Merge pull request #35 from calcom/feat/hardened-safe-mode

.env.example

@@ -1 +1 @@
-API_KEY_PREFIX=cal_
+API_KEY_PREFIX=pt_secret_

lib/helpers/verifyApiKey.ts

@@ -15,7 +15,7 @@ const today = new Date();
 export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   if (!req.query.apiKey) res.status(401).json({ message: "No API key provided" });
 
-  const strippedApiKey = `${req.query.apiKey}`.replace(process.env.API_KEY_PREFIX || "cal_", "");
+  const strippedApiKey = `${req.query.apiKey}`.replace(process.env.API_KEY_PREFIX || "pt_secret_", "");
   const hashedKey = hashAPIKey(strippedApiKey);
 
   await prisma.apiKey
@@ -25,7 +25,7 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
         res.status(401).json({ error: "You did not provide an api key" });
         throw new Error("No api key found");
       }
-      if (apiKey.userId) res.setHeader("X-Calcom-User-ID", apiKey?.userId);
+      if (apiKey.userId) res.setHeader("X-Calcom-User-ID", apiKey.userId);
       if (apiKey.expiresAt && apiKey.userId && dateInPast(today, apiKey.expiresAt)) await next();
     })
     .catch((error) => {

pages/api/attendees/[id].ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import type { AttendeeResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import { schemaAttendeeBodyParams, schemaAttendeePublic } from "@lib/validations/attendee";
 import {
   schemaQueryIdParseInt,
@@ -83,48 +84,69 @@ export async function attendeeById(req: NextApiRequest, res: NextApiResponse<Att
   const { method, query, body } = req;
   const safeQuery = schemaQueryIdParseInt.safeParse(query);
   const safeBody = schemaAttendeeBodyParams.safeParse(body);
-  if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
-
-  switch (method) {
-    case "GET":
-      await prisma.attendee
-        .findUnique({ where: { id: safeQuery.data.id } })
-        .then((data) => schemaAttendeePublic.parse(data))
-        .then((attendee) => res.status(200).json({ attendee }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Attendee with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
-
-    case "PATCH":
-      if (!safeBody.success) throw new Error("Invalid request body");
-      await prisma.attendee
-        .update({
-          where: { id: safeQuery.data.id },
-          data: safeBody.data,
-        })
-        .then((data) => schemaAttendeePublic.parse(data))
-        .then((attendee) => res.status(200).json({ attendee }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Attendee with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
-
-    case "DELETE":
-      await prisma.attendee
-        .delete({ where: { id: safeQuery.data.id } })
-        .then(() =>
-          res.status(200).json({ message: `Attendee with id: ${safeQuery.data.id} deleted successfully` })
-        )
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Attendee with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
-
-    default:
-      res.status(405).json({ message: "Method not allowed" });
-      break;
+  if (!safeQuery.success) {
+    throw new Error("Invalid request query", safeQuery.error);
   }
+  const userId = getCalcomUserId(res);
+  const userBookings = await prisma.booking.findMany({
+    where: { userId },
+    include: { attendees: true },
+  });
+  const attendees = userBookings.map((booking) => booking.attendees).flat();
+  const attendeeIds = attendees.map((attendee) => attendee.id);
+  // Here we make sure to only return attendee's of the user's own bookings.
+  if (attendeeIds.includes(safeQuery.data.id)) {
+    switch (method) {
+      case "GET":
+        await prisma.attendee
+          .findUnique({ where: { id: safeQuery.data.id } })
+          .then((data) => schemaAttendeePublic.parse(data))
+          .then((attendee) => res.status(200).json({ attendee }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `Attendee with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
+
+      case "PATCH":
+        if (!safeBody.success) {
+          throw new Error("Invalid request body");
+        }
+        await prisma.attendee
+          .update({ where: { id: safeQuery.data.id }, data: safeBody.data })
+          .then((data) => schemaAttendeePublic.parse(data))
+          .then((attendee) => res.status(200).json({ attendee }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `Attendee with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
+
+      case "DELETE":
+        await prisma.attendee
+          .delete({ where: { id: safeQuery.data.id } })
+          .then(() =>
+            res.status(200).json({
+              message: `Attendee with id: ${safeQuery.data.id} deleted successfully`,
+            })
+          )
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `Attendee with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
+
+      default:
+        res.status(405).json({ message: "Method not allowed" });
+        break;
+    }
+  } else res.status(401).json({ message: "Unauthorized" });
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(attendeeById));

