v3.9.2

* feat: use unkey for global ratelimiting and identifier overrides

fixes #13672

* revert: make test pass

* chore: push timeout incase unkey ever dies

* chore: push timeout incase unkey ever dies

---------

Co-authored-by: sean-brydon <sean@cal.com>

.env.example

@@ -26,8 +26,6 @@ DATABASE_URL="postgresql://postgres:@localhost:5450/calendso"
 # Needed to run migrations while using a connection pooler like PgBouncer
 # Use the same one as DATABASE_URL if you're not using a connection pooler
 DATABASE_DIRECT_URL="postgresql://postgres:@localhost:5450/calendso"
-UPSTASH_REDIS_REST_URL=
-UPSTASH_REDIS_REST_TOKEN=
 INSIGHTS_DATABASE_URL=
 
 # Uncomment to enable a dedicated connection pool for Prisma using Prisma Data Proxy
@@ -232,6 +230,7 @@ NEXT_PUBLIC_COMPANY_NAME="Cal.com, Inc."
 # NEXT_PUBLIC_DISABLE_SIGNUP=true
 NEXT_PUBLIC_DISABLE_SIGNUP=
 
+# Set this to 'non-strict' to enable CSP for support pages. 'strict' isn't supported yet. Also, check the README for details.
 # Content Security Policy
 CSP_POLICY=
 
@@ -294,9 +293,9 @@ E2E_TEST_CALCOM_GCAL_KEYS=
 # Used for self-hosters that are implementing Cal.com into their applications that already have certain integrations
 # Under settings/admin/apps ensure that all app secrets are set the same as the parent application
 # You can use: `openssl rand -base64 32` to generate one
-CALCOM_WEBHOOK_SECRET=""
+CALCOM_CREDENTIAL_SYNC_SECRET=""
 # This is the header name that will be used to verify the webhook secret. Should be in lowercase
-CALCOM_WEBHOOK_HEADER_NAME="calcom-webhook-secret"
+CALCOM_CREDENTIAL_SYNC_HEADER_NAME="calcom-credential-sync-secret"
 CALCOM_CREDENTIAL_SYNC_ENDPOINT=""
 # Key should match on Cal.com and your application
 # must be 24 bytes for AES256 encryption algorithm
@@ -341,3 +340,9 @@ APP_ROUTER_TEAMS_ENABLED=0
 
 # disable setry server source maps
 SENTRY_DISABLE_SERVER_WEBPACK_PLUGIN=1
+
+# api v2
+NEXT_PUBLIC_API_V2_URL="http://localhost:5555/api/v2"
+
+# Ratelimiting via unkey
+UNKEY_ROOT_KEY=

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,7 +13,7 @@ Fixes # (issue)
 <!-- Please provide all documents that are important to understand the reason of that PR. -->
 
 - If there is a requirement document, please, share it here.
-- If there is ab UI/UX design document, please, share it here.
+- If there is a UI/UX design document, please, share it here.
 
 ## Type of change
 

.github/workflows/delete-buildjet-cache.yml

@@ -0,0 +1,17 @@
+name: Manually Delete BuildJet Cache
+on:
+  workflow_dispatch:
+    inputs:
+      cache_key:
+        description: "BuildJet Cache Key to Delete"
+        required: true
+        type: string
+jobs:
+  manually-delete-buildjet-cache:
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - uses: buildjet/cache-delete@v1
+        with:
+          cache_key: ${{ inputs.cache_key }}

.github/workflows/e2e-app-store.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:12.1
+        image: postgres:13.13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/e2e-embed-react.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:12.1
+        image: postgres:13.13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/e2e-embed.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:12.1
+        image: postgres:13.13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/e2e.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: buildjet-4vcpu-ubuntu-2204
     services:
       postgres:
-        image: postgres:12.1
+        image: postgres:13.13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/production-build-without-database.yml

@@ -29,6 +29,7 @@ env:
   SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
   TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
 
 jobs:
   build:

.github/workflows/production-build.yml

@@ -33,6 +33,7 @@ env:
   SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
   TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
 
 jobs:
   build:
@@ -41,7 +42,7 @@ jobs:
     timeout-minutes: 30
     services:
       postgres:
-        image: postgres:12.1
+        image: postgres:13.13
         credentials:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.prettierignore

@@ -16,3 +16,4 @@ public
 packages/prisma/zod
 packages/prisma/enums
 apps/web/public/embed
+apps/api/v2/swagger/documentation.json

LICENSE

@@ -2,7 +2,8 @@ Copyright (c) 2020-present Cal.com, Inc.
 
