From 3fcba33b1b1e4d7416c1d40e15a70c3eb52e2265 Mon Sep 17 00:00:00 2001 From: Morgan <33722304+ThyMinimalDev@users.noreply.github.com> Date: Thu, 11 Apr 2024 11:52:31 +0300 Subject: [PATCH] fix: platform booking endpoints should be public (#14509) --- .../controllers/bookings.controller.ts | 18 ++-- apps/api/v2/swagger/documentation.json | 102 +++++++++--------- 2 files changed, 56 insertions(+), 64 deletions(-) diff --git a/apps/api/v2/src/ee/bookings/controllers/bookings.controller.ts b/apps/api/v2/src/ee/bookings/controllers/bookings.controller.ts index c198c65eb7..88e805618f 100644 --- a/apps/api/v2/src/ee/bookings/controllers/bookings.controller.ts +++ b/apps/api/v2/src/ee/bookings/controllers/bookings.controller.ts @@ -27,7 +27,7 @@ import { User } from "@prisma/client"; import { Request } from "express"; import { NextApiRequest } from "next/types"; -import { BOOKING_WRITE, SUCCESS_STATUS } from "@calcom/platform-constants"; +import { BOOKING_READ, SUCCESS_STATUS } from "@calcom/platform-constants"; import { getAllUserBookings, getBookingInfo, @@ -59,9 +59,9 @@ export class BookingsController { private readonly prismaReadService: PrismaReadService ) {} - // note(Rajiv): currently this endpoint is atoms only @Get("/") @UseGuards(AccessTokenGuard) + @Permissions([BOOKING_READ]) @ApiQuery({ name: "filters[status]", enum: Status, required: true }) @ApiQuery({ name: "limit", type: "number", required: false }) @ApiQuery({ name: "cursor", type: "number", required: false }) @@ -87,7 +87,6 @@ export class BookingsController { }; } - // note(Rajiv): currently this endpoint is atoms only @Get("/:bookingUid") async getBooking(@Param("bookingUid") bookingUid: string): Promise { const { bookingInfo } = await getBookingInfo(bookingUid); @@ -102,7 +101,6 @@ export class BookingsController { }; } - // note(Rajiv): currently this endpoint is atoms only @Get("/:bookingUid/reschedule") async getBookingForReschedule(@Param("bookingUid") bookingUid: string): Promise> { const booking = await getBookingForReschedule(bookingUid); @@ -118,12 +116,11 @@ export class BookingsController { } @Post("/") - @Permissions([BOOKING_WRITE]) async createBooking( @Req() req: Request & { userId?: number }, @Body() _: CreateBookingInput ): Promise> { - req.userId = await this.getOwnerId(req); + req.userId = (await this.getOwnerId(req)) ?? -1; req.body = { ...req.body, noEmail: true }; try { const booking = await handleNewBooking(req as unknown as NextApiRequest & { userId?: number }); @@ -138,14 +135,13 @@ export class BookingsController { } @Post("/:bookingId/cancel") - @Permissions([BOOKING_WRITE]) async cancelBooking( @Req() req: Request & { userId?: number }, @Param("bookingId") bookingId: string, @Body() body: CancelBookingInput ): Promise { if (bookingId) { - req.userId = await this.getOwnerId(req); + req.userId = (await this.getOwnerId(req)) ?? -1; req.body = { ...body, id: parseInt(bookingId) }; try { await handleCancelBooking(req as unknown as NextApiRequest & { userId?: number }); @@ -162,12 +158,11 @@ export class BookingsController { } @Post("/reccuring") - @Permissions([BOOKING_WRITE]) async createReccuringBooking( @Req() req: Request & { userId?: number }, @Body() _: CreateReccuringBookingInput[] ): Promise> { - req.userId = await this.getOwnerId(req); + req.userId = (await this.getOwnerId(req)) ?? -1; req.body = { ...req.body, noEmail: true }; try { const createdBookings: BookingResponse[] = await handleNewRecurringBooking( @@ -184,12 +179,11 @@ export class BookingsController { } @Post("/instant") - @Permissions([BOOKING_WRITE]) async createInstantBooking( @Req() req: Request & { userId?: number }, @Body() _: CreateBookingInput ): Promise>>> { - req.userId = await this.getOwnerId(req); + req.userId = (await this.getOwnerId(req)) ?? -1; req.body = { ...req.body, noEmail: true }; try { const instantMeeting = await handleInstantMeeting( diff --git a/apps/api/v2/swagger/documentation.json b/apps/api/v2/swagger/documentation.json index f06355e15c..5bb6252432 100644 --- a/apps/api/v2/swagger/documentation.json +++ b/apps/api/v2/swagger/documentation.json @@ -217,7 +217,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/UpdateManagedUserOutput" + "$ref": "#/components/schemas/GetManagedUserOutput" } } } @@ -253,7 +253,45 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/DeleteManagedUserOutput" + "$ref": "#/components/schemas/GetManagedUserOutput" + } + } + } + } + }, + "tags": [ + "Managed users" + ] + } + }, + "/api/v2/oauth-clients/{clientId}/users/{userId}/force-refresh": { + "post": { + "operationId": "OAuthClientUsersController_forceRefresh", + "parameters": [ + { + "name": "userId", + "required": true, + "in": "path", + "schema": { + "type": "number" + } + }, + { + "name": "clientId", + "required": true, + "in": "path", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/KeysResponseDto" } } } @@ -1677,27 +1715,24 @@ } } }, - "UpdateManagedUserOutput": { + "KeysDto": { "type": "object", "properties": { - "status": { + "accessToken": { "type": "string", - "example": "success", - "enum": [ - "success", - "error" - ] + "example": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" }, - "data": { - "$ref": "#/components/schemas/ManagedUserOutput" + "refreshToken": { + "type": "string", + "example": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" } }, "required": [ - "status", - "data" + "accessToken", + "refreshToken" ] }, - "DeleteManagedUserOutput": { + "KeysResponseDto": { "type": "object", "properties": { "status": { @@ -1709,7 +1744,7 @@ ] }, "data": { - "$ref": "#/components/schemas/ManagedUserOutput" + "$ref": "#/components/schemas/KeysDto" } }, "required": [ @@ -1902,43 +1937,6 @@ "clientSecret" ] }, - "KeysDto": { - "type": "object", - "properties": { - "accessToken": { - "type": "string", - "example": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" - }, - "refreshToken": { - "type": "string", - "example": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" - } - }, - "required": [ - "accessToken", - "refreshToken" - ] - }, - "KeysResponseDto": { - "type": "object", - "properties": { - "status": { - "type": "string", - "example": "success", - "enum": [ - "success", - "error" - ] - }, - "data": { - "$ref": "#/components/schemas/KeysDto" - } - }, - "required": [ - "status", - "data" - ] - }, "RefreshTokenInput": { "type": "object", "properties": {