diff --git a/apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts b/apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts index 6b55717f5c..ebad60d604 100644 --- a/apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts +++ b/apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts @@ -205,11 +205,8 @@ export class BookingsController_2024_04_15 { clientId?.toString() || (await this.getOAuthClientIdFromEventType(body.eventTypeId)); const { orgSlug, locationUrl } = body; try { - if (body.rescheduleUid) { - await this.validateRescheduleBooking(body.rescheduleUid, body.eventTypeId); - } else { - await this.checkBookingRequiresAuthentication(req, body.eventTypeId); - } + await this.checkBookingRequiresAuthentication(req, body.eventTypeId, body.rescheduleUid); + const bookingRequest = await this.createNextApiBookingRequest(req, oAuthClientId, locationUrl, isEmbed); const booking = await this.regularBookingService.createBooking({ bookingData: bookingRequest.body, @@ -463,26 +460,25 @@ export class BookingsController_2024_04_15 { return oAuthClientParams.platformClientId; } - private async validateRescheduleBooking(rescheduleUid: string, eventTypeId: number): Promise { + private async isValidRescheduleBooking(rescheduleUid: string, eventTypeId: number): Promise { const { bookingInfo } = await getBookingInfo(rescheduleUid); if (!bookingInfo) { - throw new NotFoundException( - `Booking with UID=${rescheduleUid} does not exist. Cannot reschedule a non-existent booking.` - ); + return false; } if (bookingInfo.status !== "ACCEPTED" && bookingInfo.status !== "PENDING") { - throw new BadRequestException( - `Booking with UID=${rescheduleUid} has invalid status (status: ${bookingInfo.status}). Only ACCEPTED or PENDING bookings can be rescheduled.` - ); + return false; } if (bookingInfo.eventTypeId !== eventTypeId) { - throw new BadRequestException( - `Booking with UID=${rescheduleUid} is for a different event type (eventTypeId: ${bookingInfo.eventTypeId}). Cannot reschedule to a different event type (eventTypeId: ${eventTypeId}).` - ); + return false; } + return true; } - private async checkBookingRequiresAuthentication(req: Request, eventTypeId: number): Promise { + private async checkBookingRequiresAuthentication( + req: Request, + eventTypeId: number, + rescheduleUid?: string + ): Promise { const eventType = await this.eventTypeRepository.findByIdIncludeHostsAndTeamMembers({ id: eventTypeId, }); @@ -491,6 +487,17 @@ export class BookingsController_2024_04_15 { return; } + if (rescheduleUid) { + const isValidRescheduleBooking = await this.isValidRescheduleBooking(rescheduleUid, eventTypeId); + if (isValidRescheduleBooking) { + return; + } else { + throw new BadRequestException( + "Trying to reschedule an event-type which requires authentication but provided invalid rescheduleUid." + ); + } + } + const userId = await this.getOwnerId(req); if (!userId) { @@ -501,8 +508,7 @@ export class BookingsController_2024_04_15 { const isEventTypeOwner = eventType.userId === userId; const isHost = eventType.hosts.some((host) => host.userId === userId); - const isTeamAdminOrOwner = - eventType.team?.members.some((member) => member.userId === userId) ?? false; + const isTeamAdminOrOwner = eventType.team?.members.some((member) => member.userId === userId) ?? false; let isOrgAdminOrOwner = false; if (eventType.team?.parentId) {