* Make and instance method
* Refactor files
* fix: update MembershipRepository mocks to use vi.hoisted() for proper hoisting
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Joe Au-YeungGitHubjoe@cal.com <j.auyeung419@gmail.com>joe@cal.com <j.auyeung419@gmail.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: use highest role for org admins accessing sub team event types
When an org admin who is also a member of a sub team (but only as MEMBER role) tries to update a sub team event type, they were being denied access. This was because the permission check logic was using the team MEMBER role instead of checking both team and org roles and using the highest one.
This fix updates PermissionCheckService.checkPermission() and checkPermissions() to use the highest role between team membership and org membership, similar to how getEventTypePermissions() already works.
Changes:
- Added getHighestRole() helper method to determine the highest role between two roles
- Updated checkPermission() to check both team and org membership and use the highest role
- Updated checkPermissions() to use the same logic
- Added test case for org admin who is team member updating sub team event type
Fixes the issue where org admins get 'permission required eventType.update' errors when updating sub team event types.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
* test: add PBAC-enabled test case for org admin accessing sub team event types
Adds a test case to verify that when PBAC is enabled, org admins who are also members of a sub team (but only with MEMBER role) can still access sub team event types through their org-level ADMIN permissions.
This complements the existing fallback (PBAC disabled) test case and ensures both code paths handle org admin permissions correctly.
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* New permission function
* Update permission check service to have fall backs
Update event type create permission procedure to also have org heigharchy
* Update get eventType handler to use new procedure
* Type check
* Type fix
* Update packages/features/pbac/lib/event-type-permissions.ts
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Fix type errorr
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* feat: add fallbackRoles parameter to getTeamIdsWithPermissions method
- Add fallbackRoles parameter to method signature in interface and implementation
- Implement second query for teams without PBAC where user has fallback roles
- Combine and deduplicate results from both PBAC-enabled and fallback role teams
- Supports fallback to role-based permissions when PBAC is disabled
- Fix linting issue in getUserMemberships method by replacing include with select
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix usages
* revert some change
* fix unit tests
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: always check team.parentID even if no membership
* refactor permission handling in create event type handler
* remove hasMembership
---------
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* chore: Upgrade prisma to 6.7.0
* Build fixes
* type fixes
Signed-off-by: Omar López <zomars@me.com>
* Update schema.prisma
* Patching
* Revert "Update schema.prisma"
This reverts commit 47d8618bf89ef4d007b30084df766f17281e21a1.
* Revert "Patching"
This reverts commit a1d2e3040e71690a44d4324db95d73b4d68c6adb.
* Revert schema changes
Signed-off-by: Omar López <zomars@me.com>
* WIP
Signed-off-by: Omar López <zomars@me.com>
* Update getPublicEvent.ts
* Update imports
Signed-off-by: Omar López <zomars@me.com>
* Update gitignore
Signed-off-by: Omar López <zomars@me.com>
* update remaining imports
Signed-off-by: Omar López <zomars@me.com>
* Delete .cursor/config.json
* Discard changes to packages/features/eventtypes/lib/getPublicEvent.ts
* Update _get.ts
* Update user.ts
* Update .gitignore
* update
* Update WorkflowStepContainer.tsx
* Update next-auth-custom-adapter.ts
* Update getPublicEvent.ts
* Update workflow.ts
* Update next-auth-custom-adapter.ts
* Update next-auth-options.ts
* Update bookingScenario.ts
* fix missing imports
* upgrades prismock
Signed-off-by: Omar López <zomars@me.com>
* patches prismock
Signed-off-by: Omar López <zomars@me.com>
* Update reschedule.test.ts
* Update prisma.ts
* patch prismock
Signed-off-by: Omar López <zomars@me.com>
* fix enums imports
Signed-off-by: Omar López <zomars@me.com>
* Revert "Update prisma.ts"
This reverts commit 64edcf8db54171ff4456c209d563b5d431d99619.
* Revert "patch prismock"
This reverts commit e95819113dc9d88e7130947aa120cd42710977c8.
* fix patch
* Fix test that overrun the boundary, it shouldn't test too much
* Move prisma import to changeSMSLockState
* Bring back broken test without illegal imports
* Merge with main and fix filter hosts by same round robin host
* Fixed buildDryRunBooking fn tests
* Fix and move ooo create or update handler test
* Fix packages/features/eventtypes/lib/isCurrentlyAvailable.test.ts
* Fix packages/trpc/server/routers/viewer/organizations/listMembers.handler.test.ts
* Mock @calcom/prisma
* Fix: verify-email.test.ts
* fix: Moved WebhookService test and fixed default import mock
* Fix: Added missing prisma mock, handleNewBooking uses that of course
* We're not testing createContext here
* fix: Prisma mock fix for listMembers.test.ts
* More fixes to broken testcases
* Forgot to remove borked test
* Prevent the need to mock a lot of dependencies by moving out buildBaseWhereCondition to its own file
* Temporarily skip getCalendarEvents, needs a rewrite
* Fix: turns out you can access protected in testcases
* fix further mocks
* Added packages/features/insights/server/buildBaseWhereCondition.ts, types
* Always great to have a mock and then not use it
* And one less again.
