feat: selected calendars hardened

README.md

@@ -146,7 +146,6 @@ tests/endpoint/resource.new.test.ts - Create new resource
 - memberships
 - reminder-mails
 - schedules
-- selected-calendars
 
 ## Models from database that are not exposed
 

pages/api/selected-calendars/[id].ts

@@ -4,6 +4,7 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import type { SelectedCalendarResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import {
   schemaSelectedCalendarBodyParams,
   schemaSelectedCalendarPublic,
@@ -130,72 +131,85 @@ export async function selectedCalendarById(
   const safeBody = schemaSelectedCalendarBodyParams.safeParse(body);
   if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
   // This is how we set the userId and externalId in the query for managing compoundId.
-  const [userId, integration, externalId] = safeQuery.data.id.split("_");
-
-  switch (method) {
-    case "GET":
-      await prisma.selectedCalendar
-        .findUnique({
-          where: {
-            userId_integration_externalId: {
-              userId: parseInt(userId),
-              integration: integration,
-              externalId: externalId,
+  const [paramUserId, integration, externalId] = safeQuery.data.id.split("_");
+  const userId = getCalcomUserId(res);
+  if (userId === parseInt(paramUserId)) {
+    switch (method) {
+      case "GET":
+        await prisma.selectedCalendar
+          .findUnique({
+            where: {
+              userId_integration_externalId: {
+                userId: userId,
+                integration: integration,
+                externalId: externalId,
+              },
             },
-          },
-        })
-        .then((selectedCalendar) => schemaSelectedCalendarPublic.parse(selectedCalendar))
-        .then((selected_calendar) => res.status(200).json({ selected_calendar }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `SelectedCalendar with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+          })
+          .then((selectedCalendar) => schemaSelectedCalendarPublic.parse(selectedCalendar))
+          .then((selected_calendar) => res.status(200).json({ selected_calendar }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `SelectedCalendar with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "PATCH":
-      if (!safeBody.success) throw new Error("Invalid request body");
-      await prisma.selectedCalendar
-        .update({
-          where: {
-            userId_integration_externalId: {
-              userId: parseInt(userId),
-              integration: integration,
-              externalId: externalId,
+      case "PATCH":
+        if (!safeBody.success) {
+          throw new Error("Invalid request body");
+        }
+        await prisma.selectedCalendar
+          .update({
+            where: {
+              userId_integration_externalId: {
+                userId: userId,
+                integration: integration,
+                externalId: externalId,
+              },
             },
-          },
-          data: safeBody.data,
-        })
-        .then((selectedCalendar) => schemaSelectedCalendarPublic.parse(selectedCalendar))
-        .then((selected_calendar) => res.status(200).json({ selected_calendar }))
-        .catch((error: Error) =>
-          res.status(404).json({ message: `SelectedCalendar with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+            data: safeBody.data,
+          })
+          .then((selectedCalendar) => schemaSelectedCalendarPublic.parse(selectedCalendar))
+          .then((selected_calendar) => res.status(200).json({ selected_calendar }))
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `SelectedCalendar with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    case "DELETE":
-      await prisma.selectedCalendar
-        .delete({
-          where: {
-            userId_integration_externalId: {
-              userId: parseInt(userId),
-              integration: integration,
-              externalId: externalId,
+      case "DELETE":
+        await prisma.selectedCalendar
+          .delete({
+            where: {
+              userId_integration_externalId: {
+                userId: userId,
+                integration: integration,
+                externalId: externalId,
+              },
             },
-          },
-        })
-        .then(() =>
-          res
-            .status(200)
-            .json({ message: `SelectedCalendar with id: ${safeQuery.data.id} deleted successfully` })
-        )
-        .catch((error: Error) =>
-          res.status(404).json({ message: `SelectedCalendar with id: ${safeQuery.data.id} not found`, error })
-        );
-      break;
+          })
+          .then(() =>
+            res.status(200).json({
+              message: `SelectedCalendar with id: ${safeQuery.data.id} deleted successfully`,
+            })
+          )
+          .catch((error: Error) =>
+            res.status(404).json({
+              message: `SelectedCalendar with id: ${safeQuery.data.id} not found`,
+              error,
+            })
+          );
+        break;
 
-    default:
-      res.status(405).json({ message: "Method not allowed" });
-      break;
-  }
+      default:
+        res.status(405).json({ message: "Method not allowed" });
+        break;
+    }
+  } else res.status(401).json({ message: "Unauthorized" });
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdString(selectedCalendarById));

pages/api/selected-calendars/index.ts

@@ -4,10 +4,10 @@ import prisma from "@calcom/prisma";
 
 import { withMiddleware } from "@lib/helpers/withMiddleware";
 import { SelectedCalendarResponse, SelectedCalendarsResponse } from "@lib/types";
+import { getCalcomUserId } from "@lib/utils/getCalcomUserId";
 import {
   schemaSelectedCalendarBodyParams,
   schemaSelectedCalendarPublic,
-  withValidSelectedCalendar,
 } from "@lib/validations/selected-calendar";
 
 /**
@@ -46,8 +46,10 @@ async function createOrlistAllSelectedCalendars(
   res: NextApiResponse<SelectedCalendarsResponse | SelectedCalendarResponse>
 ) {
   const { method } = req;
+  const userId = getCalcomUserId(res);
+
   if (method === "GET") {
-    const data = await prisma.selectedCalendar.findMany();
+    const data = await prisma.selectedCalendar.findMany({ where: { userId } });
     const selected_calendars = data.map((selected_calendar) =>
       schemaSelectedCalendarPublic.parse(selected_calendar)
     );
@@ -61,8 +63,10 @@ async function createOrlistAllSelectedCalendars(
   } else if (method === "POST") {
     const safe = schemaSelectedCalendarBodyParams.safeParse(req.body);
     if (!safe.success) throw new Error("Invalid request body");
-
-    const data = await prisma.selectedCalendar.create({ data: safe.data });
+    // Create new selectedCalendar connecting it to current userId
+    const data = await prisma.selectedCalendar.create({
+      data: { ...safe.data, user: { connect: { id: userId } } },
+    });
     const selected_calendar = schemaSelectedCalendarPublic.parse(data);
 
     if (selected_calendar)
@@ -76,6 +80,4 @@ async function createOrlistAllSelectedCalendars(
   } else res.status(405).json({ message: `Method ${method} not allowed` });
 }
 
-export default withMiddleware("HTTP_GET_OR_POST")(
-  withValidSelectedCalendar(createOrlistAllSelectedCalendars)
-);
+export default withMiddleware("HTTP_GET_OR_POST")(createOrlistAllSelectedCalendars);