chore: v4.6.3 (#17161)

* perf: Add index for invalid column in Credential

* Added missing file change

.env.example

@@ -168,13 +168,13 @@ NEXT_PUBLIC_STRIPE_PREMIUM_PLAN_PRICE=
 NEXT_PUBLIC_IS_PREMIUM_NEW_PLAN=0
 NEXT_PUBLIC_STRIPE_PREMIUM_NEW_PLAN_PRICE=
 STRIPE_TEAM_MONTHLY_PRICE_ID=
+STRIPE_TEAM_PRODUCT_ID=
 STRIPE_ORG_MONTHLY_PRICE_ID=
 STRIPE_WEBHOOK_SECRET=
 STRIPE_WEBHOOK_SECRET_APPS=
 STRIPE_PRIVATE_KEY=
 STRIPE_CLIENT_ID=
 
-
 # Use for internal Public API Keys and optional
 API_KEY_PREFIX=cal_
 # ***********************************************************************************************************
@@ -334,8 +334,8 @@ AB_TEST_BUCKET_PROBABILITY=50
 # whether we redirect to the future/event-types from event-types or not
 APP_ROUTER_EVENT_TYPES_ENABLED=0
 APP_ROUTER_SETTINGS_DEVELOPER_ENABLED=0
-APP_ROUTER_SETTINGS_SECURITY_ENABLED=0
 APP_ROUTER_SETTINGS_ADMIN_ENABLED=0
+APP_ROUTER_SETTINGS_MY_ACCOUNT_ENABLED=0
 APP_ROUTER_SETTINGS_PLATFORM_ENABLED=0
 APP_ROUTER_SETTINGS_ORG_ENABLED=0
 APP_ROUTER_APPS_INSTALLED_CATEGORY_ENABLED=0

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,7 +12,7 @@
 ## Mandatory Tasks (DO NOT REMOVE)
 
 - [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
-- [ ] I have added a Docs issue [here](https://github.com/calcom/docs/issues/new) if this PR makes changes that would require a [documentation change](https://docs.cal.com/docs). If N/A, write N/A here and check the checkbox.
+- [ ] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox.
 - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.
 
 ## How should this be tested?

.github/workflows/docs-build.yml

@@ -0,0 +1,41 @@
+# This is just to test this file
+name: Build
+
+on:
+  workflow_call:
+
+jobs:
+  build:
+    name: Build Docs
+    permissions:
+      contents: read
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - name: Cache Docs build
+        uses: buildjet/cache@v4
+        id: cache-docs-build
+        env:
+          cache-name: docs-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('docs/**.*', '!**/node_modules') }}
+          key-3: ${{ github.event.pull_request.number || github.ref }}
+          key-4: ${{ github.sha }}
+        with:
+          path: |
+            **/docs/**
+          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+      - name: Run build
+        working-directory: docs
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          if [ ${{ steps.cache-docs-build.outputs.cache-hit }} == 'true' ]; then
+            echo "Cache hit for Docs build. Skipping build."
+          else
+            npm install -g mintlify
+            mintlify dev &
+            sleep 5 # Let it run for 5 seconds
+            kill $!
+          fi
+        shell: bash

.github/workflows/pr.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           filters: |
             has-files-requiring-all-checks:
-              - "!(**.md|.github/CODEOWNERS)"
+              - "!(**.md|.github/CODEOWNERS|docs/**|apps/web/public/static/locales/**/common.json)"
       - name: Get Latest Commit SHA
         id: get_sha
         run: |
@@ -139,6 +139,13 @@ jobs:
     uses: ./.github/workflows/atoms-production-build.yml
     secrets: inherit
 
+  build-docs:
+    name: Production builds
+    needs: [changes, check-label, deps]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/docs-build.yml
+    secrets: inherit
+
   build:
     name: Production builds
     needs: [changes, check-label, deps]
@@ -225,6 +232,7 @@ jobs:
         build-api-v1,
         build-api-v2,
         build-atoms,
+        build-docs,
         e2e,
         e2e-api-v2,
         e2e-embed,

.github/workflows/production-build-without-database.yml

@@ -39,7 +39,7 @@ env:
 
 jobs:
   build:
-    name: Web App
+    name: Build Web App
     runs-on: buildjet-4vcpu-ubuntu-2204
     timeout-minutes: 30
     steps:

apps/api/v1/lib/validations/attendee.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
 import { _AttendeeModel as Attendee } from "@calcom/prisma/zod";
 
 import { timeZone } from "~/lib/validations/shared/timeZone";
@@ -14,7 +15,7 @@ export const schemaAttendeeBaseBodyParams = Attendee.pick({
 const schemaAttendeeCreateParams = z
   .object({
     bookingId: z.number().int(),
-    email: z.string().email(),
+    email: emailSchema,
     name: z.string(),
     timeZone: timeZone,
   })
@@ -23,7 +24,7 @@ const schemaAttendeeCreateParams = z
 const schemaAttendeeEditParams = z
   .object({
     name: z.string().optional(),
-    email: z.string().email().optional(),
+    email: emailSchema.optional(),
     timeZone: timeZone.optional(),
   })
   .strict();

apps/api/v1/lib/validations/booking.ts

@@ -73,6 +73,7 @@ export const schemaBookingReadPublic = Booking.extend({
   attendees: z
     .array(
       _AttendeeModel.pick({
+        id: true,
         email: true,
         name: true,
         timeZone: true,

apps/api/v1/lib/validations/shared/queryAttendeeEmail.ts

@@ -1,16 +1,18 @@
 import { withValidation } from "next-validations";
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
+
 import { baseApiParams } from "./baseApiParams";
 
 // Extracted out as utility function so can be reused
 // at different endpoints that require this validation.
 export const schemaQueryAttendeeEmail = baseApiParams.extend({
-  attendeeEmail: z.string().email(),
+  attendeeEmail: emailSchema,
 });
 
 export const schemaQuerySingleOrMultipleAttendeeEmails = z.object({
-  attendeeEmail: z.union([z.string().email(), z.array(z.string().email())]).optional(),
+  attendeeEmail: z.union([emailSchema, z.array(emailSchema)]).optional(),
 });
 
 export const withValidQueryAttendeeEmail = withValidation({

apps/api/v1/lib/validations/shared/queryUserEmail.ts

@@ -1,16 +1,18 @@
 import { withValidation } from "next-validations";
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
+
 import { baseApiParams } from "./baseApiParams";
 
 // Extracted out as utility function so can be reused
 // at different endpoints that require this validation.
 export const schemaQueryUserEmail = baseApiParams.extend({
-  email: z.string().email(),
+  email: emailSchema,
 });
 
 export const schemaQuerySingleOrMultipleUserEmails = z.object({
-  email: z.union([z.string().email(), z.array(z.string().email())]),
+  email: z.union([emailSchema, z.array(emailSchema)]),
 });
 
 export const withValidQueryUserEmail = withValidation({

apps/api/v1/lib/validations/team.ts

@@ -11,6 +11,7 @@ export const schemaTeamBaseBodyParams = Team.omit({ id: true, createdAt: true })
   smsLockState: true,
   smsLockReviewedByAdmin: true,
   bookingLimits: true,
+  includeManagedEventsInLimits: true,
 });
 
 const schemaTeamRequiredParams = z.object({

apps/api/v1/lib/validations/user.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { emailSchema } from "@calcom/lib/emailSchema";
 import { checkUsername } from "@calcom/lib/server/checkUsername";
 import { _UserModel as User } from "@calcom/prisma/zod";
 import { iso8601 } from "@calcom/prisma/zod-utils";
@@ -92,7 +93,7 @@ export const schemaUserBaseBodyParams = User.pick({
 // Here we can both require or not (adding optional or nullish) and also rewrite validations for any value
 // for example making weekStart only accept weekdays as input
 const schemaUserEditParams = z.object({
-  email: z.string().email().toLowerCase(),
+  email: emailSchema.toLowerCase(),
   username: usernameSchema,
   weekStart: z.nativeEnum(weekdays).optional(),
   brandColor: z.string().min(4).max(9).regex(/^#/).optional(),
@@ -115,7 +116,7 @@ const schemaUserEditParams = z.object({
 // merging both BaseBodyParams with RequiredParams, and omiting whatever we want at the end.
 
 const schemaUserCreateParams = z.object({
-  email: z.string().email().toLowerCase(),
+  email: emailSchema.toLowerCase(),
   username: usernameSchema,
   weekStart: z.nativeEnum(weekdays).optional(),
   brandColor: z.string().min(4).max(9).regex(/^#/).optional(),

apps/api/v1/package.json

@@ -33,7 +33,7 @@
     "@sentry/nextjs": "^8.8.0",
     "bcryptjs": "^2.4.3",
     "memory-cache": "^0.2.0",
-    "next": "^13.5.4",
+    "next": "^13.5.6",
     "next-api-middleware": "^1.0.1",
     "next-axiom": "^0.17.0",
     "next-swagger-doc": "^0.3.6",

apps/api/v1/pages/api/bookings/[id]/_delete.ts

@@ -2,7 +2,7 @@ import type { NextApiRequest } from "next";
 
 import handleCancelBooking from "@calcom/features/bookings/lib/handleCancelBooking";
 import { defaultResponder } from "@calcom/lib/server";
-import { schemaBookingCancelParams } from "@calcom/prisma/zod-utils";
+import { bookingCancelSchema } from "@calcom/prisma/zod-utils";
 
 import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt";
 
@@ -65,7 +65,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
  */
 async function handler(req: NextApiRequest) {
   const { id, allRemainingBookings, cancellationReason } = schemaQueryIdParseInt
-    .merge(schemaBookingCancelParams.pick({ allRemainingBookings: true, cancellationReason: true }))
+    .merge(bookingCancelSchema.pick({ allRemainingBookings: true, cancellationReason: true }))
     .parse({
       ...req.query,
       allRemainingBookings: req.query.allRemainingBookings === "true",

apps/api/v2/.env.example

@@ -26,4 +26,5 @@ WEB_APP_URL=http://localhost:3000/
 CALCOM_LICENSE_KEY=
 API_KEY_PREFIX=cal_
 GET_LICENSE_KEY_URL="https://console.cal.com/api/license"
-IS_E2E=false
+IS_E2E=false
+DOCS_URL=

apps/api/v2/package.json

@@ -28,13 +28,14 @@
   "dependencies": {
     "@calcom/platform-constants": "*",
     "@calcom/platform-enums": "*",
-    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.40",
+    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.46",
     "@calcom/platform-libraries-0.0.2": "npm:@calcom/platform-libraries@0.0.2",
     "@calcom/platform-types": "*",
     "@calcom/platform-utils": "*",
     "@calcom/prisma": "*",
     "@golevelup/ts-jest": "^0.4.0",
     "@microsoft/microsoft-graph-types-beta": "^0.42.0-preview",
+    "@nest-lab/throttler-storage-redis": "1.0.0",
     "@nestjs/bull": "^10.1.1",
     "@nestjs/common": "^10.0.0",
     "@nestjs/config": "^3.1.1",
@@ -43,7 +44,7 @@
     "@nestjs/passport": "^10.0.2",
     "@nestjs/platform-express": "^10.0.0",
     "@nestjs/swagger": "^7.3.0",
-    "@nestjs/throttler": "^5.1.2",
+    "@nestjs/throttler": "6.2.1",
     "@sentry/node": "^8.8.0",
     "body-parser": "^1.20.2",
     "bull": "^4.12.4",
@@ -57,10 +58,10 @@
     "ioredis": "^5.3.2",
     "luxon": "^3.4.4",
     "nest-winston": "^1.9.4",
-    "nestjs-throttler-storage-redis": "^0.4.1",
     "next-auth": "^4.22.1",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
+    "qs-stringify": "^1.2.1",
     "querystring": "^0.2.1",
     "reflect-metadata": "^0.1.13",
     "rxjs": "^7.8.1",

apps/api/v2/src/app.controller.ts

@@ -3,8 +3,6 @@ import { Controller, Get, Version, VERSION_NEUTRAL } from "@nestjs/common";
 import { ApiTags as DocsTags, ApiExcludeController as DocsExcludeController } from "@nestjs/swagger";
 
 @Controller()
-@DocsTags("Health - development only")
-@DocsExcludeController(getEnv("NODE_ENV") === "production")
 export class AppController {
   @Get("health")
   @Version(VERSION_NEUTRAL)

apps/api/v2/src/app.e2e-spec.ts

@@ -1,26 +1,385 @@
 import { AppModule } from "@/app.module";
+import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
+import { CustomThrottlerGuard } from "@/lib/throttler-guard";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { TokensModule } from "@/modules/tokens/tokens.module";
+import { UsersModule } from "@/modules/users/users.module";
 import { INestApplication } from "@nestjs/common";
 import { TestingModule } from "@nestjs/testing";
 import { Test } from "@nestjs/testing";
 import * as request from "supertest";
+import { ApiKeysRepositoryFixture } from "test/fixtures/repository/api-keys.repository.fixture";
+import { OAuthClientRepositoryFixture } from "test/fixtures/repository/oauth-client.repository.fixture";
+import { OrganizationRepositoryFixture } from "test/fixtures/repository/organization.repository.fixture";
+import { ProfileRepositoryFixture } from "test/fixtures/repository/profiles.repository.fixture";
+import { RateLimitRepositoryFixture } from "test/fixtures/repository/rate-limit.repository.fixture";
+import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
 
-describe("AppController (e2e)", () => {
-  let app: INestApplication;
+import { X_CAL_CLIENT_ID, X_CAL_SECRET_KEY } from "@calcom/platform-constants";
+import { User, PlatformOAuthClient, Team, RateLimit } from "@calcom/prisma/client";
 
-  beforeEach(async () => {
-    const moduleFixture: TestingModule = await Test.createTestingModule({
-      imports: [AppModule],
-    }).compile();
+describe("AppController", () => {
+  describe("Rate limiting", () => {
+    let app: INestApplication;
+    let userRepositoryFixture: UserRepositoryFixture;
+    let apiKeysRepositoryFixture: ApiKeysRepositoryFixture;
+    let rateLimitRepositoryFixture: RateLimitRepositoryFixture;
+    const userEmail = "app-rate-limits-e2e@api.com";
+    let user: User;
 
-    app = moduleFixture.createNestApplication();
-    await app.init();
-  });
+    let organization: Team;
+    let oAuthClient: PlatformOAuthClient;
+    let organizationsRepositoryFixture: OrganizationRepositoryFixture;
+    let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
+    let profilesRepositoryFixture: ProfileRepositoryFixture;
 
-  it("/ (GET)", () => {
-    return request(app.getHttpServer()).get("/health").expect("OK");
-  });
+    let apiKeyString: string;
 