 Portions of this software are licensed as follows:
 
-* All content that resides under https://github.com/calcom/cal.com/tree/main/packages/features/ee and https://github.com/calcom/cal.com/tree/main/apps/api/ directory of this repository (Commercial License) is licensed under the license defined in "ee/LICENSE".
+* All content that resides under https://github.com/calcom/cal.com/tree/main/packages/features/ee and 
+https://github.com/calcom/cal.com/tree/main/apps/api/v2/src/ee directory of this repository (Commercial License) is licensed under the license defined in "ee/LICENSE".
 * All third party components incorporated into the Cal.com Software are licensed under the original license provided by the owner of the applicable component.
 * Content outside of the above mentioned directories or restrictions above is available under the "AGPLv3" license as defined below.
 

apps/ai/src/utils/agent.ts

@@ -1,5 +1,6 @@
+import { ChatPromptTemplate } from "@langchain/core/prompts";
 import { ChatOpenAI } from "@langchain/openai";
-import { initializeAgentExecutorWithOptions } from "langchain/agents";
+import { AgentExecutor, createOpenAIFunctionsAgent } from "langchain/agents";
 
 import { env } from "../env.mjs";
 import createBookingIfAvailable from "../tools/createBooking";
@@ -47,67 +48,72 @@ const agent = async (
   /**
    * Initialize the agent executor with arguments.
    */
-  const executor = await initializeAgentExecutorWithOptions(tools, model, {
-    agentArgs: {
-      prefix: `You are Cal.ai - a bleeding edge scheduling assistant that interfaces via email.
-Make sure your final answers are definitive, complete and well formatted.
-Sometimes, tools return errors. In this case, try to handle the error intelligently or ask the user for more information.
-Tools will always handle times in UTC, but times sent to users should be formatted per that user's timezone.
-In responses to users, always summarize necessary context and open the door to follow ups. For example "I have booked your chat with @username for 3pm on Wednesday, December 20th, 2023 EST. Please let me know if you need to reschedule."
-If you can't find a referenced user, ask the user for their email or @username. Make sure to specify that usernames require the @username format. Users don't know other users' userIds.
+  const prompt =
+    ChatPromptTemplate.fromTemplate(`You are Cal.ai - a bleeding edge scheduling assistant that interfaces via email.
+  Make sure your final answers are definitive, complete and well formatted.
+  Sometimes, tools return errors. In this case, try to handle the error intelligently or ask the user for more information.
+  Tools will always handle times in UTC, but times sent to users should be formatted per that user's timezone.
+  In responses to users, always summarize necessary context and open the door to follow ups. For example "I have booked your chat with @username for 3pm on Wednesday, December 20th, 2023 EST. Please let me know if you need to reschedule."
+  If you can't find a referenced user, ask the user for their email or @username. Make sure to specify that usernames require the @username format. Users don't know other users' userIds.
+  
+  The primary user's id is: ${userId}
+  The primary user's username is: ${user.username}
+  The current time in the primary user's timezone is: ${now(user.timeZone, {
+    weekday: "long",
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+    hour: "numeric",
+    minute: "numeric",
+  })}
+  The primary user's time zone is: ${user.timeZone}
+  The primary user's event types are: ${user.eventTypes
+    .map((e: EventType) => `ID: ${e.id}, Slug: ${e.slug}, Title: ${e.title}, Length: ${e.length};`)
+    .join("\n")}
+  The primary user's working hours are: ${user.workingHours
+    .map(
+      (w: WorkingHours) =>
+        `Days: ${w.days.join(", ")}, Start Time (minutes in UTC): ${
+          w.startTime
+        }, End Time (minutes in UTC): ${w.endTime};`
+    )
+    .join("\n")}
+  ${
+    users.length
+      ? `The email references the following @usernames and emails: ${users
+          .map(
+            (u) =>
+              `${
+                (u.id ? `, id: ${u.id}` : "id: (non user)") +
+                (u.username
+                  ? u.type === "fromUsername"
+                    ? `, username: @${u.username}`
+                    : ", username: REDACTED"
+                  : ", (no username)") +
+                (u.email
+                  ? u.type === "fromEmail"
+                    ? `, email: ${u.email}`
+                    : ", email: REDACTED"
+                  : ", (no email)")
+              };`
+          )
+          .join("\n")}`
+      : ""
+  }`);
+  const agent = await createOpenAIFunctionsAgent({
+    llm: model,
+    prompt,
+    tools,
+  });
 
