fix: prevent duplicate calendar account linking (#13310)

* fix: prevent signing up multiple times from same account

* revert: lark calendar changes

* credential clean up if duplicate

* fix code duplication and check before credential creation

* feat: useRouterQuery allow unset queryParam

* feat: showToast on account duplication attempt

* Small tweak to copy

* Updated other calendars not to use checkDuplicateCalendar

* Add account already linked to apps/installed/calendar

---------

Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>

packages/app-store/zohocalendar/api/callback.ts

@@ -6,6 +6,7 @@ import { getSafeRedirectUrl } from "@calcom/lib/getSafeRedirectUrl";
 import logger from "@calcom/lib/logger";
 import { defaultHandler, defaultResponder } from "@calcom/lib/server";
 import prisma from "@calcom/prisma";
+import { Prisma } from "@calcom/prisma/client";
 
 import getAppKeysFromSlug from "../../_utils/getAppKeysFromSlug";
 import getInstalledAppPath from "../../_utils/getInstalledAppPath";
@@ -64,15 +65,6 @@ async function getHandler(req: NextApiRequest, res: NextApiResponse) {
     expires_in: Math.round(+new Date() / 1000 + responseBody.expires_in),
   };
 
-  const credential = await prisma.credential.create({
-    data: {
-      type: config.type,
-      key,
-      userId: req.session.user.id,
-      appId: config.slug,
-    },
-  });
-
   const calendarResponse = await fetch("https://calendar.zoho.com/api/v1/calendars", {
     method: "GET",
     headers: {
@@ -82,17 +74,43 @@ async function getHandler(req: NextApiRequest, res: NextApiResponse) {
   });
   const data = await calendarResponse.json();
 
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const primaryCalendar = data.calendars.find((calendar: any) => calendar.isdefault);
 
   if (primaryCalendar.uid) {
-    await prisma.selectedCalendar.create({
+    const credential = await prisma.credential.create({
       data: {
+        type: config.type,
+        key,
         userId: req.session.user.id,
-        integration: config.type,
-        externalId: primaryCalendar.uid,
-        credentialId: credential.id,
+        appId: config.slug,
       },
     });
+    // Wrapping in a try/catch to reduce chance of race conditions-
+    // also this improves performance for most of the happy-paths.
+    try {
+      await prisma.selectedCalendar.create({
+        data: {
+          userId: req.session.user.id,
+          integration: config.type,
+          externalId: primaryCalendar.uid,
+          credentialId: credential.id,
+        },
+      });
+    } catch (error) {
+      await prisma.credential.delete({ where: { id: credential.id } });
+      let errorMessage = "something_went_wrong";
+      if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002") {
+        errorMessage = "account_already_linked";
+      }
+      res.redirect(
+        `${
+          getSafeRedirectUrl(state?.onErrorReturnTo) ??
+          getInstalledAppPath({ variant: config.variant, slug: config.slug })
+        }?error=${errorMessage}`
+      );
+      return;
+    }
   }
 
   res.redirect(