pages/api/attendees/index.ts

@@ -61,24 +61,42 @@ async function createOrlistAllAttendees(
   } else if (method === "POST") {
     const safe = schemaAttendeeBodyParams.safeParse(req.body);
     if (!safe.success) {
-      console.log(safe.error);
       throw new Error("Invalid request body", safe.error);
     }
     const bookingId = safe.data.bookingId;
-    delete safe.data.bookingId;
-    const noBookingId = safe.data;
-    const data = await prisma.attendee.create({
-      data: { ...noBookingId, booking: { connect: { id: parseInt(bookingId as string) } } },
+    const userId = await getCalcomUserId(res);
+    const userWithBookings = await prisma.user.findUnique({
+      where: { id: userId },
+      include: { bookings: true },
     });
-    const attendee = schemaAttendeePublic.parse(data);
+    if (!userWithBookings) {
+      throw new Error("User not found");
+    }
+    const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
+    if (userBookingIds.includes(bookingId)) {
+      delete safe.data.bookingId;
+      const noBookingId = safe.data;
+      const data = await prisma.attendee.create({
+        data: {
+          ...noBookingId,
+          booking: { connect: { id: bookingId } },
+        },
+      });
+      const attendee = schemaAttendeePublic.parse(data);
 
-    if (attendee) res.status(201).json({ attendee, message: "Attendee created successfully" });
-    else
-      (error: Error) =>
-        res.status(400).json({
-          message: "Could not create new attendee",
-          error,
+      if (attendee) {
+        res.status(201).json({
+          attendee,
+          message: "Attendee created successfully",
         });
+      } else {
+        (error: Error) =>
+          res.status(400).json({
+            message: "Could not create new attendee",
+            error,
+          });
+      }
+    } else res.status(401).json({ message: "Unauthorized" });
   } else res.status(405).json({ message: `Method ${method} not allowed` });
 }
 

pages/api/availabilities/[id].ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import type { AvailabilityResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import { schemaAvailabilityBodyParams, schemaAvailabilityPublic } from "@lib/validations/availability";
 import {
   schemaQueryIdParseInt,
@@ -84,46 +85,54 @@ export async function availabilityById(req: NextApiRequest, res: NextApiResponse
   const safeQuery = schemaQueryIdParseInt.safeParse(query);
   const safeBody = schemaAvailabilityBodyParams.safeParse(body);
   if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
+  const userId = await getCalcomUserId(res);
+  const data = await prisma.availability.findMany({ where: { userId } });
+  const availabiltiesIds = data.map((availability) => availability.id);
+  if (availabiltiesIds.includes(safeQuery.data.id)) {
+    switch (method) {
+      case "GET":
+        await prisma.availability
+          .findUnique({ where: { id: safeQuery.data.id } })
+          .then((data) => schemaAvailabilityPublic.parse(data))
+          .then((availability) => res.status(200).json({ availability }))
+          .catch((error: Error) =>
+            res.status(404).json({ message: `Availability with id: ${safeQuery.data.id} not found`, error })
+          );
+        break;
 
-  switch (method) {
-    case "GET":
-      await prisma.availability
-        .findUnique({ where: { id: safeQuery.data.id } })
-        .then((data) => schemaAvailabilityPublic.parse(data))
-        .then((availability) => res.status(200).json({ availability }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Availability with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "PATCH":
+        if (!safeBody.success) throw new Error("Invalid request body");
+        await prisma.availability
+          .update({
+            where: { id: safeQuery.data.id },
+            data: safeBody.data,
+          })
+          .then((data) => schemaAvailabilityPublic.parse(data))
+          .then((availability) => res.status(200).json({ availability }))
+          .catch((error: Error) =>
+            res.status(404).json({ message: `Availability with id: ${safeQuery.data.id} not found`, error })
+          );
+        break;
 
-    case "PATCH":
-      if (!safeBody.success) throw new Error("Invalid request body");
-      await prisma.availability
-        .update({
-          where: { id: safeQuery.data.id },
-          data: safeBody.data,
-        })
-        .then((data) => schemaAvailabilityPublic.parse(data))
-        .then((availability) => res.status(200).json({ availability }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Availability with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "DELETE":
+        await prisma.availability
+          .delete({ where: { id: safeQuery.data.id } })
+          .then(() =>
+            res
+              .status(200)
+              .json({ message: `Availability with id: ${safeQuery.data.id} deleted successfully` })
+          )
+          .catch((error: Error) =>
+            res.status(404).json({ message: `Availability with id: ${safeQuery.data.id} not found`, error })
+          );
+        break;
 
