fix: v2 isSystemAdmin (#18162)

* refactor: ApiAuthStrategy return isSystemAdmin and define returned type

* refactor: use ApiAuthGuardUser instead of GetUserReturnType

* regenerate docs

apps/api/v2/src/modules/auth/decorators/get-user/get-user.decorator.ts

@@ -1,22 +1,18 @@
-import { UserWithProfile } from "@/modules/users/users.repository";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { ExecutionContext } from "@nestjs/common";
 import { createParamDecorator } from "@nestjs/common";
 
-export type GetUserReturnType = UserWithProfile & { isSystemAdmin: boolean };
-
 export const GetUser = createParamDecorator<
-  keyof GetUserReturnType | (keyof GetUserReturnType)[],
+  keyof ApiAuthGuardUser | (keyof ApiAuthGuardUser)[],
   ExecutionContext
 >((data, ctx) => {
   const request = ctx.switchToHttp().getRequest();
-  const user = request.user as GetUserReturnType;
+  const user = request.user as ApiAuthGuardUser;
 
   if (!user) {
     throw new Error("GetUser decorator : User not found");
   }
 
-  user.isSystemAdmin = user.role === "ADMIN";
-
   if (Array.isArray(data)) {
     return data.reduce((prev, curr) => {
       return {

apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.ts

@@ -1,5 +1,5 @@
 import { PlatformPlan } from "@/modules/auth/decorators/billing/platform-plan.decorator";
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { PlatformPlanType } from "@/modules/billing/types";
 import { OrganizationsRepository } from "@/modules/organizations/organizations.repository";
 import { RedisService } from "@/modules/redis/redis.service";
@@ -19,7 +19,7 @@ export class PlatformPlanGuard implements CanActivate {
     const request = context.switchToHttp().getRequest<Request>();
     const teamId = request.params.teamId as string;
     const orgId = request.params.orgId as string;
-    const user = request.user as GetUserReturnType;
+    const user = request.user as ApiAuthGuardUser;
     const minimumPlan = this.reflector.get(PlatformPlan, context.getHandler()) as PlatformPlanType;
 
     const REDIS_CACHE_KEY = `apiv2:user:${user?.id ?? "none"}:org:${orgId ?? "none"}:team:${

apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts

@@ -1,6 +1,6 @@
 import { ORG_ROLES, TEAM_ROLES, SYSTEM_ADMIN_ROLE } from "@/lib/roles/constants";
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
 import { Roles } from "@/modules/auth/decorators/roles/roles.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { MembershipsRepository } from "@/modules/memberships/memberships.repository";
 import { RedisService } from "@/modules/redis/redis.service";
 import { Injectable, CanActivate, ExecutionContext, ForbiddenException, Logger } from "@nestjs/common";
@@ -22,7 +22,7 @@ export class RolesGuard implements CanActivate {
     const request = context.switchToHttp().getRequest<Request & { team: Team }>();
     const teamId = request.params.teamId as string;
     const orgId = request.params.orgId as string;
-    const user = request.user as GetUserReturnType;
+    const user = request.user as ApiAuthGuardUser;
     const allowedRole = this.reflector.get(Roles, context.getHandler());
     const REDIS_CACHE_KEY = `apiv2:user:${user.id ?? "none"}:org:${orgId ?? "none"}:team:${
       teamId ?? "none"

apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts

@@ -17,6 +17,8 @@ import { getToken } from "next-auth/jwt";
 
 import { INVALID_ACCESS_TOKEN, X_CAL_CLIENT_ID, X_CAL_SECRET_KEY } from "@calcom/platform-constants";
 