-The primary user's id is: ${userId}
-The primary user's username is: ${user.username}
-The current time in the primary user's timezone is: ${now(user.timeZone, {
-        weekday: "long",
-        year: "numeric",
-        month: "long",
-        day: "numeric",
-        hour: "numeric",
-        minute: "numeric",
-      })}
-The primary user's time zone is: ${user.timeZone}
-The primary user's event types are: ${user.eventTypes
-        .map((e: EventType) => `ID: ${e.id}, Slug: ${e.slug}, Title: ${e.title}, Length: ${e.length};`)
-        .join("\n")}
-The primary user's working hours are: ${user.workingHours
-        .map(
-          (w: WorkingHours) =>
-            `Days: ${w.days.join(", ")}, Start Time (minutes in UTC): ${
-              w.startTime
-            }, End Time (minutes in UTC): ${w.endTime};`
-        )
-        .join("\n")}
-${
-  users.length
-    ? `The email references the following @usernames and emails: ${users
-        .map(
-          (u) =>
-            `${
-              (u.id ? `, id: ${u.id}` : "id: (non user)") +
-              (u.username
-                ? u.type === "fromUsername"
-                  ? `, username: @${u.username}`
-                  : ", username: REDACTED"
-                : ", (no username)") +
-              (u.email
-                ? u.type === "fromEmail"
-                  ? `, email: ${u.email}`
-                  : ", email: REDACTED"
-                : ", (no email)")
-            };`
-        )
-        .join("\n")}`
-    : ""
-}
-            `,
-    },
-    agentType: "openai-functions",
+  const executor = new AgentExecutor({
+    agent,
+    tools,
     returnIntermediateSteps: env.NODE_ENV === "development",
     verbose: env.NODE_ENV === "development",
   });
 
-  const result = await executor.call({ input });
+  const result = await executor.invoke({ input });
   const { output } = result;
 
   return output;

apps/api/index.js

@@ -0,0 +1,18 @@
+const http = require("http");
+const connect = require("connect");
+const { createProxyMiddleware } = require("http-proxy-middleware");
+
+const apiProxyV1 = createProxyMiddleware({
+  target: "http://localhost:3003",
+});
+
+const apiProxyV2 = createProxyMiddleware({
+  target: "http://localhost:3004",
+});
+
+const app = connect();
+app.use("/", apiProxyV1);
+
+app.use("/v2", apiProxyV2);
+
+http.createServer(app).listen(3002);

apps/api/lib/helpers/customPrisma.ts

@@ -1,43 +0,0 @@
-import type { NextMiddleware } from "next-api-middleware";
-
-import { CONSOLE_URL } from "@calcom/lib/constants";
-import { customPrisma } from "@calcom/prisma";
-
-const LOCAL_CONSOLE_URL = process.env.NEXT_PUBLIC_CONSOLE_URL || CONSOLE_URL;
-
-// This replaces the prisma client for the custom one if the key is valid
-export const customPrismaClient: NextMiddleware = async (req, res, next) => {
-  const {
-    query: { key },
-  } = req;
-  // If no custom api Id is provided, attach to request the regular cal.com prisma client.
-  if (!key) {
-    req.prisma = customPrisma();
-    await next();
-    return;
-  }
-
-  // If we have a key, we check if the deployment matching the key, has a databaseUrl value set.
-  const databaseUrl = await fetch(`${LOCAL_CONSOLE_URL}/api/deployments/database?key=${key}`)
-    .then((res) => res.json())
-    .then((res) => res.databaseUrl);
-
-  if (!databaseUrl) {
-    res.status(400).json({ error: "no databaseUrl set up at your instance yet" });
-    return;
-  }
-  req.prisma = customPrisma({ datasources: { db: { url: databaseUrl } } });
-  /* @note:
-    In order to skip verifyApiKey for customPrisma requests, 
-    we pass isAdmin true, and userId 0, if we detect them later, 
-    we skip verifyApiKey logic and pass onto next middleware instead.
-     */
-  req.isAdmin = true;
-  req.isCustomPrisma = true;
-  // We don't need the key from here and on. Prevents unrecognized key errors.
-  delete req.query.key;
-  await next();
-  await req.prisma.$disconnect();
-  // @ts-expect-error testing
-  delete req.prisma;
-};