-    case "DELETE":
-      await prisma.availability
-        .delete({ where: { id: safeQuery.data.id } })
-        .then(() =>
-          res.status(200).json({ message: `Availability with id: ${safeQuery.data.id} deleted successfully` })
-        )
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Availability with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
-
-    default:
-      res.status(405).json({ message: "Method not allowed" });
-      break;
+      default:
+        res.status(405).json({ message: "Method not allowed" });
+        break;
+    }
+  } else {
+    res.status(401).json({ message: "Unauthorized" });
   }
 }
 

pages/api/availabilities/index.ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import { AvailabilityResponse, AvailabilitiesResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import { schemaAvailabilityBodyParams, schemaAvailabilityPublic } from "@lib/validations/availability";
 
 /**
@@ -38,8 +39,10 @@ async function createOrlistAllAvailabilities(
   res: NextApiResponse<AvailabilitiesResponse | AvailabilityResponse>
 ) {
   const { method } = req;
+  const userId = await getCalcomUserId(res);
+
   if (method === "GET") {
-    const data = await prisma.availability.findMany();
+    const data = await prisma.availability.findMany({ where: { userId } });
     const availabilities = data.map((availability) => schemaAvailabilityPublic.parse(availability));
     if (availabilities) res.status(200).json({ availabilities });
     else
@@ -52,7 +55,7 @@ async function createOrlistAllAvailabilities(
     const safe = schemaAvailabilityBodyParams.safeParse(req.body);
     if (!safe.success) throw new Error("Invalid request body");
 
-    const data = await prisma.availability.create({ data: safe.data });
+    const data = await prisma.availability.create({ data: { ...safe.data, userId } });
     const availability = schemaAvailabilityPublic.parse(data);
 
     if (availability) res.status(201).json({ availability, message: "Availability created successfully" });

pages/api/booking-references/[id].ts

@@ -1,9 +1,11 @@
+import { BookingModel } from "@/../../packages/prisma/zod";
 import type { NextApiRequest, NextApiResponse } from "next";
 
 import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import type { BookingReferenceResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import {
   schemaBookingReferenceBodyParams,
   schemaBookingReferencePublic,
@@ -90,48 +92,69 @@ export async function bookingReferenceById(
   const safeQuery = schemaQueryIdParseInt.safeParse(query);
   const safeBody = schemaBookingReferenceBodyParams.safeParse(body);
   if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
-  // FIXME: Allow only userId owner of booking ref to edit it
+  const userId = await getCalcomUserId(res);
+  const userWithBookings = await prisma.user.findUnique({
+    where: { id: userId },
+    include: { bookings: true },
+  });
+  if (!userWithBookings) throw new Error("User not found");
+  const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
+  const bookingReference = await prisma.bookingReference.findUnique({ where: { id: safeQuery.data.id } });
+  if (!bookingReference) throw new Error("BookingReference not found");
+  if (userBookingIds.includes(bookingReference.bookingId)) {
+    switch (method) {
+      case "GET":
+        await prisma.bookingReference
+          .findUnique({ where: { id: safeQuery.data.id } })
+          .then((data) => schemaBookingReferencePublic.parse(data))
+          .then((booking_reference) => res.status(200).json({ booking_reference }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `BookingReference with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-  switch (method) {
-    case "GET":
-      await prisma.bookingReference
-        .findUnique({ where: { id: safeQuery.data.id } })
-        .then((data) => schemaBookingReferencePublic.parse(data))
-        .then((booking_reference) => res.status(200).json({ booking_reference }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `BookingReference with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "PATCH":
+        if (!safeBody.success) {
+          throw new Error("Invalid request body");
+        }
+        await prisma.bookingReference
+          .update({ where: { id: safeQuery.data.id }, data: safeBody.data })
+          .then((data) => schemaBookingReferencePublic.parse(data))
+          .then((booking_reference) => res.status(200).json({ booking_reference }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `BookingReference with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "PATCH":
-      if (!safeBody.success) throw new Error("Invalid request body");
-      await prisma.bookingReference
-        .update({
-          where: { id: safeQuery.data.id },
-          data: safeBody.data,
-        })
-        .then((data) => schemaBookingReferencePublic.parse(data))
-        .then((booking_reference) => res.status(200).json({ booking_reference }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `BookingReference with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "DELETE":
+        await prisma.bookingReference
+          .delete({
+            where: { id: safeQuery.data.id },
+          })
+          .then(() =>
+            res.status(200).json({
+              message: `BookingReference with id: ${safeQuery.data.id} deleted`,
+            })
+          )
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `BookingReference with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "DELETE":
-      await prisma.bookingReference
-        .delete({ where: { id: safeQuery.data.id } })
-        .then(() =>
-          res.status(200).json({ message: `BookingReference with id: ${safeQuery.data.id} deleted` })
-        )
-        .catch((error: Error) =>
-          res.status(404).json({ message: `BookingReference with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
-
-    default:
-      res.status(405).json({ message: "Method not allowed" });
-      break;
-  }
+      default:
+        res.status(405).json({ message: "Method not allowed" });
+        break;
+    }
+  } else res.status(401).json({ message: "Unauthorized" });
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(

