diff --git a/apps/api/v2/src/modules/auth/decorators/get-user/get-user.decorator.ts b/apps/api/v2/src/modules/auth/decorators/get-user/get-user.decorator.ts index ebdd75e395..b8bc554dab 100644 --- a/apps/api/v2/src/modules/auth/decorators/get-user/get-user.decorator.ts +++ b/apps/api/v2/src/modules/auth/decorators/get-user/get-user.decorator.ts @@ -1,22 +1,18 @@ -import { UserWithProfile } from "@/modules/users/users.repository"; +import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy"; import { ExecutionContext } from "@nestjs/common"; import { createParamDecorator } from "@nestjs/common"; -export type GetUserReturnType = UserWithProfile & { isSystemAdmin: boolean }; - export const GetUser = createParamDecorator< - keyof GetUserReturnType | (keyof GetUserReturnType)[], + keyof ApiAuthGuardUser | (keyof ApiAuthGuardUser)[], ExecutionContext >((data, ctx) => { const request = ctx.switchToHttp().getRequest(); - const user = request.user as GetUserReturnType; + const user = request.user as ApiAuthGuardUser; if (!user) { throw new Error("GetUser decorator : User not found"); } - user.isSystemAdmin = user.role === "ADMIN"; - if (Array.isArray(data)) { return data.reduce((prev, curr) => { return { diff --git a/apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.ts b/apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.ts index 0752b6c945..7974a65e55 100644 --- a/apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.ts +++ b/apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.ts @@ -1,5 +1,5 @@ import { PlatformPlan } from "@/modules/auth/decorators/billing/platform-plan.decorator"; -import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator"; +import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy"; import { PlatformPlanType } from "@/modules/billing/types"; import { OrganizationsRepository } from "@/modules/organizations/organizations.repository"; import { RedisService } from "@/modules/redis/redis.service"; @@ -19,7 +19,7 @@ export class PlatformPlanGuard implements CanActivate { const request = context.switchToHttp().getRequest(); const teamId = request.params.teamId as string; const orgId = request.params.orgId as string; - const user = request.user as GetUserReturnType; + const user = request.user as ApiAuthGuardUser; const minimumPlan = this.reflector.get(PlatformPlan, context.getHandler()) as PlatformPlanType; const REDIS_CACHE_KEY = `apiv2:user:${user?.id ?? "none"}:org:${orgId ?? "none"}:team:${ diff --git a/apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts b/apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts index 4cf1c91a58..8756281ff9 100644 --- a/apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts +++ b/apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts @@ -1,6 +1,6 @@ import { ORG_ROLES, TEAM_ROLES, SYSTEM_ADMIN_ROLE } from "@/lib/roles/constants"; -import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator"; import { Roles } from "@/modules/auth/decorators/roles/roles.decorator"; +import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy"; import { MembershipsRepository } from "@/modules/memberships/memberships.repository"; import { RedisService } from "@/modules/redis/redis.service"; import { Injectable, CanActivate, ExecutionContext, ForbiddenException, Logger } from "@nestjs/common"; @@ -22,7 +22,7 @@ export class RolesGuard implements CanActivate { const request = context.switchToHttp().getRequest(); const teamId = request.params.teamId as string; const orgId = request.params.orgId as string; - const user = request.user as GetUserReturnType; + const user = request.user as ApiAuthGuardUser; const allowedRole = this.reflector.get(Roles, context.getHandler()); const REDIS_CACHE_KEY = `apiv2:user:${user.id ?? "none"}:org:${orgId ?? "none"}:team:${ teamId ?? "none" diff --git a/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts b/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts index 44d165cae2..35c6f80ed6 100644 --- a/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts +++ b/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts @@ -17,6 +17,8 @@ import { getToken } from "next-auth/jwt"; import { INVALID_ACCESS_TOKEN, X_CAL_CLIENT_ID, X_CAL_SECRET_KEY } from "@calcom/platform-constants"; +export type ApiAuthGuardUser = UserWithProfile & { isSystemAdmin: boolean }; + @Injectable() export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth") { constructor( @@ -75,12 +77,19 @@ export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth") async authenticateNextAuth(token: { email?: string | null }) { const user = await this.nextAuthStrategy(token); - return this.success(user); + return this.success(this.getSuccessUser(user)); + } + + getSuccessUser(user: UserWithProfile): ApiAuthGuardUser { + return { + ...user, + isSystemAdmin: user.role === "ADMIN", + }; } async authenticateOAuthClient(oAuthClientId: string, oAuthClientSecret: string) { const