diff --git a/README.md b/README.md index 009ac0dd0d..da64d6178d 100644 --- a/README.md +++ b/README.md @@ -179,13 +179,12 @@ We make sure of this by not using next in dev, but next build && next start, if See . Here in dev mode OPTIONS method is hardcoded to return only GET and OPTIONS as allowed method. Running in Production mode would cause this file to be not used. This is hot-reloading logic only. To remove this limitation, we need to ensure that on local endpoints are requested by swagger at /api/v1 and not /v1 - ## Hosted api through cal.com -Go to console.com +Go to console.cal.com Add a deployment or go to an existing one. Activate API or Admin addon -Provide your DATABASE-URL +Provide your `DATABASE_URL` Store it safely, you'll get a customApiID, save it. call api.cal.com?apiKey=your_cal_instance_apiKey&customApiId=cal_datasource_key ## How to deploy diff --git a/lib/constants.ts b/lib/constants.ts index 52c7fe0a41..96af470397 100644 --- a/lib/constants.ts +++ b/lib/constants.ts @@ -1 +1 @@ -export const PRISMA_CLIENT_CACHING_TIME = 1000 * 60 * 60 * 24; +export const PRISMA_CLIENT_CACHING_TIME = 1000 * 60 * 60 * 24; // = 86_400_000 ms, 24 hours / 1 day. diff --git a/lib/helpers/customPrisma.ts b/lib/helpers/customPrisma.ts index d5aeaf9749..61edbfd221 100644 --- a/lib/helpers/customPrisma.ts +++ b/lib/helpers/customPrisma.ts @@ -3,7 +3,6 @@ import cache from "memory-cache"; import { NextMiddleware } from "next-api-middleware"; import { PRISMA_CLIENT_CACHING_TIME } from "@calcom/api/lib/constants"; -// import prismaAdmin from "@calcom/console/modules/common/utils/prisma"; import { CONSOLE_URL } from "@calcom/lib/constants"; import { prisma, customPrisma } from "@calcom/prisma"; @@ -16,6 +15,7 @@ export const customPrismaClient: NextMiddleware = async (req, res, next) => { if (!key) { req.prisma = prisma; await next(); + return; } else { // If we have a key, we check if the deployment matching the key, has a databaseUrl value set. const databaseUrl = await fetch( diff --git a/lib/helpers/verifyApiKey.ts b/lib/helpers/verifyApiKey.ts index 4a375aee26..e5cf0332a3 100644 --- a/lib/helpers/verifyApiKey.ts +++ b/lib/helpers/verifyApiKey.ts @@ -37,7 +37,7 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => { // save the user id in the request for later use req.userId = apiKey.userId; // save the isAdmin boolean here for later use - req.isAdmin = await isAdminGuard(req.userId, prisma); + req.isAdmin = await isAdminGuard(req); await next(); }; diff --git a/lib/utils/isAdmin.ts b/lib/utils/isAdmin.ts index aab1454b62..b068ebe12f 100644 --- a/lib/utils/isAdmin.ts +++ b/lib/utils/isAdmin.ts @@ -1,6 +1,7 @@ -import { PrismaClient, UserPermissionRole } from "@prisma/client"; +import { UserPermissionRole } from "@prisma/client"; -export const isAdminGuard = async (userId: number, prisma: PrismaClient) => { +export const isAdminGuard = async (req: NextApiRequest) => { + const { userId, prisma } = req; const user = await prisma.user.findUnique({ where: { id: userId } }); return user?.role === UserPermissionRole.ADMIN; }; diff --git a/lib/utils/webhookSubscriptions.ts b/lib/utils/webhookSubscriptions.ts index af185248b3..51de834f2d 100644 --- a/lib/utils/webhookSubscriptions.ts +++ b/lib/utils/webhookSubscriptions.ts @@ -5,7 +5,7 @@ export type GetSubscriberOptions = { eventTypeId: number; triggerEvent: WebhookTriggerEvents; }; -/** @note will this not work with custom prisma? since we're importing prisma directly and not passing it from request here **/ + const getWebhooks = async (options: GetSubscriberOptions, prisma: PrismaClient) => { const { userId, eventTypeId } = options; const allWebhooks = await prisma.webhook.findMany({ diff --git a/pages/api/users/[userId]/_delete.ts b/pages/api/users/[userId]/_delete.ts index 0f5c208e2a..d03c569709 100644 --- a/pages/api/users/[userId]/_delete.ts +++ b/pages/api/users/[userId]/_delete.ts @@ -33,7 +33,7 @@ import { schemaQueryUserId } from "@lib/validations/shared/queryUserId"; export async function deleteHandler(req: NextApiRequest) { const { prisma } = req; const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req.userId, req.prisma); + const isAdmin = await isAdminGuard(req); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/[userId]/_get.ts b/pages/api/users/[userId]/_get.ts index 76b2603a89..36320e1636 100644 --- a/pages/api/users/[userId]/_get.ts +++ b/pages/api/users/[userId]/_get.ts @@ -35,7 +35,7 @@ export async function getHandler(req: NextApiRequest) { const { prisma } = req; const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req.userId, req.prisma); + const isAdmin = await isAdminGuard(req); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/[userId]/_patch.ts b/pages/api/users/[userId]/_patch.ts index b7bf27c47f..9d12d178bc 100644 --- a/pages/api/users/[userId]/_patch.ts +++ b/pages/api/users/[userId]/_patch.ts @@ -55,7 +55,7 @@ import { schemaUserEditBodyParams, schemaUserReadPublic } from "@lib/validations export async function patchHandler(req: NextApiRequest) { const { prisma } = req; const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req.userId, req.prisma); + const isAdmin = await isAdminGuard(req); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/_get.ts b/pages/api/users/_get.ts index 42ec41ecfb..703760adb5 100644 --- a/pages/api/users/_get.ts +++ b/pages/api/users/_get.ts @@ -23,8 +23,9 @@ import { Prisma } from ".prisma/client"; * 404: * description: No users were found */ -async function getHandler({ userId, prisma }: NextApiRequest) { - const isAdmin = await isAdminGuard(userId, prisma); +async function getHandler(req: NextApiRequest) { + const { userId, prisma } = req; + const isAdmin = await isAdminGuard(req); const where: Prisma.UserWhereInput = {}; // If user is not ADMIN, return only his data. if (!isAdmin) where.id = userId; diff --git a/pages/api/users/_post.ts b/pages/api/users/_post.ts index 8809aa7e8a..4ff41bde62 100644 --- a/pages/api/users/_post.ts +++ b/pages/api/users/_post.ts @@ -8,7 +8,7 @@ import { schemaUserCreateBodyParams } from "@lib/validations/user"; async function postHandler(req: NextApiRequest) { const { prisma } = req; - const isAdmin = await isAdminGuard(req.userId, req.prisma); + const isAdmin = await isAdminGuard(req); // If user is not ADMIN, return unauthorized. if (!isAdmin) throw new HttpError({ statusCode: 401, message: "You are not authorized" }); const data = schemaUserCreateBodyParams.parse(req.body);