pages/api/booking-references/index.ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import { BookingReferenceResponse, BookingReferencesResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import {
   schemaBookingReferenceBodyParams,
   schemaBookingReferencePublic,
@@ -41,8 +42,15 @@ async function createOrlistAllBookingReferences(
   res: NextApiResponse<BookingReferencesResponse | BookingReferenceResponse>
 ) {
   const { method } = req;
+  const userId = await getCalcomUserId(res);
+  const userWithBookings = await prisma.user.findUnique({
+    where: { id: userId },
+    include: { bookings: true },
+  });
+  if (!userWithBookings) throw new Error("User not found");
+  const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
   if (method === "GET") {
-    const data = await prisma.bookingReference.findMany();
+    const data = await prisma.bookingReference.findMany({ where: { id: { in: userBookingIds } } });
     const booking_references = data.map((bookingReference) =>
       schemaBookingReferencePublic.parse(bookingReference)
     );
@@ -55,18 +63,37 @@ async function createOrlistAllBookingReferences(
         });
   } else if (method === "POST") {
     const safe = schemaBookingReferenceBodyParams.safeParse(req.body);
-    if (!safe.success) throw new Error("Invalid request body");
+    if (!safe.success) {
+      throw new Error("Invalid request body");
+    }
 
-    const data = await prisma.bookingReference.create({ data: safe.data });
+    const data = await prisma.bookingReference.create({
+      data: { ...safe.data },
+    });
     const booking_reference = schemaBookingReferencePublic.parse(data);
-
-    if (data) res.status(201).json({ booking_reference, message: "BookingReference created successfully" });
-    else
-      (error: Error) =>
-        res.status(400).json({
-          message: "Could not create new booking reference",
-          error,
+    const userId = await getCalcomUserId(res);
+    const userWithBookings = await prisma.user.findUnique({
+      where: { id: userId },
+      include: { bookings: true },
+    });
+    if (!userWithBookings) {
+      throw new Error("User not found");
+    }
+    const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
+    if (userBookingIds.includes(safe.data.bookingId)) {
+      if (data) {
+        res.status(201).json({
+          booking_reference,
+          message: "BookingReference created successfully",
         });
+      } else {
+        (error: Error) =>
+          res.status(400).json({
+            message: "Could not create new booking reference",
+            error,
+          });
+      }
+    } else res.status(401).json({ message: "Unauthorized" });
   } else res.status(405).json({ message: `Method ${method} not allowed` });
 }
 