apps/api/package.json

@@ -1,46 +1,16 @@
 {
-  "name": "@calcom/api",
+  "name": "@calcom/api-proxy",
   "version": "1.0.0",
-  "description": "Public API for Cal.com",
-  "main": "index.ts",
-  "repository": "git@github.com:calcom/api.git",
-  "author": "Cal.com Inc.",
-  "private": true,
+  "description": "",
+  "main": "index.js",
   "scripts": {
-    "build": "next build",
-    "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf .next",
-    "dev": "PORT=3002 next dev",
-    "lint": "eslint . --ignore-path .gitignore",
-    "lint:fix": "eslint . --ext .ts,.js,.tsx,.jsx --fix",
-    "start": "PORT=3002 next start",
-    "docker-start-api": "PORT=80 next start",
-    "type-check": "tsc --pretty --noEmit"
-  },
-  "devDependencies": {
-    "@calcom/tsconfig": "*",
-    "@calcom/types": "*",
-    "node-mocks-http": "^1.11.0"
+    "dev": "node ./index.js"
   },
+  "author": "",
+  "license": "ISC",
   "dependencies": {
-    "@calcom/app-store": "*",
-    "@calcom/core": "*",
-    "@calcom/dayjs": "*",
-    "@calcom/emails": "*",
-    "@calcom/features": "*",
-    "@calcom/lib": "*",
-    "@calcom/prisma": "*",
-    "@calcom/trpc": "*",
-    "@sentry/nextjs": "^7.73.0",
-    "bcryptjs": "^2.4.3",
-    "memory-cache": "^0.2.0",
-    "next": "^13.5.4",
-    "next-api-middleware": "^1.0.1",
-    "next-axiom": "^0.17.0",
-    "next-swagger-doc": "^0.3.6",
-    "next-validations": "^0.2.0",
-    "typescript": "^4.9.4",
-    "tzdata": "^1.0.30",
-    "uuid": "^8.3.2",
-    "zod": "^3.22.4"
+    "connect": "^3.7.0",
+    "http": "^0.0.1-security",
+    "http-proxy-middleware": "^2.0.6"
   }
 }

apps/api/test/lib/middleware/withMiddleware.test.ts

@@ -1,17 +0,0 @@
-import { describe, vi, it, expect, afterEach } from "vitest";
-
-import { middlewareOrder } from "../../../lib/helpers/withMiddleware";
-
-afterEach(() => {
-  vi.resetAllMocks();
-});
-
-// Not sure if there is much point testing this order is actually applied via an integration test:
-// It is tested internally https://github.com/htunnicliff/next-api-middleware/blob/368b12aa30e79f4bd7cfe7aacc18da263cc3de2f/lib/label.spec.ts#L62
-describe("API - withMiddleware test", () => {
-  it("Custom prisma should be before verifyApiKey", async () => {
-    const customPrismaClientIndex = middlewareOrder.indexOf("customPrismaClient");
-    const verifyApiKeyIndex = middlewareOrder.indexOf("verifyApiKey");
-    expect(customPrismaClientIndex).toBeLessThan(verifyApiKeyIndex);
-  });
-});

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -3,6 +3,7 @@ import type { NextMiddleware } from "next-api-middleware";
 import { hashAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
 import checkLicense from "@calcom/features/ee/common/server/checkLicense";
 import { IS_PRODUCTION } from "@calcom/lib/constants";
+import prisma from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";
 
@@ -16,15 +17,9 @@ export const dateNotInPast = function (date: Date) {
 
 // This verifies the apiKey and sets the user if it is valid.
 export const verifyApiKey: NextMiddleware = async (req, res, next) => {
-  const { prisma, isCustomPrisma, isAdmin } = req;
   const hasValidLicense = await checkLicense(prisma);
   if (!hasValidLicense && IS_PRODUCTION)
     return res.status(401).json({ error: "Invalid or missing CALCOM_LICENSE_KEY environment variable" });
-  // If the user is an admin and using a license key (from customPrisma), skip the apiKey check.
-  if (isCustomPrisma && isAdmin) {
-    await next();
-    return;
-  }
   // Check if the apiKey query param is provided.
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
   // remove the prefix from the user provided api_key. If no env set default to "cal_"
@@ -43,6 +38,5 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   req.userId = apiKey.userId;
   // save the isAdmin boolean here for later use
   req.isAdmin = await isAdminGuard(req);
-  req.isCustomPrisma = false;
   await next();
 };

apps/api/v1/lib/helpers/verifyCredentialSyncEnabled.ts

@@ -0,0 +1,24 @@
+import type { NextMiddleware } from "next-api-middleware";
+
+import { APP_CREDENTIAL_SHARING_ENABLED } from "@calcom/lib/constants";
+
+export const verifyCredentialSyncEnabled: NextMiddleware = async (req, res, next) => {
+  const { isAdmin } = req;
+
+  if (!isAdmin) {
+    return res.status(403).json({ error: "Only admin API keys can access credential syncing endpoints" });
+  }
+
+  if (!APP_CREDENTIAL_SHARING_ENABLED) {
+    return res.status(501).json({ error: "Credential syncing is not enabled" });
+  }
+
+  if (
+    req.headers[process.env.CALCOM_CREDENTIAL_SYNC_HEADER_NAME || "calcom-credential-sync-secret"] !==
+    process.env.CALCOM_CREDENTIAL_SYNC_SECRET
+  ) {
+    return res.status(401).json({ message: "Invalid credential sync secret" });
+  }
+
+  await next();
+};