-  afterAll(async () => {
-    await app.close();
+    let rateLimit: RateLimit;
+    let apiKeyStringWithRateLimit: string;
+
+    let apiKeyStringWithMultipleLimits: string;
+    let firstRateLimitWithMultipleLimits: RateLimit;
+    let secondRateLimitWithMultipleLimits: RateLimit;
+
+    const mockDefaultLimit = 5;
+    const mockDefaultTtl = 2500;
+    const mockDefaultBlockDuration = 5000;
+
+    beforeEach(async () => {
+      const moduleRef: TestingModule = await Test.createTestingModule({
+        imports: [AppModule, PrismaModule, UsersModule, TokensModule, SchedulesModule_2024_04_15],
+      }).compile();
+
+      jest.spyOn(CustomThrottlerGuard.prototype, "getDefaultLimit").mockReturnValue(mockDefaultLimit);
+      jest.spyOn(CustomThrottlerGuard.prototype, "getDefaultTtl").mockReturnValue(mockDefaultTtl);
+      jest
+        .spyOn(CustomThrottlerGuard.prototype, "getDefaultBlockDuration")
+        .mockReturnValue(mockDefaultBlockDuration);
+
+      userRepositoryFixture = new UserRepositoryFixture(moduleRef);
+      user = await userRepositoryFixture.create({
+        email: userEmail,
+        username: userEmail,
+      });
+
+      apiKeysRepositoryFixture = new ApiKeysRepositoryFixture(moduleRef);
+      const { keyString } = await apiKeysRepositoryFixture.createApiKey(user.id, null);
+      apiKeyString = `cal_test_${keyString}`;
+
+      rateLimitRepositoryFixture = new RateLimitRepositoryFixture(moduleRef);
+      const { apiKey, keyString: keyStringWithRateLimit } = await apiKeysRepositoryFixture.createApiKey(
+        user.id,
+        null
+      );
+      apiKeyStringWithRateLimit = `cal_test_${keyStringWithRateLimit}`;
+      rateLimit = await rateLimitRepositoryFixture.createRateLimit("long", apiKey.id, 2000, 3, 4000);
+
+      const { apiKey: apiKeyWithMultipleLimits, keyString: keyStringWithMultipleLimits } =
+        await apiKeysRepositoryFixture.createApiKey(user.id, null);
+      apiKeyStringWithMultipleLimits = `cal_test_${keyStringWithMultipleLimits}`;
+      firstRateLimitWithMultipleLimits = await rateLimitRepositoryFixture.createRateLimit(
+        "short",
+        apiKeyWithMultipleLimits.id,
+        1000,
+        2,
+        2000
+      );
+      secondRateLimitWithMultipleLimits = await rateLimitRepositoryFixture.createRateLimit(
+        "long",
+        apiKeyWithMultipleLimits.id,
+        2000,
+        3,
+        4000
+      );
+
+      organizationsRepositoryFixture = new OrganizationRepositoryFixture(moduleRef);
+      organization = await organizationsRepositoryFixture.create({ name: "ecorp" });
+      oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
+      oAuthClient = await createOAuthClient(organization.id);
+      profilesRepositoryFixture = new ProfileRepositoryFixture(moduleRef);
+      await profilesRepositoryFixture.create({
+        uid: "asd-asd",
+        username: userEmail,
+        user: { connect: { id: user.id } },
+        organization: { connect: { id: organization.id } },
+      });
+
+      app = moduleRef.createNestApplication();
+      await app.init();
+    });
+
+    async function createOAuthClient(organizationId: number) {
+      const data = {
+        logo: "logo-url",
+        name: "name",
+        redirectUris: ["http://localhost:5555"],
+        permissions: 1023,
+      };
+      const secret = "secret";
+
+      const client = await oauthClientRepositoryFixture.create(organizationId, data, secret);
+      return client;
+    }
+
+    it(
+      "api key with default rate limit - should enforce rate limits and reset after block duration",
+      async () => {
+        const limit = mockDefaultLimit;
+        const blockDuration = mockDefaultBlockDuration;
+
+        for (let i = 1; i <= limit; i++) {
+          const response = await request(app.getHttpServer())
+            .get("/v2/me")
+            .set({ Authorization: `Bearer ${apiKeyString}` })
+            .expect(200);
+
+          expect(response.headers["x-ratelimit-limit-default"]).toBe(limit.toString());
+          expect(response.headers["x-ratelimit-remaining-default"]).toBe((limit - i).toString());
+          expect(Number(response.headers["x-ratelimit-reset-default"])).toBeGreaterThan(0);
+        }
+
+        const blockedResponse = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set("Authorization", `Bearer ${apiKeyString}`)
+          .expect(429);
+
+        expect(blockedResponse.headers["x-ratelimit-limit-default"]).toBe(limit.toString());
+        expect(blockedResponse.headers["x-ratelimit-remaining-default"]).toBe("0");
+        expect(Number(blockedResponse.headers["x-ratelimit-reset-default"])).toBeGreaterThanOrEqual(
+          blockDuration / 1000
+        );
+
+        await new Promise((resolve) => setTimeout(resolve, blockDuration));
+
+        const afterBlockResponse = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set("Authorization", `Bearer ${apiKeyString}`)
+          .expect(200);
+
+        expect(afterBlockResponse.headers["x-ratelimit-limit-default"]).toBe(limit.toString());
+        expect(afterBlockResponse.headers["x-ratelimit-remaining-default"]).toBe((limit - 1).toString());
+        expect(Number(afterBlockResponse.headers["x-ratelimit-reset-default"])).toBeGreaterThan(0);
+      },
+      15 * 1000
+    );
+
+    it(
+      "api key with custom rate limit - should enforce rate limits and reset after block duration",
+      async () => {
+        const limit = rateLimit.limit;
+        const blockDuration = rateLimit.blockDuration;
+        const name = rateLimit.name;
+
+        for (let i = 1; i <= limit; i++) {
+          const response = await request(app.getHttpServer())
+            .get("/v2/me")
+            .set({ Authorization: `Bearer ${apiKeyStringWithRateLimit}` })
+            .expect(200);
+
+          expect(response.headers[`x-ratelimit-limit-${name}`]).toBe(limit.toString());
+          expect(response.headers[`x-ratelimit-remaining-${name}`]).toBe((limit - i).toString());
+          expect(Number(response.headers[`x-ratelimit-reset-${name}`])).toBeGreaterThan(0);
+        }
+
+        const blockedResponse = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set("Authorization", `Bearer ${apiKeyStringWithRateLimit}`)
+          .expect(429);
+
+        expect(blockedResponse.headers[`x-ratelimit-limit-${name}`]).toBe(limit.toString());
+        expect(blockedResponse.headers[`x-ratelimit-remaining-${name}`]).toBe("0");
+        expect(Number(blockedResponse.headers[`x-ratelimit-reset-${name}`])).toBeGreaterThanOrEqual(
+          blockDuration / 1000
+        );
+
+        await new Promise((resolve) => setTimeout(resolve, blockDuration));
+
+        const afterBlockResponse = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set("Authorization", `Bearer ${apiKeyStringWithRateLimit}`)
+          .expect(200);
+
+        expect(afterBlockResponse.headers[`x-ratelimit-limit-${name}`]).toBe(limit.toString());
+        expect(afterBlockResponse.headers[`x-ratelimit-remaining-${name}`]).toBe((limit - 1).toString());
+        expect(Number(afterBlockResponse.headers[`x-ratelimit-reset-${name}`])).toBeGreaterThan(0);
+      },
+      15 * 1000
+    );
+
+    it(
+      "api key with multiple rate limits - should enforce both short and long rate limits",
+      async () => {
+        const shortLimit = firstRateLimitWithMultipleLimits.limit;
+        const longLimit = secondRateLimitWithMultipleLimits.limit;
+        const shortName = firstRateLimitWithMultipleLimits.name;
+        const longName = secondRateLimitWithMultipleLimits.name;
+        const shortBlock = firstRateLimitWithMultipleLimits.blockDuration;
+        const longBlock = secondRateLimitWithMultipleLimits.blockDuration;
+
+        let requestsMade = 0;
+        // note(Lauris): exhaust short limit to have remaining 0 for it
+        for (let i = 1; i <= shortLimit; i++) {
+          const response = await request(app.getHttpServer())
+            .get("/v2/me")
+            .set({ Authorization: `Bearer ${apiKeyStringWithMultipleLimits}` })
+            .expect(200);
+
+          requestsMade++;
+
+          expect(response.headers[`x-ratelimit-limit-${shortName}`]).toBe(shortLimit.toString());
+          expect(response.headers[`x-ratelimit-remaining-${shortName}`]).toBe((shortLimit - i).toString());
+          expect(Number(response.headers[`x-ratelimit-reset-${shortName}`])).toBeGreaterThan(0);
+
+          expect(response.headers[`x-ratelimit-limit-${longName}`]).toBe(longLimit.toString());
+          expect(response.headers[`x-ratelimit-remaining-${longName}`]).toBe((longLimit - i).toString());
+          expect(Number(response.headers[`x-ratelimit-reset-${longName}`])).toBeGreaterThan(0);
+        }
+
+        // note(Lauris): short limit exhausted, now exhaust long limit to have remaining 0 for it
+        for (let i = requestsMade; i < longLimit; i++) {
+          const responseAfterShortLimit = await request(app.getHttpServer())
+            .get("/v2/me")
+            .set({ Authorization: `Bearer ${apiKeyStringWithMultipleLimits}` })
+            .expect(200);
+
+          requestsMade++;
+
+          expect(responseAfterShortLimit.headers[`x-ratelimit-limit-${shortName}`]).toBe(
+            shortLimit.toString()
+          );
+          expect(responseAfterShortLimit.headers[`x-ratelimit-remaining-${shortName}`]).toBe("0");
+          expect(Number(responseAfterShortLimit.headers[`x-ratelimit-reset-${shortName}`])).toBeGreaterThan(
+            0
+          );
+
+          expect(responseAfterShortLimit.headers[`x-ratelimit-limit-${longName}`]).toBe(longLimit.toString());
+          expect(responseAfterShortLimit.headers[`x-ratelimit-remaining-${longName}`]).toBe(
+            (longLimit - requestsMade).toString()
+          );
+          expect(Number(responseAfterShortLimit.headers[`x-ratelimit-reset-${longName}`])).toBeGreaterThan(0);
+        }
+
+        // note(Lauris): both have remaining 0 so now exceed both
+        const blockedResponseLong = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set({ Authorization: `Bearer ${apiKeyStringWithMultipleLimits}` })
+          .expect(429);
+
+        expect(blockedResponseLong.headers[`x-ratelimit-limit-${shortName}`]).toBe(shortLimit.toString());
+        expect(blockedResponseLong.headers[`x-ratelimit-remaining-${shortName}`]).toBe("0");
+        expect(Number(blockedResponseLong.headers[`x-ratelimit-reset-${shortName}`])).toBeGreaterThanOrEqual(
+          firstRateLimitWithMultipleLimits.blockDuration / 1000
+        );
+
+        expect(blockedResponseLong.headers[`x-ratelimit-limit-${longName}`]).toBe(longLimit.toString());
+        expect(blockedResponseLong.headers[`x-ratelimit-remaining-${longName}`]).toBe("0");
+        expect(Number(blockedResponseLong.headers[`x-ratelimit-reset-${longName}`])).toBeGreaterThanOrEqual(
+          secondRateLimitWithMultipleLimits.blockDuration / 1000
+        );
+
+        // note(Lauris): wait for short limit to reset
+        await new Promise((resolve) => setTimeout(resolve, shortBlock));
+        const responseAfterShortLimitReload = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set({ Authorization: `Bearer ${apiKeyStringWithMultipleLimits}` })
+          .expect(200);
+        expect(responseAfterShortLimitReload.headers[`x-ratelimit-limit-${shortName}`]).toBe(
+          shortLimit.toString()
+        );
+        expect(responseAfterShortLimitReload.headers[`x-ratelimit-remaining-${shortName}`]).toBe(
+          (shortLimit - 1).toString()
+        );
+        expect(
+          Number(responseAfterShortLimitReload.headers[`x-ratelimit-reset-${shortName}`])
+        ).toBeGreaterThan(0);
+        expect(responseAfterShortLimitReload.headers[`x-ratelimit-limit-${longName}`]).toBe(
+          longLimit.toString()
+        );
+        expect(responseAfterShortLimitReload.headers[`x-ratelimit-remaining-${longName}`]).toBe(
+          (longLimit - requestsMade).toString()
+        );
+        expect(
+          Number(responseAfterShortLimitReload.headers[`x-ratelimit-reset-${longName}`])
+        ).toBeGreaterThan(0);
+
+        // note(Lauris): wait for long limit to reset
+        await new Promise((resolve) => setTimeout(resolve, longBlock));
+        const responseAfterLongLimitReload = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set({ Authorization: `Bearer ${apiKeyStringWithMultipleLimits}` })
+          .expect(200);
+        expect(responseAfterLongLimitReload.headers[`x-ratelimit-limit-${shortName}`]).toBe(
+          shortLimit.toString()
+        );
+        expect(responseAfterLongLimitReload.headers[`x-ratelimit-remaining-${shortName}`]).toBe(
+          (shortLimit - 1).toString()
+        );
+        expect(
+          Number(responseAfterLongLimitReload.headers[`x-ratelimit-reset-${shortName}`])
+        ).toBeGreaterThan(0);
+        expect(responseAfterLongLimitReload.headers[`x-ratelimit-limit-${longName}`]).toBe(
+          longLimit.toString()
+        );
+        expect(responseAfterLongLimitReload.headers[`x-ratelimit-remaining-${longName}`]).toBe(
+          (longLimit - 1).toString()
+        );
+        expect(Number(responseAfterLongLimitReload.headers[`x-ratelimit-reset-${longName}`])).toBeGreaterThan(
+          0
+        );
+      },
+      30 * 1000
+    );
+
+    it(
+      "non api key with default rate limit - should enforce rate limits and reset after block duration",
+      async () => {
+        const limit = mockDefaultLimit;
+        const blockDuration = mockDefaultBlockDuration;
+
+        for (let i = 1; i <= limit; i++) {
+          const response = await request(app.getHttpServer())
+            .get("/v2/me")
+            .set(X_CAL_CLIENT_ID, oAuthClient.id)
+            .set(X_CAL_SECRET_KEY, oAuthClient.secret)
+            .expect(200);
+
+          expect(response.headers["x-ratelimit-limit-default"]).toBe(limit.toString());
+          expect(response.headers["x-ratelimit-remaining-default"]).toBe((limit - i).toString());
+          expect(Number(response.headers["x-ratelimit-reset-default"])).toBeGreaterThan(0);
+        }
+
+        const blockedResponse = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set(X_CAL_CLIENT_ID, oAuthClient.id)
+          .set(X_CAL_SECRET_KEY, oAuthClient.secret)
+          .expect(429);
+
+        expect(blockedResponse.headers["x-ratelimit-limit-default"]).toBe(limit.toString());
+        expect(blockedResponse.headers["x-ratelimit-remaining-default"]).toBe("0");
+        expect(Number(blockedResponse.headers["x-ratelimit-reset-default"])).toBeGreaterThanOrEqual(
+          blockDuration / 1000
+        );
+
+        await new Promise((resolve) => setTimeout(resolve, blockDuration));
+
+        const afterBlockResponse = await request(app.getHttpServer())
+          .get("/v2/me")
+          .set(X_CAL_CLIENT_ID, oAuthClient.id)
+          .set(X_CAL_SECRET_KEY, oAuthClient.secret)
+          .expect(200);
+
+        expect(afterBlockResponse.headers["x-ratelimit-limit-default"]).toBe(limit.toString());
+        expect(afterBlockResponse.headers["x-ratelimit-remaining-default"]).toBe((limit - 1).toString());
+        expect(Number(afterBlockResponse.headers["x-ratelimit-reset-default"])).toBeGreaterThan(0);
+      },
+      15 * 1000
+    );
+
+    afterAll(async () => {
+      await userRepositoryFixture.deleteByEmail(userEmail);
+      await organizationsRepositoryFixture.delete(organization.id);
+      await app.close();
+    });
   });
 });

apps/api/v2/src/app.module.ts

@@ -1,6 +1,7 @@
 import appConfig from "@/config/app";
 import { CustomThrottlerGuard } from "@/lib/throttler-guard";
 import { AppLoggerMiddleware } from "@/middleware/app.logger.middleware";
+import { RedirectsMiddleware } from "@/middleware/app.redirects.middleware";
 import { RewriterMiddleware } from "@/middleware/app.rewrites.middleware";
 import { JsonBodyMiddleware } from "@/middleware/body/json.body.middleware";
 import { RawBodyMiddleware } from "@/middleware/body/raw.body.middleware";
@@ -12,12 +13,12 @@ import { JwtModule } from "@/modules/jwt/jwt.module";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
 import { RedisModule } from "@/modules/redis/redis.module";
 import { RedisService } from "@/modules/redis/redis.service";
+import { ThrottlerStorageRedisService } from "@nest-lab/throttler-storage-redis";
 import { BullModule } from "@nestjs/bull";
 import { MiddlewareConsumer, Module, NestModule, RequestMethod } from "@nestjs/common";
 import { ConfigModule } from "@nestjs/config";
 import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
 import { seconds, ThrottlerModule } from "@nestjs/throttler";
-import { ThrottlerStorageRedisService } from "nestjs-throttler-storage-redis";
 
 import { AppController } from "./app.controller";
 
@@ -33,16 +34,19 @@ import { AppController } from "./app.controller";
     BullModule.forRoot({
       redis: `${process.env.REDIS_URL}${process.env.NODE_ENV === "production" ? "?tls=true" : ""}`,
     }),
-    // Rate limiting here is handled by the CustomThrottlerGuard
     ThrottlerModule.forRootAsync({
       imports: [RedisModule],
       inject: [RedisService],
       useFactory: (redisService: RedisService) => ({
+        // note(Lauris): IMPORTANT: rate limiting is enforced by CustomThrottlerGuard, but we need to have at least one
+        // entry in the throttlers array otherwise CustomThrottlerGuard is not invoked at all. If we specify only ThrottlerModule
+        // without .forRootAsync then throttler options are not passed to CustomThrottlerGuard containing redis connection etc.
+        // So we need to specify at least one dummy throttler here and CustomThrottlerGuard is actually handling the default and custom rate limits.
         throttlers: [
           {
-            name: "long",
-            ttl: seconds(60), // Time to live for the long period in seconds
-            limit: 120, // Maximum number of requests within the long ttl
+            name: "dummy",
+            ttl: seconds(60),
+            limit: 120,
           },
         ],
         storage: new ThrottlerStorageRedisService(redisService.redis),
@@ -55,6 +59,13 @@ import { AppController } from "./app.controller";
   ],
   controllers: [AppController],
   providers: [
+    {
+      provide: ThrottlerStorageRedisService,
+      useFactory: (redisService: RedisService) => {
+        return new ThrottlerStorageRedisService(redisService.redis);
+      },
+      inject: [RedisService],
+    },
     {
       provide: APP_INTERCEPTOR,
       useClass: ResponseInterceptor,
@@ -79,6 +90,8 @@ export class AppModule implements NestModule {
       .forRoutes("*")
       .apply(AppLoggerMiddleware)
       .forRoutes("*")
+      .apply(RedirectsMiddleware)
+      .forRoutes("/")
       .apply(RewriterMiddleware)
       .forRoutes("/");
   }

apps/api/v2/src/ee/bookings/2024-08-13/bookings.repository.ts

@@ -14,7 +14,7 @@ export class BookingsRepository_2024_08_13 {
     });
   }
 
-  async getByIdsWithAttendeesAndUser(ids: number[]) {
+  async getByIdsWithAttendeesAndUserAndEvent(ids: number[]) {
     return this.dbRead.prisma.booking.findMany({
       where: {
         id: {
@@ -24,6 +24,7 @@ export class BookingsRepository_2024_08_13 {
       include: {
         attendees: true,
         user: true,
+        eventType: true,
       },
     });
   }
@@ -36,7 +37,7 @@ export class BookingsRepository_2024_08_13 {
     });
   }
 
-  async getByIdWithAttendeesAndUser(id: number) {
+  async getByIdWithAttendeesAndUserAndEvent(id: number) {
     return this.dbRead.prisma.booking.findUnique({
       where: {
         id,
@@ -44,11 +45,12 @@ export class BookingsRepository_2024_08_13 {
       include: {
         attendees: true,
         user: true,
+        eventType: true,
       },
     });
   }
 
-  async getByUidWithAttendeesAndUser(uid: string) {
+  async getByUidWithAttendeesAndUserAndEvent(uid: string) {
     return this.dbRead.prisma.booking.findUnique({
       where: {
         uid,
@@ -56,11 +58,12 @@ export class BookingsRepository_2024_08_13 {
       include: {
         attendees: true,
         user: true,
+        eventType: true,
       },
     });
   }
 
-  async getRecurringByUidWithAttendeesAndUser(uid: string) {
+  async getRecurringByUidWithAttendeesAndUserAndEvent(uid: string) {
     return this.dbRead.prisma.booking.findMany({
       where: {
         recurringEventId: uid,
@@ -68,6 +71,7 @@ export class BookingsRepository_2024_08_13 {
       include: {
         attendees: true,
         user: true,
+        eventType: true,
       },
     });
   }

apps/api/v2/src/ee/bookings/2024-08-13/controllers/bookings.controller.ts

@@ -1,8 +1,6 @@
 import { BookingUidGuard } from "@/ee/bookings/2024-08-13/guards/booking-uid.guard";
 import { CancelBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/cancel-booking.output";
 import { CreateBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/create-booking.output";
-import { GetBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/get-booking.output";
-import { GetBookingsOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/get-bookings.output";
 import { MarkAbsentBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/mark-absent.output";
 import { RescheduleBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/reschedule-booking.output";
 import { BookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/bookings.service";
@@ -36,6 +34,7 @@ import { User } from "@prisma/client";
 import { Request } from "express";
 
 import { BOOKING_READ, BOOKING_WRITE, SUCCESS_STATUS } from "@calcom/platform-constants";
+import { GetBookingOutput_2024_08_13, GetBookingsOutput_2024_08_13 } from "@calcom/platform-types";
 import {
   CreateBookingInputPipe,
   CreateBookingInput,

apps/api/v2/src/ee/bookings/2024-08-13/controllers/team-bookings.controller.e2e-spec.ts

@@ -1,7 +1,6 @@
 import { bootstrap } from "@/app";
 import { AppModule } from "@/app.module";
 import { CreateBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/create-booking.output";
-import { GetBookingsOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/get-bookings.output";
 import { CreateScheduleInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-schedule.input";
 import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
 import { SchedulesService_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/services/schedules.service";
@@ -29,6 +28,7 @@ import {
   CreateBookingInput_2024_08_13,
   BookingOutput_2024_08_13,
   RecurringBookingOutput_2024_08_13,
+  GetBookingsOutput_2024_08_13,
 } from "@calcom/platform-types";
 import { PlatformOAuthClient, Team } from "@calcom/prisma/client";
 

apps/api/v2/src/ee/bookings/2024-08-13/controllers/user-bookings.controller.e2e-spec.ts

@@ -2,8 +2,6 @@ import { bootstrap } from "@/app";
 import { AppModule } from "@/app.module";
 import { CancelBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/cancel-booking.output";
 import { CreateBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/create-booking.output";
-import { GetBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/get-booking.output";
-import { GetBookingsOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/get-bookings.output";
 import { MarkAbsentBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/mark-absent.output";
 import { RescheduleBookingOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/reschedule-booking.output";
 import { CreateScheduleInput_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/inputs/create-schedule.input";
@@ -30,6 +28,7 @@ import {
   VERSION_2024_08_13,
   X_CAL_CLIENT_ID,
 } from "@calcom/platform-constants";
+import { GetBookingOutput_2024_08_13, GetBookingsOutput_2024_08_13 } from "@calcom/platform-types";
 import {
   CreateBookingInput_2024_08_13,
   BookingOutput_2024_08_13,
@@ -58,6 +57,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
     let user: User;
 
     let eventTypeId: number;
+    const eventTypeSlug = "peer-coding";
     let recurringEventTypeId: number;
 
     let createdBooking: BookingOutput_2024_08_13;
@@ -100,7 +100,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
       };
       await schedulesService.createUserSchedule(user.id, userSchedule);
       const event = await eventTypesRepositoryFixture.create(
-        { title: "peer coding", slug: "peer-coding", length: 60 },
+        { title: "peer coding", slug: eventTypeSlug, length: 60 },
         user.id
       );
       eventTypeId = event.id;
@@ -184,7 +184,10 @@ describe("Bookings Endpoints 2024-08-13", () => {
             timeZone: "Europe/Rome",
             language: "it",
           },
-          meetingUrl: "https://meet.google.com/abc-def-ghi",
+          location: "https://meet.google.com/abc-def-ghi",
+          bookingFieldsResponses: {
+            customField: "customValue",
+          },
         };
 
         return request(app.getHttpServer())
@@ -208,14 +211,24 @@ describe("Bookings Endpoints 2024-08-13", () => {
               expect(data.end).toEqual(new Date(Date.UTC(2030, 0, 8, 14, 0, 0)).toISOString());
               expect(data.duration).toEqual(60);
               expect(data.eventTypeId).toEqual(eventTypeId);
+              expect(data.eventType).toEqual({
+                id: eventTypeId,
+                slug: eventTypeSlug,
+              });
               expect(data.attendees[0]).toEqual({
                 name: body.attendee.name,
                 timeZone: body.attendee.timeZone,
                 language: body.attendee.language,
                 absent: false,
               });
-              expect(data.meetingUrl).toEqual(body.meetingUrl);
+              expect(data.location).toEqual(body.location);
+              expect(data.meetingUrl).toEqual(body.location);
               expect(data.absentHost).toEqual(false);
+              expect(data.bookingFieldsResponses).toEqual({
+                name: body.attendee.name,
+                email: body.attendee.email,
+                ...body.bookingFieldsResponses,
+              });
               createdBooking = data;
             } else {
               throw new Error(
@@ -235,7 +248,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
             timeZone: "Europe/Rome",
             language: "it",
           },
-          meetingUrl: "https://meet.google.com/abc-def-ghi",
+          location: "https://meet.google.com/abc-def-ghi",
         };
 
         return request(app.getHttpServer())
@@ -268,7 +281,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
                 language: body.attendee.language,
                 absent: false,
               });
-              expect(firstBooking.meetingUrl).toEqual(body.meetingUrl);
+              expect(firstBooking.location).toEqual(body.location);
               expect(firstBooking.recurringBookingUid).toBeDefined();
               expect(firstBooking.absentHost).toEqual(false);
 
