feat: all endpoints safe

README.md

@@ -139,11 +139,6 @@ tests/endpoint/resource.new.test.ts - Create new resource
 | teams                    |     ✅    |    ✅    |    ✅   |   ✅  |    ✅   |
 | users                    |     ✅    |   👤[1]  |    ✅   |   ✅  |    ✅   |
 
-## Models missing userId relation
-
-- daily-event-references
-
-
 ## Models from database that are not exposed
 
 mostly because they're deemed too sensitive can be revisited if needed. most are expected to be used via cal's webapp.
@@ -154,7 +149,7 @@ mostly because they're deemed too sensitive can be revisited if needed. most are
 - [ ] ResetPasswordRequest
 - [ ] VerificationToken
 - [ ] ReminderMail
-- [ ] 
+
 ## Documentation (OpenAPI)
 
 You will see that each endpoint has a comment at the top with the annotation `@swagger` with the documentation of the endpoint, **please update it if you change the code!** This is what auto-generates the OpenAPI spec by collecting the YAML in each endpoint and parsing it in /docs alongside the json-schema (auto-generated from prisma package, not added to code but manually for now, need to fix later)
@@ -171,7 +166,11 @@ in order to build and deploy properly.
 
 ## Envirorment variables
 
-DATABASE_URL=
-API_KEY_PREFIX=cal_# This can be changed per envirorment so cal_test_ for staging for example.
+### Required
 
-If you're self-hosting under our commercial license, you can use any prefix you want for api keys. either leave the default cal_ (not providing any envirorment variable) or modify it
+DATABASE_URL=DATABASE_URL="postgresql://postgres:@localhost:5450/calendso"
+
+## Optional
+
+API_KEY_PREFIX=cal_# This can be changed per envirorment so cal_test_ for staging for example.
+> If you're self-hosting under our commercial license, you can use any prefix you want for api keys. either leave the default cal_ (not providing any envirorment variable) or modify it

pages/api/daily-event-references/[id].ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import type { DailyEventReferenceResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import {
   schemaDailyEventReferenceBodyParams,
   schemaDailyEventReferencePublic,
@@ -96,53 +97,69 @@ export async function dailyEventReferenceById(
   const safeQuery = schemaQueryIdParseInt.safeParse(query);
   const safeBody = schemaDailyEventReferenceBodyParams.safeParse(body);
   if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
+  const userId = getCalcomUserId(res);
+  const userBookings = await prisma.booking.findMany({ where: { userId } });
+  const userBookingIds = userBookings.map((booking) => booking.id);
+  const userBookingDailyEventReferences = await prisma.dailyEventReference.findMany({
+    where: { bookingId: { in: userBookingIds } },
+  });
+  const userBookingDailyEventReferenceIds = userBookingDailyEventReferences.map(
+    (dailyEventReference) => dailyEventReference.id
+  );
+  if (userBookingDailyEventReferenceIds.includes(safeQuery.data.id)) {
+    switch (method) {
+      case "GET":
+        await prisma.dailyEventReference
+          .findUnique({ where: { id: safeQuery.data.id } })
+          .then((data) => schemaDailyEventReferencePublic.parse(data))
+          .then((daily_event_reference) => res.status(200).json({ daily_event_reference }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `DailyEventReference with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-  switch (method) {
-    case "GET":
-      await prisma.dailyEventReference
-        .findUnique({ where: { id: safeQuery.data.id } })
-        .then((data) => schemaDailyEventReferencePublic.parse(data))
-        .then((daily_event_reference) => res.status(200).json({ daily_event_reference }))
-        .catch((error: Error) =>
-          res
-            .status(404)
-            .json({ message: `DailyEventReference with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "PATCH":
+        if (!safeBody.success) {
+          throw new Error("Invalid request body");
+        }
+        await prisma.dailyEventReference
+          .update({ where: { id: safeQuery.data.id }, data: safeBody.data })
+          .then((data) => schemaDailyEventReferencePublic.parse(data))
+          .then((daily_event_reference) => res.status(200).json({ daily_event_reference }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `DailyEventReference with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "PATCH":
-      if (!safeBody.success) throw new Error("Invalid request body");
-      await prisma.dailyEventReference
-        .update({
-          where: { id: safeQuery.data.id },
-          data: safeBody.data,
-        })
-        .then((data) => schemaDailyEventReferencePublic.parse(data))
-        .then((daily_event_reference) => res.status(200).json({ daily_event_reference }))
-        .catch((error: Error) =>
-          res
-            .status(404)
-            .json({ message: `DailyEventReference with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+      case "DELETE":
+        await prisma.dailyEventReference
+          .delete({
+            where: { id: safeQuery.data.id },
+          })
+          .then(() =>
+            res.status(200).json({
+              message: `DailyEventReference with id: ${safeQuery.data.id} deleted`,
+            })
+          )
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `DailyEventReference with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "DELETE":
-      await prisma.dailyEventReference
-        .delete({ where: { id: safeQuery.data.id } })
-        .then(() =>
-          res.status(200).json({ message: `DailyEventReference with id: ${safeQuery.data.id} deleted` })
-        )
-        .catch((error: Error) =>
-          res
-            .status(404)
-            .json({ message: `DailyEventReference with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
-
-    default:
-      res.status(405).json({ message: "Method not allowed" });
-      break;
-  }
+      default:
+        res.status(405).json({ message: "Method not allowed" });
+        break;
+    }
+  } else res.status(401).json({ message: "Unauthorized" });
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(

pages/api/daily-event-references/index.ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import { DailyEventReferenceResponse, DailyEventReferencesResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import {
   schemaDailyEventReferenceBodyParams,
   schemaDailyEventReferencePublic,
@@ -45,8 +46,14 @@ async function createOrlistAllDailyEventReferences(
   res: NextApiResponse<DailyEventReferencesResponse | DailyEventReferenceResponse>
 ) {
   const { method } = req;
+  const userId = getCalcomUserId(res);
+  const userBookings = await prisma.booking.findMany({ where: { userId } });
+  const userBookingIds = userBookings.map((booking) => booking.id);
+
   if (method === "GET") {
-    const data = await prisma.dailyEventReference.findMany();
+    const data = await prisma.dailyEventReference.findMany({
+      where: { bookingId: { in: userBookingIds } },
+    });
     const daily_event_references = data.map((dailyEventReference) =>
       schemaDailyEventReferencePublic.parse(dailyEventReference)
     );