apps/api/v1/lib/helpers/withMiddleware.ts

@@ -2,7 +2,6 @@ import { label } from "next-api-middleware";
 
 import { addRequestId } from "./addRequestid";
 import { captureErrors } from "./captureErrors";
-import { customPrismaClient } from "./customPrisma";
 import { extendRequest } from "./extendRequest";
 import {
   HTTP_POST,
@@ -14,6 +13,7 @@ import {
 } from "./httpMethods";
 import { rateLimitApiKey } from "./rateLimitApiKey";
 import { verifyApiKey } from "./verifyApiKey";
+import { verifyCredentialSyncEnabled } from "./verifyCredentialSyncEnabled";
 import { withPagination } from "./withPagination";
 
 const middleware = {
@@ -26,25 +26,22 @@ const middleware = {
   addRequestId,
   verifyApiKey,
   rateLimitApiKey,
-  customPrismaClient,
   extendRequest,
   pagination: withPagination,
   captureErrors,
+  verifyCredentialSyncEnabled,
 };
 
 type Middleware = keyof typeof middleware;
 
-const middlewareOrder =
+const middlewareOrder = [
   // The order here, determines the order of execution
-  [
-    "extendRequest",
-    "captureErrors",
-    // - Put customPrismaClient before verifyApiKey always.
-    "customPrismaClient",
-    "verifyApiKey",
-    "rateLimitApiKey",
-    "addRequestId",
-  ] as Middleware[]; // <-- Provide a list of middleware to call automatically
+  "extendRequest",
+  "captureErrors",
+  "verifyApiKey",
+  "rateLimitApiKey",
+  "addRequestId",
+] as Middleware[]; // <-- Provide a list of middleware to call automatically
 
 const withMiddleware = label(middleware, middlewareOrder);
 

apps/api/v1/lib/utils/isAdmin.ts

@@ -1,9 +1,10 @@
 import type { NextApiRequest } from "next";
 
+import prisma from "@calcom/prisma";
 import { UserPermissionRole } from "@calcom/prisma/enums";
 
 export const isAdminGuard = async (req: NextApiRequest) => {
-  const { userId, prisma } = req;
+  const { userId } = req;
   const user = await prisma.user.findUnique({ where: { id: userId } });
   return user?.role === UserPermissionRole.ADMIN;
 };

apps/api/v1/lib/validations/connected-calendar.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+const CalendarSchema = z.object({
+  externalId: z.string(),
+  name: z.string(),
+  primary: z.boolean(),
+  readOnly: z.boolean(),
+});
+
+const IntegrationSchema = z.object({
+  name: z.string(),
+  appId: z.string(),
+  userId: z.number(),
+  integration: z.string(),
+  calendars: z.array(CalendarSchema),
+});
+
+export const schemaConnectedCalendarsReadPublic = z.array(IntegrationSchema);

apps/api/v1/lib/validations/credential-sync.ts

@@ -0,0 +1,64 @@
+import { z } from "zod";
+
+import { HttpError } from "@calcom/lib/http-error";
+
+const userId = z.string().transform((val) => {
+  const userIdInt = parseInt(val);
+
+  if (isNaN(userIdInt)) {
+    throw new HttpError({ message: "userId is not a valid number", statusCode: 400 });
+  }
+
+  return userIdInt;
+});
+const appSlug = z.string();
+const credentialId = z.string().transform((val) => {
+  const credentialIdInt = parseInt(val);
+
+  if (isNaN(credentialIdInt)) {
+    throw new HttpError({ message: "credentialId is not a valid number", statusCode: 400 });
+  }
+
+  return credentialIdInt;
+});
+const encryptedKey = z.string();
+
+export const schemaCredentialGetParams = z.object({
+  userId,
+  appSlug: appSlug.optional(),
+});
+
+export const schemaCredentialPostParams = z.object({
+  userId,
+  createSelectedCalendar: z
+    .string()
+    .optional()
+    .transform((val) => {
+      return val === "true";
+    }),
+  createDestinationCalendar: z
+    .string()
+    .optional()
+    .transform((val) => {
+      return val === "true";
+    }),
+});
+
+export const schemaCredentialPostBody = z.object({
+  appSlug,
+  encryptedKey,
+});
+
+export const schemaCredentialPatchParams = z.object({
+  userId,
+  credentialId,
+});
+
+export const schemaCredentialPatchBody = z.object({
+  encryptedKey,
+});
+
+export const schemaCredentialDeleteParams = z.object({
+  userId,
+  credentialId,
+});

apps/api/v1/next-i18next.config.js

@@ -4,7 +4,7 @@ const i18nConfig = require("@calcom/config/next-i18next.config");
 /** @type {import("next-i18next").UserConfig} */
 const config = {
   ...i18nConfig,
-  localePath: path.resolve("../web/public/static/locales"),
+  localePath: path.resolve("../../web/public/static/locales"),
 };
 
 module.exports = config;

apps/api/v1/next.d.ts

@@ -1,8 +1,6 @@
 import type { Session } from "next-auth";
 import type { NextApiRequest as BaseNextApiRequest } from "next/types";
 