pages/api/bookings/[id].ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import type { BookingResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import { schemaBookingBodyParams, schemaBookingPublic } from "@lib/validations/booking";
 import {
   schemaQueryIdParseInt,
@@ -84,47 +85,68 @@ export async function bookingById(req: NextApiRequest, res: NextApiResponse<Book
   const safeQuery = schemaQueryIdParseInt.safeParse(query);
   const safeBody = schemaBookingBodyParams.safeParse(body);
   if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
-  // FIXME: Allow only userId owner of booking to edit it
-  switch (method) {
-    case "GET":
-      await prisma.booking
-        .findUnique({ where: { id: safeQuery.data.id } })
-        .then((data) => schemaBookingPublic.parse(data))
-        .then((booking) => res.status(200).json({ booking }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Booking with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+  const userId = await getCalcomUserId(res);
+  const userWithBookings = await prisma.user.findUnique({
+    where: { id: userId },
+    include: { bookings: true },
+  });
+  if (!userWithBookings) throw new Error("User not found");
+  const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
+  if (userBookingIds.includes(safeQuery.data.id)) {
+    switch (method) {
+      case "GET":
+        await prisma.booking
+          .findUnique({ where: { id: safeQuery.data.id } })
+          .then((data) => schemaBookingPublic.parse(data))
+          .then((booking) => res.status(200).json({ booking }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `Booking with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "PATCH":
-      if (!safeBody.success) throw new Error("Invalid request body");
-      await prisma.booking
-        .update({
-          where: { id: safeQuery.data.id },
-          data: safeBody.data,
-        })
-        .then((data) => schemaBookingPublic.parse(data))
-        .then((booking) => res.status(200).json({ booking }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Booking with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "PATCH":
+        if (!safeBody.success) {
+          throw new Error("Invalid request body");
+        }
+        await prisma.booking
+          .update({
+            where: { id: safeQuery.data.id },
+            data: safeBody.data,
+          })
+          .then((data) => schemaBookingPublic.parse(data))
+          .then((booking) => res.status(200).json({ booking }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `Booking with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "DELETE":
-      await prisma.booking
-        .delete({ where: { id: safeQuery.data.id } })
-        .then(() =>
-          res.status(200).json({ message: `Booking with id: ${safeQuery.data.id} deleted successfully` })
-        )
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Booking with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "DELETE":
+        await prisma.booking
+          .delete({ where: { id: safeQuery.data.id } })
+          .then(() =>
+            res.status(200).json({
+              message: `Booking with id: ${safeQuery.data.id} deleted successfully`,
+            })
+          )
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `Booking with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    default:
-      res.status(405).json({ message: "Method not allowed" });
-      break;
-  }
+      default:
+        res.status(405).json({ message: "Method not allowed" });
+        break;
+    }
+  } else res.status(401).json({ message: "Unauthorized" });
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(bookingById));

pages/api/bookings/index.ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import { BookingResponse, BookingsResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import { schemaBookingBodyParams, schemaBookingPublic, withValidBooking } from "@lib/validations/booking";
 
 /**
@@ -38,10 +39,10 @@ async function createOrlistAllBookings(
   res: NextApiResponse<BookingsResponse | BookingResponse>
 ) {
   const { method } = req;
-  // FIXME: List only bookings owner by userId
+  const userId = await getCalcomUserId(res);
 
   if (method === "GET") {
-    const data = await prisma.booking.findMany();
+    const data = await prisma.booking.findMany({ where: { userId } });
     const bookings = data.map((booking) => schemaBookingPublic.parse(booking));
     if (bookings) res.status(200).json({ bookings });
     else
@@ -54,7 +55,7 @@ async function createOrlistAllBookings(
     const safe = schemaBookingBodyParams.safeParse(req.body);
     if (!safe.success) throw new Error("Invalid request body");
 
-    const data = await prisma.booking.create({ data: safe.data });
+    const data = await prisma.booking.create({ data: { ...safe.data, userId } });
     const booking = schemaBookingPublic.parse(data);
 
     if (booking) res.status(201).json({ booking, message: "Booking created successfully" });

pages/api/credentials/[id].ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import type { CredentialResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import { schemaCredentialBodyParams, schemaCredentialPublic } from "@lib/validations/credential";
 import {
   schemaQueryIdParseInt,
@@ -84,47 +85,52 @@ export async function credentialById(req: NextApiRequest, res: NextApiResponse<C
   const safeQuery = schemaQueryIdParseInt.safeParse(query);
   const safeBody = schemaCredentialBodyParams.safeParse(body);
   if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
+  const userId = getCalcomUserId(res);
+  const data = await prisma.credential.findMany({ where: { userId } });
+  const credentialIds = data.map((credential) => credential.id);
+  // res.status(200).json({ data });
+  if (credentialIds.includes(safeQuery.data.id)) {
+    switch (method) {
+      case "GET":
+        await prisma.credential
+          .findUnique({ where: { id: safeQuery.data.id } })
+          .then((data) => schemaCredentialPublic.parse(data))
+          .then((credential) => res.status(200).json({ credential }))
+          .catch((error: Error) =>
+            res.status(404).json({ message: `Credential with id: ${safeQuery.data.id} not found`, error })
+          );
+        break;
 
