95120e1ff4
* feat: add bookingRequiresAuthentication validation to 2024-04-15 booking controller - Add checkBookingRequiresAuthentication method to validate authentication requirements - Check if user is event type owner, host, team admin/owner, or org admin/owner - Add comprehensive e2e tests for bookingRequiresAuthentication feature - Ensure parity with 2024-08-13 controller implementation - Fix type issue in setPlatformAttendeesEmails method Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor: move Prisma calls to repository pattern - Add findByIdIncludeHostsAndTeamMembers method to EventTypeRepository - Inject PrismaEventTypeRepository and PrismaTeamRepository into controller - Replace direct Prisma calls with repository methods in checkBookingRequiresAuthentication - Use getTeamByIdIfUserIsAdmin for org admin/owner check - Add repositories to BookingsModule_2024_04_15 providers Co-Authored-By: morgan@cal.com <morgan@cal.com> * handle httpException in handleBookingErrors * test: add test case for authenticated but unauthorized user booking - Create second user who is not authorized to book the event type - Verify that authenticated user without proper permissions receives 403 Forbidden - Test validates that bookingRequiresAuthentication properly checks authorization levels - Cleanup unauthorized user in afterAll hook Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: add accepted filter to team members and handle org-owned event types Addresses PR comments from cubic-dev-ai and @ThyMinimalDev: 1. Add accepted: true filter to team.members query - Prevents pending team invitations from being treated as authorized - Also filter by role to only fetch ADMIN and OWNER roles - Reduces payload size and improves query performance 2. Add isOrganization field to team select - Enables proper handling of org-owned event types 3. Update authorization logic for org-owned event types - Handle case where team.isOrganization is true with no parent - Ensure org admins/owners are properly authorized for org-owned events - Matches behavior of 2024-08-13 controller Changes: - packages/features/eventtypes/repositories/eventTypeRepository.ts: * Add where clause to members query with accepted: true and role filter * Add isOrganization: true to team select - apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts: * Update authorization logic to handle org-owned event types * Check if team.isOrganization is true when no parentId exists Co-Authored-By: morgan@cal.com <morgan@cal.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
A progressive Node.js framework for building efficient and scalable server-side applications.
Description
Cal.com is using the Nest framework TypeScript starter repository.
Installation
$ yarn install
Prisma setup
$ yarn prisma generate
Env setup
Copy .env.example to .env and fill values.
Add license Key to Deployment table in DB
id, logo, theme, licenseKey, agreedLicenseAt:- 1, null, null, '00000000-0000-0000-0000-000000000000', '2023-05-15 21:39:47.611'
Replace with your actual license key.
your CALCOM_LICENSE_KEY env var need to contain the same value
.env CALCOM_LICENSE_KEY=00000000-0000-0000-0000-000000000000
Running the app
Development
$ yarn run start
OR if you don't want to use docker, you can run following command.
$ yarn dev:no-docker
Additionally you can run following command(in different terminal) to ensure that any change in any of the dependencies is rebuilt and detected. It watches platform-libraries, platform-constants, platform-enums, platform-utils, platform-types.
$ yarn run dev:build:watch
If you are making changes in packages/platform/libraries, you should run the following command too that would connect your local packages/platform/libraries to the api/v2
$ yarn local
watch mode
$ yarn run start:dev
production mode
$ yarn run start:prod
## Test
```bash
# unit tests
$ yarn run test
# e2e tests
$ yarn run test:e2e
# e2e tests in watch mode
$ yarn test:e2e:watch
# run specific e2e test file in watch mode
$ yarn test:e2e:watch --testPathPattern=filePath
# test coverage
$ yarn run test:cov
Conventions
Guards
- In case a guard would return "false" for "canActivate" instead throw ForbiddenException with an error message containing guard name and the error.
- In case a guard would return "false" for "canActivate" DO NOT cache the result in redis, because we don't want that someone is forbidden, updates whatever was the problem, and then has to wait for cache to expire. We only cache in redis guard results where "canAccess" is "true".
- If you use ApiAuthGuard but want that only specific auth method is allowed, for example, api key, then you also need to add
@ApiAuthGuardOnlyAllow(["API_KEY"])under the@UseGuards(ApiAuthGuard). Shortly, useApiAuthGuardOnlyAllowto specify which auth methods are allowed byApiAuthGuard. IfApiAuthGuardOnlyAllowis not used or nothing is passed to it or empty array it means that all auth methods are allowed.
Support
Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please read more here.
Stay in touch
- Author - Kamil Myśliwiec
- Website - https://nestjs.com
- Twitter - @nestframework
License
Nest is MIT licensed.