feat: usage base billed - license key check - move to private api (#15222)

Co-authored-by: Omar López <zomars@me.com>

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -1,7 +1,7 @@
 import type { NextMiddleware } from "next-api-middleware";
 
+import LicenseKeyService from "@calcom/ee/common/server/LicenseKeyService";
 import { hashAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
-import checkLicense from "@calcom/features/ee/common/server/checkLicense";
 import { IS_PRODUCTION } from "@calcom/lib/constants";
 import prisma from "@calcom/prisma";
 
@@ -18,9 +18,12 @@ export const dateNotInPast = function (date: Date) {
 
 // This verifies the apiKey and sets the user if it is valid.
 export const verifyApiKey: NextMiddleware = async (req, res, next) => {
-  const hasValidLicense = await checkLicense(prisma);
-  if (!hasValidLicense && IS_PRODUCTION)
+  const licenseKeyService = await LicenseKeyService.create();
+  const hasValidLicense = await licenseKeyService.checkLicense();
+
+  if (!hasValidLicense && IS_PRODUCTION) {
     return res.status(401).json({ error: "Invalid or missing CALCOM_LICENSE_KEY environment variable" });
+  }
   // Check if the apiKey query param is provided.
   if (!req.query.apiKey) return res.status(401).json({ message: "No apiKey provided" });
   // remove the prefix from the user provided api_key. If no env set default to "cal_"

apps/api/v1/test/lib/middleware/verifyApiKey.test.ts

@@ -3,9 +3,9 @@ import prismaMock from "../../../../../../tests/libs/__mocks__/prismaMock";
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { createMocks } from "node-mocks-http";
-import { describe, vi, it, expect, afterEach } from "vitest";
+import { describe, vi, it, expect, afterEach, beforeEach } from "vitest";
 
-import checkLicense from "@calcom/features/ee/common/server/checkLicense";
+import LicenseKeyService from "@calcom/ee/common/server/LicenseKeyService";
 import prisma from "@calcom/prisma";
 
 import { isAdminGuard } from "~/lib/utils/isAdmin";
@@ -20,20 +20,21 @@ afterEach(() => {
   vi.resetAllMocks();
 });
 
-vi.mock("@calcom/features/ee/common/server/checkLicense", () => {
-  return {
-    default: vi.fn(),
-  };
-});
-
-vi.mock("~/lib/utils/isAdmin", () => {
-  return {
-    isAdminGuard: vi.fn(),
-  };
-});
+vi.mock("@calcom/prisma");
+vi.mock("~/lib/utils/isAdmin", () => ({
+  isAdminGuard: vi.fn(),
+}));
 
 describe("Verify API key", () => {
-  it("It should throw an error if the api key is not valid", async () => {
+  let service: LicenseKeyService;
+
+  beforeEach(async () => {
+    service = await LicenseKeyService.create();
+
+    vi.spyOn(service, "checkLicense");
+  });
+
+  it("should throw an error if the api key is not valid", async () => {
     const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
       method: "POST",
       body: {},
@@ -43,7 +44,7 @@ describe("Verify API key", () => {
       fn: verifyApiKey,
     };
 
-    vi.mocked(checkLicense).mockResolvedValue(false);
+    vi.mocked(service.checkLicense).mockResolvedValue(false);
     vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: false, scope: null });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
@@ -53,9 +54,11 @@ describe("Verify API key", () => {
     await middleware.fn(req, res, serverNext);
 
     expect(middlewareSpy).toBeCalled();
+
     expect(res.statusCode).toBe(401);
   });
-  it("It should throw an error if no api key is provided", async () => {
+
+  it("should throw an error if no api key is provided", async () => {
     const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
       method: "POST",
       body: {},
@@ -65,7 +68,7 @@ describe("Verify API key", () => {
       fn: verifyApiKey,
     };
 
-    vi.mocked(checkLicense).mockResolvedValue(true);
+    vi.mocked(service.checkLicense).mockResolvedValue(true);
     vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: false, scope: null });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
@@ -75,10 +78,11 @@ describe("Verify API key", () => {
     await middleware.fn(req, res, serverNext);
 
     expect(middlewareSpy).toBeCalled();
+
     expect(res.statusCode).toBe(401);
   });
 
-  it("It should set correct permissions for system-wide admin", async () => {
+  it("should set correct permissions for system-wide admin", async () => {
     const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
       method: "POST",
       body: {},
@@ -97,7 +101,7 @@ describe("Verify API key", () => {
       fn: verifyApiKey,
     };
 
-    vi.mocked(checkLicense).mockResolvedValue(true);
+    vi.mocked(service.checkLicense).mockResolvedValue(true);
     vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: true, scope: ScopeOfAdmin.SystemWide });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
@@ -107,11 +111,12 @@ describe("Verify API key", () => {
     await middleware.fn(req, res, serverNext);
 
     expect(middlewareSpy).toBeCalled();
+
     expect(req.isSystemWideAdmin).toBe(true);
     expect(req.isOrganizationOwnerOrAdmin).toBe(false);
   });
 
-  it("It should set correct permissions for org-level admin", async () => {
+  it("should set correct permissions for org-level admin", async () => {
     const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
       method: "POST",
       body: {},
@@ -130,7 +135,7 @@ describe("Verify API key", () => {
       fn: verifyApiKey,
     };
 
-    vi.mocked(checkLicense).mockResolvedValue(true);
+    vi.mocked(service.checkLicense).mockResolvedValue(true);
     vi.mocked(isAdminGuard).mockResolvedValue({ isAdmin: true, scope: ScopeOfAdmin.OrgOwnerOrAdmin });
 
     const serverNext = vi.fn((next: void) => Promise.resolve(next));
@@ -140,6 +145,7 @@ describe("Verify API key", () => {
     await middleware.fn(req, res, serverNext);
 
     expect(middlewareSpy).toBeCalled();
+
     expect(req.isSystemWideAdmin).toBe(false);
     expect(req.isOrganizationOwnerOrAdmin).toBe(true);
   });