vynte-infra/calendar
2
0
Fork 0
Code Issues Pull Requests Actions 2.2k Packages Projects Releases Wiki Activity

feat: initial isAdmin work for events and attendees

Browse Source
This commit is contained in:
Agusti Fernandez Pardo
2022-06-15 20:43:35 +02:00
parent 996ec31b26
commit ed1bc8015a
9 changed files with 69 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/helpers/verifyApiKey.ts
+6
View File
@@ -4,12 +4,15 @@ import { NextMiddleware } from "next-api-middleware";
import { hashAPIKey } from "@calcom/ee/lib/api/apiKeys";
import prisma from "@calcom/prisma";
import { isAdminGuard } from "@lib/utils/isAdmin";
/** @todo figure how to use the one from `@calcom/types`fi */
/** @todo: remove once `@calcom/types` is updated with it.*/
declare module "next" {
export interface NextApiRequest extends IncomingMessage {
userId: number;
method: string;
isAdmin: boolean;
query: { [key: string]: string | string[] };
}
}
@@ -39,5 +42,8 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
if (!apiKey.userId) return res.status(404).json({ error: "No user found for this apiKey" });
/* We save the user id in the request for later use */
req.userId = apiKey.userId;
/* We save the isAdmin boolean here for later use */
req.isAdmin = await isAdminGuard(req.userId);
await next();
};
lib/validations/booking.ts
-1
View File
@@ -24,7 +24,6 @@ export const schemaBookingCreateBodyParams = schemaBookingBaseBodyParams.merge(s
const schemaBookingEditParams = z
.object({
uid: z.string().optional(),
title: z.string().optional(),
startTime: z.date().optional(),
endTime: z.date().optional(),
pages/api/attendees/[id].ts
+6 -4
View File
@@ -11,7 +11,7 @@ import {
} from "@lib/validations/shared/queryIdTransformParseInt";
export async function attendeeById(
{ method, query, body, userId }: NextApiRequest,
{ method, query, body, userId, isAdmin }: NextApiRequest,
res: NextApiResponse<AttendeeResponse>
) {
const safeQuery = schemaQueryIdParseInt.safeParse(query);
@@ -33,9 +33,11 @@ export async function attendeeById(
.flat()
.map((attendee) => attendee.id)
);
// @note: Here we make sure to only return attendee's of the user's own bookings.
if (!userBookingsAttendeeIds.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
else {
// @note: Here we make sure to only return attendee's of the user's own bookings if the user is not an admin.
if (!isAdmin) {
if (!userBookingsAttendeeIds.includes(safeQuery.data.id))
res.status(401).json({ message: "Unauthorized" });
} else {
switch (method) {
/**
* @swagger
pages/api/attendees/index.ts
+52 -27
View File
@@ -1,24 +1,30 @@
import type { NextApiRequest, NextApiResponse } from "next";
import db from "@calcom/prisma";
import prisma from "@calcom/prisma";
import { withMiddleware } from "@lib/helpers/withMiddleware";
import { AttendeeResponse, AttendeesResponse } from "@lib/types";
import { schemaAttendeeCreateBodyParams, schemaAttendeeReadPublic } from "@lib/validations/attendee";
async function createOrlistAllAttendees(
{ method, userId, body }: NextApiRequest,
{ method, userId, body, isAdmin }: NextApiRequest,
res: NextApiResponse<AttendeesResponse | AttendeeResponse>
) {
const userBookings = await db.booking.findMany({
where: {
userId,
},
include: {
attendees: true,
},
});
const attendees = userBookings.map((booking) => booking.attendees).flat();
let attendees;
if (!isAdmin) {
const userBookings = await prisma.booking.findMany({
where: {
userId,
},
include: {
attendees: true,
},
});
attendees = userBookings.map((booking) => booking.attendees).flat();
} else {
const data = await prisma.attendee.findMany();
attendees = data.map((attendee) => schemaAttendeeReadPublic.parse(attendee));
}
if (method === "GET") {
/**
* @swagger
@@ -37,12 +43,7 @@ async function createOrlistAllAttendees(
* description: No attendees were found
*/
if (attendees) res.status(200).json({ attendees });
else
(error: Error) =>
res.status(404).json({
message: "No Attendees were found",
error,
});
else (error: Error) => res.status(400).json({ error });
} else if (method === "POST") {
/**
* @swagger
@@ -90,16 +91,40 @@ async function createOrlistAllAttendees(
res.status(400).json({ message: "Invalid request body", error: safePost.error });
return;
}
const userWithBookings = await db.user.findUnique({ where: { id: userId }, include: { bookings: true } });
if (!userWithBookings) {
res.status(404).json({ message: "User not found" });
return;
}
const userBookingIds = userWithBookings.bookings.map((booking: { id: number }) => booking.id).flat();
// Here we make sure to only return attendee's of the user's own bookings.
if (!userBookingIds.includes(safePost.data.bookingId)) res.status(401).json({ message: "Unauthorized" });
else {
const data = await db.attendee.create({
if (!isAdmin) {
const userWithBookings = await prisma.user.findUnique({
where: { id: userId },
include: { bookings: true },
});
if (!userWithBookings) {
res.status(404).json({ message: "User not found" });
return;
}
const userBookingIds = userWithBookings.bookings.map((booking: { id: number }) => booking.id).flat();
// Here we make sure to only return attendee's of the user's own bookings.
