chore: Integrate mark-no-show booking audit

[hariombalhara]

What does this PR do?

Integrates booking audit logging for the mark no-show functionality. This is PR 6 from the booking audit integration plan.

When hosts or attendees are marked as no-show, the system now logs audit events using BookingEventHandlerService:

• onHostNoShowUpdated - When a host is marked as no-show
• onAttendeeNoShowUpdated - When an attendee is marked as no-show

Changes:

• handleMarkNoShow.ts: Added audit logging calls with actor derivation and action source tracking
• markNoShow.handler.ts: Passes actionSource: "WEBAPP" and userUuid for authenticated users
• markHostAsNoShow.handler.ts: Passes actionSource: "WEBAPP" for public route (attendee marking host)
• bookings.service.ts (API v2): Passes actionSource: "API_V2"

Audit Data Schema:

• Host no-show: { noShowHost: { old: null, new: true } } (old value always null since hosts can only be marked, not unmarked)
• Attendee no-show: { noShowAttendee: { old: null, new: boolean } } (old value not easily accessible in current flow)

Updates since last revision:

• Simplified host no-show audit: removed unnecessary DB query for old value since hosts can only be marked as no-show (not unmarked)
• Added JSDoc comment documenting better approaches for attendee actor identification in public route

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - internal audit logging only.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

1. Mark a host as no-show via the webapp and verify audit event is logged
2. Mark an attendee as no-show via the webapp and verify audit event is logged
3. Mark absent via API v2 and verify audit event includes API_V2 as source
4. Test the public route (attendee marking host as no-show) and verify guest actor is created

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have checked if my changes generate no new warnings

Human Review Checklist

• Verify audit data schema is acceptable (using null for old values)
• Verify guest actor approach is acceptable for public routes (uses fallback unique identifier)
• Confirm additional DB query for org ID in host no-show path is necessary

Important Notes for Reviewers

1. Actor derivation: For public routes (markHostAsNoShow), a guest actor with a unique identifier is created since there's no authenticated user. JSDoc comment documents better approaches for future improvement.
2. Old values: Both host and attendee no-show use null for old value - host because it can only be marked (not unmarked), attendee because the previous value isn't easily accessible in the current flow.

---

Link to Devin run

https://app.devin.ai/sessions/05bd714240a6450c908cdcd505310115

Requested by

hariom@cal.com (@hariombalhara)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

4 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
api-v2	Ignored	Preview	Jan 8, 2026 9:00am
cal	Ignored		Jan 8, 2026 9:00am
cal-companion	Ignored	Preview	Jan 8, 2026 9:00am
cal-eu	Ignored		Jan 8, 2026 9:00am