@@ -288,7 +301,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
                 language: body.attendee.language,
                 absent: false,
               });
-              expect(secondBooking.meetingUrl).toEqual(body.meetingUrl);
+              expect(secondBooking.location).toEqual(body.location);
               expect(secondBooking.absentHost).toEqual(false);
 
               const thirdBooking = data[2];
@@ -307,7 +320,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
                 language: body.attendee.language,
                 absent: false,
               });
-              expect(thirdBooking.meetingUrl).toEqual(body.meetingUrl);
+              expect(thirdBooking.location).toEqual(body.location);
               expect(thirdBooking.absentHost).toEqual(false);
 
               createdRecurringBooking = data;
@@ -343,7 +356,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               expect(data.duration).toEqual(createdBooking.duration);
               expect(data.eventTypeId).toEqual(createdBooking.eventTypeId);
               expect(data.attendees[0]).toEqual(createdBooking.attendees[0]);
-              expect(data.meetingUrl).toEqual(createdBooking.meetingUrl);
+              expect(data.location).toEqual(createdBooking.location);
               expect(data.absentHost).toEqual(createdBooking.absentHost);
             } else {
               throw new Error(
@@ -377,7 +390,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               expect(data.eventTypeId).toEqual(createdRecurringBooking[0].eventTypeId);
               expect(data.recurringBookingUid).toEqual(createdRecurringBooking[0].recurringBookingUid);
               expect(data.attendees[0]).toEqual(createdRecurringBooking[0].attendees[0]);
-              expect(data.meetingUrl).toEqual(createdRecurringBooking[0].meetingUrl);
+              expect(data.location).toEqual(createdRecurringBooking[0].location);
               expect(data.absentHost).toEqual(createdRecurringBooking[0].absentHost);
             } else {
               throw new Error(
@@ -414,7 +427,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               expect(firstBooking.eventTypeId).toEqual(createdRecurringBooking[0].eventTypeId);
               expect(firstBooking.recurringBookingUid).toEqual(recurringBookingUid);
               expect(firstBooking.attendees[0]).toEqual(createdRecurringBooking[0].attendees[0]);
-              expect(firstBooking.meetingUrl).toEqual(createdRecurringBooking[0].meetingUrl);
+              expect(firstBooking.location).toEqual(createdRecurringBooking[0].location);
               expect(firstBooking.absentHost).toEqual(createdRecurringBooking[0].absentHost);
 
               const secondBooking = data[1];
@@ -428,7 +441,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               expect(secondBooking.eventTypeId).toEqual(createdRecurringBooking[1].eventTypeId);
               expect(secondBooking.recurringBookingUid).toEqual(recurringBookingUid);
               expect(secondBooking.attendees[0]).toEqual(createdRecurringBooking[1].attendees[0]);
-              expect(secondBooking.meetingUrl).toEqual(createdRecurringBooking[1].meetingUrl);
+              expect(secondBooking.location).toEqual(createdRecurringBooking[1].location);
               expect(secondBooking.absentHost).toEqual(createdRecurringBooking[1].absentHost);
 
               const thirdBooking = data[2];
@@ -442,7 +455,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
               expect(thirdBooking.eventTypeId).toEqual(createdRecurringBooking[2].eventTypeId);
               expect(thirdBooking.recurringBookingUid).toEqual(recurringBookingUid);
               expect(thirdBooking.attendees[0]).toEqual(createdRecurringBooking[2].attendees[0]);
-              expect(thirdBooking.meetingUrl).toEqual(createdRecurringBooking[2].meetingUrl);
+              expect(thirdBooking.location).toEqual(createdRecurringBooking[2].location);
               expect(thirdBooking.absentHost).toEqual(createdRecurringBooking[2].absentHost);
 
               createdRecurringBooking = data;
@@ -764,7 +777,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
             expect(data.duration).toEqual(createdBooking.duration);
             expect(data.eventTypeId).toEqual(createdBooking.eventTypeId);
             expect(data.attendees[0]).toEqual(createdBooking.attendees[0]);
-            expect(data.meetingUrl).toEqual(createdBooking.meetingUrl);
+            expect(data.location).toEqual(createdBooking.location);
             expect(data.absentHost).toEqual(createdBooking.absentHost);
 
             rescheduledBooking = data;
@@ -815,7 +828,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
             expect(data.recurringBookingUid).toEqual(createdRecurringBooking[0].recurringBookingUid);
             expect(data.eventTypeId).toEqual(createdRecurringBooking[0].eventTypeId);
             expect(data.attendees[0]).toEqual(createdRecurringBooking[0].attendees[0]);
-            expect(data.meetingUrl).toEqual(createdRecurringBooking[0].meetingUrl);
+            expect(data.location).toEqual(createdRecurringBooking[0].location);
             expect(data.absentHost).toEqual(createdRecurringBooking[0].absentHost);
 
             const oldBooking = await bookingsRepositoryFixture.getByUid(createdRecurringBooking[0].uid);
@@ -885,7 +898,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
             expect(data.duration).toEqual(booking.duration);
             expect(data.eventTypeId).toEqual(booking.eventTypeId);
             expect(data.attendees[0]).toEqual(booking.attendees[0]);
-            expect(data.meetingUrl).toEqual(booking.meetingUrl);
+            expect(data.location).toEqual(booking.location);
           });
       });
 
@@ -918,7 +931,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
             expect(data.eventTypeId).toEqual(booking.eventTypeId);
             expect(data.attendees[0].absent).toEqual(true);
             expect(data.absentHost).toEqual(booking.absentHost);
-            expect(data.meetingUrl).toEqual(booking.meetingUrl);
+            expect(data.location).toEqual(booking.location);
           });
       });
     });
@@ -955,7 +968,7 @@ describe("Bookings Endpoints 2024-08-13", () => {
             expect(data.duration).toEqual(rescheduledBooking.duration);
             expect(data.eventTypeId).toEqual(rescheduledBooking.eventTypeId);
             expect(data.attendees[0]).toEqual(rescheduledBooking.attendees[0]);
-            expect(data.meetingUrl).toEqual(rescheduledBooking.meetingUrl);
+            expect(data.location).toEqual(rescheduledBooking.location);
             expect(data.absentHost).toEqual(rescheduledBooking.absentHost);
 
             const cancelledBooking = await bookingsRepositoryFixture.getByUid(rescheduledBooking.uid);
@@ -1005,10 +1018,6 @@ describe("Bookings Endpoints 2024-08-13", () => {
       });
     });
 
-    function responseDataIsBooking(data: any): data is BookingOutput_2024_08_13 {
-      return !Array.isArray(data) && typeof data === "object" && data && "id" in data;
-    }
-
     function responseDataIsRecurranceBooking(data: any): data is RecurringBookingOutput_2024_08_13 {
       return (
         !Array.isArray(data) &&
@@ -1019,10 +1028,303 @@ describe("Bookings Endpoints 2024-08-13", () => {
       );
     }
 
-    function responseDataIsRecurringBooking(data: any): data is RecurringBookingOutput_2024_08_13[] {
-      return Array.isArray(data);
+    afterAll(async () => {
+      await oauthClientRepositoryFixture.delete(oAuthClient.id);
+      await teamRepositoryFixture.delete(organization.id);
+      await userRepositoryFixture.deleteByEmail(user.email);
+      await bookingsRepositoryFixture.deleteAllBookings(user.id, user.email);
+      await app.close();
+    });
+  });
+
+  function responseDataIsBooking(data: any): data is BookingOutput_2024_08_13 {
+    return !Array.isArray(data) && typeof data === "object" && data && "id" in data;
+  }
+
+  function responseDataIsRecurringBooking(data: any): data is RecurringBookingOutput_2024_08_13[] {
+    return Array.isArray(data);
+  }
+
+  describe("Recurring bookings", () => {
+    let app: INestApplication;
+    let organization: Team;
+
+    let userRepositoryFixture: UserRepositoryFixture;
+    let bookingsRepositoryFixture: BookingsRepositoryFixture;
+    let schedulesService: SchedulesService_2024_04_15;
+    let eventTypesRepositoryFixture: EventTypesRepositoryFixture;
+    let oauthClientRepositoryFixture: OAuthClientRepositoryFixture;
+    let oAuthClient: PlatformOAuthClient;
+    let teamRepositoryFixture: TeamRepositoryFixture;
+
+    const userEmail = "bookings-controller-e2e@api.com";
+    let user: User;
+
+    const maxRecurrenceCount = 3;
+    let recurringEventTypeId: number;
+
+    beforeAll(async () => {
+      const moduleRef = await withApiAuth(
+        userEmail,
+        Test.createTestingModule({
+          imports: [AppModule, PrismaModule, UsersModule, SchedulesModule_2024_04_15],
+        })
+      )
+        .overrideGuard(PermissionsGuard)
+        .useValue({
+          canActivate: () => true,
+        })
+        .compile();
+
+      userRepositoryFixture = new UserRepositoryFixture(moduleRef);
+      bookingsRepositoryFixture = new BookingsRepositoryFixture(moduleRef);
+      eventTypesRepositoryFixture = new EventTypesRepositoryFixture(moduleRef);
+      oauthClientRepositoryFixture = new OAuthClientRepositoryFixture(moduleRef);
+      teamRepositoryFixture = new TeamRepositoryFixture(moduleRef);
+      schedulesService = moduleRef.get<SchedulesService_2024_04_15>(SchedulesService_2024_04_15);
+
+      organization = await teamRepositoryFixture.create({ name: "organization bookings" });
+      oAuthClient = await createOAuthClient(organization.id);
+
+      user = await userRepositoryFixture.create({
+        email: userEmail,
+      });
+
+      const userSchedule: CreateScheduleInput_2024_04_15 = {
+        name: "working time",
+        timeZone: "Europe/Rome",
+        isDefault: true,
+      };
+      await schedulesService.createUserSchedule(user.id, userSchedule);
+
+      const recurringEvent = await eventTypesRepositoryFixture.create(
+        // note(Lauris): freq 2 means weekly, interval 1 means every week and count 3 means 3 weeks in a row
+        {
+          title: "peer coding recurring",
+          slug: "peer-coding-recurring",
+          length: 60,
+          recurringEvent: { freq: 2, count: maxRecurrenceCount, interval: 1 },
+        },
+        user.id
+      );
+      recurringEventTypeId = recurringEvent.id;
+
+      app = moduleRef.createNestApplication();
+      bootstrap(app as NestExpressApplication);
+
+      await app.init();
+    });
+
+    async function createOAuthClient(organizationId: number) {
+      const data = {
+        logo: "logo-url",
+        name: "name",
+        redirectUris: ["http://localhost:5555"],
+        permissions: 32,
+      };
+      const secret = "secret";
+
+      const client = await oauthClientRepositoryFixture.create(organizationId, data, secret);
+      return client;
     }
 
+    it("should not create recurring booking with recurrenceCount larger than event type recurrence count", async () => {
+      const recurrenceCount = 1000;
+
+      const body: CreateRecurringBookingInput_2024_08_13 = {
+        start: new Date(Date.UTC(2030, 1, 4, 13, 0, 0)).toISOString(),
+        eventTypeId: recurringEventTypeId,
+        attendee: {
+          name: "Mr Proper Recurring",
+          email: "mr_proper_recurring@gmail.com",
+          timeZone: "Europe/Rome",
+          language: "it",
+        },
+        location: "https://meet.google.com/abc-def-ghi",
+        recurrenceCount,
+      };
+
+      return request(app.getHttpServer())
+        .post("/v2/bookings")
+        .send(body)
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .expect(400);
+    });
+
+    it("should create a recurring booking with recurrenceCount smaller than event type recurrence count", async () => {
+      const recurrenceCount = maxRecurrenceCount - 1;
+      const body: CreateRecurringBookingInput_2024_08_13 = {
+        start: new Date(Date.UTC(2030, 1, 4, 13, 0, 0)).toISOString(),
+        eventTypeId: recurringEventTypeId,
+        attendee: {
+          name: "Mr Proper Recurring",
+          email: "mr_proper_recurring@gmail.com",
+          timeZone: "Europe/Rome",
+          language: "it",
+        },
+        location: "https://meet.google.com/abc-def-ghi",
+        recurrenceCount,
+      };
+
+      return request(app.getHttpServer())
+        .post("/v2/bookings")
+        .send(body)
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .expect(201)
+        .then(async (response) => {
+          const responseBody: CreateBookingOutput_2024_08_13 = response.body;
+          expect(responseBody.status).toEqual(SUCCESS_STATUS);
+          expect(responseBody.data).toBeDefined();
+          expect(responseDataIsRecurringBooking(responseBody.data)).toBe(true);
+
+          if (responseDataIsRecurringBooking(responseBody.data)) {
+            const data: RecurringBookingOutput_2024_08_13[] = responseBody.data;
+            expect(data.length).toEqual(maxRecurrenceCount - 1);
+
+            const firstBooking = data[0];
+            expect(firstBooking.id).toBeDefined();
+            expect(firstBooking.uid).toBeDefined();
+            expect(firstBooking.hosts[0].id).toEqual(user.id);
+            expect(firstBooking.status).toEqual("accepted");
+            expect(firstBooking.start).toEqual(new Date(Date.UTC(2030, 1, 4, 13, 0, 0)).toISOString());
+            expect(firstBooking.end).toEqual(new Date(Date.UTC(2030, 1, 4, 14, 0, 0)).toISOString());
+            expect(firstBooking.duration).toEqual(60);
+            expect(firstBooking.eventTypeId).toEqual(recurringEventTypeId);
+            expect(firstBooking.attendees[0]).toEqual({
+              name: body.attendee.name,
+              timeZone: body.attendee.timeZone,
+              language: body.attendee.language,
+              absent: false,
+            });
+            expect(firstBooking.location).toEqual(body.location);
+            expect(firstBooking.recurringBookingUid).toBeDefined();
+            expect(firstBooking.absentHost).toEqual(false);
+
+            const secondBooking = data[1];
+            expect(secondBooking.id).toBeDefined();
+            expect(secondBooking.uid).toBeDefined();
+            expect(secondBooking.hosts[0].id).toEqual(user.id);
+            expect(secondBooking.status).toEqual("accepted");
+            expect(secondBooking.start).toEqual(new Date(Date.UTC(2030, 1, 11, 13, 0, 0)).toISOString());
+            expect(secondBooking.end).toEqual(new Date(Date.UTC(2030, 1, 11, 14, 0, 0)).toISOString());
+            expect(secondBooking.duration).toEqual(60);
+            expect(secondBooking.eventTypeId).toEqual(recurringEventTypeId);
+            expect(secondBooking.recurringBookingUid).toBeDefined();
+            expect(secondBooking.attendees[0]).toEqual({
+              name: body.attendee.name,
+              timeZone: body.attendee.timeZone,
+              language: body.attendee.language,
+              absent: false,
+            });
+            expect(secondBooking.location).toEqual(body.location);
+            expect(secondBooking.absentHost).toEqual(false);
+          } else {
+            throw new Error(
+              "Invalid response data - expected recurring booking but received non array response"
+            );
+          }
+        });
+    });
+
+    it("should create a recurring booking with recurrenceCount equal to event type recurrence count", async () => {
+      const recurrenceCount = maxRecurrenceCount;
+      const body: CreateRecurringBookingInput_2024_08_13 = {
+        start: new Date(Date.UTC(2030, 1, 4, 13, 0, 0)).toISOString(),
+        eventTypeId: recurringEventTypeId,
+        attendee: {
+          name: "Mr Proper Recurring",
+          email: "mr_proper_recurring@gmail.com",
+          timeZone: "Europe/Rome",
+          language: "it",
+        },
+        location: "https://meet.google.com/abc-def-ghi",
+        recurrenceCount,
+      };
+
+      return request(app.getHttpServer())
+        .post("/v2/bookings")
+        .send(body)
+        .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
+        .expect(201)
+        .then(async (response) => {
+          const responseBody: CreateBookingOutput_2024_08_13 = response.body;
+          expect(responseBody.status).toEqual(SUCCESS_STATUS);
+          expect(responseBody.data).toBeDefined();
+          expect(responseDataIsRecurringBooking(responseBody.data)).toBe(true);
+
+          if (responseDataIsRecurringBooking(responseBody.data)) {
+            const data: RecurringBookingOutput_2024_08_13[] = responseBody.data;
+            expect(data.length).toEqual(maxRecurrenceCount);
+
+            const firstBooking = data[0];
+            expect(firstBooking.id).toBeDefined();
+            expect(firstBooking.uid).toBeDefined();
+            expect(firstBooking.hosts[0].id).toEqual(user.id);
+            expect(firstBooking.status).toEqual("accepted");
+            expect(firstBooking.start).toEqual(new Date(Date.UTC(2030, 1, 4, 13, 0, 0)).toISOString());
+            expect(firstBooking.end).toEqual(new Date(Date.UTC(2030, 1, 4, 14, 0, 0)).toISOString());
+            expect(firstBooking.duration).toEqual(60);
+            expect(firstBooking.eventTypeId).toEqual(recurringEventTypeId);
+            expect(firstBooking.attendees[0]).toEqual({
+              name: body.attendee.name,
+              timeZone: body.attendee.timeZone,
+              language: body.attendee.language,
+              absent: false,
+            });
+            expect(firstBooking.location).toEqual(body.location);
+            expect(firstBooking.meetingUrl).toEqual(body.location);
+            expect(firstBooking.recurringBookingUid).toBeDefined();
+            expect(firstBooking.absentHost).toEqual(false);
+
+            const secondBooking = data[1];
+            expect(secondBooking.id).toBeDefined();
+            expect(secondBooking.uid).toBeDefined();
+            expect(secondBooking.hosts[0].id).toEqual(user.id);
+            expect(secondBooking.status).toEqual("accepted");
+            expect(secondBooking.start).toEqual(new Date(Date.UTC(2030, 1, 11, 13, 0, 0)).toISOString());
+            expect(secondBooking.end).toEqual(new Date(Date.UTC(2030, 1, 11, 14, 0, 0)).toISOString());
+            expect(secondBooking.duration).toEqual(60);
+            expect(secondBooking.eventTypeId).toEqual(recurringEventTypeId);
+            expect(secondBooking.recurringBookingUid).toBeDefined();
+            expect(secondBooking.attendees[0]).toEqual({
+              name: body.attendee.name,
+              timeZone: body.attendee.timeZone,
+              language: body.attendee.language,
+              absent: false,
+            });
+            expect(secondBooking.location).toEqual(body.location);
+            expect(secondBooking.absentHost).toEqual(false);
+
+            const thirdBooking = data[2];
+            expect(thirdBooking.id).toBeDefined();
+            expect(thirdBooking.uid).toBeDefined();
+            expect(thirdBooking.hosts[0].id).toEqual(user.id);
+            expect(thirdBooking.status).toEqual("accepted");
+            expect(thirdBooking.start).toEqual(new Date(Date.UTC(2030, 1, 18, 13, 0, 0)).toISOString());
+            expect(thirdBooking.end).toEqual(new Date(Date.UTC(2030, 1, 18, 14, 0, 0)).toISOString());
+            expect(thirdBooking.duration).toEqual(60);
+            expect(thirdBooking.eventTypeId).toEqual(recurringEventTypeId);
+            expect(thirdBooking.recurringBookingUid).toBeDefined();
+            expect(thirdBooking.attendees[0]).toEqual({
+              name: body.attendee.name,
+              timeZone: body.attendee.timeZone,
+              language: body.attendee.language,
+              absent: false,
+            });
+            expect(thirdBooking.location).toEqual(body.location);
+            expect(thirdBooking.absentHost).toEqual(false);
+          } else {
+            throw new Error(
+              "Invalid response data - expected recurring booking but received non array response"
+            );
+          }
+        });
+    });
+
+    afterEach(async () => {
+      await bookingsRepositoryFixture.deleteAllBookings(user.id, user.email);
+    });
+
     afterAll(async () => {
       await oauthClientRepositoryFixture.delete(oAuthClient.id);
       await teamRepositoryFixture.delete(organization.id);

apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts

@@ -73,7 +73,9 @@ export class BookingsService_2024_08_13 {
     const bookingRequest = await this.inputService.createBookingRequest(request, body);
     const booking = await handleInstantMeeting(bookingRequest);
 
-    const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUser(booking.bookingId);
+    const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUserAndEvent(
+      booking.bookingId
+    );
     if (!databaseBooking) {
       throw new Error(`Booking with id=${booking.bookingId} was not found in the database`);
     }
@@ -94,7 +96,7 @@ export class BookingsService_2024_08_13 {
       throw new Error("Recurring booking was not created");
     }
 
-    const recurringBooking = await this.bookingsRepository.getRecurringByUidWithAttendeesAndUser(uid);
+    const recurringBooking = await this.bookingsRepository.getRecurringByUidWithAttendeesAndUserAndEvent(uid);
     return this.outputService.getOutputRecurringBookings(recurringBooking);
   }
 
@@ -106,7 +108,7 @@ export class BookingsService_2024_08_13 {
       throw new Error("Booking was not created");
     }
 
-    const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUser(booking.id);
+    const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUserAndEvent(booking.id);
     if (!databaseBooking) {
       throw new Error(`Booking with id=${booking.id} was not found in the database`);
     }
@@ -115,7 +117,7 @@ export class BookingsService_2024_08_13 {
   }
 
   async getBooking(uid: string) {
-    const booking = await this.bookingsRepository.getByUidWithAttendeesAndUser(uid);
+    const booking = await this.bookingsRepository.getByUidWithAttendeesAndUserAndEvent(uid);
 
     if (booking) {
       const isRecurring = !!booking.recurringEventId;
@@ -125,7 +127,7 @@ export class BookingsService_2024_08_13 {
       return this.outputService.getOutputBooking(booking);
     }
 
-    const recurringBooking = await this.bookingsRepository.getRecurringByUidWithAttendeesAndUser(uid);
+    const recurringBooking = await this.bookingsRepository.getRecurringByUidWithAttendeesAndUserAndEvent(uid);
     if (!recurringBooking.length) {
       throw new NotFoundException(`Booking with uid=${uid} was not found in the database`);
     }
@@ -149,7 +151,7 @@ export class BookingsService_2024_08_13 {
     // note(Lauris): fetchedBookings don't have attendees information and responses and i don't want to add them to the handler query,
     // because its used elsewhere in code that does not need that information, so i get ids, fetch bookings and then return them formatted in same order as ids.
     const ids = fetchedBookings.bookings.map((booking) => booking.id);
-    const bookings = await this.bookingsRepository.getByIdsWithAttendeesAndUser(ids);
+    const bookings = await this.bookingsRepository.getByIdsWithAttendeesAndUserAndEvent(ids);
 
     const bookingMap = new Map(bookings.map((booking) => [booking.id, booking]));
     const orderedBookings = ids.map((id) => bookingMap.get(id));
@@ -162,6 +164,7 @@ export class BookingsService_2024_08_13 {
 
       const formatted = {
         ...booking,
+        eventType: booking.eventType,
         eventTypeId: booking.eventTypeId,
         startTime: new Date(booking.startTime),
         endTime: new Date(booking.endTime),
@@ -191,7 +194,7 @@ export class BookingsService_2024_08_13 {
         throw new Error("Booking was not created");
       }
 
-      const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUser(booking.id);
+      const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUserAndEvent(booking.id);
       if (!databaseBooking) {
         throw new Error(`Booking with id=${booking.id} was not found in the database`);
       }
@@ -226,7 +229,7 @@ export class BookingsService_2024_08_13 {
       userId: bookingOwnerId,
     });
 