-import type { PrismaClient } from "@calcom/prisma";
-
 export type * from "next/types";
 
 export declare module "next" {
@@ -11,11 +9,9 @@ export declare module "next" {
 
     userId: number;
     method: string;
-    prisma: PrismaClient;
     // session: { user: { id: number } };
     // query: Partial<{ [key: string]: string | string[] }>;
     isAdmin: boolean;
-    isCustomPrisma: boolean;
     pagination: { take: number; skip: number };
   }
 }

apps/api/v1/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@calcom/api",
+  "version": "1.0.0",
+  "description": "Public API for Cal.com",
+  "main": "index.ts",
+  "repository": "git@github.com:calcom/api.git",
+  "author": "Cal.com Inc.",
+  "private": true,
+  "scripts": {
+    "build": "next build",
+    "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf .next",
+    "dev": "PORT=3003 next dev",
+    "lint": "eslint . --ignore-path .gitignore",
+    "lint:fix": "eslint . --ext .ts,.js,.tsx,.jsx --fix",
+    "start": "PORT=3003 next start",
+    "docker-start-api": "PORT=80 next start",
+    "type-check": "tsc --pretty --noEmit"
+  },
+  "devDependencies": {
+    "@calcom/tsconfig": "*",
+    "@calcom/types": "*",
+    "node-mocks-http": "^1.11.0"
+  },
+  "dependencies": {
+    "@calcom/app-store": "*",
+    "@calcom/core": "*",
+    "@calcom/dayjs": "*",
+    "@calcom/emails": "*",
+    "@calcom/features": "*",
+    "@calcom/lib": "*",
+    "@calcom/prisma": "*",
+    "@calcom/trpc": "*",
+    "@sentry/nextjs": "^7.73.0",
+    "bcryptjs": "^2.4.3",
+    "memory-cache": "^0.2.0",
+    "next": "^13.5.4",
+    "next-api-middleware": "^1.0.1",
+    "next-axiom": "^0.17.0",
+    "next-swagger-doc": "^0.3.6",
+    "next-validations": "^0.2.0",
+    "typescript": "^4.9.4",
+    "tzdata": "^1.0.30",
+    "uuid": "^8.3.2",
+    "zod": "^3.22.4"
+  }
+}

apps/api/v1/pages/api/api-keys/[id]/_auth-middleware.ts

@@ -1,11 +1,12 @@
 import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
+import prisma from "@calcom/prisma";
 
 import { schemaQueryIdAsString } from "~/lib/validations/shared/queryIdString";
 
 export async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin, prisma } = req;
+  const { userId, isAdmin } = req;
   const { id } = schemaQueryIdAsString.parse(req.query);
   // Admin can check any api key
   if (isAdmin) return;

apps/api/v1/pages/api/api-keys/[id]/_delete.ts

@@ -1,11 +1,12 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaQueryIdAsString } from "~/lib/validations/shared/queryIdString";
 
 async function deleteHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdAsString.parse(query);
   await prisma.apiKey.delete({ where: { id } });
   return { message: `ApiKey with id: ${id} deleted` };

apps/api/v1/pages/api/api-keys/[id]/_get.ts

@@ -1,12 +1,13 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { apiKeyPublicSchema } from "~/lib/validations/api-key";
 import { schemaQueryIdAsString } from "~/lib/validations/shared/queryIdString";
 
 async function getHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdAsString.parse(query);
   const api_key = await prisma.apiKey.findUniqueOrThrow({ where: { id } });
   return { api_key: apiKeyPublicSchema.parse(api_key) };

apps/api/v1/pages/api/api-keys/[id]/_patch.ts

@@ -1,12 +1,13 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { apiKeyEditBodySchema, apiKeyPublicSchema } from "~/lib/validations/api-key";
 import { schemaQueryIdAsString } from "~/lib/validations/shared/queryIdString";
 
 async function patchHandler(req: NextApiRequest) {
-  const { prisma, body } = req;
+  const { body } = req;
   const { id } = schemaQueryIdAsString.parse(req.query);
   const data = apiKeyEditBodySchema.parse(body);
   const api_key = await prisma.apiKey.update({ where: { id }, data });

apps/api/v1/pages/api/api-keys/_get.ts

@@ -2,6 +2,7 @@ import type { Prisma } from "@prisma/client";
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 import type { Ensure } from "@calcom/types/utils";
 
