From 7a2060fe082e0972c38ef4fe65f09666f27bc808 Mon Sep 17 00:00:00 2001
From: Somay Chauhan <somaychauhan98@gmail.com>
Date: Mon, 23 Jun 2025 12:39:44 +0530
Subject: [PATCH] fix: dont expose credential.key in api output (#21970)

Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
---
 .../repositories/conferencing.repository.ts   | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/apps/api/v2/src/modules/conferencing/repositories/conferencing.repository.ts b/apps/api/v2/src/modules/conferencing/repositories/conferencing.repository.ts
index a8c6d9840b..ef8b147805 100644
--- a/apps/api/v2/src/modules/conferencing/repositories/conferencing.repository.ts
+++ b/apps/api/v2/src/modules/conferencing/repositories/conferencing.repository.ts
@@ -1,6 +1,7 @@
 import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { Injectable } from "@nestjs/common";
+import { Prisma } from "@prisma/client";
 
 import { GOOGLE_MEET_TYPE } from "@calcom/platform-constants";
 
@@ -8,12 +9,26 @@ import { GOOGLE_MEET_TYPE } from "@calcom/platform-constants";
 export class ConferencingRepository {
   constructor(private readonly dbRead: PrismaReadService, private readonly dbWrite: PrismaWriteService) {}
 
+  private readonly credentialSelect = Prisma.validator<Prisma.CredentialSelect>()({
+    id: true,
+    type: true,
+    userId: true,
+    teamId: true,
+    appId: true,
+    subscriptionId: true,
+    paymentStatus: true,
+    billingCycleStart: true,
+    invalid: true,
+    delegationCredentialId: true,
+  });
+
   async findConferencingApps(userId: number) {
     return this.dbRead.prisma.credential.findMany({
       where: {
         userId,
         type: { endsWith: "_video" },
       },
+      select: this.credentialSelect,
     });
   }
 
@@ -23,24 +38,28 @@ export class ConferencingRepository {
         teamId,
         type: { endsWith: "_video" },
       },
+      select: this.credentialSelect,
     });
   }
 
   async findGoogleMeet(userId: number) {
     return this.dbRead.prisma.credential.findFirst({
       where: { userId, type: GOOGLE_MEET_TYPE },
+      select: this.credentialSelect,
     });
   }
 
   async findConferencingApp(userId: number, app: string) {
     return this.dbRead.prisma.credential.findFirst({
       where: { userId, appId: app },
+      select: this.credentialSelect,
     });
   }
 
   async findTeamConferencingApp(teamId: number, app: string) {
     return this.dbRead.prisma.credential.findFirst({
       where: { teamId, appId: app },
+      select: this.credentialSelect,
     });
   }
 }