-    const booking = await this.bookingsRepository.getByUidWithAttendeesAndUser(bookingUid);
+    const booking = await this.bookingsRepository.getByUidWithAttendeesAndUserAndEvent(bookingUid);
 
     if (!booking) {
       throw new Error(`Booking with uid=${bookingUid} was not found in the database`);

apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts

@@ -5,7 +5,7 @@ import { hashAPIKey, isApiKey, stripApiKey } from "@/lib/api-key";
 import { ApiKeyRepository } from "@/modules/api-key/api-key-repository";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { OAuthFlowService } from "@/modules/oauth-clients/services/oauth-flow.service";
-import { Injectable, NotFoundException } from "@nestjs/common";
+import { BadRequestException, Injectable, NotFoundException } from "@nestjs/common";
 import { Logger } from "@nestjs/common";
 import { ConfigService } from "@nestjs/config";
 import { Request } from "express";
@@ -57,9 +57,9 @@ export enum Frequency {
 
 const recurringEventSchema = z.object({
   dtstart: z.string().optional(),
-  interval: z.number().int().optional(),
-  count: z.number().int().optional(),
-  freq: z.nativeEnum(Frequency).optional(),
+  interval: z.number().int(),
+  count: z.number().int(),
+  freq: z.nativeEnum(Frequency),
   until: z.string().optional(),
 });
 
@@ -89,7 +89,7 @@ export class InputBookingsService_2024_08_13 {
       ? await this.createBookingRequestOAuthClientParams(oAuthClientId)
       : DEFAULT_PLATFORM_PARAMS;
 
-    const location = request.body.meetingUrl;
+    const location = request.body.location || request.body.meetingUrl;
     Object.assign(newRequest, { userId, ...oAuthParams, platformBookingLocation: location });
 
     newRequest.body = { ...bodyTransformed, noEmail: !oAuthParams.arePlatformEmailsEnabled };
@@ -147,7 +147,7 @@ export class InputBookingsService_2024_08_13 {
       ? await this.createBookingRequestOAuthClientParams(oAuthClientId)
       : DEFAULT_PLATFORM_PARAMS;
 
-    const location = request.body.meetingUrl;
+    const location = request.body.location || request.body.meetingUrl;
     Object.assign(newRequest, {
       userId,
       ...oAuthParams,
@@ -175,14 +175,16 @@ export class InputBookingsService_2024_08_13 {
 
     const occurrence = recurringEventSchema.parse(eventType.recurringEvent);
     const repeatsEvery = occurrence.interval;
-    const repeatsTimes = occurrence.count;
+
+    if (inputBooking.recurrenceCount && inputBooking.recurrenceCount > occurrence.count) {
+      throw new BadRequestException(
+        "Provided recurrence count is higher than the event type's recurring event count."
+      );
+    }
+    const repeatsTimes = inputBooking.recurrenceCount || occurrence.count;
     // note(Lauris): timeBetween 0=yearly, 1=monthly and 2=weekly
     const timeBetween = occurrence.freq;
 
-    if (!repeatsTimes) {
-      throw new Error("Repeats times is required");
-    }
-
     const events = [];
     const recurringEventId = uuidv4();
 
@@ -257,7 +259,7 @@ export class InputBookingsService_2024_08_13 {
   }
 
   async transformInputRescheduleBooking(bookingUid: string, inputBooking: RescheduleBookingInput_2024_08_13) {
-    const booking = await this.bookingsRepository.getByUidWithAttendeesAndUser(bookingUid);
+    const booking = await this.bookingsRepository.getByUidWithAttendeesAndUserAndEvent(bookingUid);
     if (!booking) {
       throw new NotFoundException(`Booking with uid=${bookingUid} not found`);
     }
@@ -390,7 +392,9 @@ export class InputBookingsService_2024_08_13 {
   async transformInputCancelBooking(bookingUid: string, inputBooking: CancelBookingInput_2024_08_13) {
     let allRemainingBookings = false;
     let uid = bookingUid;
-    const recurringBooking = await this.bookingsRepository.getRecurringByUidWithAttendeesAndUser(bookingUid);
+    const recurringBooking = await this.bookingsRepository.getRecurringByUidWithAttendeesAndUserAndEvent(
+      bookingUid
+    );
 
     if (recurringBooking.length) {
       // note(Lauirs): this means that bookingUid is equal to recurringEventId on individual bookings of recurring one aka main recurring event

apps/api/v2/src/ee/bookings/2024-08-13/services/output.service.ts

@@ -7,14 +7,20 @@ import { z } from "zod";
 import { BookingOutput_2024_08_13, RecurringBookingOutput_2024_08_13 } from "@calcom/platform-types";
 import { Booking } from "@calcom/prisma/client";
 
-export const bookingResponsesSchema = z.object({
-  email: z.string(),
-  name: z.string(),
-  guests: z.array(z.string()).optional(),
-  rescheduledReason: z.string().optional(),
-});
+export const bookingResponsesSchema = z
+  .object({
+    email: z.string(),
+    name: z.string(),
+    guests: z.array(z.string()).optional(),
+    rescheduledReason: z.string().optional(),
+  })
+  .passthrough();
 
 type DatabaseBooking = Booking & {
+  eventType: {
+    id: number;
+    slug: string;
+  } | null;
   attendees: {
     name: string;
     email: string;
@@ -38,6 +44,8 @@ export class OutputBookingsService_2024_08_13 {
     const booking = {
       id: databaseBooking.id,
       uid: databaseBooking.uid,
+      title: databaseBooking.title,
+      description: databaseBooking.description,
       hosts: [databaseBooking.user],
       status: databaseBooking.status.toLowerCase(),
       cancellationReason: databaseBooking.cancellationReason || undefined,
@@ -46,6 +54,8 @@ export class OutputBookingsService_2024_08_13 {
       start: databaseBooking.startTime,
       end: databaseBooking.endTime,
       duration,
+      eventType: databaseBooking.eventType,
+      // note(Lauris): eventTypeId is deprecated
       eventTypeId: databaseBooking.eventTypeId,
       attendees: databaseBooking.attendees.map((attendee) => ({
         name: attendee.name,
@@ -55,18 +65,22 @@ export class OutputBookingsService_2024_08_13 {
         absent: !!attendee.noShow,
       })),
       guests: bookingResponses.guests,
+      location: databaseBooking.location,
+      // note(Lauris): meetingUrl is deprecated
       meetingUrl: databaseBooking.location,
       absentHost: !!databaseBooking.noShowHost,
     };
 
-    return plainToClass(BookingOutput_2024_08_13, booking, { strategy: "excludeAll" });
+    const bookingTransformed = plainToClass(BookingOutput_2024_08_13, booking, { strategy: "excludeAll" });
+    bookingTransformed.bookingFieldsResponses = bookingResponses;
+    return bookingTransformed;
   }
 
   async getOutputRecurringBookings(databaseBookings: DatabaseBooking[]) {
     const transformed = [];
 
     for (const booking of databaseBookings) {
-      const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUser(booking.id);
+      const databaseBooking = await this.bookingsRepository.getByIdWithAttendeesAndUserAndEvent(booking.id);
       if (!databaseBooking) {
         throw new Error(`Booking with id=${booking.id} was not found in the database`);
       }
@@ -87,6 +101,8 @@ export class OutputBookingsService_2024_08_13 {
     const booking = {
       id: databaseBooking.id,
       uid: databaseBooking.uid,
+      title: databaseBooking.title,
+      description: databaseBooking.description,
       hosts: [databaseBooking.user],
       status: databaseBooking.status.toLowerCase(),
       cancellationReason: databaseBooking.cancellationReason || undefined,
@@ -95,6 +111,8 @@ export class OutputBookingsService_2024_08_13 {
       start: databaseBooking.startTime,
       end: databaseBooking.endTime,
       duration,
+      eventType: databaseBooking.eventType,
+      // note(Lauris): eventTypeId is deprecated
       eventTypeId: databaseBooking.eventTypeId,
       attendees: databaseBooking.attendees.map((attendee) => ({
         name: attendee.name,
@@ -104,9 +122,12 @@ export class OutputBookingsService_2024_08_13 {
         absent: !!attendee.noShow,
       })),
       guests: bookingResponses.guests,
+      location: databaseBooking.location,
+      // note(Lauris): meetingUrl is deprecated
       meetingUrl: databaseBooking.location,
       recurringBookingUid: databaseBooking.recurringEventId,
       absentHost: !!databaseBooking.noShowHost,
+      bookingFieldsResponses: databaseBooking.responses,
     };
 
     return plainToClass(RecurringBookingOutput_2024_08_13, booking, { strategy: "excludeAll" });

apps/api/v2/src/ee/calendars/controllers/calendars.controller.ts

@@ -68,6 +68,7 @@ export class CalendarsController {
 
   @Post("/ics-feed/save")
   @UseGuards(ApiAuthGuard)
+  @ApiOperation({ summary: "Save an ICS feed" })
   async createIcsFeed(
     @GetUser("id") userId: number,
     @GetUser("email") userEmail: string,
@@ -78,6 +79,7 @@ export class CalendarsController {
 
   @Get("/ics-feed/check")
   @UseGuards(ApiAuthGuard)
+  @ApiOperation({ summary: "Check an ICS feed" })
   async checkIcsFeed(@GetUser("id") userId: number): Promise<ApiResponse> {
     return await this.icsFeedService.check(userId);
   }

apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts

@@ -260,6 +260,7 @@ describe("Event types Endpoints", () => {
         },
         requiresBookerEmailVerification: false,
         hideCalendarNotes: false,
+        hideCalendarEventDetails: false,
         lockTimeZoneToggleOnBookingPage: true,
         color: {
           darkThemeHex: "#292929",
@@ -297,6 +298,7 @@ describe("Event types Endpoints", () => {
           );
 
           expect(createdEventType.hideCalendarNotes).toEqual(body.hideCalendarNotes);
+          expect(createdEventType.hideCalendarEventDetails).toEqual(body.hideCalendarEventDetails);
           expect(createdEventType.lockTimeZoneToggleOnBookingPage).toEqual(
             body.lockTimeZoneToggleOnBookingPage
           );
@@ -351,6 +353,7 @@ describe("Event types Endpoints", () => {
         eventType.requiresBookerEmailVerification
       );
       expect(fetchedEventType.hideCalendarNotes).toEqual(eventType.hideCalendarNotes);
+      expect(fetchedEventType.hideCalendarEventDetails).toEqual(eventType.hideCalendarEventDetails);
       expect(fetchedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
         eventType.lockTimeZoneToggleOnBookingPage
       );
@@ -667,6 +670,7 @@ describe("Event types Endpoints", () => {
         },
         requiresBookerEmailVerification: true,
         hideCalendarNotes: true,
+        hideCalendarEventDetails: true,
         lockTimeZoneToggleOnBookingPage: true,
         color: {
           darkThemeHex: "#292929",
@@ -706,6 +710,7 @@ describe("Event types Endpoints", () => {
             body.requiresBookerEmailVerification
           );
           expect(updatedEventType.hideCalendarNotes).toEqual(body.hideCalendarNotes);
+          expect(updatedEventType.hideCalendarEventDetails).toEqual(body.hideCalendarEventDetails);
           expect(updatedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
             body.lockTimeZoneToggleOnBookingPage
           );
@@ -724,6 +729,7 @@ describe("Event types Endpoints", () => {
           eventType.customName = updatedEventType.customName;
           eventType.requiresBookerEmailVerification = updatedEventType.requiresBookerEmailVerification;
           eventType.hideCalendarNotes = updatedEventType.hideCalendarNotes;
+          eventType.hideCalendarEventDetails = updatedEventType.hideCalendarEventDetails;
           eventType.lockTimeZoneToggleOnBookingPage = updatedEventType.lockTimeZoneToggleOnBookingPage;
           eventType.color = updatedEventType.color;
         });
@@ -774,6 +780,7 @@ describe("Event types Endpoints", () => {
         eventType.requiresBookerEmailVerification
       );
       expect(fetchedEventType.hideCalendarNotes).toEqual(eventType.hideCalendarNotes);
+      expect(fetchedEventType.hideCalendarEventDetails).toEqual(eventType.hideCalendarEventDetails);
       expect(fetchedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
         eventType.lockTimeZoneToggleOnBookingPage
       );
@@ -811,6 +818,7 @@ describe("Event types Endpoints", () => {
         eventType.requiresBookerEmailVerification
       );
       expect(fetchedEventType.hideCalendarNotes).toEqual(eventType.hideCalendarNotes);
+      expect(fetchedEventType.hideCalendarEventDetails).toEqual(eventType.hideCalendarEventDetails);
       expect(fetchedEventType.lockTimeZoneToggleOnBookingPage).toEqual(
         eventType.lockTimeZoneToggleOnBookingPage
       );

apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts

@@ -1,12 +1,9 @@
 import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { UsersService } from "@/modules/users/services/users.service";
-import { UserWithProfile } from "@/modules/users/users.repository";
 import { Injectable } from "@nestjs/common";
 
-import { getEventTypeById } from "@calcom/platform-libraries";
 import { InputEventTransformed_2024_06_14 } from "@calcom/platform-types";
-import type { PrismaClient } from "@calcom/prisma";
 
 @Injectable()
 export class EventTypesRepository_2024_06_14 {
@@ -69,21 +66,6 @@ export class EventTypesRepository_2024_06_14 {
     });
   }
 
-  async getUserEventTypeForAtom(
-    user: UserWithProfile,
-    isUserOrganizationAdmin: boolean,
-    eventTypeId: number
-  ) {
-    return await getEventTypeById({
-      currentOrganizationId: this.usersService.getUserMainOrgId(user),
-      eventTypeId,
-      userId: user.id,
-      prisma: this.dbRead.prisma as unknown as PrismaClient,
-      isUserOrganizationAdmin,
-      isTrpcCall: true,
-    });
-  }
-
   async getEventTypeById(eventTypeId: number) {
     return this.dbRead.prisma.eventType.findUnique({
       where: { id: eventTypeId },

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts

@@ -142,27 +142,6 @@ export class EventTypesService_2024_06_14 {
     });
   }
 
-  async getUserEventTypeForAtom(user: UserWithProfile, eventTypeId: number) {
-    const organizationId = this.usersService.getUserMainOrgId(user);
-
-    const isUserOrganizationAdmin = organizationId
-      ? await this.membershipsRepository.isUserOrganizationAdmin(user.id, organizationId)
-      : false;
-
-    const eventType = await this.eventTypesRepository.getUserEventTypeForAtom(
-      user,
-      isUserOrganizationAdmin,
-      eventTypeId
-    );
-
-    if (!eventType) {
-      return null;
-    }
-
-    this.checkUserOwnsEventType(user.id, eventType.eventType);
-    return eventType;
-  }
-
   async getEventTypesPublicByUsername(username: string): Promise<EventTypesPublic> {
     const user = await this.usersRepository.findByUsername(username);
     if (!user) {

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/input-event-types.service.ts

@@ -242,6 +242,10 @@ export class InputEventTypesService_2024_06_14 {
     return transformConfirmationPolicyApiToInternal(requiresConfirmation);
   }
   transformInputRecurrignEvent(recurrence: CreateEventTypeInput_2024_06_14["recurrence"]) {
+    if (!recurrence || recurrence.disabled) {
+      return undefined;
+    }
+
     return transformRecurrenceApiToInternal(recurrence);
   }
 

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts

@@ -80,6 +80,7 @@ type Input = Pick<
   | "eventName"
   | "destinationCalendar"
   | "useEventTypeDestinationCalendarEmail"
+  | "hideCalendarEventDetails"
 >;
 
 @Injectable()
@@ -111,6 +112,7 @@ export class OutputEventTypesService_2024_06_14 {
       hideCalendarNotes,
       seatsShowAttendees,
       useEventTypeDestinationCalendarEmail,
+      hideCalendarEventDetails,
     } = databaseEventType;
 
     const locations = this.transformLocations(databaseEventType.locations);
@@ -182,6 +184,7 @@ export class OutputEventTypesService_2024_06_14 {
       customName,
       destinationCalendar,
       useDestinationCalendarEmail: useEventTypeDestinationCalendarEmail,
+      hideCalendarEventDetails,
     };
   }
 

apps/api/v2/src/ee/schedules/schedules_2024_04_15/controllers/schedules.controller.ts

@@ -23,8 +23,7 @@ import {
   Patch,
   UseGuards,
 } from "@nestjs/common";
-import { ApiResponse, ApiExcludeController as DocsExcludeController } from "@nestjs/swagger";
-import { Throttle } from "@nestjs/throttler";
+import { ApiExcludeController as DocsExcludeController } from "@nestjs/swagger";
 
 import { SCHEDULE_READ, SCHEDULE_WRITE, SUCCESS_STATUS } from "@calcom/platform-constants";
 import { UpdateScheduleInput_2024_04_15 } from "@calcom/platform-types";
@@ -57,11 +56,6 @@ export class SchedulesController_2024_04_15 {
 
   @Get("/default")
   @Permissions([SCHEDULE_READ])
-  @ApiResponse({
-    status: 200,
-    description: "Returns the default schedule",
-    type: GetDefaultScheduleOutput_2024_04_15,
-  })
   async getDefaultSchedule(
     @GetUser() user: UserWithProfile
   ): Promise<GetDefaultScheduleOutput_2024_04_15 | null> {
@@ -78,7 +72,6 @@ export class SchedulesController_2024_04_15 {
 
   @Get("/:scheduleId")
   @Permissions([SCHEDULE_READ])
-  @Throttle({ default: { limit: 10, ttl: 60000 } }) // allow 10 requests per minute (for :scheduleId)
   async getSchedule(
     @GetUser() user: UserWithProfile,
     @Param("scheduleId") scheduleId: number

apps/api/v2/src/ee/schedules/schedules_2024_06_11/controllers/schedules.controller.ts

@@ -18,7 +18,6 @@ import {
   UseGuards,
 } from "@nestjs/common";
 import { ApiHeader, ApiOperation, ApiResponse, ApiTags as DocsTags } from "@nestjs/swagger";
-import { Throttle } from "@nestjs/throttler";
 
 import { SCHEDULE_READ, SCHEDULE_WRITE, SUCCESS_STATUS } from "@calcom/platform-constants";
 import {
@@ -57,17 +56,19 @@ export class SchedulesController_2024_06_11 {
   @ApiOperation({
     summary: "Create a schedule",
     description: `
+      Create a schedule for the authenticated user.
+
       The point of creating schedules is for event types to be available at specific times.
 
-      First goal of schedules is to have a default schedule. If you are platform customer and created managed users, then it is important to note that each managed user should have a default schedule.
-      1. If you passed \`timeZone\` when creating managed user, then the default schedule from Monday to Friday from 9AM to 5PM will be created with that timezone. Managed user can then change the default schedule via \`AvailabilitySettings\` atom.
-      2. If you did not, then we assume you want that user has specific schedule right away. You should create default schedule by specifying
-      \`"isDefault": true\` in the request body. Until the user has a default schedule that user can't be booked or manage his / her schedule via the AvailabilitySettings atom.
+      The first goal of schedules is to have a default schedule. If you are platform customer and created managed users, then it is important to note that each managed user should have a default schedule.
+      1. If you passed \`timeZone\` when creating managed user, then the default schedule from Monday to Friday from 9AM to 5PM will be created with that timezone. The managed user can then change the default schedule via the \`AvailabilitySettings\` atom.
+      2. If you did not, then we assume you want the user to have this specific schedule right away. You should create a default schedule by specifying
+      \`"isDefault": true\` in the request body. Until the user has a default schedule the user can't be booked nor manage their schedule via the AvailabilitySettings atom.
 
-      Second goal is to create other schedules that event types can point to, so that when that event is booked availability is not checked against the default schedule but against that specific schedule.
-      After creating a non default schedule you can update event type to point to that schedule via the PATCH \`event-types/{eventTypeId}\` endpoint.
+      The second goal of schedules is to create another schedule that event types can point to. This is useful for when an event is booked because availability is not checked against the default schedule but instead against that specific schedule.
+      After creating a non-default schedule, you can update an event type to point to that schedule via the PATCH \`event-types/{eventTypeId}\` endpoint.
 