 import { apiKeyPublicSchema } from "~/lib/validations/api-key";
@@ -29,7 +30,7 @@ function hasReqArgs(req: CustomNextApiRequest): req is Ensure<CustomNextApiReque
 }
 
 async function getHandler(req: CustomNextApiRequest) {
-  const { userId, isAdmin, prisma } = req;
+  const { userId, isAdmin } = req;
   req.args = isAdmin ? {} : { where: { userId } };
   // Proof of concept: allowing mutation in exchange of composability
   handleAdminRequests(req);

apps/api/v1/pages/api/api-keys/_post.ts

@@ -5,11 +5,12 @@ import { v4 } from "uuid";
 import { generateUniqueAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { apiKeyCreateBodySchema, apiKeyPublicSchema } from "~/lib/validations/api-key";
 
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin, prisma } = req;
+  const { userId, isAdmin } = req;
   const { neverExpires, userId: bodyUserId, ...input } = apiKeyCreateBodySchema.parse(req.body);
   const [hashedKey, apiKey] = generateUniqueAPIKey();
   const args: Prisma.ApiKeyCreateArgs = {

apps/api/v1/pages/api/attendees/[id]/_auth-middleware.ts

@@ -1,11 +1,12 @@
 import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
+import prisma from "@calcom/prisma";
 
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin, prisma } = req;
+  const { userId, isAdmin } = req;
   const query = schemaQueryIdParseInt.parse(req.query);
   // @note: Here we make sure to only return attendee's of the user's own bookings if the user is not an admin.
   if (isAdmin) return;

apps/api/v1/pages/api/attendees/[id]/_delete.ts

@@ -1,6 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
@@ -34,7 +35,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Authorization information is missing or invalid.
  */
 export async function deleteHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   await prisma.attendee.delete({ where: { id } });
   return { message: `Attendee with id: ${id} deleted successfully` };

apps/api/v1/pages/api/attendees/[id]/_get.ts

@@ -1,6 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaAttendeeReadPublic } from "~/lib/validations/attendee";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
@@ -35,7 +36,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *         description: Attendee was not found
  */
 export async function getHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const attendee = await prisma.attendee.findUnique({ where: { id } });
   return { attendee: schemaAttendeeReadPublic.parse(attendee) };

apps/api/v1/pages/api/attendees/[id]/_patch.ts

@@ -3,6 +3,7 @@ import type { z } from "zod";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaAttendeeEditBodyParams, schemaAttendeeReadPublic } from "~/lib/validations/attendee";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
@@ -53,7 +54,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  */
 
 export async function patchHandler(req: NextApiRequest) {
-  const { prisma, query, body } = req;
+  const { query, body } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const data = schemaAttendeeEditBodyParams.parse(body);
   await checkPermissions(req, data);
@@ -62,7 +63,7 @@ export async function patchHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest, body: z.infer<typeof schemaAttendeeEditBodyParams>) {
-  const { isAdmin, prisma } = req;
+  const { isAdmin } = req;
   if (isAdmin) return;
   const { userId } = req;
   const { bookingId } = body;

apps/api/v1/pages/api/attendees/_get.ts

@@ -3,6 +3,7 @@ import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaAttendeeReadPublic } from "~/lib/validations/attendee";
 
@@ -30,7 +31,7 @@ import { schemaAttendeeReadPublic } from "~/lib/validations/attendee";
  *         description: No attendees were found
  */
 async function handler(req: NextApiRequest) {
-  const { userId, isAdmin, prisma } = req;
+  const { userId, isAdmin } = req;
   const args: Prisma.AttendeeFindManyArgs = isAdmin ? {} : { where: { booking: { userId } } };
   const data = await prisma.attendee.findMany(args);
   const attendees = data.map((attendee) => schemaAttendeeReadPublic.parse(attendee));

apps/api/v1/pages/api/attendees/_post.ts

@@ -2,6 +2,7 @@ import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaAttendeeCreateBodyParams, schemaAttendeeReadPublic } from "~/lib/validations/attendee";
 
@@ -51,7 +52,7 @@ import { schemaAttendeeCreateBodyParams, schemaAttendeeReadPublic } from "~/lib/
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { userId, isAdmin, prisma } = req;
+  const { userId, isAdmin } = req;
   const body = schemaAttendeeCreateBodyParams.parse(req.body);
 
   if (!isAdmin) {

apps/api/v1/pages/api/availabilities/[id]/_auth-middleware.ts

@@ -1,9 +1,11 @@
 import type { NextApiRequest } from "next";
 
