]/getServerSideProps.ts

📝 Walkthrough

Walkthrough

Replaced node:querystring encode usage with a local getQueryString() that builds query strings via URLSearchParams, appending multiple values for array entries and skipping undefined/null. Dynamic-group and single-event-type redirects now append the getQueryString(context.query) output. Introduced a local orgDomain variable (set only when valid) and pass it to handleOrgRedirect and getUsersInOrgContext. Local typings tightened and the exported getUsersInOrgContext gained an explicit Promise<Awaited<ReturnType<UserRepository["findUsersByUsername"]>>> return type.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title 'fix: preserve array query parameters in redirect logic' accurately describes the main change—fixing query parameter serialization to preserve array values as multiple key-value pairs.
Description check ✅ Passed The PR description is directly related to the changeset, providing clear context about the bug fix, implementation approach, testing steps, and visual demonstrations of the before/after behavior.
Linked Issues check ✅ Passed The code changes fully address issue #28687 by removing the unsafe type cast, implementing a loop to iterate through context.query entries, and using URLSearchParams.append() to preserve array values as separate key-value pairs [#28687].
Out of Scope Changes check ✅ Passed All changes are directly related to fixing query parameter serialization. Type annotation updates to getUsersInOrgContext, orgDomain handling, and log typing are supporting changes necessary for the serialization fix.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
apps/web/server/lib/[user]/getServerSideProps.ts (1)

111-121: Refactor duplicated query serialization and guard empty query suffix.

The same context.query serialization logic is implemented twice. Extracting it into a local helper will keep both redirect paths consistent and avoid future drift. Also, build destination URLs without forcing ? when the query string is empty.

♻️ Proposed refactor
 export const getServerSideProps: GetServerSideProps<UserPageProps> = async (context) => {
+  const buildQueryString = (query: typeof context.query) => {
+    const searchParams = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+      if (Array.isArray(value)) {
+        value.forEach((v) => searchParams.append(key, v));
+      } else if (value !== undefined && value !== null) {
+        searchParams.append(key, value);
+      }
+    }
+    return searchParams.toString();
+  };
+
   const { currentOrgDomain, isValidOrgDomain } = orgDomainConfig(context.req, context.params?.orgSlug);
@@
   if (isDynamicGroup) {
     const destinationUrl = encodeURI(`/${usernameList.join("+")}/dynamic`);
-
-    const searchParams = new URLSearchParams();
-    Object.entries(context.query).forEach(([key, value]) => {
-      if (Array.isArray(value)) {
-        value.forEach((v) => searchParams.append(key, v));
-      } else if (value !== undefined && value !== null) {
-        searchParams.append(key, value);
-      }
-    });
-
-    const originalQueryString = searchParams.toString();
-    const destinationWithQuery = `${destinationUrl}?${originalQueryString}`;
+    const originalQueryString = buildQueryString(context.query);
+    const destinationWithQuery = originalQueryString
+      ? `${destinationUrl}?${originalQueryString}`
+      : destinationUrl;
@@
   if (eventTypes.length === 1 && context.query.redirect !== "false") {
     const urlDestination = `/${user.profile.username}/${eventTypes[0].slug}`;
-    const searchParams = new URLSearchParams();
-
-    Object.entries(context.query).forEach(([key, value]) => {
-      if (Array.isArray(value)) {
-        value.forEach((v) => searchParams.append(key, v));
-      } else if (value !== undefined && value !== null) {
-        searchParams.append(key, value);
-      }
-    });
-
-    const urlQuery = searchParams.toString();
+    const urlQuery = buildQueryString(context.query);
+    const destination = urlQuery ? `${encodeURI(urlDestination)}?${urlQuery}` : encodeURI(urlDestination);

     return {
       redirect: {
         permanent: false,
-        destination: `${encodeURI(urlDestination)}?${urlQuery}`,
+        destination,
       },
     };
   }

Also applies to: 172-188

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/server/lib/`[user]/getServerSideProps.ts around lines 111 - 121,
Extract the duplicated serialization of context.query into a small local helper
(e.g., serializeQuery or buildQueryString) that takes context.query and returns
the encoded query string; replace the duplicate blocks that build
originalQueryString with calls to that helper. When composing
destinationWithQuery (or any redirect URL), append the query string only if the
helper returns a non-empty string (i.e., use `${destinationUrl}?${qs}` only when
qs is truthy) so you don't add a trailing '?' for empty queries. Ensure both
places referenced in the diff (the block producing
originalQueryString/destinationWithQuery and the other occurrence around lines
172-188) call the same helper to keep behavior consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@apps/web/server/lib/`[user]/getServerSideProps.ts:
- Around line 111-121: Extract the duplicated serialization of context.query
into a small local helper (e.g., serializeQuery or buildQueryString) that takes
context.query and returns the encoded query string; replace the duplicate blocks
that build originalQueryString with calls to that helper. When composing
destinationWithQuery (or any redirect URL), append the query string only if the
helper returns a non-empty string (i.e., use `${destinationUrl}?${qs}` only when
qs is truthy) so you don't add a trailing '?' for empty queries. Ensure both
places referenced in the diff (the block producing
originalQueryString/destinationWithQuery and the other occurrence around lines
172-188) call the same helper to keep behavior consistent.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9b51f911-1b9b-412d-9437-e002108286ae

📥 Commits

Reviewing files that changed from the base of the PR and between facc074 and 9b48b28.

📒 Files selected for processing (1)
  • apps/web/server/lib/[user]/getServerSideProps.ts

@pull-request-size pull-request-size Bot added size/M and removed size/S labels Apr 6, 2026
@TheBhowmik
Copy link
Copy Markdown
Author

Final update: Refactored the logic into a typed getQueryString helper. This addresses the array serialization issue and the trailing '?' suffix. The file is now fully compliant with Biome nursery linting rules (explicit types, no ternaries). Ready for review!"

@TheBhowmik
Copy link
Copy Markdown
Author

@sahitya-chandra sir ?

@github-actions
Copy link
Copy Markdown
Contributor

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

@github-actions github-actions Bot added the Stale label Apr 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🐛 bug Something isn't working size/M Stale

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Incorrect serialization of array query parameters in redirect logic

3 participants