-      When specifying start time and end time for each day use 24 hour format e.g. 08:00, 15:00 etc.
+      When specifying start time and end time for each day use the 24 hour format e.g. 08:00, 15:00 etc.
       `,
   })
   async createSchedule(
@@ -86,10 +87,12 @@ export class SchedulesController_2024_06_11 {
   @Permissions([SCHEDULE_READ])
   @ApiResponse({
     status: 200,
-    description: "Returns the default schedule of the authenticated user",
     type: GetDefaultScheduleOutput_2024_06_11,
   })
-  @ApiOperation({ summary: "Get default schedule (of the authenticated user)" })
+  @ApiOperation({
+    summary: "Get default schedule",
+    description: "Get the default schedule of the authenticated user.",
+  })
   async getDefaultSchedule(@GetUser() user: UserWithProfile): Promise<GetScheduleOutput_2024_06_11> {
     const schedule = await this.schedulesService.getUserScheduleDefault(user.id);
 
@@ -101,7 +104,6 @@ export class SchedulesController_2024_06_11 {
 
   @Get("/:scheduleId")
   @Permissions([SCHEDULE_READ])
-  @Throttle({ default: { limit: 10, ttl: 60000 } }) // allow 10 requests per minute (for :scheduleId)
   @ApiOperation({ summary: "Get a schedule" })
   async getSchedule(
     @GetUser() user: UserWithProfile,
@@ -117,7 +119,10 @@ export class SchedulesController_2024_06_11 {
 
   @Get("/")
   @Permissions([SCHEDULE_READ])
-  @ApiOperation({ summary: "Get all schedules (of the authenticated user)" })
+  @ApiOperation({
+    summary: "Get all schedules",
+    description: "Get all schedules of the authenticated user.",
+  })
   async getSchedules(@GetUser() user: UserWithProfile): Promise<GetSchedulesOutput_2024_06_11> {
     const schedules = await this.schedulesService.getUserSchedules(user.id);
 

apps/api/v2/src/env.ts

@@ -19,6 +19,13 @@ export type Environment = {
   CALCOM_LICENSE_KEY: string;
   GET_LICENSE_KEY_URL: string;
   API_KEY_PREFIX: string;
+  DOCS_URL: string;
+  RATE_LIMIT_DEFAULT_TTL_MS: number;
+  RATE_LIMIT_DEFAULT_LIMIT_API_KEY: number;
+  RATE_LIMIT_DEFAULT_LIMIT_OAUTH_CLIENT: number;
+  RATE_LIMIT_DEFAULT_LIMIT_ACCESS_TOKEN: number;
+  RATE_LIMIT_DEFAULT_LIMIT: number;
+  RATE_LIMIT_DEFAULT_BLOCK_DURATION_MS: number;
 };
 
 export const getEnv = <K extends keyof Environment>(key: K, fallback?: Environment[K]): Environment[K] => {

apps/api/v2/src/lib/throttler-guard.ts

@@ -1,42 +1,230 @@
-import { isApiKey } from "@/lib/api-key";
-import { Injectable, Logger } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
+import { getEnv } from "@/env";
+import { hashAPIKey, isApiKey, stripApiKey } from "@/lib/api-key";
+import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
+import { ThrottlerStorageRedisService } from "@nest-lab/throttler-storage-redis";
+import { Inject, Injectable, Logger, UnauthorizedException } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-import { ThrottlerGuard, ThrottlerModuleOptions, ThrottlerStorage } from "@nestjs/throttler";
-import { Request } from "express";
+import {
+  ThrottlerGuard,
+  ThrottlerException,
+  ThrottlerRequest,
+  ThrottlerModuleOptions,
+  seconds,
+} from "@nestjs/throttler";
+import { Request, Response } from "express";
+import { z } from "zod";
 
 import { X_CAL_CLIENT_ID } from "@calcom/platform-constants";
 
+const rateLimitSchema = z.object({
+  name: z.string(),
+  limit: z.number(),
+  ttl: z.number(),
+  blockDuration: z.number(),
+});
+type RateLimitType = z.infer<typeof rateLimitSchema>;
+const rateLimitsSchema = z.array(rateLimitSchema);
+
+const sixtySecondsMs = 60 * 1000;
+
 @Injectable()
 export class CustomThrottlerGuard extends ThrottlerGuard {
   private logger = new Logger("CustomThrottlerGuard");
 
+  private defaultTttl = Number(getEnv("RATE_LIMIT_DEFAULT_TTL_MS", sixtySecondsMs));
+
+  private defaultLimitApiKey = Number(getEnv("RATE_LIMIT_DEFAULT_LIMIT_API_KEY", 120));
+  private defaultLimitOAuthClient = Number(getEnv("RATE_LIMIT_DEFAULT_LIMIT_OAUTH_CLIENT", 500));
+  private defaultLimitAccessToken = Number(getEnv("RATE_LIMIT_DEFAULT_LIMIT_ACCESS_TOKEN", 500));
+  private defaultLimit = Number(getEnv("RATE_LIMIT_DEFAULT_LIMIT", 120));
+
+  private defaultBlockDuration = Number(getEnv("RATE_LIMIT_DEFAULT_BLOCK_DURATION_MS", sixtySecondsMs));
+
   constructor(
     options: ThrottlerModuleOptions,
-    storageService: ThrottlerStorage,
+    @Inject(ThrottlerStorageRedisService) protected readonly storageService: ThrottlerStorageRedisService,
     reflector: Reflector,
-    private readonly config: ConfigService
+    private readonly dbRead: PrismaReadService
   ) {
     super(options, storageService, reflector);
+    this.storageService = storageService;
+  }
+
+  protected async handleRequest(requestProps: ThrottlerRequest): Promise<boolean> {
+    const { context } = requestProps;
+
+    const request = context.switchToHttp().getRequest<Request>();
+    const response = context.switchToHttp().getResponse<Response>();
+    const tracker = await this.getTracker(request);
+    this.logger.log(
+      `Tracker "${tracker}" generated based on: Bearer token "${request.get(
+        "Authorization"
+      )}", OAuth client ID "${request.get(X_CAL_CLIENT_ID)}" and IP "${request.ip}"`
+    );
+
+    if (tracker.startsWith("api_key_")) {
+      return this.handleApiKeyRequest(tracker, response);
+    } else {
+      return this.handleNonApiKeyRequest(tracker, response);
+    }
+  }
+
+  private async handleApiKeyRequest(tracker: string, response: Response): Promise<boolean> {
+    const rateLimits = await this.getRateLimitsForApiKeyTracker(tracker);
+
+    let allLimitsBlocked = true;
+    for (const rateLimit of rateLimits) {
+      const { isBlocked } = await this.incrementRateLimit(tracker, rateLimit, response);
+      if (!isBlocked) {
+        allLimitsBlocked = false;
+      }
+    }
+
+    if (allLimitsBlocked) {
+      throw new ThrottlerException("Too many requests. Please try again later.");
+    }
+
+    return true;
+  }
+
+  private async handleNonApiKeyRequest(tracker: string, response: Response): Promise<boolean> {
+    const rateLimit = this.getDefaultRateLimit(tracker);
+    this.logger.log(`Tracker "${tracker}" uses default rate limits because it is not tracking api key:
+      ${JSON.stringify(rateLimit, null, 2)}
+    `);
+
+    const { isBlocked } = await this.incrementRateLimit(tracker, rateLimit, response);
+    if (isBlocked) {
+      throw new ThrottlerException("Too many requests. Please try again later.");
+    }
+
+    return true;
+  }
+
+  private getDefaultRateLimit(tracker: string) {
+    return {
+      name: "default",
+      limit: this.getDefaultLimit(tracker),
+      ttl: this.getDefaultTtl(),
+      blockDuration: this.getDefaultBlockDuration(),
+    };
+  }
+
+  getDefaultLimit(tracker: string) {
+    if (tracker.startsWith("api_key_")) {
+      return this.defaultLimitApiKey;
+    } else if (tracker.startsWith("oauth_client_")) {
+      return this.defaultLimitOAuthClient;
+    } else if (tracker.startsWith("access_token_")) {
+      return this.defaultLimitAccessToken;
+    } else {
+      return this.defaultLimit;
+    }
+  }
+
+  getDefaultTtl() {
+    return this.defaultTttl;
+  }
+
+  getDefaultBlockDuration() {
+    return this.defaultBlockDuration;
+  }
+
+  private async getRateLimitsForApiKeyTracker(tracker: string) {
+    const cacheKey = `rate_limit:${tracker}`;
+
+    const cachedRateLimits = await this.storageService.redis.get(cacheKey);
+    if (cachedRateLimits) {
+      this.logger.log(`Tracker "${tracker}" rate limits retrieved from redis cache:
+        ${cachedRateLimits}
+      `);
+      return rateLimitsSchema.parse(JSON.parse(cachedRateLimits));
+    }
+
+    const apiKey = tracker.replace("api_key_", "");
+    let rateLimits: RateLimitType[];
+    const apiKeyRecord = await this.dbRead.prisma.apiKey.findUnique({
+      where: { hashedKey: apiKey },
+      select: { id: true },
+    });
+
+    if (!apiKeyRecord) {
+      throw new UnauthorizedException("Invalid API Key");
+    }
+
+    rateLimits = await this.dbRead.prisma.rateLimit.findMany({
+      where: { apiKeyId: apiKeyRecord.id },
+      select: { name: true, limit: true, ttl: true, blockDuration: true },
+    });
+
+    if (rateLimits) {
+      this.logger.log(`Tracker "${tracker}" rate limits retrieved from database:
+        ${JSON.stringify(rateLimits, null, 2)}`);
+    }
+
+    if (!rateLimits || rateLimits.length === 0) {
+      rateLimits = [this.getDefaultRateLimit(tracker)];
+      this.logger.log(`Tracker "${tracker}" rate limits not found in database. Using default rate limits:
+        ${JSON.stringify(rateLimits, null, 2)}`);
+    }
+
+    await this.storageService.redis.set(cacheKey, JSON.stringify(rateLimits), "EX", 3600);
+
+    return rateLimits;
+  }
+
+  private async incrementRateLimit(tracker: string, rateLimit: RateLimitType, response: Response) {
+    const { name, limit, ttl, blockDuration } = rateLimit;
+
+    const key = `${tracker}:${limit}:${ttl}`;
+
+    const { isBlocked, totalHits, timeToExpire, timeToBlockExpire } = await this.storageService.increment(
+      key,
+      ttl,
+      limit,
+      blockDuration,
+      name
+    );
+
+    const nameFirstUpper = name.charAt(0).toUpperCase() + name.slice(1);
+    response.setHeader(`X-RateLimit-Limit-${nameFirstUpper}`, limit);
+    response.setHeader(
+      `X-RateLimit-Remaining-${nameFirstUpper}`,
+      timeToBlockExpire ? 0 : Math.max(0, limit - totalHits)
+    );
+    response.setHeader(`X-RateLimit-Reset-${nameFirstUpper}`, timeToBlockExpire || timeToExpire);
+
+    this.logger.log(
+      `Tracker "${tracker}" rate limit "${name}" incremented. isBlocked ${isBlocked}, totalHits ${totalHits}, timeToExpire ${timeToExpire}, timeToBlockExpire ${timeToBlockExpire}`
+    );
+    this.logger.log(
+      `Tracker "${tracker}" rate limit "${name}" response headers:
+        X-RateLimit-Limit-${nameFirstUpper}: ${limit},
+        X-RateLimit-Remaining-${nameFirstUpper}: ${timeToBlockExpire ? 0 : Math.max(0, limit - totalHits)},
+        X-RateLimit-Reset-${nameFirstUpper}: ${timeToBlockExpire || timeToExpire}`
+    );
+
+    return { isBlocked };
   }
 
   protected async getTracker(request: Request): Promise<string> {
     const authorizationHeader = request.get("Authorization")?.replace("Bearer ", "");
 
     if (authorizationHeader) {
-      return isApiKey(authorizationHeader, this.config.get<string>("api.apiKeyPrefix") ?? "cal_")
-        ? `api_key_${authorizationHeader}`
+      const apiKeyPrefix = getEnv("API_KEY_PREFIX", "cal_");
+      return isApiKey(authorizationHeader, apiKeyPrefix)
+        ? `api_key_${hashAPIKey(stripApiKey(authorizationHeader, apiKeyPrefix))}`
         : `access_token_${authorizationHeader}`;
     }
 
     const oauthClientId = request.get(X_CAL_CLIENT_ID);
 
     if (oauthClientId) {
-      return oauthClientId;
+      return `oauth_client_${oauthClientId}`;
     }
 
     if (request.ip) {
-      return request.ip;
+      return `ip_${request.ip}`;
     }
 
     this.logger.log(`no tracker found: ${request.url}`);

apps/api/v2/src/main.ts

@@ -114,11 +114,14 @@ async function generateSwagger(app: NestExpressApplication<Server>) {
   }
 
   fs.writeFileSync(outputFile, JSON.stringify(document, null, 2), { encoding: "utf8" });
-  SwaggerModule.setup("docs", app, document, {
-    customCss: ".swagger-ui .topbar { display: none }",
-  });
 
-  logger.log(`Swagger documentation available in the "/docs" endpoint\n`);
+  if (!process.env.DOCS_URL) {
+    SwaggerModule.setup("docs", app, document, {
+      customCss: ".swagger-ui .topbar { display: none }",
+    });
+
+    logger.log(`Swagger documentation available in the "/docs" endpoint\n`);
+  }
 }
 
 run().catch((error: Error) => {

apps/api/v2/src/middleware/app.redirects.middleware.ts

@@ -0,0 +1,12 @@
+import { Injectable, NestMiddleware } from "@nestjs/common";
+import { Request, Response } from "express";
+
+@Injectable()
+export class RedirectsMiddleware implements NestMiddleware {
+  use(req: Request, res: Response, next: () => void) {
+    if (process.env.DOCS_URL && (req.url.startsWith("/v2/docs") || req.url.startsWith("/docs"))) {
+      return res.redirect(process.env.DOCS_URL);
+    }
+    next();
+  }
+}

apps/api/v2/src/modules/apps/apps.repository.ts

@@ -1,7 +1,7 @@
 import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { Injectable } from "@nestjs/common";
-import { App } from "@prisma/client";
+import { App, Prisma } from "@prisma/client";
 
 @Injectable()
 export class AppsRepository {
@@ -10,4 +10,15 @@ export class AppsRepository {
   async getAppBySlug(slug: string): Promise<App | null> {
     return await this.dbRead.prisma.app.findUnique({ where: { slug } });
   }
+
+  async createAppCredential(type: string, key: Prisma.InputJsonValue, userId: number, appId: string) {
+    return this.dbWrite.prisma.credential.create({
+      data: {
+        type: type,
+        key: key,
+        userId: userId,
+        appId: appId,
+      },
+    });
+  }
 }

apps/api/v2/src/modules/atoms/atoms.module.ts

@@ -0,0 +1,24 @@
+import { EventTypesModule_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.module";
+import { SchedulesRepository_2024_06_11 } from "@/ee/schedules/schedules_2024_06_11/schedules.repository";
+import { AtomsController } from "@/modules/atoms/controllers/atoms.controller";
+import { EventTypesAtomService } from "@/modules/atoms/services/event-types-atom.service";
+import { MembershipsRepository } from "@/modules/memberships/memberships.repository";
+import { OrganizationsModule } from "@/modules/organizations/organizations.module";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { UsersService } from "@/modules/users/services/users.service";
+import { UsersRepository } from "@/modules/users/users.repository";
+import { Module } from "@nestjs/common";
+
+@Module({
+  imports: [PrismaModule, EventTypesModule_2024_06_14, OrganizationsModule],
+  providers: [
+    EventTypesAtomService,
+    MembershipsRepository,
+    UsersRepository,
+    UsersService,
+    SchedulesRepository_2024_06_11,
+  ],
+  exports: [EventTypesAtomService],
+  controllers: [AtomsController],
+})
+export class AtomsModule {}

apps/api/v2/src/modules/atoms/controllers/atoms.controller.ts

@@ -0,0 +1,83 @@
+import { API_VERSIONS_VALUES } from "@/lib/api-versions";
+import { EventTypesAtomService } from "@/modules/atoms/services/event-types-atom.service";
+import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import { UserWithProfile } from "@/modules/users/users.repository";
+import {
+  Controller,
+  Get,
+  Param,
+  ParseIntPipe,
+  UseGuards,
+  Version,
+  VERSION_NEUTRAL,
+  Patch,
+  Body,
+} from "@nestjs/common";
+import { ApiTags as DocsTags, ApiExcludeController as DocsExcludeController } from "@nestjs/swagger";
+
+import { SUCCESS_STATUS } from "@calcom/platform-constants";
+import type { UpdateEventTypeReturn } from "@calcom/platform-libraries";
+import { ApiResponse } from "@calcom/platform-types";
+
+/*
+
+Endpoints used only by platform atoms, reusing code from other modules, data is already formatted and ready to be used by frontend atoms
+these endpoints should not be recommended for use by third party and are excluded from docs
+
+*/
+
+@Controller({
+  path: "/v2/atoms",
+  version: API_VERSIONS_VALUES,
+})
+@DocsTags("Atoms - endpoints for atoms")
+@DocsExcludeController(true)
+export class AtomsController {
+  constructor(private readonly eventTypesService: EventTypesAtomService) {}
+
+  @Get("event-types/:eventTypeId")
+  @Version(VERSION_NEUTRAL)
+  @UseGuards(ApiAuthGuard)
+  async getAtomEventType(
+    @GetUser() user: UserWithProfile,
+    @Param("eventTypeId", ParseIntPipe) eventTypeId: number
+  ): Promise<ApiResponse<unknown>> {
+    const eventType = await this.eventTypesService.getUserEventType(user, eventTypeId);
+    return {
+      status: SUCCESS_STATUS,
+      data: eventType,
+    };
+  }
+
+  @Patch("event-types/:eventTypeId")
+  @Version(VERSION_NEUTRAL)
+  @UseGuards(ApiAuthGuard)
+  async updateAtomEventType(
+    @GetUser() user: UserWithProfile,
+    @Param("eventTypeId", ParseIntPipe) eventTypeId: number,
+    @Body() body: UpdateEventTypeReturn
+  ): Promise<ApiResponse<UpdateEventTypeReturn>> {
+    const eventType = await this.eventTypesService.updateEventType(eventTypeId, body, user);
+    return {
+      status: SUCCESS_STATUS,
+      data: eventType,
+    };
+  }
+
+  @Patch("/organizations/:organizationId/teams/:teamId/event-types/:eventTypeId")
+  @Version(VERSION_NEUTRAL)
+  @UseGuards(ApiAuthGuard)
+  async updateAtomTeamEventType(
+    @GetUser() user: UserWithProfile,
+    @Param("eventTypeId", ParseIntPipe) eventTypeId: number,
+    @Param("teamId", ParseIntPipe) teamId: number,
+    @Body() body: UpdateEventTypeReturn
+  ): Promise<ApiResponse<UpdateEventTypeReturn>> {
+    const eventType = await this.eventTypesService.updateTeamEventType(eventTypeId, body, user, teamId);
+    return {
+      status: SUCCESS_STATUS,
+      data: eventType,
+    };
+  }
+}

apps/api/v2/src/modules/atoms/services/event-types-atom.service.ts

@@ -0,0 +1,149 @@
+import { EventTypesService_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/services/event-types.service";
+import { MembershipsRepository } from "@/modules/memberships/memberships.repository";
+import { OrganizationsEventTypesService } from "@/modules/organizations/services/event-types/organizations-event-types.service";
+import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
+import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
+import { UsersService } from "@/modules/users/services/users.service";
+import { UserWithProfile } from "@/modules/users/users.repository";
+import { Injectable, NotFoundException, ForbiddenException } from "@nestjs/common";
+
+import {
+  updateEventType,
+  TUpdateEventTypeInputSchema,
+  systemBeforeFieldEmail,
+  getEventTypeById,
+} from "@calcom/platform-libraries";
+import { PrismaClient } from "@calcom/prisma/client";
+
+@Injectable()
+export class EventTypesAtomService {
+  constructor(
+    private readonly membershipsRepository: MembershipsRepository,
+    private readonly usersService: UsersService,
+    private readonly dbWrite: PrismaWriteService,
+    private readonly dbRead: PrismaReadService,
+    private readonly eventTypeService: EventTypesService_2024_06_14,
+    private readonly teamEventTypeService: OrganizationsEventTypesService
+  ) {}
+
+  async getUserEventType(user: UserWithProfile, eventTypeId: number) {
+    const organizationId = this.usersService.getUserMainOrgId(user);
+
+    const isUserOrganizationAdmin = organizationId
+      ? await this.membershipsRepository.isUserOrganizationAdmin(user.id, organizationId)
+      : false;
+
+    const eventType = await getEventTypeById({
+      currentOrganizationId: this.usersService.getUserMainOrgId(user),
+      eventTypeId,
+      userId: user.id,
+      prisma: this.dbRead.prisma as unknown as PrismaClient,
+      isUserOrganizationAdmin,
+      isTrpcCall: true,
+    });
+
+    if (!eventType) {
+      throw new NotFoundException(`Event type with id ${eventTypeId} not found`);
+    }
+
+    if (eventType?.team?.id) {
+      await this.checkTeamOwnsEventType(user.id, eventType.eventType.id, eventType.team.id);
+    } else {
+      this.eventTypeService.checkUserOwnsEventType(user.id, eventType.eventType);
+    }
+
+    return eventType;
+  }
+
+  async updateTeamEventType(
+    eventTypeId: number,
+    body: TUpdateEventTypeInputSchema,
+    user: UserWithProfile,
+    teamId: number
+  ) {
+    await this.checkCanUpdateTeamEventType(user.id, eventTypeId, teamId, body.scheduleId);
+    const eventTypeUser = await this.eventTypeService.getUserToUpdateEvent(user);
+    const bookingFields = [...(body.bookingFields || [])];
+
+    if (
+      !bookingFields.find((field) => field.type === "email") &&
+      !bookingFields.find((field) => field.type === "phone")
+    ) {
+      bookingFields.push(systemBeforeFieldEmail);
+    }
+
+    const eventType = await updateEventType({
+      input: { id: eventTypeId, ...body, bookingFields },
+      ctx: {
+        user: eventTypeUser,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore
+        prisma: this.dbWrite.prisma,
+      },
+    });
+
+    if (!eventType) {
+      throw new NotFoundException(`Event type with id ${eventTypeId} not found`);
+    }
+
+    return eventType.eventType;
+  }
+
+  async updateEventType(eventTypeId: number, body: TUpdateEventTypeInputSchema, user: UserWithProfile) {
+    await this.eventTypeService.checkCanUpdateEventType(user.id, eventTypeId, body.scheduleId);
+    const eventTypeUser = await this.eventTypeService.getUserToUpdateEvent(user);
+    const bookingFields = [...(body.bookingFields || [])];
+
+    if (
+      !bookingFields.find((field) => field.type === "email") &&
+      !bookingFields.find((field) => field.type === "phone")
+    ) {
+      bookingFields.push(systemBeforeFieldEmail);
+    }
+
+    const eventType = await updateEventType({
+      input: { id: eventTypeId, ...body, bookingFields },
+      ctx: {
+        user: eventTypeUser,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore
+        prisma: this.dbWrite.prisma,
+      },
+    });
+
+    if (!eventType) {
+      throw new NotFoundException(`Event type with id ${eventTypeId} not found`);
+    }
+
+    return eventType.eventType;
+  }
+
+  async checkCanUpdateTeamEventType(userId: number, eventTypeId: number, teamId: number, scheduleId: number) {
+    await this.checkTeamOwnsEventType(userId, eventTypeId, teamId);
+    await this.teamEventTypeService.validateEventTypeExists(teamId, eventTypeId);
+    await this.eventTypeService.checkUserOwnsSchedule(userId, scheduleId);
+  }
+
+  async checkTeamOwnsEventType(userId: number, eventTypeId: number, teamId: number) {
+    const membership = await this.dbRead.prisma.membership.findFirst({
+      where: {
+        userId,
+        teamId,
+        accepted: true,
+        OR: [{ role: "ADMIN" }, { role: "OWNER" }],
+      },
+      select: {
+        team: {
+          select: {
+            eventTypes: true,
+          },
+        },
+      },
+    });
+    if (!membership?.team?.eventTypes?.some((item) => item.id === eventTypeId)) {
+      throw new ForbiddenException(
+        `Access denied. Either the team with ID=${teamId} does not own the event type with ID=${eventTypeId}, or your MEMBER role does not have permission to access this resource.`
+      );
+    }
+  }
+}

apps/api/v2/src/modules/auth/guards/permissions/permissions.guard.spec.ts

@@ -1,3 +1,4 @@
+import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { TokensRepository } from "@/modules/tokens/tokens.repository";
 import { createMock } from "@golevelup/ts-jest";
 import { ExecutionContext } from "@nestjs/common";
@@ -26,7 +27,8 @@ describe("PermissionsGuard", () => {
               return null;
           }
         }),
-      })
+      }),
+      createMock<OAuthClientRepository>()
     );
   });
 