user = await this.oAuthClientStrategy(oAuthClientId, oAuthClientSecret); - return this.success(user); + return this.success(this.getSuccessUser(user)); } async oAuthClientStrategy(oAuthClientId: string, oAuthClientSecret: string) { @@ -119,7 +128,7 @@ export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth") return this.error(new UnauthorizedException("No user associated with the provided token")); } - return this.success(user); + return this.success(this.getSuccessUser(user)); } catch (err) { if (err instanceof Error) { return this.error(err); diff --git a/apps/api/v2/src/modules/oauth-clients/guards/oauth-client-guard.ts b/apps/api/v2/src/modules/oauth-clients/guards/oauth-client-guard.ts index bcc94627c4..b06eaad2fb 100644 --- a/apps/api/v2/src/modules/oauth-clients/guards/oauth-client-guard.ts +++ b/apps/api/v2/src/modules/oauth-clients/guards/oauth-client-guard.ts @@ -1,4 +1,4 @@ -import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator"; +import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy"; import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository"; import { UsersService } from "@/modules/users/services/users.service"; import { @@ -15,8 +15,8 @@ export class OAuthClientGuard implements CanActivate { constructor(private oAuthClientRepository: OAuthClientRepository, private usersService: UsersService) {} async canActivate(context: ExecutionContext): Promise { - const request = context.switchToHttp().getRequest(); - const user: GetUserReturnType = request.user; + const request = context.switchToHttp().getRequest(); + const user: ApiAuthGuardUser = request.user; const organizationId = user ? this.usersService.getUserMainOrgId(user) : null; const oAuthClientId = request.params.clientId; diff --git a/apps/api/v2/src/modules/webhooks/guards/is-oauth-client-webhook-guard.ts b/apps/api/v2/src/modules/webhooks/guards/is-oauth-client-webhook-guard.ts index 543f4fef25..ae4cd803e0 100644 --- a/apps/api/v2/src/modules/webhooks/guards/is-oauth-client-webhook-guard.ts +++ b/apps/api/v2/src/modules/webhooks/guards/is-oauth-client-webhook-guard.ts @@ -1,4 +1,4 @@ -import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator"; +import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy"; import { OAuthClientRepository } from "@/modules/oauth-clients/oauth-client.repository"; import { UsersService } from "@/modules/users/services/users.service"; import { WebhooksService } from "@/modules/webhooks/services/webhooks.service"; @@ -26,7 +26,7 @@ export class IsOAuthClientWebhookGuard implements CanActivate { const request = context .switchToHttp() .getRequest(); - const user = request.user as GetUserReturnType; + const user = request.user as ApiAuthGuardUser; const webhookId = request.params.webhookId; const oAuthClientId = request.params.clientId; const organizationId = this.usersService.getUserMainOrgId(user); diff --git a/apps/api/v2/src/modules/webhooks/guards/is-user-event-type-webhook-guard.ts b/apps/api/v2/src/modules/webhooks/guards/is-user-event-type-webhook-guard.ts index a69c6d5fe8..2ff90ea6ac 100644 --- a/apps/api/v2/src/modules/webhooks/guards/is-user-event-type-webhook-guard.ts +++ b/apps/api/v2/src/modules/webhooks/guards/is-user-event-type-webhook-guard.ts @@ -1,5 +1,5 @@ import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.repository"; -import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator"; +import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy"; import { WebhooksService } from "@/modules/webhooks/services/webhooks.service"; import { BadRequestException, @@ -23,7 +23,7 @@ export class IsUserEventTypeWebhookGuard implements CanActivate { const request = context .switchToHttp() .getRequest(); - const user = request.user as GetUserReturnType; + const user = request.user as ApiAuthGuardUser; const webhookId = request.params.webhookId; const eventTypeId = request.params.eventTypeId; diff --git a/apps/api/v2/src/modules/webhooks/guards/is-user-webhook-guard.ts b/apps/api/v2/src/modules/webhooks/guards/is-user-webhook-guard.ts index 857732aa9e..95cc4ea6ee 100644 --- a/apps/api/v2/src/modules/webhooks/guards/is-user-webhook-guard.ts +++ b/apps/api/v2/src/modules/webhooks/guards/is-user-webhook-guard.ts @@ -1,4 +1,4 @@ -import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator"; +import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy"; import { WebhooksService } from "@/modules/webhooks/services/webhooks.service"; import { CanActivate, ExecutionContext, Injectable } from "@nestjs/common"; import { Request } from "express"; @@ -11,7 +11,7 @@ export class IsUserWebhookGuard implements CanActivate { async canActivate(context: ExecutionContext): Promise { const request = context.switchToHttp().getRequest(); - const user = request.user as GetUserReturnType; + const user = request.user as ApiAuthGuardUser; const webhookId = request.params.webhookId; if (!user || !webhookId) {