+import prisma from "@calcom/prisma";
+
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, prisma, isAdmin, query } = req;
+  const { userId, isAdmin, query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   /** Admins can skip the ownership verification */
   if (isAdmin) return;

apps/api/v1/pages/api/availabilities/[id]/_delete.ts

@@ -1,6 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
@@ -36,7 +37,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Authorization information is missing or invalid.
  */
 export async function deleteHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   await prisma.availability.delete({ where: { id } });
   return { message: `Availability with id: ${id} deleted successfully` };

apps/api/v1/pages/api/availabilities/[id]/_get.ts

@@ -1,6 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaAvailabilityReadPublic } from "~/lib/validations/availability";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
@@ -37,7 +38,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Availability not found
  */
 export async function getHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const availability = await prisma.availability.findUnique({
     where: { id },

apps/api/v1/pages/api/availabilities/[id]/_patch.ts

@@ -1,6 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import {
   schemaAvailabilityEditBodyParams,
@@ -72,7 +73,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Authorization information is missing or invalid.
  */
 export async function patchHandler(req: NextApiRequest) {
-  const { prisma, query, body } = req;
+  const { query, body } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const data = schemaAvailabilityEditBodyParams.parse(body);
   const availability = await prisma.availability.update({

apps/api/v1/pages/api/availabilities/_post.ts

@@ -2,6 +2,7 @@ import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import {
   schemaAvailabilityCreateBodyParams,
@@ -71,7 +72,6 @@ import {
  *        description: Authorization information is missing or invalid.
  */
 async function postHandler(req: NextApiRequest) {
-  const { prisma } = req;
   const data = schemaAvailabilityCreateBodyParams.parse(req.body);
   await checkPermissions(req);
   const availability = await prisma.availability.create({
@@ -86,7 +86,7 @@ async function postHandler(req: NextApiRequest) {
 }
 
 async function checkPermissions(req: NextApiRequest) {
-  const { userId, prisma, isAdmin } = req;
+  const { userId, isAdmin } = req;
   if (isAdmin) return;
   const data = schemaAvailabilityCreateBodyParams.parse(req.body);
   const schedule = await prisma.schedule.findFirst({

apps/api/v1/pages/api/availability/_get.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { getUserAvailability } from "@calcom/core/getUserAvailability";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 import { availabilityUserSelect } from "@calcom/prisma";
 import { MembershipRole } from "@calcom/prisma/enums";
 import { stringOrNumber } from "@calcom/prisma/zod-utils";
@@ -188,7 +189,7 @@ const availabilitySchema = z
   );
 
 async function handler(req: NextApiRequest) {
-  const { prisma, isAdmin, userId: reqUserId } = req;
+  const { isAdmin, userId: reqUserId } = req;
   const { username, userId, eventTypeId, dateTo, dateFrom, teamId } = availabilitySchema.parse(req.query);
   if (!teamId)
     return getUserAvailability({

apps/api/v1/pages/api/booking-references/[id]/_auth-middleware.ts

@@ -1,11 +1,12 @@
 import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
+import prisma from "@calcom/prisma";
 
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
 async function authMiddleware(req: NextApiRequest) {
-  const { userId, isAdmin, prisma } = req;
+  const { userId, isAdmin } = req;
   const { id } = schemaQueryIdParseInt.parse(req.query);
   // Here we make sure to only return references of the user's own bookings if the user is not an admin.
   if (isAdmin) return;

apps/api/v1/pages/api/booking-references/[id]/_delete.ts

@@ -1,6 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
@@ -34,7 +35,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Authorization information is missing or invalid.
  */
 export async function deleteHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   await prisma.bookingReference.delete({ where: { id } });
   return { message: `BookingReference with id: ${id} deleted` };

apps/api/v1/pages/api/booking-references/[id]/_get.ts

@@ -1,6 +1,7 @@
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import { schemaBookingReferenceReadPublic } from "~/lib/validations/booking-reference";
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
@@ -35,7 +36,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *         description: BookingReference was not found
  */
 export async function getHandler(req: NextApiRequest) {
-  const { prisma, query } = req;
+  const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const booking_reference = await prisma.bookingReference.findUniqueOrThrow({ where: { id } });
   return { booking_reference: schemaBookingReferenceReadPublic.parse(booking_reference) };

apps/api/v1/pages/api/booking-references/[id]/_patch.ts

@@ -2,6 +2,7 @@ import type { Prisma } from "@prisma/client";
 import type { NextApiRequest } from "next";
 
 import { defaultResponder } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
 
 import {
   schemaBookingEditBodyParams,
@@ -59,7 +60,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  *        description: Authorization information is missing or invalid.
  */
 export async function patchHandler(req: NextApiRequest) {
-  const { prisma, query, body, isAdmin, userId } = req;
+  const { query, body, isAdmin, userId } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
   const data = schemaBookingEditBodyParams.parse(body);
   /* If user tries to update bookingId, we run extra checks */