@@ -38,7 +40,7 @@ describe("PermissionsGuard", () => {
     it("should return false", async () => {
       const mockContext = createMockExecutionContext({});
       jest.spyOn(reflector, "get").mockReturnValue([SCHEDULE_WRITE]);
-      jest.spyOn(guard, "getOAuthClientPermissions").mockResolvedValue(0);
+      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(0);
 
       await expect(guard.canActivate(mockContext)).resolves.toBe(false);
     });
@@ -51,7 +53,7 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissions").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
 
@@ -62,7 +64,7 @@ describe("PermissionsGuard", () => {
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
       oAuthClientPermissions |= SCHEDULE_READ;
-      jest.spyOn(guard, "getOAuthClientPermissions").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
 
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
@@ -73,7 +75,7 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissions").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
       await expect(guard.canActivate(mockContext)).resolves.toBe(true);
     });
 
@@ -83,7 +85,7 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= APPS_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissions").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
 
       await expect(guard.canActivate(mockContext)).resolves.toBe(false);
     });
@@ -94,7 +96,63 @@ describe("PermissionsGuard", () => {
 
       let oAuthClientPermissions = 0;
       oAuthClientPermissions |= SCHEDULE_WRITE;
-      jest.spyOn(guard, "getOAuthClientPermissions").mockResolvedValue(oAuthClientPermissions);
+      jest.spyOn(guard, "getOAuthClientPermissionsByAccessToken").mockResolvedValue(oAuthClientPermissions);
+
+      await expect(guard.canActivate(mockContext)).resolves.toBe(false);
+    });
+  });
+
+  describe("when oauth id is provided", () => {
+    it("should return true for valid permissions", async () => {
+      const mockContext = createMockExecutionContext({ "x-cal-client-id": "100" });
+      jest.spyOn(reflector, "get").mockReturnValue([SCHEDULE_WRITE]);
+
+      let oAuthClientPermissions = 0;
+      oAuthClientPermissions |= SCHEDULE_WRITE;
+      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+      await expect(guard.canActivate(mockContext)).resolves.toBe(true);
+    });
+
+    it("should return true for multiple valid permissions", async () => {
+      const mockContext = createMockExecutionContext({ "x-cal-client-id": "100" });
+      jest.spyOn(reflector, "get").mockReturnValue([SCHEDULE_WRITE, SCHEDULE_READ]);
+
+      let oAuthClientPermissions = 0;
+      oAuthClientPermissions |= SCHEDULE_WRITE;
+      oAuthClientPermissions |= SCHEDULE_READ;
+      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+
+      await expect(guard.canActivate(mockContext)).resolves.toBe(true);
+    });
+
+    it("should return true for empty Permissions decorator", async () => {
+      const mockContext = createMockExecutionContext({ "x-cal-client-id": "100" });
+      jest.spyOn(reflector, "get").mockReturnValue([]);
+
+      let oAuthClientPermissions = 0;
+      oAuthClientPermissions |= SCHEDULE_WRITE;
+      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+      await expect(guard.canActivate(mockContext)).resolves.toBe(true);
+    });
+
+    it("should return false for invalid permissions", async () => {
+      const mockContext = createMockExecutionContext({ "x-cal-client-id": "100" });
+      jest.spyOn(reflector, "get").mockReturnValue([SCHEDULE_WRITE]);
+
+      let oAuthClientPermissions = 0;
+      oAuthClientPermissions |= APPS_WRITE;
+      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
+
+      await expect(guard.canActivate(mockContext)).resolves.toBe(false);
+    });
+
+    it("should return false for a missing permission", async () => {
+      const mockContext = createMockExecutionContext({ "x-cal-client-id": "100" });
+      jest.spyOn(reflector, "get").mockReturnValue([SCHEDULE_WRITE, SCHEDULE_READ]);
+
+      let oAuthClientPermissions = 0;
+      oAuthClientPermissions |= SCHEDULE_WRITE;
+      jest.spyOn(guard, "getOAuthClientPermissionsById").mockResolvedValue(oAuthClientPermissions);
 
       await expect(guard.canActivate(mockContext)).resolves.toBe(false);
     });

apps/api/v2/src/modules/auth/guards/permissions/permissions.guard.ts

@@ -1,11 +1,13 @@
 import { isApiKey } from "@/lib/api-key";
 import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
+import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { TokensRepository } from "@/modules/tokens/tokens.repository";
 import { Injectable, CanActivate, ExecutionContext } from "@nestjs/common";
 import { ConfigService } from "@nestjs/config";
 import { Reflector } from "@nestjs/core";
 import { getToken } from "next-auth/jwt";
 
+import { X_CAL_CLIENT_ID } from "@calcom/platform-constants";
 import { hasPermissions } from "@calcom/platform-utils";
 
 @Injectable()
@@ -13,7 +15,8 @@ export class PermissionsGuard implements CanActivate {
   constructor(
     private reflector: Reflector,
     private tokensRepository: TokensRepository,
-    private readonly config: ConfigService
+    private readonly config: ConfigService,
+    private readonly oAuthClientRepository: OAuthClientRepository
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -27,12 +30,13 @@ export class PermissionsGuard implements CanActivate {
     const authString = request.get("Authorization")?.replace("Bearer ", "");
     const nextAuthSecret = this.config.get("next.authSecret", { infer: true });
     const nextAuthToken = await getToken({ req: request, secret: nextAuthSecret });
+    const oAuthClientId = request.params?.clientId || request.get(X_CAL_CLIENT_ID);
 
     if (nextAuthToken) {
       return true;
     }
 
-    if (!authString) {
+    if (!authString && !oAuthClientId) {
       return false;
     }
 
@@ -41,7 +45,9 @@ export class PermissionsGuard implements CanActivate {
       return true;
     }
 
-    const oAuthClientPermissions = await this.getOAuthClientPermissions(authString);
+    const oAuthClientPermissions = authString
+      ? await this.getOAuthClientPermissionsByAccessToken(authString)
+      : await this.getOAuthClientPermissionsById(oAuthClientId);
 
     if (!oAuthClientPermissions) {
       return false;
@@ -50,8 +56,13 @@ export class PermissionsGuard implements CanActivate {
     return hasPermissions(oAuthClientPermissions, [...requiredPermissions]);
   }
 
-  async getOAuthClientPermissions(accessToken: string) {
+  async getOAuthClientPermissionsByAccessToken(accessToken: string) {
     const oAuthClient = await this.tokensRepository.getAccessTokenClient(accessToken);
     return oAuthClient?.permissions;
   }
+
+  async getOAuthClientPermissionsById(id: string) {
+    const oAuthClient = await this.oAuthClientRepository.getOAuthClient(id);
+    return oAuthClient?.permissions;
+  }
 }

apps/api/v2/src/modules/billing/controllers/billing.controller.ts

@@ -68,20 +68,14 @@ export class BillingController {
     @Param("teamId") teamId: number,
     @Body() input: SubscribeToPlanInput
   ): Promise<ApiResponse<SubscribeTeamToBillingResponseDto | undefined>> {
-    const { action, url } = await this.billingService.createSubscriptionForTeam(teamId, input.plan);
-
-    if (action === "redirect") {
-      return {
-        status: "success",
-        data: {
-          action: "redirect",
-          url,
-        },
-      };
-    }
+    const customerId = await this.billingService.createTeamBilling(teamId);
+    const url = await this.billingService.redirectToSubscribeCheckout(teamId, input.plan, customerId);
 
     return {
       status: "success",
+      data: {
+        url,
+      },
     };
   }
 
@@ -92,20 +86,13 @@ export class BillingController {
     @Param("teamId") teamId: number,
     @Body() input: SubscribeToPlanInput
   ): Promise<ApiResponse<SubscribeTeamToBillingResponseDto | undefined>> {
-    const { action, url } = await this.billingService.updateSubscriptionForTeam(teamId, input.plan);
-
-    if (action === "redirect") {
-      return {
-        status: "success",
-        data: {
-          action: "redirect",
-          url,
-        },
-      };
-    }
+    const url = await this.billingService.updateSubscriptionForTeam(teamId, input.plan);
 
     return {
       status: "success",
+      data: {
+        url,
+      },
     };
   }
 

apps/api/v2/src/modules/billing/services/billing.service.ts

@@ -47,7 +47,7 @@ export class BillingService implements OnModuleDestroy {
     }
   }
 
-  async createSubscriptionForTeam(teamId: number, plan: PlatformPlan) {
+  async createTeamBilling(teamId: number) {
     const teamWithBilling = await this.teamsRepository.findByIdIncludeBilling(teamId);
     let customerId = teamWithBilling?.platformBilling?.customerId;
 
@@ -60,6 +60,10 @@ export class BillingService implements OnModuleDestroy {
       });
     }
 
+    return customerId;
+  }
+
+  async redirectToSubscribeCheckout(teamId: number, plan: PlatformPlan, customerId?: string) {
     const { url } = await this.stripeService.stripe.checkout.sessions.create({
       customer: customerId,
       line_items: [
@@ -90,7 +94,7 @@ export class BillingService implements OnModuleDestroy {
 
     if (!url) throw new InternalServerErrorException("Failed to create Stripe session.");
 
-    return { action: "redirect", url };
+    return url;
   }
 
   async updateSubscriptionForTeam(teamId: number, plan: PlatformPlan) {
@@ -111,7 +115,7 @@ export class BillingService implements OnModuleDestroy {
 
     if (!url) throw new InternalServerErrorException("Failed to create Stripe session.");
 
-    return { action: "redirect", url };
+    return url;
   }
 
   async setSubscriptionForTeam(teamId: number, subscriptionId: string, plan: PlatformPlan) {

apps/api/v2/src/modules/conferencing/conferencing.module.ts

@@ -0,0 +1,22 @@
+import { ConferencingController } from "@/modules/conferencing/controllers/conferencing.controller";
+import { ConferencingRepository } from "@/modules/conferencing/repositories/conferencing.respository";
+import { ConferencingService } from "@/modules/conferencing/services/conferencing.service";
+import { GoogleMeetService } from "@/modules/conferencing/services/google-meet.service";
+import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { UsersRepository } from "@/modules/users/users.repository";
+import { Module } from "@nestjs/common";
+
+@Module({
+  imports: [PrismaModule],
+  providers: [
+    ConferencingService,
+    ConferencingRepository,
+    GoogleMeetService,
+    CredentialsRepository,
+    UsersRepository,
+  ],
+  exports: [],
+  controllers: [ConferencingController],
+})
+export class ConferencingModule {}

apps/api/v2/src/modules/conferencing/controllers/conferencing.controller.e2e-spec.ts

@@ -0,0 +1,137 @@
+import { bootstrap } from "@/app";
+import { AppModule } from "@/app.module";
+import { ConferencingAppsOutputDto } from "@/modules/conferencing/outputs/get-conferencing-apps.output";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { TokensModule } from "@/modules/tokens/tokens.module";
+import { UsersModule } from "@/modules/users/users.module";
+import { INestApplication } from "@nestjs/common";
+import { NestExpressApplication } from "@nestjs/platform-express";
+import { Test } from "@nestjs/testing";
+import { User } from "@prisma/client";
+import * as request from "supertest";
+import { CredentialsRepositoryFixture } from "test/fixtures/repository/credentials.repository.fixture";
+import { UserRepositoryFixture } from "test/fixtures/repository/users.repository.fixture";
+import { withApiAuth } from "test/utils/withApiAuth";
+
+import {
+  ERROR_STATUS,
+  GOOGLE_CALENDAR_ID,
+  GOOGLE_CALENDAR_TYPE,
+  GOOGLE_MEET,
+  GOOGLE_MEET_TYPE,
+  SUCCESS_STATUS,
+} from "@calcom/platform-constants";
+import { ApiErrorResponse, ApiSuccessResponse } from "@calcom/platform-types";
+
+describe("Conferencing Endpoints", () => {
+  describe("conferencing controller e2e tests", () => {
+    let app: INestApplication;
+
+    let userRepositoryFixture: UserRepositoryFixture;
+    let credentialsRepositoryFixture: CredentialsRepositoryFixture;
+
+    const userEmail = "conferencing-controller-user-e2e@api.com";
+    let user: User;
+
+    beforeAll(async () => {
+      const moduleRef = await withApiAuth(
+        userEmail,
+        Test.createTestingModule({
+          imports: [AppModule, PrismaModule, UsersModule, TokensModule],
+        })
+      ).compile();
+
+      userRepositoryFixture = new UserRepositoryFixture(moduleRef);
+      credentialsRepositoryFixture = new CredentialsRepositoryFixture(moduleRef);
+
+      user = await userRepositoryFixture.create({
+        email: userEmail,
+        username: userEmail,
+      });
+
+      app = moduleRef.createNestApplication();
+      bootstrap(app as NestExpressApplication);
+
+      await app.init();
+    });
+
+    it("should get all the conferencing apps of the auth user", async () => {
+      return request(app.getHttpServer())
+        .get(`/v2/conferencing`)
+        .expect(200)
+        .then((response) => {
+          const responseBody: ApiSuccessResponse<ConferencingAppsOutputDto[]> = response.body;
+          expect(responseBody.status).toEqual(SUCCESS_STATUS);
+          expect(responseBody.data).toEqual([]);
+        });
+    });
+
+    it("should fail to connect google meet if google calendar is not connected ", async () => {
+      return request(app.getHttpServer())
+        .post(`/v2/conferencing/google-meet/connect`)
+        .expect(400)
+        .then(async () => {
+          await credentialsRepositoryFixture.create(GOOGLE_CALENDAR_TYPE, {}, user.id, GOOGLE_CALENDAR_ID);
+        });
+    });
+
+    it("should connect google meet if google calendar is connected ", async () => {
+      return request(app.getHttpServer())
+        .post(`/v2/conferencing/google-meet/connect`)
+        .expect(200)
+        .then((response) => {
+          const responseBody: ApiSuccessResponse<ConferencingAppsOutputDto[]> = response.body;
+          expect(responseBody.status).toEqual(SUCCESS_STATUS);
+        });
+    });
+
+    it("should set google meet as default conferencing app", async () => {
+      return request(app.getHttpServer())
+        .post(`/v2/conferencing/google-meet/default`)
+        .expect(200)
+        .then(async () => {
+          const updatedUser = await userRepositoryFixture.get(user.id);
+
+          expect(updatedUser).toBeDefined();
+
+          if (updatedUser) {
+            const metadata = updatedUser.metadata as { defaultConferencingApp?: { appSlug?: string } };
+            expect(metadata?.defaultConferencingApp?.appSlug).toEqual(GOOGLE_MEET);
+          }
+        });
+    });
+
+    it("should get all the conferencing apps of the auth user, and contain google meet", async () => {
+      return request(app.getHttpServer())
+        .get(`/v2/conferencing`)
+        .expect(200)
+        .then((response) => {
+          const responseBody: ApiSuccessResponse<ConferencingAppsOutputDto[]> = response.body;
+          expect(responseBody.status).toEqual(SUCCESS_STATUS);
+          const googleMeet = responseBody.data.find((app) => app.type === GOOGLE_MEET_TYPE);
+          expect(googleMeet?.userId).toEqual(user.id);
+        });
+    });
+
+    it("should disconnect google meet", async () => {
+      return request(app.getHttpServer()).delete(`/v2/conferencing/google-meet/disconnect`).expect(200);
+    });
+
+    it("should get all the conferencing apps of the auth user, and not contain google meet", async () => {
+      return request(app.getHttpServer())
+        .get(`/v2/conferencing`)
+        .expect(200)
+        .then((response) => {
+          const responseBody: ApiSuccessResponse<ConferencingAppsOutputDto[]> = response.body;
+          expect(responseBody.status).toEqual(SUCCESS_STATUS);
+          const googleMeet = responseBody.data.find((app) => app.type === GOOGLE_MEET_TYPE);
+          expect(googleMeet).toBeUndefined();
+        });
+    });
+
+    afterAll(async () => {
+      await userRepositoryFixture.deleteByEmail(user.email);
+      await app.close();
+    });
+  });
+});

apps/api/v2/src/modules/conferencing/controllers/conferencing.controller.ts

@@ -0,0 +1,121 @@
+import { API_VERSIONS_VALUES } from "@/lib/api-versions";
+import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import {
+  ConferencingAppsOutputResponseDto,
+  ConferencingAppOutputResponseDto,
+  ConferencingAppsOutputDto,
+} from "@/modules/conferencing/outputs/get-conferencing-apps.output";
+import { SetDefaultConferencingAppOutputResponseDto } from "@/modules/conferencing/outputs/set-default-conferencing-app.output";
+import { ConferencingService } from "@/modules/conferencing/services/conferencing.service";
+import { GoogleMeetService } from "@/modules/conferencing/services/google-meet.service";
+import {
+  Controller,
+  Get,
+  HttpCode,
+  HttpStatus,
+  Logger,
+  UseGuards,
+  Post,
+  Param,
+  BadRequestException,
+  Delete,
+} from "@nestjs/common";
+import { ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { plainToInstance } from "class-transformer";
+
+import { CONFERENCING_APPS, GOOGLE_MEET, SUCCESS_STATUS } from "@calcom/platform-constants";
+
+@Controller({
+  path: "/v2/conferencing",
+  version: API_VERSIONS_VALUES,
+})
+@DocsTags("Conferencing")
+export class ConferencingController {
+  private readonly logger = new Logger("Platform Gcal Provider");
+
+  constructor(
+    private readonly conferencingService: ConferencingService,
+    private readonly googleMeetService: GoogleMeetService
+  ) {}
+
+  @Post("/:app/connect")
+  @HttpCode(HttpStatus.OK)
+  @UseGuards(ApiAuthGuard)
+  @ApiOperation({ summary: "Connect your conferencing application" })
+  async connect(
+    @GetUser("id") userId: number,
+    @Param("app") app: string
+  ): Promise<ConferencingAppOutputResponseDto> {
+    switch (app) {
+      case GOOGLE_MEET:
+        const credential = await this.googleMeetService.connectGoogleMeetApp(userId);
+
+        return { status: SUCCESS_STATUS, data: plainToInstance(ConferencingAppsOutputDto, credential) };
+
+      default:
+        throw new BadRequestException(
+          "Invalid conferencing app, available apps are: ",
+          CONFERENCING_APPS.join(", ")
+        );
+    }
+  }
+
+  @Get("/")
+  @HttpCode(HttpStatus.OK)
+  @UseGuards(ApiAuthGuard)
+  @ApiOperation({ summary: "List your conferencing applications" })
+  async listConferencingApps(@GetUser("id") userId: number): Promise<ConferencingAppsOutputResponseDto> {
+    const conferencingApps = await this.conferencingService.getConferencingApps(userId);
+
+    const data = conferencingApps.map((conferencingApps) =>
+      plainToInstance(ConferencingAppsOutputDto, conferencingApps)
+    );
+
+    return { status: SUCCESS_STATUS, data };
+  }
+
+  @Post("/:app/default")
+  @HttpCode(HttpStatus.OK)
+  @UseGuards(ApiAuthGuard)
+  @ApiOperation({ summary: "Set your default conferencing application" })
+  async default(
+    @GetUser("id") userId: number,
+    @Param("app") app: string
+  ): Promise<SetDefaultConferencingAppOutputResponseDto> {
+    switch (app) {
+      case GOOGLE_MEET:
+        await this.googleMeetService.setDefault(userId);
+
+        return { status: SUCCESS_STATUS };
+
+      default:
+        throw new BadRequestException(
+          "Invalid conferencing app, available apps are: ",
+          CONFERENCING_APPS.join(", ")
+        );
+    }
+  }
+
+  @Delete("/:app/disconnect")
+  @HttpCode(HttpStatus.OK)
+  @UseGuards(ApiAuthGuard)
+  @ApiOperation({ summary: "Disconnect your conferencing application" })
+  async disconnect(
+    @GetUser("id") userId: number,
+    @Param("app") app: string
+  ): Promise<ConferencingAppOutputResponseDto> {
+    switch (app) {
+      case GOOGLE_MEET:
+        const credential = await this.googleMeetService.disconnectGoogleMeetApp(userId);
+
+        return { status: SUCCESS_STATUS, data: plainToInstance(ConferencingAppsOutputDto, credential) };
+
+      default:
+        throw new BadRequestException(
+          "Invalid conferencing app, available apps are: ",
+          CONFERENCING_APPS.join(", ")
+        );
+    }
+  }
+}

apps/api/v2/src/modules/conferencing/outputs/get-conferencing-apps.output.ts

@@ -0,0 +1,50 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { Expose, Type } from "class-transformer";
+import { IsString, ValidateNested, IsEnum, IsNumber, IsOptional, IsBoolean } from "class-validator";
+
+import { ERROR_STATUS, GOOGLE_MEET_TYPE, SUCCESS_STATUS } from "@calcom/platform-constants";
+
+export class ConferencingAppsOutputDto {
+  @Expose()
+  @IsNumber()
+  @ApiProperty({ description: "Id of the conferencing app credentials" })
+  id!: number;
+
+  @ApiProperty({ example: GOOGLE_MEET_TYPE, description: "Type of conferencing app" })
+  @Expose()
+  @IsString()
+  type!: string;
+
+  @ApiProperty({ description: "Id of the user associated to the conferencing app" })
+  @Expose()
+  @IsNumber()
+  userId!: number;
+
+  @ApiProperty({ example: true, description: "Whether if the connection is working or not." })
+  @Expose()
+  @IsBoolean()
+  @IsOptional()
+  invalid?: boolean | null;
+}
+
+export class ConferencingAppsOutputResponseDto {
+  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+
+  @Expose()
+  @ValidateNested()
+  @Type(() => ConferencingAppsOutputDto)
+  data!: ConferencingAppsOutputDto[];
+}
+
+export class ConferencingAppOutputResponseDto {
+  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+
+  @Expose()
+  @ValidateNested()
+  @Type(() => ConferencingAppsOutputDto)
+  data!: ConferencingAppsOutputDto;
+}

apps/api/v2/src/modules/conferencing/outputs/set-default-conferencing-app.output.ts

