* feat: add bookingRequiresAuthentication validation to 2024-04-15 booking controller
- Add checkBookingRequiresAuthentication method to validate authentication requirements
- Check if user is event type owner, host, team admin/owner, or org admin/owner
- Add comprehensive e2e tests for bookingRequiresAuthentication feature
- Ensure parity with 2024-08-13 controller implementation
- Fix type issue in setPlatformAttendeesEmails method
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* refactor: move Prisma calls to repository pattern
- Add findByIdIncludeHostsAndTeamMembers method to EventTypeRepository
- Inject PrismaEventTypeRepository and PrismaTeamRepository into controller
- Replace direct Prisma calls with repository methods in checkBookingRequiresAuthentication
- Use getTeamByIdIfUserIsAdmin for org admin/owner check
- Add repositories to BookingsModule_2024_04_15 providers
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* handle httpException in handleBookingErrors
* test: add test case for authenticated but unauthorized user booking
- Create second user who is not authorized to book the event type
- Verify that authenticated user without proper permissions receives 403 Forbidden
- Test validates that bookingRequiresAuthentication properly checks authorization levels
- Cleanup unauthorized user in afterAll hook
Co-Authored-By: morgan@cal.com <morgan@cal.com>
* fix: add accepted filter to team members and handle org-owned event types
Addresses PR comments from cubic-dev-ai and @ThyMinimalDev:
1. Add accepted: true filter to team.members query
- Prevents pending team invitations from being treated as authorized
- Also filter by role to only fetch ADMIN and OWNER roles
- Reduces payload size and improves query performance
2. Add isOrganization field to team select
- Enables proper handling of org-owned event types
3. Update authorization logic for org-owned event types
- Handle case where team.isOrganization is true with no parent
- Ensure org admins/owners are properly authorized for org-owned events
- Matches behavior of 2024-08-13 controller
Changes:
- packages/features/eventtypes/repositories/eventTypeRepository.ts:
* Add where clause to members query with accepted: true and role filter
* Add isOrganization: true to team select
- apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts:
* Update authorization logic to handle org-owned event types
* Check if team.isOrganization is true when no parentId exists
Co-Authored-By: morgan@cal.com <morgan@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
95120e1ff4