feat: botid enabled on api/book/event api route (#24207)

* wip

* WIP

* restore event

* testing without instrument client

* Add conditional for botID init

* Bump BotID version + pass in header

* botID yarn lock changes

* feat: Add feature flag checks + tidy up into service

* rely on env var also

* use eventType repo instead of passing in prisma

* remove slug from audit

* rename botId feature to botid

* add unit tests for bot service

apps/web/instrumentation-client.ts

@@ -2,6 +2,7 @@
 // The added config here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
 import * as Sentry from "@sentry/nextjs";
+import { initBotId } from "botid/client/core";
 
 if (process.env.NODE_ENV === "production") {
   Sentry.init({
@@ -48,3 +49,13 @@ export function onRouterTransitionStart(url: string, navigationType: "push" | "r
     Sentry.captureRouterTransitionStart(url, navigationType);
   }
 }
+
+process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER === "1" &&
+  initBotId({
+    protect: [
+      {
+        path: "/api/book/event",
+        method: "POST",
+      },
+    ],
+  });

apps/web/next.config.js

@@ -1,6 +1,7 @@
 require("dotenv").config({ path: "../../.env" });
 const englishTranslation = require("./public/static/locales/en/common.json");
 const { withAxiom } = require("next-axiom");
+const { withBotId } = require("botid/next/config");
 const { version } = require("./package.json");
 const { PrismaPlugin } = require("@prisma/nextjs-monorepo-workaround-plugin");
 const {
@@ -117,6 +118,11 @@ if (process.env.ANALYZE === "true") {
 }
 
 plugins.push(withAxiom);
+
+if (process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER === "1") {
+  plugins.push(withBotId);
+}
+
 const orgDomainMatcherConfig = {
   root: nextJsOrgRewriteConfig.disableRootPathRewrite
     ? null

apps/web/package.json

@@ -87,6 +87,7 @@
     "async": "^3.2.4",
     "bcp-47-match": "^2.0.3",
     "bcryptjs": "^2.4.3",
+    "botid": "^1.5.7",
     "classnames": "^2.3.1",
     "dompurify": "^3.1.7",
     "dotenv-cli": "^6.0.0",

apps/web/pages/api/book/event.ts

@@ -2,11 +2,15 @@ import type { NextApiRequest } from "next";
 
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
 import handleNewBooking from "@calcom/features/bookings/lib/handleNewBooking";
+import { BotDetectionService } from "@calcom/features/bot-detection";
+import { FeaturesRepository } from "@calcom/features/flags/features.repository";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
 import getIP from "@calcom/lib/getIP";
 import { piiHasher } from "@calcom/lib/server/PiiHasher";
 import { checkCfTurnstileToken } from "@calcom/lib/server/checkCfTurnstileToken";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
+import { EventTypeRepository } from "@calcom/lib/server/repository/eventTypeRepository";
+import prisma from "@calcom/prisma";
 import { CreationSource } from "@calcom/prisma/enums";
 
 async function handler(req: NextApiRequest & { userId?: number }) {
@@ -19,6 +23,16 @@ async function handler(req: NextApiRequest & { userId?: number }) {
     });
   }
 
+  // Check for bot detection using feature flag
+  const featuresRepository = new FeaturesRepository(prisma);
+  const eventTypeRepository = new EventTypeRepository(prisma);
+  const botDetectionService = new BotDetectionService(featuresRepository, eventTypeRepository);
+
+  await botDetectionService.checkBotDetection({
+    eventTypeId: req.body.eventTypeId,
+    headers: req.headers,
+  });
+
   await checkRateLimitAndThrowError({
     rateLimitingType: "core",
     identifier: piiHasher.hash(userIp),