From 74936a3abe367948adc6eec42de4e44ca0d9b280 Mon Sep 17 00:00:00 2001
From: Pedro Castro <pedro@cal.com>
Date: Tue, 14 Apr 2026 08:48:47 -0300
Subject: [PATCH] fix: align reassignment query handlers with existing access
 check pattern (#28876)

---
 .../getManagedEventUsersToReassign.handler.ts       | 13 +++++++++++++
 .../getRoundRobinHostsToReasign.handler.ts          | 13 +++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/packages/trpc/server/routers/viewer/teams/managedEvents/getManagedEventUsersToReassign.handler.ts b/packages/trpc/server/routers/viewer/teams/managedEvents/getManagedEventUsersToReassign.handler.ts
index bc5c60696e..7ccfeeb3f8 100644
--- a/packages/trpc/server/routers/viewer/teams/managedEvents/getManagedEventUsersToReassign.handler.ts
+++ b/packages/trpc/server/routers/viewer/teams/managedEvents/getManagedEventUsersToReassign.handler.ts
@@ -4,6 +4,7 @@ import { ensureAvailableUsers } from "@calcom/features/bookings/lib/handleNewBoo
 import { getEventTypesFromDB } from "@calcom/features/bookings/lib/handleNewBooking/getEventTypesFromDB";
 import type { IsFixedAwareUser } from "@calcom/features/bookings/lib/handleNewBooking/types";
 import { BookingRepository } from "@calcom/features/bookings/repositories/BookingRepository";
+import { getBookingAccessService } from "@calcom/features/di/containers/BookingAccessService";
 import { EventTypeRepository } from "@calcom/features/eventtypes/repositories/eventTypeRepository";
 import { withSelectedCalendars } from "@calcom/features/users/repositories/UserRepository";
 import { ErrorCode } from "@calcom/lib/errorCodes";
@@ -12,6 +13,8 @@ import type { PrismaClient } from "@calcom/prisma";
 
 import type { TrpcSessionUser } from "@calcom/trpc/server/types";
 
+import { TRPCError } from "@trpc/server";
+
 import type { TGetManagedEventUsersToReassignInputSchema } from "./getManagedEventUsersToReassign.schema";
 
 type GetManagedEventUsersToReassignOptions = {
@@ -74,6 +77,16 @@ export const getManagedEventUsersToReassign = async ({
     prefix: ["gettingManagedEventUsersToReassign", `${bookingId}`],
   });
 
+  const bookingAccessService = getBookingAccessService();
+  const isAllowed = await bookingAccessService.doesUserIdHaveAccessToBooking({
+    userId: user.id,
+    bookingId,
+  });
+
+  if (!isAllowed) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "You do not have permission" });
+  }
+
   const bookingRepository = new BookingRepository(prisma);
   const eventTypeRepository = new EventTypeRepository(prisma);
 
diff --git a/packages/trpc/server/routers/viewer/teams/roundRobin/getRoundRobinHostsToReasign.handler.ts b/packages/trpc/server/routers/viewer/teams/roundRobin/getRoundRobinHostsToReasign.handler.ts
index 72ee49149f..f72173c25c 100644
--- a/packages/trpc/server/routers/viewer/teams/roundRobin/getRoundRobinHostsToReasign.handler.ts
+++ b/packages/trpc/server/routers/viewer/teams/roundRobin/getRoundRobinHostsToReasign.handler.ts
@@ -2,6 +2,7 @@ import { enrichUsersWithDelegationCredentials } from "@calcom/app-store/delegati
 import dayjs from "@calcom/dayjs";
 import { ensureAvailableUsers } from "@calcom/features/bookings/lib/handleNewBooking/ensureAvailableUsers";
 import type { IsFixedAwareUser } from "@calcom/features/bookings/lib/handleNewBooking/types";
+import { getBookingAccessService } from "@calcom/features/di/containers/BookingAccessService";
 import { withSelectedCalendars } from "@calcom/features/users/repositories/UserRepository";
 import { ErrorCode } from "@calcom/lib/errorCodes";
 import logger from "@calcom/lib/logger";
@@ -10,6 +11,8 @@ import { userSelect } from "@calcom/prisma";
 import { credentialForCalendarServiceSelect } from "@calcom/prisma/selects/credential";
 import type { TrpcSessionUser } from "@calcom/trpc/server/types";
 
+import { TRPCError } from "@trpc/server";
+
 import type { TGetRoundRobinHostsToReassignInputSchema } from "./getRoundRobinHostsToReasign.schema";
 
 type GetRoundRobinHostsToReassignOptions = {
@@ -111,6 +114,16 @@ export const getRoundRobinHostsToReassign = async ({ ctx, input }: GetRoundRobin
     prefix: ["gettingRoundRobinHostsToReassign", `${bookingId}`],
   });
 
+  const bookingAccessService = getBookingAccessService();
+  const isAllowed = await bookingAccessService.doesUserIdHaveAccessToBooking({
+    userId: user.id,
+    bookingId,
+  });
+
+  if (!isAllowed) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "You do not have permission" });
+  }
+
   const booking = await prisma.booking.findUniqueOrThrow({
     where: { id: bookingId },
     select: {