fix: Remove hosts - verify event type belongs to event type

[joeauyeung]

What does this PR do?

• When removing hosts from an event type, validate that the passed eventTypeId and userIds belong to the team

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

• Are there environment variables that should be set?
• What are the minimal test data to have?
• What is expected (happy path) to have (input and output)?
• Any other important info that could help to test that PR

Checklist

• I haven't read the contributing guide
• My code doesn't follow the style guidelines of this project
• I haven't commented my code, particularly in hard-to-understand areas
• I haven't checked if my changes generate no new warnings

---

Summary by cubic

Restrict host removal to team-owned event types and users in the team. Adds a teamId check and filters userIds to accepted members to prevent cross-team changes.

^{Written for commit 16f3ebd. Summary will update automatically on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
cal	Ignored			Nov 21, 2025 2:44pm
cal-eu	Ignored			Nov 21, 2025 2:44pm

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (all 1 issues)

Understand the root cause of the following 1 issues and fix them.


<file name="packages/features/membership/repositories/MembershipRepository.ts">

<violation number="1" location="packages/features/membership/repositories/MembershipRepository.ts:144">
Limit this query to the fields actually consumed (e.g., userId) instead of returning full membership rows; otherwise Prisma fetches unnecessary, potentially sensitive columns.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

Limit this query to the fields actually consumed (e.g., userId) instead of returning full membership rows; otherwise Prisma fetches unnecessary, potentially sensitive columns.

Prompt for AI agents

Address the following comment on packages/features/membership/repositories/MembershipRepository.ts at line 144:

<comment>Limit this query to the fields actually consumed (e.g., userId) instead of returning full membership rows; otherwise Prisma fetches unnecessary, potentially sensitive columns.</comment>

<file context>
@@ -134,6 +134,22 @@ export class MembershipRepository {
+    userIds: number[];
+    teamId: number;
+  }) {
+    return prisma.membership.findMany({
+      where: {
+        userId: { in: userIds },
</file context>

[github-actions]

E2E results are ready!

• Workflow #89509.1 latest results