-  switch (method) {
-    case "GET":
-      await prisma.credential
-        .findUnique({ where: { id: safeQuery.data.id } })
-        .then((data) => schemaCredentialPublic.parse(data))
-        .then((credential) => res.status(200).json({ credential }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Credential with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "PATCH":
+        if (!safeBody.success) throw new Error("Invalid request body");
+        await prisma.credential
+          .update({
+            where: { id: safeQuery.data.id },
+            data: safeBody.data,
+          })
+          .then((data) => schemaCredentialPublic.parse(data))
+          .then((credential) => res.status(200).json({ credential }))
+          .catch((error: Error) =>
+            res.status(404).json({ message: `Credential with id: ${safeQuery.data.id} not found`, error })
+          );
+        break;
 
-    case "PATCH":
-      if (!safeBody.success) throw new Error("Invalid request body");
-      await prisma.credential
-        .update({
-          where: { id: safeQuery.data.id },
-          data: safeBody.data,
-        })
-        .then((data) => schemaCredentialPublic.parse(data))
-        .then((credential) => res.status(200).json({ credential }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Credential with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "DELETE":
+        await prisma.credential
+          .delete({ where: { id: safeQuery.data.id } })
+          .then(() =>
+            res.status(200).json({ message: `Credential with id: ${safeQuery.data.id} deleted successfully` })
+          )
+          .catch((error: Error) =>
+            res.status(404).json({ message: `Credential with id: ${safeQuery.data.id} not found`, error })
+          );
+        break;
 
-    case "DELETE":
-      await prisma.credential
-        .delete({ where: { id: safeQuery.data.id } })
-        .then(() =>
-          res.status(200).json({ message: `Credential with id: ${safeQuery.data.id} deleted successfully` })
-        )
-        .catch((error: Error) =>
-          res.status(404).json({ message: `Credential with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
-
-    default:
-      res.status(405).json({ message: "Method not allowed" });
-      break;
-  }
+      default:
+        res.status(405).json({ message: "Method not allowed" });
+        break;
+    }
+  } else res.status(401).json({ message: "Unauthorized" });
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(credentialById));

pages/api/credentials/index.ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import { CredentialResponse, CredentialsResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import { schemaCredentialBodyParams, schemaCredentialPublic } from "@lib/validations/credential";
 
 /**
@@ -38,8 +39,10 @@ async function createOrlistAllCredentials(
   res: NextApiResponse<CredentialsResponse | CredentialResponse>
 ) {
   const { method } = req;
+  const userId = getCalcomUserId(res);
+
   if (method === "GET") {
-    const data = await prisma.credential.findMany();
+    const data = await prisma.credential.findMany({ where: { userId } });
     const credentials = data.map((credential) => schemaCredentialPublic.parse(credential));
     if (credentials) res.status(200).json({ credentials });
     else
@@ -55,7 +58,10 @@ async function createOrlistAllCredentials(
     const data = await prisma.credential.create({ data: safe.data });
     const credential = schemaCredentialPublic.parse(data);
 
-    if (credential) res.status(201).json({ credential, message: "Credential created successfully" });
+    if (credential)
+      res
+        .status(201)
+        .json({ credential: { ...credential, userId }, message: "Credential created successfully" });
     else
       (error: Error) =>
         res.status(400).json({

pages/api/teams/[id].ts

@@ -89,6 +89,7 @@ export async function teamById(req: NextApiRequest, res: NextApiResponse<TeamRes
   const userWithMemberships = await prisma.membership.findMany({
     where: { userId: userId },
   });
+  //FIXME: This is a hack to get the teamId from the user's membership
   console.log(userWithMemberships);
   switch (method) {
     case "GET":

pages/api/teams/index.ts

@@ -56,7 +56,7 @@ async function createOrlistAllTeams(req: NextApiRequest, res: NextApiResponse<Te
     if (!safe.success) throw new Error("Invalid request body");
     const team = await prisma.team.create({ data: safe.data });
     const membership = await prisma.membership.create({
-      data: { userId: userId, teamId: team.id, role: "ADMIN" },
+      data: { userId, teamId: team.id, role: "ADMIN" },
     });
     console.log(membership);
     const data = schemaTeamPublic.parse(team);