fix: v2 isSystemAdmin (#18162)

* refactor: ApiAuthStrategy return isSystemAdmin and define returned type

* refactor: use ApiAuthGuardUser instead of GetUserReturnType

* regenerate docs

apps/api/v2/src/modules/auth/decorators/get-user/get-user.decorator.ts

@@ -1,22 +1,18 @@
-import { UserWithProfile } from "@/modules/users/users.repository";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { ExecutionContext } from "@nestjs/common";
 import { createParamDecorator } from "@nestjs/common";
 
-export type GetUserReturnType = UserWithProfile & { isSystemAdmin: boolean };
-
 export const GetUser = createParamDecorator<
-  keyof GetUserReturnType | (keyof GetUserReturnType)[],
+  keyof ApiAuthGuardUser | (keyof ApiAuthGuardUser)[],
   ExecutionContext
 >((data, ctx) => {
   const request = ctx.switchToHttp().getRequest();
-  const user = request.user as GetUserReturnType;
+  const user = request.user as ApiAuthGuardUser;
 
   if (!user) {
     throw new Error("GetUser decorator : User not found");
   }
 
-  user.isSystemAdmin = user.role === "ADMIN";
-
   if (Array.isArray(data)) {
     return data.reduce((prev, curr) => {
       return {

apps/api/v2/src/modules/auth/guards/billing/platform-plan.guard.ts

@@ -1,5 +1,5 @@
 import { PlatformPlan } from "@/modules/auth/decorators/billing/platform-plan.decorator";
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { PlatformPlanType } from "@/modules/billing/types";
 import { OrganizationsRepository } from "@/modules/organizations/organizations.repository";
 import { RedisService } from "@/modules/redis/redis.service";
@@ -19,7 +19,7 @@ export class PlatformPlanGuard implements CanActivate {
     const request = context.switchToHttp().getRequest<Request>();
     const teamId = request.params.teamId as string;
     const orgId = request.params.orgId as string;
-    const user = request.user as GetUserReturnType;
+    const user = request.user as ApiAuthGuardUser;
     const minimumPlan = this.reflector.get(PlatformPlan, context.getHandler()) as PlatformPlanType;
 
     const REDIS_CACHE_KEY = `apiv2:user:${user?.id ?? "none"}:org:${orgId ?? "none"}:team:${

apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts

@@ -1,6 +1,6 @@
 import { ORG_ROLES, TEAM_ROLES, SYSTEM_ADMIN_ROLE } from "@/lib/roles/constants";
-import { GetUserReturnType } from "@/modules/auth/decorators/get-user/get-user.decorator";
 import { Roles } from "@/modules/auth/decorators/roles/roles.decorator";
+import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.strategy";
 import { MembershipsRepository } from "@/modules/memberships/memberships.repository";
 import { RedisService } from "@/modules/redis/redis.service";
 import { Injectable, CanActivate, ExecutionContext, ForbiddenException, Logger } from "@nestjs/common";
@@ -22,7 +22,7 @@ export class RolesGuard implements CanActivate {
     const request = context.switchToHttp().getRequest<Request & { team: Team }>();
     const teamId = request.params.teamId as string;
     const orgId = request.params.orgId as string;
-    const user = request.user as GetUserReturnType;
+    const user = request.user as ApiAuthGuardUser;
     const allowedRole = this.reflector.get(Roles, context.getHandler());
     const REDIS_CACHE_KEY = `apiv2:user:${user.id ?? "none"}:org:${orgId ?? "none"}:team:${
       teamId ?? "none"

apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts

@@ -17,6 +17,8 @@ import { getToken } from "next-auth/jwt";
 
 import { INVALID_ACCESS_TOKEN, X_CAL_CLIENT_ID, X_CAL_SECRET_KEY } from "@calcom/platform-constants";
 
+export type ApiAuthGuardUser = UserWithProfile & { isSystemAdmin: boolean };
+
 @Injectable()
 export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth") {
   constructor(
@@ -75,12 +77,19 @@ export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth")
 
   async authenticateNextAuth(token: { email?: string | null }) {
     const user = await this.nextAuthStrategy(token);
-    return this.success(user);
+    return this.success(this.getSuccessUser(user));
+  }
+
+  getSuccessUser(user: UserWithProfile): ApiAuthGuardUser {
+    return {
+      ...user,
+      isSystemAdmin: user.role === "ADMIN",
+    };
   }
 
   async authenticateOAuthClient(oAuthClientId: string, oAuthClientSecret: string) {
     const user = await this.oAuthClientStrategy(oAuthClientId, oAuthClientSecret);
-    return this.success(user);
+    return this.success(this.getSuccessUser(user));
   }
 
   async oAuthClientStrategy(oAuthClientId: string, oAuthClientSecret: string) {
@@ -119,7 +128,7 @@ export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth")
         return this.error(new UnauthorizedException("No user associated with the provided token"));
       }
 
-      return this.success(user);
+      return this.success(this.getSuccessUser(user));
     } catch (err) {
       if (err instanceof Error) {
         return this.error(err);