if (!userBookingIds.includes(safePost.data.bookingId))
res.status(401).json({ message: "Unauthorized" });
else {
const data = await prisma.attendee.create({
data: {
email: safePost.data.email,
name: safePost.data.name,
timeZone: safePost.data.timeZone,
booking: { connect: { id: safePost.data.bookingId } },
},
});
const attendee = schemaAttendeeReadPublic.parse(data);
if (attendee) {
res.status(201).json({
attendee,
message: "Attendee created successfully",
});
} else (error: Error) => res.status(400).json({ error });
}
} else {
// @todo: check real availability times before booking
const data = await prisma.attendee.create({
data: {
email: safePost.data.email,
name: safePost.data.name,
pages/api/bookings/index.ts
+1 -1
View File
@@ -12,7 +12,7 @@ import { schemaBookingCreateBodyParams, schemaBookingReadPublic } from "@lib/val
import { schemaEventTypeReadPublic } from "@lib/validations/event-type";
async function createOrlistAllBookings(
{ method, body, userId }: NextApiRequest,
{ method, body, userId, isAdmin }: NextApiRequest,
res: NextApiResponse<BookingsResponse | BookingResponse>
) {
console.log("userIduserId", userId);
pages/api/event-types/[id].ts
+1 -3
View File
@@ -4,7 +4,6 @@ import prisma from "@calcom/prisma";
import { withMiddleware } from "@lib/helpers/withMiddleware";
import type { EventTypeResponse } from "@lib/types";
import { isAdminGuard } from "@lib/utils/isAdmin";
import { schemaEventTypeEditBodyParams, schemaEventTypeReadPublic } from "@lib/validations/event-type";
import {
schemaQueryIdParseInt,
@@ -12,10 +11,9 @@ import {
} from "@lib/validations/shared/queryIdTransformParseInt";
export async function eventTypeById(
{ method, query, body, userId }: NextApiRequest,
{ method, query, body, userId, isAdmin }: NextApiRequest,
res: NextApiResponse<EventTypeResponse>
) {
const isAdmin = await isAdminGuard(userId);
const safeQuery = schemaQueryIdParseInt.safeParse(query);
if (!safeQuery.success) {
res.status(400).json({ message: "Your query was invalid" });
pages/api/event-types/index.ts
+1 -3
View File
@@ -4,14 +4,12 @@ import prisma from "@calcom/prisma";
import { withMiddleware } from "@lib/helpers/withMiddleware";
import { EventTypeResponse, EventTypesResponse } from "@lib/types";
import { isAdminGuard } from "@lib/utils/isAdmin";
import { schemaEventTypeCreateBodyParams, schemaEventTypeReadPublic } from "@lib/validations/event-type";
async function createOrlistAllEventTypes(
{ method, body, userId }: NextApiRequest,
{ method, body, userId, isAdmin }: NextApiRequest,
res: NextApiResponse<EventTypesResponse | EventTypeResponse>
) {
const isAdmin = await isAdminGuard(userId);
if (method === "GET") {
/**
* @swagger
pages/api/users/[id].ts
+1 -3
View File
@@ -4,7 +4,6 @@ import prisma from "@calcom/prisma";
import { withMiddleware } from "@lib/helpers/withMiddleware";
import type { UserResponse } from "@lib/types";
import { isAdminGuard } from "@lib/utils/isAdmin";
import {
schemaQueryIdParseInt,
withValidQueryIdTransformParseInt,
@@ -12,7 +11,7 @@ import {
import { schemaUserEditBodyParams, schemaUserReadPublic } from "@lib/validations/user";
export async function userById(
{ method, query, body, userId }: NextApiRequest,
{ method, query, body, userId, isAdmin }: NextApiRequest,
res: NextApiResponse<UserResponse>
) {
const safeQuery = schemaQueryIdParseInt.safeParse(query);
@@ -21,7 +20,6 @@ export async function userById(
res.status(400).json({ message: "Your query was invalid" });
return;
}
const isAdmin = await isAdminGuard(userId);
// Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user
if (!isAdmin) {
if (safeQuery.data.id !== userId) res.status(401).json({ message: "Unauthorized" });
pages/api/users/index.ts
+1 -3
View File
@@ -4,7 +4,6 @@ import prisma from "@calcom/prisma";
import { withMiddleware } from "@lib/helpers/withMiddleware";
import { UserResponse, UsersResponse } from "@lib/types";
import { isAdminGuard } from "@lib/utils/isAdmin";
import { schemaUserReadPublic, schemaUserCreateBodyParams } from "@lib/validations/user";
/**
@@ -24,10 +23,9 @@ import { schemaUserReadPublic, schemaUserCreateBodyParams } from "@lib/validatio
* description: No users were found
*/
async function getAllorCreateUser(
{ userId, method, body }: NextApiRequest,
{ userId, method, body, isAdmin }: NextApiRequest,
res: NextApiResponse<UsersResponse | UserResponse>
) {
const isAdmin = await isAdminGuard(userId);
if (method === "GET") {
if (!isAdmin) {
// If user is not ADMIN, return only his data.