feat(dashboard): create an event from the dashboard

[harshtandiya]

Stacked on develop.

What changed

Creating an event needed Desk. This adds a create page at /manage/team/events/new,
reached from the Create Event button that has been inert on the team pages since they
shipped. It sits outside the manager shell, so the team comes from the route guard
rather than the layout.

• buzz.api.events.create_event — membership decides who may call it; anything
  below Manager is refused, as is a non-member.
• Schedule — start and end dates and times, plus a time zone picker searchable by
  city, country, everyday name or zone id.
• Location — one control for both kinds: the team's venues, searched as you type
  with an inline add, or a Zoom meeting under Virtual.
• Banner — the generated contour pattern, seeded by the title as you type. Opened
  up (wider spacing, 2px lines) since it moired at card size.

Worth a look during review:

• Category and host are filled in by the server. Buzz Event requires both and the
  form asks for neither. Host is the team's own, minted on first use. Category is
  Meetups, or Zoom Meeting when Zoom was chosen — that one isn't cosmetic, it's what
  marks an event Zoom-backed (buzz/utils.py:13).
• Zoom is booked automatically after insert, where Desk has a manual button. A
  failure leaves the event standing rather than rolling it back, since the call goes out
  to Zoom mid-request.
• Time zone names come from the runtime, which still reports renamed zones under
  their old names (Asia/Calcutta). The eight a reader would notice are mapped forward;
  both spellings resolve the same in ZoneInfo.
• fix(tests): stamp a team on the seeded test records rides along. before_tests
  seeds a venue, host and event without the team those doctypes made mandatory in the
  multi-tenancy work, so bench run-tests failed for every module before a single
  test ran. Nothing here could be tested without it. Happy to split it out.

Not done: no unsaved-changes guard, so Back discards a filled-in form silently; nothing
in the dashboard has been checked in dark mode; medium is derived server-side only, so
the picker no longer tracks it.

Demo

The create page, filled in — the banner pattern is seeded by the title as you type:

One control for both kinds of location, venues and Zoom under the same picker:

Time zone search, by city rather than by zone id:

If the user is Viewer for the team

[greptile-apps]

Greptile Summary

The PR adds dashboard event creation, including scheduling, venue creation, Zoom selection, generated banners, role-aware UI controls, and server-side event defaults. It also adds event-level venue ownership validation, but the cross-team disclosure fix remains incomplete for unstamped venues.

• Adds a new dashboard event-creation page and supporting schedule, location, timezone, and banner utilities.
• Adds a protected event-creation API that derives category, host, and delivery medium.
• Adds Zoom meeting creation and test-fixture team assignments.
• Adds venue-team validation, while retaining an ownership bypass for null or empty venue teams.

Confidence Score: 3/5

The PR is not yet safe to merge because the attempted venue-ownership fix still permits cross-team address disclosure through unstamped venues.

The new validator rejects venues belonging to a different populated team but deliberately accepts null or empty team values; the create API can therefore persist one of those venues on an event, and booking and calendar paths subsequently expose its address without another ownership check.

Files Needing Attention: buzz/events/doctype/buzz_event/buzz_event.py and buzz/api/events/services.py

Security Review

The venue ownership boundary remains bypassable for legacy venues with no team stamp. A manager can link such a venue to a new event, after which downstream booking and calendar paths expose its address without another authorization check.

Important Files Changed

Filename	Overview
buzz/api/events/services.py	Adds authorized event creation, derived host/category values, and optional Zoom booking; the caller-provided venue relies on Buzz Event validation for ownership enforcement.
buzz/events/doctype/buzz_event/buzz_event.py	Adds venue-team validation, but accepts null or empty venue teams and therefore leaves the previously reported disclosure reachable.
dashboard/src/pages/manage/events/CreateEvent.vue	Adds the event-creation form and correctly prevents roles below Manager from submitting through canCreate and canSave.
dashboard/src/composables/useTeamAccess.ts	Adds a tri-state membership guard for pages outside the manager shell; role-specific creation is separately enforced by the page.
dashboard/src/router.ts	Registers the full-bleed create-event route outside the manager shell, with access handled by the page guard.
dashboard/src/components/dashboard/events/EventLocation.vue	Adds a unified venue and Zoom selector with inline venue creation.
dashboard/src/components/dashboard/events/EventSchedule.vue	Adds event date, time, and timezone controls for the creation flow.