@@ -0,0 +1,10 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { IsEnum } from "class-validator";
+
+import { ERROR_STATUS, SUCCESS_STATUS } from "@calcom/platform-constants";
+
+export class SetDefaultConferencingAppOutputResponseDto {
+  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+}

apps/api/v2/src/modules/conferencing/repositories/conferencing.respository.ts

@@ -0,0 +1,25 @@
+import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
+import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
+import { Injectable } from "@nestjs/common";
+
+import { GOOGLE_MEET_TYPE } from "@calcom/platform-constants";
+
+@Injectable()
+export class ConferencingRepository {
+  constructor(private readonly dbRead: PrismaReadService, private readonly dbWrite: PrismaWriteService) {}
+
+  async findConferencingApps(userId: number) {
+    return this.dbRead.prisma.credential.findMany({
+      where: {
+        userId,
+        type: { endsWith: "_video" },
+      },
+    });
+  }
+
+  async findGoogleMeet(userId: number) {
+    return this.dbRead.prisma.credential.findFirst({
+      where: { userId, type: GOOGLE_MEET_TYPE },
+    });
+  }
+}

apps/api/v2/src/modules/conferencing/services/conferencing.service.ts

@@ -0,0 +1,14 @@
+import { ConferencingRepository } from "@/modules/conferencing/repositories/conferencing.respository";
+import { Logger } from "@nestjs/common";
+import { Injectable } from "@nestjs/common";
+
+@Injectable()
+export class ConferencingService {
+  private logger = new Logger("ConferencingService");
+
+  constructor(private readonly conferencingRepository: ConferencingRepository) {}
+
+  async getConferencingApps(userId: number) {
+    return this.conferencingRepository.findConferencingApps(userId);
+  }
+}

apps/api/v2/src/modules/conferencing/services/google-meet.service.ts

@@ -0,0 +1,71 @@
+import { ConferencingRepository } from "@/modules/conferencing/repositories/conferencing.respository";
+import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
+import { UsersRepository } from "@/modules/users/users.repository";
+import { BadRequestException, InternalServerErrorException, Logger } from "@nestjs/common";
+import { Injectable } from "@nestjs/common";
+
+import { GOOGLE_CALENDAR_TYPE, GOOGLE_MEET_TYPE, GOOGLE_MEET } from "@calcom/platform-constants";
+
+@Injectable()
+export class GoogleMeetService {
+  private logger = new Logger("GoogleMeetService");
+
+  constructor(
+    private readonly conferencingRepository: ConferencingRepository,
+    private readonly credentialsRepository: CredentialsRepository,
+    private readonly usersRepository: UsersRepository
+  ) {}
+
+  async connectGoogleMeetApp(userId: number) {
+    const googleCalendar = await this.credentialsRepository.getByTypeAndUserId(GOOGLE_CALENDAR_TYPE, userId);
+
+    if (!googleCalendar) {
+      throw new BadRequestException("Google Meet app requires a Google Calendar connection");
+    }
+
+    if (googleCalendar.invalid) {
+      throw new BadRequestException(
+        "Google Meet app requires a valid Google Calendar connection, please reconnect Google Calendar."
+      );
+    }
+
+    const googleMeet = await this.conferencingRepository.findGoogleMeet(userId);
+
+    if (googleMeet) {
+      throw new BadRequestException("Google Meet is already connected.");
+    }
+
+    const googleMeetCredential = await this.credentialsRepository.upsertAppCredential(
+      GOOGLE_MEET_TYPE,
+      {},
+      userId
+    );
+
+    return googleMeetCredential;
+  }
+
+  async disconnectGoogleMeetApp(userId: number) {
+    const googleMeet = await this.conferencingRepository.findGoogleMeet(userId);
+
+    if (!googleMeet) {
+      throw new BadRequestException("Google Meet is not connected.");
+    }
+
+    const googleMeetCredential = await this.credentialsRepository.deleteUserCredentialById(
+      userId,
+      googleMeet.id
+    );
+
+    return googleMeetCredential;
+  }
+
+  async setDefault(userId: number) {
+    const user = await this.usersRepository.setDefaultConferencingApp(userId, GOOGLE_MEET);
+    const metadata = user.metadata as { defaultConferencingApp?: { appSlug?: string } };
+
+    if (metadata?.defaultConferencingApp?.appSlug !== GOOGLE_MEET) {
+      throw new InternalServerErrorException("Could not set Google Meet as default conferencing app");
+    }
+    return true;
+  }
+}

apps/api/v2/src/modules/credentials/credentials.repository.ts

@@ -88,6 +88,12 @@ export class CredentialsRepository {
       },
     });
   }
+
+  async deleteUserCredentialById(userId: number, credentialId: number) {
+    return await this.dbWrite.prisma.credential.delete({
+      where: { id: credentialId, userId },
+    });
+  }
 }
 
 export type CredentialsWithUserEmail = Awaited<

apps/api/v2/src/modules/endpoints.module.ts

@@ -1,7 +1,10 @@
 import { PlatformEndpointsModule } from "@/ee/platform-endpoints-module";
+import { AtomsModule } from "@/modules/atoms/atoms.module";
 import { BillingModule } from "@/modules/billing/billing.module";
+import { ConferencingModule } from "@/modules/conferencing/conferencing.module";
 import { DestinationCalendarsModule } from "@/modules/destination-calendars/destination-calendars.module";
 import { OAuthClientModule } from "@/modules/oauth-clients/oauth-client.module";
+import { StripeModule } from "@/modules/stripe/stripe.module";
 import { TimezoneModule } from "@/modules/timezones/timezones.module";
 import type { MiddlewareConsumer, NestModule } from "@nestjs/common";
 import { Module } from "@nestjs/common";
@@ -18,6 +21,9 @@ import { WebhooksModule } from "./webhooks/webhooks.module";
     UsersModule,
     WebhooksModule,
     DestinationCalendarsModule,
+    AtomsModule,
+    StripeModule,
+    ConferencingModule,
   ],
 })
 export class EndpointsModule implements NestModule {

apps/api/v2/src/modules/oauth-clients/controllers/oauth-clients/oauth-clients.controller.ts

@@ -52,8 +52,6 @@ Second, make sure that the logged in user has organizationId set to pass the Org
   version: API_VERSIONS_VALUES,
 })
 @UseGuards(NextAuthGuard, OrganizationRolesGuard)
-@DocsExcludeController(getEnv("NODE_ENV") === "production")
-@DocsTags("OAuth - development only")
 export class OAuthClientsController {
   private readonly logger = new Logger("OAuthClientController");
 

apps/api/v2/src/modules/oauth-clients/controllers/oauth-flow/oauth-flow.controller.ts

@@ -25,9 +25,11 @@ import {
 import {
   ApiTags as DocsTags,
   ApiExcludeController as DocsExcludeController,
+  ApiExcludeEndpoint as DocsExcludeEndpoint,
   ApiOperation as DocsOperation,
   ApiOkResponse as DocsOkResponse,
   ApiBadRequestResponse as DocsBadRequestResponse,
+  ApiHeader as DocsHeader,
 } from "@nestjs/swagger";
 import { Response as ExpressResponse } from "express";
 
@@ -37,8 +39,7 @@ import { SUCCESS_STATUS, X_CAL_SECRET_KEY } from "@calcom/platform-constants";
   path: "/v2/oauth/:clientId",
   version: API_VERSIONS_VALUES,
 })
-@DocsExcludeController(getEnv("NODE_ENV") === "production")
-@DocsTags("OAuth - development only")
+@DocsTags("OAuth")
 export class OAuthFlowController {
   constructor(
     private readonly oauthClientRepository: OAuthClientRepository,
@@ -62,6 +63,7 @@ export class OAuthFlowController {
     description:
       "Bad request if the OAuth client is not found, if the redirect URI is invalid, or if the user has already authorized the client.",
   })
+  @DocsExcludeEndpoint(getEnv("NODE_ENV") === "production")
   async authorize(
     @Param("clientId") clientId: string,
     @Body() body: OAuthAuthorizeInput,
@@ -108,6 +110,7 @@ export class OAuthFlowController {
     description:
       "Bad request if the authorization code is missing, invalid, or if the client ID and secret do not match.",
   })
+  @DocsExcludeEndpoint(getEnv("NODE_ENV") === "production")
   async exchange(
     @Headers("Authorization") authorization: string,
     @Param("clientId") clientId: string,
@@ -138,6 +141,12 @@ export class OAuthFlowController {
   @Post("/refresh")
   @HttpCode(HttpStatus.OK)
   @UseGuards(ApiAuthGuard)
+  @DocsTags("Managed users")
+  @DocsHeader({
+    name: X_CAL_SECRET_KEY,
+    description: "OAuth client secret key.",
+    required: true,
+  })
   async refreshAccessToken(
     @Param("clientId") clientId: string,
     @Headers(X_CAL_SECRET_KEY) secretKey: string,

apps/api/v2/src/modules/oauth-clients/inputs/refresh-token.input.ts

@@ -1,6 +1,8 @@
+import { ApiProperty as DocsProperty } from "@nestjs/swagger";
 import { IsString } from "class-validator";
 
 export class RefreshTokenInput {
   @IsString()
+  @DocsProperty({ description: "Managed user's refresh token." })
   refreshToken!: string;
 }

apps/api/v2/src/modules/organizations/controllers/event-types/organizations-event-types.e2e-spec.ts

@@ -300,6 +300,7 @@ describe("Organizations Event Types Endpoints", () => {
         },
         requiresBookerEmailVerification: true,
         hideCalendarNotes: true,
+        hideCalendarEventDetails: true,
         lockTimeZoneToggleOnBookingPage: true,
         color: {
           darkThemeHex: "#292929",
@@ -330,6 +331,7 @@ describe("Organizations Event Types Endpoints", () => {
           expect(data.confirmationPolicy).toEqual(body.confirmationPolicy);
           expect(data.requiresBookerEmailVerification).toEqual(body.requiresBookerEmailVerification);
           expect(data.hideCalendarNotes).toEqual(body.hideCalendarNotes);
+          expect(data.hideCalendarEventDetails).toEqual(body.hideCalendarEventDetails);
           expect(data.lockTimeZoneToggleOnBookingPage).toEqual(body.lockTimeZoneToggleOnBookingPage);
           expect(data.color).toEqual(body.color);
 

apps/api/v2/src/modules/organizations/controllers/teams/organizations-teams.controller.e2e-spec.ts

@@ -162,6 +162,7 @@ describe("Organizations Team Endpoints", () => {
           const responseBody: ApiSuccessResponse<OrgMeTeamOutputDto[]> = response.body;
           expect(responseBody.data.find((t) => t.id === teamCreatedViaApi.id)).toBeDefined();
           expect(responseBody.data.some((t) => t.accepted)).toBeTruthy();
+          expect(responseBody.data.find((t) => t.id === teamCreatedViaApi.id)?.role).toBe("OWNER");
         });
     });
 

apps/api/v2/src/modules/organizations/controllers/teams/organizations-teams.controller.ts

@@ -67,7 +67,7 @@ export class OrganizationsTeamsController {
   }
 
   @Get("/me")
-  @ApiOperation({ summary: "Get team membership for user" })
+  @ApiOperation({ summary: "Get teams membership for user" })
   @Roles("ORG_MEMBER")
   @PlatformPlan("ESSENTIALS")
   async getMyTeams(
@@ -84,13 +84,14 @@ export class OrganizationsTeamsController {
     );
     return {
       status: SUCCESS_STATUS,
-      data: teams.map((team) =>
-        plainToClass(
+      data: teams.map((team) => {
+        const me = team.members.find((member) => member.userId === user.id);
+        return plainToClass(
           OrgMeTeamOutputDto,
-          { ...team, accepted: team.members.find((member) => member.userId === user.id)?.accepted ?? false },
+          me ? { ...team, role: me.role, accepted: me.accepted } : team,
           { strategy: "excludeAll" }
-        )
-      ),
+        );
+      }),
     };
   }
 

apps/api/v2/src/modules/organizations/inputs/update-organization-team.input.ts

@@ -76,4 +76,8 @@ export class UpdateOrgTeamDto {
   @IsOptional()
   @IsString()
   readonly bookingLimits?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  readonly includeManagedEventsInLimits?: boolean;
 }

apps/api/v2/src/modules/organizations/organizations.module.ts

@@ -100,6 +100,7 @@ import { Module } from "@nestjs/common";
     OrganizationsWebhooksService,
     WebhooksRepository,
     WebhooksService,
+    OrganizationsEventTypesService,
   ],
   controllers: [
     OrganizationsTeamsController,

apps/api/v2/src/modules/organizations/outputs/organization-team.output.ts

@@ -1,4 +1,5 @@
 import { ApiProperty } from "@nestjs/swagger";
+import { MembershipRole } from "@prisma/client";
 import { Expose, Type } from "class-transformer";
 import { IsEnum, IsString, ValidateNested } from "class-validator";
 
@@ -9,6 +10,14 @@ export class OrgMeTeamOutputDto extends OrgTeamOutputDto {
   @IsString()
   @Expose()
   readonly accepted!: boolean;
+
+  @ApiProperty({
+    example: MembershipRole.MEMBER,
+    enum: [MembershipRole.ADMIN, MembershipRole.OWNER, MembershipRole.MEMBER],
+  })
+  @IsEnum([MembershipRole.ADMIN, MembershipRole.OWNER, MembershipRole.MEMBER])
+  @Expose()
+  readonly role!: MembershipRole;
 }
 
 export class OrgTeamsOutputResponseDto {

apps/api/v2/src/modules/organizations/repositories/organizations-teams.repository.ts

@@ -97,7 +97,7 @@ export class OrganizationsTeamsRepository {
         },
       },
       include: {
-        members: { select: { accepted: true, userId: true } },
+        members: { select: { accepted: true, userId: true, role: true } },
       },
       skip,
       take,

apps/api/v2/src/modules/organizations/services/event-types/output.service.ts

@@ -65,6 +65,7 @@ type Input = Pick<
   | "requiresConfirmationWillBlockSlot"
   | "eventName"
   | "useEventTypeDestinationCalendarEmail"
+  | "hideCalendarEventDetails"
 >;
 
 @Injectable()

apps/api/v2/src/modules/slots/controllers/slots.controller.ts

@@ -1,7 +1,7 @@
 import { API_VERSIONS_VALUES } from "@/lib/api-versions";
 import { SlotsService } from "@/modules/slots/services/slots.service";
 import { Query, Body, Controller, Get, Delete, Post, Req, Res } from "@nestjs/common";
-import { ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { ApiTags as DocsTags, ApiCreatedResponse, ApiOkResponse, ApiOperation } from "@nestjs/swagger";
 import { Response as ExpressResponse, Request as ExpressRequest } from "express";
 
 import { SUCCESS_STATUS } from "@calcom/platform-constants";
@@ -19,6 +19,21 @@ export class SlotsController {
   constructor(private readonly slotsService: SlotsService) {}
 
   @Post("/reserve")
+  @ApiCreatedResponse({
+    description: "Successful response returning uid of reserved slot.",
+    schema: {
+      type: "object",
+      properties: {
+        status: { type: "string", example: "success" },
+        data: {
+          type: "object",
+          properties: {
+            uid: { type: "string", example: "e2a7bcf9-cc7b-40a0-80d3-657d391775a6" },
+          },
+        },
+      },
+    },
+  })
   @ApiOperation({ summary: "Reserve a slot" })
   async reserveSlot(
     @Body() body: ReserveSlotInput,
@@ -35,6 +50,15 @@ export class SlotsController {
   }
 
   @Delete("/selected-slot")
+  @ApiOkResponse({
+    description: "Response deleting reserved slot by uid.",
+    schema: {
+      type: "object",
+      properties: {
+        status: { type: "string", example: "success" },
+      },
+    },
+  })
   @ApiOperation({ summary: "Delete a selected slot" })
   async deleteSelectedSlot(
     @Query() params: RemoveSelectedSlotInput,
@@ -50,6 +74,45 @@ export class SlotsController {
   }
 
