packages/prisma/cleanup-pbac.ts (1)

82-89: Make redirect cleanup more specific

The current query for cleaning up redirects might catch unintended records. The from field check only looks for specific usernames without considering the organization context.

     await prisma.tempOrgRedirect.deleteMany({
       where: {
         OR: [
-          { from: { in: ["owner", "events", "analytics", "coordinator", "support"] } },
+          { 
+            from: { in: ["owner", "events", "analytics", "coordinator", "support"] },
+            fromOrgId: 0, // Ensure these are the redirects created by the seed
+          },
           { toUrl: { contains: "pbac-demo-org" } },
         ],
       },
     });

packages/prisma/seed-pbac-only.ts (1)

22-26: Display actual demo passwords for better usability

The current output shows "password" as a placeholder, but users need the actual passwords to log in. Since these are demo credentials as mentioned in the PR objectives, consider showing the actual passwords.

     console.log("\n🔐 Login Credentials:");
     result.users.forEach(({ user, role, customRole }) => {
       const roleText = customRole ? `${role} + ${customRole}` : role;
-      console.log(`  - ${user.name}: ${user.email} / password (${roleText})`);
+      // Map emails to their demo passwords
+      const passwordMap: Record<string, string> = {
+        "owner@pbac-demo.com": "pbac-owner-2024!",
+        "events@pbac-demo.com": "events-2024!",
+        "analytics@pbac-demo.com": "analytics-2024!",
+        "coordinator@pbac-demo.com": "coordinator-2024!",
+        "support@pbac-demo.com": "support-2024!",
+      };
+      const password = passwordMap[user.email] || "unknown";
+      console.log(`  - ${user.name}: ${user.email} / ${password} (${roleText})`);
     });

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Select selects only the fields you specify explicitly.

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Only select data you need.

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Select selects only the fields you specify explicitly.

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Only select data you need.

packages/prisma/package.json (1)

21-22: Add an execution-guard or naming convention to prevent accidental prod execution

The new seed-pbac script parallels other ad-hoc seeders, but unlike the default Prisma seed hook it can be invoked in any environment. Consider adding a guard (e.g., check process.env.NODE_ENV !== 'production') inside seed-pbac-organization.ts or prefixing the script with NODE_ENV=development to avoid seeding PBAC demo data in production by mistake.

-    "seed-pbac": "ts-node --transpile-only ./seed-pbac-organization.ts"
+    "seed-pbac": "NODE_ENV=development ts-node --transpile-only ./seed-pbac-organization.ts"

Alternatively, rename to seed-pbac:dev to signal its intent.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Select selects only the fields you specify explicitly.

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Only select data you need.

packages/prisma/seed-pbac-organization.ts (3)

24-32: Return existing data when organization already exists

When the organization exists, returning empty customRoles and users arrays is misleading. The existing organization likely has roles and users that should be fetched and returned for consistency.

---

316-323: Existing users returned with incorrect default roles

When existing users are found, they're returned with hardcoded MembershipRole.MEMBER and customRole: null, which may not reflect their actual roles. Consider fetching the actual membership data to return accurate role information.

---

468-478: Hardcoded role assignment logic needs refactoring

The role assignment uses hardcoded email checks and assigns "owner_role" which wasn't created in createCustomRoles. This logic is fragile and should use dynamic role mapping based on user data structure.

packages/prisma/seed-pbac-organization.ts (1)

617-691: Consider consolidating hardcoded data to reduce duplication

The password mapping and permission definitions are duplicated across the file. Consider creating centralized data structures to define user data and role permissions, then reference them in both creation and utility functions to improve maintainability.

+// Centralized user and role data
+const DEMO_USERS = {
+  owner: { email: "owner@pbac-demo.com", password: "pbac-owner-2024!", role: "owner" },
+  events: { email: "events@pbac-demo.com", password: "events-2024!", role: "Event Manager" },
+  // ... other users
+};
+
+const ROLE_PERMISSIONS = {
+  "Event Manager": [
+    { resource: "eventType", action: "create" },
+    // ... other permissions
+  ],
+  // ... other roles
+};

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Select selects only the fields you specify explicitly.

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-21T13:54:11.770Z
Learning: Applies to backend/**/*.{ts,tsx} : For Prisma queries: Only select data you need.