+export type ApiAuthGuardUser = UserWithProfile & { isSystemAdmin: boolean };
+
 @Injectable()
 export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth") {
   constructor(
@@ -75,12 +77,19 @@ export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth")
 
   async authenticateNextAuth(token: { email?: string | null }) {
     const user = await this.nextAuthStrategy(token);
-    return this.success(user);
+    return this.success(this.getSuccessUser(user));
+  }
+
+  getSuccessUser(user: UserWithProfile): ApiAuthGuardUser {
+    return {
+      ...user,
+      isSystemAdmin: user.role === "ADMIN",
+    };
   }
 
   async authenticateOAuthClient(oAuthClientId: string, oAuthClientSecret: string) {
     const user = await this.oAuthClientStrategy(oAuthClientId, oAuthClientSecret);
-    return this.success(user);
+    return this.success(this.getSuccessUser(user));
   }
 
   async oAuthClientStrategy(oAuthClientId: string, oAuthClientSecret: string) {
@@ -119,7 +128,7 @@ export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth")
         return this.error(new UnauthorizedException("No user associated with the provided token"));
       }
 
-      return this.success(user);
+      return this.success(this.getSuccessUser(user));
     } catch (err) {
       if (err instanceof Error) {
         return this.error(err);

apps/api/v2/src/modules/oauth-clients/guards/oauth-client-guard.ts

@@ -1,4 +1,4 @@
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { UsersService } from "@/modules/users/services/users.service";
 import {
@@ -15,8 +15,8 @@ export class OAuthClientGuard implements CanActivate {
   constructor(private oAuthClientRepository: OAuthClientRepository, private usersService: UsersService) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    const request = context.switchToHttp().getRequest<Request & { user: GetUserReturnType }>();
-    const user: GetUserReturnType = request.user;
+    const request = context.switchToHttp().getRequest<Request & { user: ApiAuthGuardUser }>();
+    const user: ApiAuthGuardUser = request.user;
     const organizationId = user ? this.usersService.getUserMainOrgId(user) : null;
     const oAuthClientId = request.params.clientId;
 

apps/api/v2/src/modules/webhooks/guards/is-oauth-client-webhook-guard.ts

@@ -1,4 +1,4 @@
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository";
 import { UsersService } from "@/modules/users/services/users.service";
 import { WebhooksService } from "@/modules/webhooks/services/webhooks.service";
@@ -26,7 +26,7 @@ export class IsOAuthClientWebhookGuard implements CanActivate {
     const request = context
       .switchToHttp()
       .getRequest<Request & { webhook: Webhook; oAuthClient: PlatformOAuthClient }>();
-    const user = request.user as GetUserReturnType;
+    const user = request.user as ApiAuthGuardUser;
     const webhookId = request.params.webhookId;
     const oAuthClientId = request.params.clientId;
     const organizationId = this.usersService.getUserMainOrgId(user);

apps/api/v2/src/modules/webhooks/guards/is-user-event-type-webhook-guard.ts

@@ -1,5 +1,5 @@
 import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.repository";
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { WebhooksService } from "@/modules/webhooks/services/webhooks.service";
 import {
   BadRequestException,
@@ -23,7 +23,7 @@ export class IsUserEventTypeWebhookGuard implements CanActivate {
     const request = context
       .switchToHttp()
       .getRequest<Request & { webhook: Webhook } & { eventType: EventType }>();
-    const user = request.user as GetUserReturnType;
+    const user = request.user as ApiAuthGuardUser;
     const webhookId = request.params.webhookId;
     const eventTypeId = request.params.eventTypeId;
 

apps/api/v2/src/modules/webhooks/guards/is-user-webhook-guard.ts

@@ -1,4 +1,4 @@
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { WebhooksService } from "@/modules/webhooks/services/webhooks.service";
 import { CanActivate, ExecutionContext, Injectable } from "@nestjs/common";
 import { Request } from "express";
@@ -11,7 +11,7 @@ export class IsUserWebhookGuard implements CanActivate {
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
     const request = context.switchToHttp().getRequest<Request & { webhook: Webhook }>();
-    const user = request.user as GetUserReturnType;
+    const user = request.user as ApiAuthGuardUser;
     const webhookId = request.params.webhookId;
 
     if (!user || !webhookId) {