   @Get("/available")
+  @ApiOkResponse({
+    description: "Available time slots retrieved successfully",
+    schema: {
+      type: "object",
+      properties: {
+        status: { type: "string", example: "success" },
+        data: {
+          type: "object",
+          properties: {
+            slots: {
+              type: "object",
+              additionalProperties: {
+                type: "array",
+                items: {
+                  type: "object",
+                  properties: {
+                    time: { type: "string", format: "date-time", example: "2024-09-25T08:00:00.000Z" },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      example: {
+        status: "success",
+        data: {
+          slots: {
+            "2024-09-25": [{ time: "2024-09-25T08:00:00.000Z" }, { time: "2024-09-25T08:15:00.000Z" }],
+            "2024-09-26": [
+              { time: "2024-09-26T08:00:00.000Z" },
+              { time: "2024-09-26T08:15:00.000Z" },
+              { time: "2024-09-26T08:30:00.000Z" },
+            ],
+          },
+        },
+      },
+    },
+  })
   @ApiOperation({ summary: "Get available slots" })
   async getAvailableSlots(
     @Query() query: GetAvailableSlotsInput,

apps/api/v2/src/modules/stripe/controllers/stripe.controller.ts

@@ -0,0 +1,104 @@
+import { API_VERSIONS_VALUES } from "@/lib/api-versions";
+import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import {
+  StripConnectOutputDto,
+  StripConnectOutputResponseDto,
+  StripCredentialsCheckOutputResponseDto,
+  StripCredentialsSaveOutputResponseDto,
+} from "@/modules/stripe/outputs/stripe.output";
+import { StripeService } from "@/modules/stripe/stripe.service";
+import { getOnErrorReturnToValueFromQueryState } from "@/modules/stripe/utils/getReturnToValueFromQueryState";
+import { UserWithProfile } from "@/modules/users/users.repository";
+import {
+  Controller,
+  Query,
+  UseGuards,
+  Get,
+  HttpCode,
+  HttpStatus,
+  Redirect,
+  Req,
+  BadRequestException,
+  Headers,
+} from "@nestjs/common";
+import { ApiTags as DocsTags, ApiOperation } from "@nestjs/swagger";
+import { plainToClass } from "class-transformer";
+import { Request } from "express";
+import { stringify } from "querystring";
+
+import { SUCCESS_STATUS } from "@calcom/platform-constants";
+
+@Controller({
+  path: "/v2/stripe",
+  version: API_VERSIONS_VALUES,
+})
+@DocsTags("Stripe")
+export class StripeController {
+  constructor(private readonly stripeService: StripeService) {}
+
+  @Get("/connect")
+  @UseGuards(ApiAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: "Get stripe connect URL" })
+  async redirect(
+    @Req() req: Request,
+    @Headers("Authorization") authorization: string,
+    @GetUser() user: UserWithProfile,
+    @Query("redir") redir?: string | null,
+    @Query("errorRedir") errorRedir?: string | null
+  ): Promise<StripConnectOutputResponseDto> {
+    const origin = req.headers.origin;
+    const accessToken = authorization.replace("Bearer ", "");
+
+    const state = {
+      onErrorReturnTo: !!errorRedir ? errorRedir : origin,
+      fromApp: false,
+      returnTo: !!redir ? redir : origin,
+      accessToken,
+    };
+
+    const stripeRedirectUrl = await this.stripeService.getStripeRedirectUrl(
+      JSON.stringify(state),
+      user.email,
+      user.name
+    );
+
+    return {
+      status: SUCCESS_STATUS,
+      data: plainToClass(StripConnectOutputDto, { authUrl: stripeRedirectUrl }, { strategy: "excludeAll" }),
+    };
+  }
+
+  @Get("/save")
+  @UseGuards()
+  @Redirect(undefined, 301)
+  @ApiOperation({ summary: "Save stripe credentials" })
+  async save(
+    @Query("state") state: string,
+    @Query("code") code: string,
+    @Query("error") error: string | undefined,
+    @Query("error_description") error_description: string | undefined
+  ): Promise<StripCredentialsSaveOutputResponseDto> {
+    const accessToken = JSON.parse(state).accessToken;
+
+    // user cancels flow
+    if (error === "access_denied") {
+      return { url: getOnErrorReturnToValueFromQueryState(state) };
+    }
+
+    if (error) {
+      throw new BadRequestException(stringify({ error, error_description }));
+    }
+
+    return await this.stripeService.saveStripeAccount(state, code, accessToken);
+  }
+
+  @Get("/check")
+  @UseGuards(ApiAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: "Check stripe connection" })
+  async check(@GetUser() user: UserWithProfile): Promise<StripCredentialsCheckOutputResponseDto> {
+    return await this.stripeService.checkIfStripeAccountConnected(user.id);
+  }
+}

apps/api/v2/src/modules/stripe/inputs/stripe.input.ts

@@ -0,0 +1,7 @@
+import { IsString, IsOptional } from "class-validator";
+
+export class StripeConnectQueryParamsInputDto {
+  @IsString()
+  @IsOptional()
+  readonly redir?: string;
+}

apps/api/v2/src/modules/stripe/outputs/stripe.output.ts

@@ -0,0 +1,33 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { Expose, Type } from "class-transformer";
+import { IsString, ValidateNested, IsEnum } from "class-validator";
+
+import { ERROR_STATUS, SUCCESS_STATUS } from "@calcom/platform-constants";
+
+export class StripConnectOutputDto {
+  @IsString()
+  @Expose()
+  readonly authUrl!: string;
+}
+
+export class StripConnectOutputResponseDto {
+  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+
+  @Expose()
+  @ValidateNested()
+  @Type(() => StripConnectOutputDto)
+  data!: StripConnectOutputDto;
+}
+
+export class StripCredentialsCheckOutputResponseDto {
+  @ApiProperty({ example: SUCCESS_STATUS })
+  status!: typeof SUCCESS_STATUS;
+}
+
+export class StripCredentialsSaveOutputResponseDto {
+  @IsString()
+  @Expose()
+  readonly url!: string;
+}

apps/api/v2/src/modules/stripe/stripe.module.ts

@@ -1,10 +1,16 @@
+import { AppsRepository } from "@/modules/apps/apps.repository";
+import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { StripeController } from "@/modules/stripe/controllers/stripe.controller";
 import { StripeService } from "@/modules/stripe/stripe.service";
+import { TokensRepository } from "@/modules/tokens/tokens.repository";
 import { Module } from "@nestjs/common";
 import { ConfigModule } from "@nestjs/config";
 
 @Module({
-  imports: [ConfigModule],
+  imports: [ConfigModule, PrismaModule],
   exports: [StripeService],
-  providers: [StripeService],
+  providers: [StripeService, AppsRepository, CredentialsRepository, TokensRepository],
+  controllers: [StripeController],
 })
 export class StripeModule {}

apps/api/v2/src/modules/stripe/stripe.service.ts

@@ -1,15 +1,130 @@
 import { AppConfig } from "@/config/type";
-import { Injectable } from "@nestjs/common";
+import { AppsRepository } from "@/modules/apps/apps.repository";
+import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
+import { getReturnToValueFromQueryState } from "@/modules/stripe/utils/getReturnToValueFromQueryState";
+import { stripeInstance } from "@/modules/stripe/utils/newStripeInstance";
+import { StripeData } from "@/modules/stripe/utils/stripeDataSchemas";
+import { TokensRepository } from "@/modules/tokens/tokens.repository";
+import { Injectable, NotFoundException, BadRequestException, UnauthorizedException } from "@nestjs/common";
 import { ConfigService } from "@nestjs/config";
+import type { Prisma } from "@prisma/client";
 import Stripe from "stripe";
+import { z } from "zod";
+
+import { SUCCESS_STATUS } from "@calcom/platform-constants";
+
+import { stripeKeysResponseSchema } from "./utils/stripeDataSchemas";
+
+import stringify = require("qs-stringify");
 
 @Injectable()
 export class StripeService {
   public stripe: Stripe;
+  private redirectUri = `${this.config.get("api.url")}/stripe/save`;
 
-  constructor(configService: ConfigService<AppConfig>) {
+  constructor(
+    configService: ConfigService<AppConfig>,
+    private readonly config: ConfigService,
+    private readonly appsRepository: AppsRepository,
+    private readonly credentialRepository: CredentialsRepository,
+    private readonly tokensRepository: TokensRepository
+  ) {
     this.stripe = new Stripe(configService.get("stripe.apiKey", { infer: true }) ?? "", {
       apiVersion: "2020-08-27",
     });
   }
+
+  async getStripeRedirectUrl(state: string, userEmail?: string, userName?: string | null) {
+    const { client_id } = await this.getStripeAppKeys();
+
+    const stripeConnectParams: Stripe.OAuthAuthorizeUrlParams = {
+      client_id,
+      scope: "read_write",
+      response_type: "code",
+      stripe_user: {
+        email: userEmail,
+        first_name: userName || undefined,
+        /** We need this so E2E don't fail for international users */
+        country: process.env.NEXT_PUBLIC_IS_E2E ? "US" : undefined,
+      },
+      redirect_uri: this.redirectUri,
+      state: state,
+    };
+
+    const params = z.record(z.any()).parse(stripeConnectParams);
+    const query = stringify(params);
+    const url = `https://connect.stripe.com/oauth/authorize?${query}`;
+
+    return url;
+  }
+
+  async getStripeAppKeys() {
+    const app = await this.appsRepository.getAppBySlug("stripe");
+
+    const { client_id, client_secret } = stripeKeysResponseSchema.parse(app?.keys);
+
+    if (!client_id) {
+      throw new NotFoundException("Stripe app not found");
+    }
+
+    if (!client_secret) {
+      throw new NotFoundException("Stripe app not found");
+    }
+
+    return { client_id, client_secret };
+  }
+
+  async saveStripeAccount(state: string, code: string, accessToken: string): Promise<{ url: string }> {
+    const userId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);
+
+    if (!userId) {
+      throw new UnauthorizedException("Invalid Access token.");
+    }
+
+    const response = await stripeInstance.oauth.token({
+      grant_type: "authorization_code",
+      code: code?.toString(),
+    });
+
+    const data: StripeData = { ...response, default_currency: "" };
+    if (response["stripe_user_id"]) {
+      const account = await stripeInstance.accounts.retrieve(response["stripe_user_id"]);
+      data["default_currency"] = account.default_currency;
+    }
+
+    await this.appsRepository.createAppCredential(
+      "stripe_payment",
+      data as unknown as Prisma.InputJsonObject,
+      userId,
+      "stripe"
+    );
+
+    return { url: getReturnToValueFromQueryState(state) };
+  }
+
+  async checkIfStripeAccountConnected(userId: number): Promise<{ status: typeof SUCCESS_STATUS }> {
+    const stripeCredentials = await this.credentialRepository.getByTypeAndUserId("stripe_payment", userId);
+
+    if (!stripeCredentials) {
+      throw new NotFoundException("Credentials for stripe not found.");
+    }
+
+    if (stripeCredentials.invalid) {
+      throw new BadRequestException("Invalid stripe credentials.");
+    }
+
+    const stripeKey = JSON.stringify(stripeCredentials.key);
+    const stripeKeyObject = JSON.parse(stripeKey);
+
+    const stripeAccount = await stripeInstance.accounts.retrieve(stripeKeyObject?.stripe_user_id);
+
+    // both of these should be true for an account to be fully active
+    if (!stripeAccount.payouts_enabled || !stripeAccount.charges_enabled) {
+      throw new BadRequestException("Stripe account is not an active account");
+    }
+
+    return {
+      status: SUCCESS_STATUS,
+    };
+  }
 }

apps/api/v2/src/modules/stripe/utils/getReturnToValueFromQueryState.ts

@@ -0,0 +1,19 @@
+export const getReturnToValueFromQueryState = (queryState: string | string[] | undefined) => {
+  let returnTo = "";
+  try {
+    returnTo = JSON.parse(`${queryState}`).returnTo;
+  } catch (error) {
+    console.info("No 'returnTo' in req.query.state");
+  }
+  return returnTo;
+};
+
+export const getOnErrorReturnToValueFromQueryState = (queryState: string | string[] | undefined) => {
+  let returnTo = "";
+  try {
+    returnTo = JSON.parse(`${queryState}`).onErrorReturnTo;
+  } catch (error) {
+    console.info("No 'onErrorReturnTo' in req.query.state");
+  }
+  return returnTo;
+};

apps/api/v2/src/modules/stripe/utils/newStripeInstance.ts

@@ -0,0 +1,6 @@
+import Stripe from "stripe";
+
+const stripeApiKey = process.env.STRIPE_API_KEY || "";
+export const stripeInstance = new Stripe(stripeApiKey, {
+  apiVersion: "2020-08-27",
+});

apps/api/v2/src/modules/stripe/utils/stripeDataSchemas.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+
+export const stripeOAuthTokenSchema = z.object({
+  access_token: z.string().optional(),
+  scope: z.string().optional(),
+  livemode: z.boolean().optional(),
+  token_type: z.literal("bearer").optional(),
+  refresh_token: z.string().optional(),
+  stripe_user_id: z.string().optional(),
+  stripe_publishable_key: z.string().optional(),
+});
+
+export const stripeDataSchema = stripeOAuthTokenSchema.extend({
+  default_currency: z.string(),
+});
+
+export type StripeData = z.infer<typeof stripeDataSchema>;
+
+export const stripeKeysResponseSchema = z.object({
+  client_id: z.string().startsWith("ca_").min(1),
+  client_secret: z.string().startsWith("sk_").min(1),
+  public_key: z.string().startsWith("pk_").min(1),
+  webhook_secret: z.string().startsWith("whsec_").min(1),
+});

apps/api/v2/src/modules/users/users.repository.ts

@@ -2,7 +2,7 @@ import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { CreateManagedUserInput } from "@/modules/users/inputs/create-managed-user.input";
 import { UpdateManagedUserInput } from "@/modules/users/inputs/update-managed-user.input";
-import { Injectable } from "@nestjs/common";
+import { Injectable, NotFoundException } from "@nestjs/common";
 import type { Profile, User, Team } from "@prisma/client";
 
 export type UserWithProfile = User & {
@@ -223,4 +223,29 @@ export class UsersRepository {
     });
     return profiles.map((profile) => profile.user);
   }
+
+  async setDefaultConferencingApp(userId: number, appSlug?: string, appLink?: string) {
+    const user = await this.findById(userId);
+
+    if (!user) {
+      throw new NotFoundException("user not found");
+    }
+
+    return await this.dbWrite.prisma.user.update({
+      data: {
+        metadata:
+          typeof user.metadata === "object"
+            ? {
+                ...user.metadata,
+                defaultConferencingApp: {
+                  appSlug: appSlug,
+                  appLink: appLink,
+                },
+              }
+            : {},
+      },
+
+      where: { id: userId },
+    });
+  }
 }

apps/api/v2/src/modules/webhooks/guards/is-oauth-client-webhook-guard.ts

@@ -3,12 +3,12 @@ import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repo
 import { UsersService } from "@/modules/users/services/users.service";
 import { WebhooksService } from "@/modules/webhooks/services/webhooks.service";
 import {
+  BadRequestException,
   CanActivate,
   ExecutionContext,
+  ForbiddenException,
   Injectable,
   NotFoundException,
-  ForbiddenException,
-  BadRequestException,
 } from "@nestjs/common";
 import { Request } from "express";
 
@@ -39,14 +39,10 @@ export class IsOAuthClientWebhookGuard implements CanActivate {
       throw new BadRequestException("webhookId parameter not specified in the request");
     }
 
-    if (!webhookId) {
+    if (!oAuthClientId) {
       throw new BadRequestException("oAuthClientId parameter not specified in the request");
     }
 
-    if (!user || !webhookId || !oAuthClientId) {
-      return false;
-    }
-
     const oAuthClient = await this.oAuthClientRepository.getOAuthClient(oAuthClientId);
 
     if (!oAuthClient) {

apps/api/v2/test/fixtures/repository/rate-limit.repository.fixture.ts

@@ -0,0 +1,22 @@
+import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
+import { TestingModule } from "@nestjs/testing";
+
+export class RateLimitRepositoryFixture {
+  private dbWrite: PrismaWriteService["prisma"];
+
+  constructor(private readonly module: TestingModule) {
+    this.dbWrite = module.get(PrismaWriteService).prisma;
+  }
+
+  async createRateLimit(name: string, apiKeyId: string, ttl: number, limit: number, blockDuration: number) {
+    return await this.dbWrite.rateLimit.create({
+      data: {
+        name,
+        apiKeyId,
+        ttl,
+        limit,
+        blockDuration,
+      },
+    });
+  }
+}

apps/api/v2/test/setEnvVars.ts

@@ -16,6 +16,10 @@ const env: Partial<Omit<Environment, "NODE_ENV">> = {
   API_KEY_PREFIX: "cal_test_",
   GET_LICENSE_KEY_URL: " https://console.cal.com/api/license",
   CALCOM_LICENSE_KEY: "c4234812-12ab-42s6-a1e3-55bedd4a5bb7",
+  RATE_LIMIT_DEFAULT_TTL_MS: 60000,
+  // note(Lauris): setting high limit so that e2e tests themselves are not rate limited
+  RATE_LIMIT_DEFAULT_LIMIT: 10000,
+  RATE_LIMIT_DEFAULT_BLOCK_DURATION_MS: 60000,
 };
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
 // @ts-ignore

apps/storybook/package.json

@@ -24,7 +24,7 @@
     "@storybook/blocks": "^7.6.3",
     "@storybook/nextjs": "^7.6.3",
     "@storybook/preview-api": "^7.6.3",
-    "next": "^13.5.4",
+    "next": "^13.5.6",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "storybook-addon-rtl-direction": "^0.0.19"

apps/swagger/package.json

@@ -14,7 +14,7 @@
   "dependencies": {
     "highlight.js": "^11.6.0",
     "isarray": "2.0.5",
-    "next": "^13.5.4",
+    "next": "^13.5.6",
     "openapi-snippet": "^0.13.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",

apps/web/abTest/middlewareFactory.ts

@@ -8,8 +8,8 @@ import { FUTURE_ROUTES_ENABLED_COOKIE_NAME, FUTURE_ROUTES_OVERRIDE_COOKIE_NAME }
 const ROUTES: [URLPattern, boolean][] = [
   ["/event-types", process.env.APP_ROUTER_EVENT_TYPES_ENABLED === "1"] as const,
   ["/settings/developer/:path*", process.env.APP_ROUTER_SETTINGS_DEVELOPER_ENABLED === "1"] as const,
-  ["/settings/security/:path*", process.env.APP_ROUTER_SETTINGS_SECURITY_ENABLED === "1"] as const,
   ["/settings/admin/:path*", process.env.APP_ROUTER_SETTINGS_ADMIN_ENABLED === "1"] as const,
+  ["/settings/my-account/:path*", process.env.APP_ROUTER_SETTINGS_MY_ACCOUNT_ENABLED === "1"] as const,
   ["/settings/platform/:path*", process.env.APP_ROUTER_SETTINGS_PLATFORM_ENABLED === "1"] as const,
   ["/settings/organizations/:path*", process.env.APP_ROUTER_SETTINGS_ORG_ENABLED === "1"] as const,
   ["/apps/installed/:category", process.env.APP_ROUTER_APPS_INSTALLED_CATEGORY_ENABLED === "1"] as const,

apps/web/app/WithAppDirSsr.tsx

@@ -21,8 +21,5 @@ export const withAppDirSsr =
       ...("trpcState" in props && {
         dehydratedState: props.trpcState,
       }),
-      ...("isInfiniteScrollEnabled" in props && {
-        isInfiniteScrollEnabled: props.isInfiniteScrollEnabled,
-      }),
     };
   };

apps/web/app/future/apps/[slug]/[...pages]/page.tsx

@@ -27,12 +27,12 @@ export const generateMetadata = async ({ params, searchParams }: PageProps) => {
   const legacyContext = buildLegacyCtx(headers(), cookies(), params, searchParams);
   const data = await getData(legacyContext);
   const form = "form" in data ? (data.form as { name?: string; description?: string }) : null;
-  const formName = form?.name ?? "Routing Forms";
-  const formDescription = form?.description ?? "";
+  const formName = form?.name;
+  const formDescription = form?.description;
 
   return await _generateMetadata(
-    () => formName,
-    () => formDescription
+    (t) => formName ?? t("routing_forms"),
+    (t) => formDescription ?? t("routing_forms_description")
   );
 };
 

apps/web/app/future/apps/categories/[category]/page.tsx

@@ -11,8 +11,8 @@ import CategoryPage, { type PageProps } from "~/apps/categories/[category]/categ
 
 export const generateMetadata = async () => {
   return await _generateMetadata(
-    () => "Apps Store",
-    () => "Connecting people, technology and the workplace."
+    (t) => t("app_store"),
+    (t) => t("app_store_description")
   );
 };
 

apps/web/app/future/apps/categories/page.tsx

@@ -8,8 +8,8 @@ import Page from "~/apps/categories/categories-view";
 
 export const generateMetadata = async () => {
   return await _generateMetadata(
-    () => "Apps Store",
-    () => "Connecting people, technology and the workplace."
+    (t) => t("app_store"),
+    (t) => t("app_store_description")
   );
 };
 

apps/web/app/future/bookings/[status]/page.tsx

@@ -12,8 +12,8 @@ const getData = withAppDirSsg<Y>(getStaticProps);
 
 export const generateMetadata = async () =>
   await _generateMetadata(
-    () => "Bookings",
-    () => "Create events to share for people to book on your calendar."
+    (t) => t("bookings"),
+    (t) => t("bookings_description")
   );
 
 export const generateStaticParams = async () => {

apps/web/app/future/insights/page.tsx

@@ -9,7 +9,7 @@ import InsightsPage from "~/insights/insights-view";
 
 export const generateMetadata = async () =>
   await _generateMetadata(
-    () => "Insights",
+    (t) => t("insights"),
     (t) => t("insights_subtitle")
   );
 

apps/web/app/future/settings/platform/page.tsx

@@ -5,8 +5,8 @@ import PlatformView from "~/settings/platform/platform-view";
 
 export const generateMetadata = async () => {
   return await _generateMetadata(
-    () => "Platform",
-    () => "Manage everything related to platform."
+    (t) => t("platform"),
+    (t) => t("platform_description")
   );
 };
 

apps/web/app/layout.tsx

@@ -67,6 +67,7 @@ export default async function RootLayout({ children }: { children: React.ReactNo
       lang={locale}
       dir={direction}
       style={embedColorScheme ? { colorScheme: embedColorScheme as string } : undefined}
+      suppressHydrationWarning
       data-nextjs-router="app">
       <head nonce={nonce}>
         {!!process.env.NEXT_PUBLIC_HEAD_SCRIPTS && (

apps/web/app/layoutHOC.tsx

@@ -51,7 +51,7 @@ export function WithLayout<T extends Record<string, any>>({
         requiresLicense={requiresLicense || !!(Page && "requiresLicense" in Page && Page.requiresLicense)}
         nonce={nonce}
         themeBasis={null}
-        isThemeSupported={!!(Page && "isThemeSupported" in Page && Page.isThemeSupported)}
+        isThemeSupported={Page && "isThemeSupported" in Page ? (Page.isThemeSupported as boolean) : undefined}
         isBookingPage={isBookingPage || !!(Page && "isBookingPage" in Page && Page.isBookingPage)}
         {...props}>
         {pageWithServerLayout}

apps/web/app/settings/(settings-layout)/layout.tsx

@@ -0,0 +1,5 @@
+import { WithLayout } from "app/layoutHOC";
+
+import { getLayout } from "@calcom/features/settings/appDir/SettingsLayoutAppDir";
+
+export default WithLayout({ getServerLayout: getLayout })<"L">;

apps/web/app/settings/(settings-layout)/my-account/general/page.tsx

@@ -1,5 +1,6 @@
 import { _generateMetadata } from "app/_utils";
 import { getFixedT } from "app/_utils";
+import { revalidatePath } from "next/cache";
 
 import { getServerSessionForAppDir } from "@calcom/feature-auth/lib/get-server-session-for-app-dir";
 import SettingsHeader from "@calcom/features/settings/appDir/SettingsHeader";
@@ -16,9 +17,14 @@ const Page = async () => {
   const session = await getServerSessionForAppDir();
 
   const t = await getFixedT(session?.user.locale || "en");
+  const revalidatePage = async () => {
+    "use server";
+    revalidatePath("settings/my-account/general");
+  };
+
   return (
     <SettingsHeader title={t("general")} description={t("general_description")} borderInShellHeader={true}>
-      <GeneralQueryView />
+      <GeneralQueryView revalidatePage={revalidatePage} />
     </SettingsHeader>
   );
 };