Prompt To Fix All With AI

### Issue 1
buzz/events/doctype/buzz_event/buzz_event.py:115-118
**Unstamped venues bypass ownership**

When a manager supplies the name of a legacy venue whose `team` is null or empty, this truthiness check accepts the venue and links it to the manager's event, causing its address to be exposed through booking details, booking confirmation, and calendar invitations.

**How this was verified:** The create API copies the supplied venue after authorizing only the event team, while downstream booking and calendar paths dereference the accepted venue without another ownership check.

```suggestion
		venue_team = frappe.db.get_value("Event Venue", self.venue, "team")
		if venue_team != self.team:
			frappe.throw(_("Venue {0} belongs to another team.").format(self.venue))
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (8): Last reviewed commit: "feat(dashboard): keep an event from endi..." | Re-trigger Greptile}

[github-actions]

✅ UI Demo Check — a screenshot or demo is attached.

[greptile-apps]

Unstamped venues bypass ownership

When a manager supplies the name of a legacy venue whose team is null or empty, this truthiness check accepts the venue and links it to the manager's event, causing its address to be exposed through booking details, booking confirmation, and calendar invitations.

How this was verified: The create API copies the supplied venue after authorizing only the event team, while downstream booking and calendar paths dereference the accepted venue without another ownership check.

Suggested change

	venue_team = frappe.db.get_value("Event Venue", self.venue, "team")
	# An unstamped venue predates the team backfill; role permissions still gate it.
	if venue_team and venue_team != self.team:
	frappe.throw(_("Venue {0} belongs to another team.").format(self.venue))
	venue_team = frappe.db.get_value("Event Venue", self.venue, "team")
	if venue_team != self.team:
	frappe.throw(_("Venue {0} belongs to another team.").format(self.venue))

Knowledge Base Used:

• Event configuration and scheduling
• Frappe application integration

Prompt To Fix With AI

This is a comment left during a code review.
Path: buzz/events/doctype/buzz_event/buzz_event.py
Line: 115-118

Comment:
**Unstamped venues bypass ownership**

When a manager supplies the name of a legacy venue whose `team` is null or empty, this truthiness check accepts the venue and links it to the manager's event, causing its address to be exposed through booking details, booking confirmation, and calendar invitations.

**How this was verified:** The create API copies the supplied venue after authorizing only the event team, while downstream booking and calendar paths dereference the accepted venue without another ownership check.

```suggestion
		venue_team = frappe.db.get_value("Event Venue", self.venue, "team")
		if venue_team != self.team:
			frappe.throw(_("Venue {0} belongs to another team.").format(self.venue))
```

**Knowledge Base Used:**
- [Event configuration and scheduling](https://app.greptile.com/bwh-tech/-/custom-context/knowledge-base/bwhtech/buzz/-/docs/event-configuration.md)
- [Frappe application integration](https://app.greptile.com/bwh-tech/-/custom-context/knowledge-base/bwhtech/buzz/-/docs/frappe-application-integration.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[harshtandiya]

Valid catch — an unstamped venue is linkable by any team, which is the same leak narrowed to legacy rows. The justification in my comment was a bad analogy: has_team_access abstains on an unstamped row because role permissions still gate it, and nothing gates a venue link.

Not taking the suggestion in this PR, though. Dropping the truthiness check turns a data problem into a save failure — any site still holding such a row would find those events unsaveable, including edits that never touch the venue. The backfill should land first, then the guard tightens.

Tracked in #375, which also notes that buzz.patches.assign_default_team already covers Event Venue and is logged as applied, so the remaining work is mostly confirming it left nothing behind before the guard changes.

[greptile-apps]

That’s a reasonable trade-off for this PR. The current check still protects already-stamped venues, while tightening it before the backfill is verified would make legacy records unsaveable—even on unrelated edits. #375 is the right follow-up: confirm assign_default_team left no unstamped venues, then change the guard to reject any venue whose team differs, including empty values.