diff --git a/apps/api/v2/src/modules/organizations/event-types/services/input.service.ts b/apps/api/v2/src/modules/organizations/event-types/services/input.service.ts index 0402d5cf62..64c429c4ef 100644 --- a/apps/api/v2/src/modules/organizations/event-types/services/input.service.ts +++ b/apps/api/v2/src/modules/organizations/event-types/services/input.service.ts @@ -316,6 +316,7 @@ export class InputOrganizationsEventTypesService { } if (inputEventType.hosts) { + await this.validateHosts(teamId, inputEventType.hosts); return inputEventType.hosts.map((host) => host.userId); } @@ -354,6 +355,7 @@ export class InputOrganizationsEventTypesService { } if (inputEventType.hosts) { + await this.validateHosts(teamId, inputEventType.hosts); return inputEventType.hosts.map((host) => host.userId); } diff --git a/apps/api/v2/src/modules/teams/event-types/controllers/teams-event-types.controller.e2e-spec.ts b/apps/api/v2/src/modules/teams/event-types/controllers/teams-event-types.controller.e2e-spec.ts index 14789a5d77..43a3f62865 100644 --- a/apps/api/v2/src/modules/teams/event-types/controllers/teams-event-types.controller.e2e-spec.ts +++ b/apps/api/v2/src/modules/teams/event-types/controllers/teams-event-types.controller.e2e-spec.ts @@ -205,6 +205,33 @@ describe("Organizations Event Types Endpoints", () => { return request(app.getHttpServer()).post(`/v2/teams/${team.id}/event-types`).send(body).expect(404); }); + it("should not be able to create managed event-type for user outside team", async () => { + const userId = falseTestUser.id; + + const body: CreateTeamEventTypeInput_2024_06_14 = { + title: `managed-outside-team-${randomString()}`, + slug: `managed-outside-team-${randomString()}`, + description: "Managed event type with non-team member.", + lengthInMinutes: 60, + locations: [ + { + type: "integration", + integration: "cal-video", + }, + ], + schedulingType: "MANAGED", + hosts: [ + { + userId, + mandatory: true, + priority: "high", + }, + ], + }; + + return request(app.getHttpServer()).post(`/v2/teams/${team.id}/event-types`).send(body).expect(404); + }); + it("should not be able to create phone-only event type", async () => { const body: CreateTeamEventTypeInput_2024_06_14 = { title: "Phone coding consultation", @@ -564,6 +591,25 @@ describe("Organizations Event Types Endpoints", () => { }); }); + it("should not be able to update managed event-type with user outside team", async () => { + await ensureManagedEventType(); + + const body: UpdateTeamEventTypeInput_2024_06_14 = { + hosts: [ + { + userId: falseTestUser.id, + mandatory: true, + priority: "high", + }, + ], + }; + + return request(app.getHttpServer()) + .patch(`/v2/teams/${team.id}/event-types/${managedEventType?.id}`) + .send(body) + .expect(404); + }); + it("should not be able to update non existing event-type", async () => { const body: UpdateTeamEventTypeInput_2024_06_14 = { title: "Clean code consultation",