* fix: confirm.handler.test, didn't mock prisma
* fix: Address minor nit by @eunjae & fix ImpersonationProvider test
* Updated isPrismaAvailableCheck that doesn't crash on import
* fix: Get Prisma directly from the client, it usually involves the Validator and does not need 'local' inclusion
* Add zod-prisma-types without the generator enabled (commented out)
* Uncomment and see what happens
* Change method of import as imports did not work in Input Schemas
* Remove custom 'zod' booking model, it does not belong with Prisma
* Fix all other global Model imports
* Rewrite most schema includes AND remove barrel file
* Add bookingCreateBodySchema to features/bookings
* Flurry of type fixes for compatibility with new zod gen
* Refactor out the custom prisma type createEventTypeInput
* Work around nullable eventTypeLocations
* HandlePayment type fix
* More fixes, final fix remaining is CompleteEventType
* Should fix a bunch more booking related type errors
* Missed one
* Some props missing from BookingCreateBodySchema
* Fix location type in handleChildrenEventTypes
* Little bit hacky imo but it works
* Final type error \o/
* Forgot to include Prisma
* Do not include zod-utils in booker/types
* Oops, was already including Booker/types
* Fix membership type, also disallow updating createdAt/updatedAt, make part of patch/post
* Fix api v1 type errors
* Fix EventTypeDescription typings
* Remove getParserWithGeneric, use userBodySchema with UserSchema
* use centralized timeZoneSchema
* Implement feedback by @zomars
* Couple of WIP pushes
* Fix tests
* Type fixes in `handleChildrenEventTypes` test
* Try and parse metadata before use
* Change zod-prisma-types configuration for optimal performance
* Fix prisma validator error in `prisma/selects/credential`
* Disable seperate relations model, hits a bug
* Import absolute - this makes rollup work in @platform/libraries
* Attempt at removing resolutions override
* Refactor using `Prisma.validator` to `satisfies`
* Build atoms using @calcom/prisma/client
* Build atoms using @calcom/prisma/client
* fixes
* Update eventTypeSelect.ts
* Adjust `eventTypeMetaDataSchemaWithUntypedApps` from `unknown` to `record(any)`
* `EventTypeDescription` rely on `descriptionAsSafeHTML` instead of `description`
* Add `seatsPerTimeSlot` to event type public select
* Fix typing in `users-public-view` getServerSide props
* Add missing `schedulingType` to prop
* chore: bump platform libraries
* Function return type is illegal, not sure how this passed eslint (#21567)
* Merged with main
* Update updateTokenObject.ts
* Update handleResponse.ts
* Update index.ts
* Update handleChildrenEventTypes.ts
* Update booking-idempotency-key.ts
* Update WebhookService.test.ts
* Update events.test.ts
* Update queued-response.test.ts
* Update events.test.ts
* Update getRoutedUrl.test.ts
* fix: type checks
Signed-off-by: Omar López <zomars@me.com>
* fixes
Signed-off-by: Omar López <zomars@me.com>
* chore: bump platform libraries
* Update yarn.lock
* more fixes
Signed-off-by: Omar López <zomars@me.com>
* fixes
Signed-off-by: Omar López <zomars@me.com>
* biuld fixes
* chore: bump platform libraries
* Update conferencing.repository.ts
* Update conferencing.repository.ts
* Update getCalendarsEvents.test.ts
* Update vite.config.js
* chore: bump platform libraries
* Update users.ts
* Discard changes to docs/api-reference/v2/openapi.json
* Update vite.config.ts
* updated platform libraries
* Update get.handler.test.ts
* Update get.handler.test.ts
* Update schema.prisma
* Discard changes to docs/api-reference/v2/openapi.json
* Update next-auth-custom-adapter.ts
* Update team.ts
* Flurry of type fixes
* Fix majority of insight related type errors
* Type fixes for unlink of account
* Make user nullable again
* Fixed a bunch of unit tests and one type error
* Attempted mock fix
* Attempted fix for Attribute type
* Ensure default import becomes prisma, but not direct usage
* Import default as prisma in prisma.module
* Add attributeOption to attribute type
* Fix calcom/prisma mock
* Refactor Prisma client imports to @calcom/prisma/client
Updated all imports from '@prisma/client' to '@calcom/prisma/client' across tests and repository files for consistency and to use the correct Prisma client package. This change improves maintainability and ensures the correct client is referenced throughout the codebase.
* Undo removal of max-warnings=0 to get main to merge
* Remove unit tests for e2e fixtures, provide new prisma mock
* Mock @calcom/prisma in event manager
* Mock @calcom/prisma in event manager
* Add correct format even with --no-verify
* Mock prisma in CalendarManager
* Add mock for permission-check.service
* Better injection in PrismaApiKeyRepository imports
* More mock fixes :)
* Fix listMembers.handler.test
* Fix User import
* Appropriately adjust all types to be imported as types, there were a lot of types imported as normal deps
* Why was this a thing?
* Strictly speaking; Not using prismock anymore
* Ditched patch file for prismock
* Fix output.service.ts platform type imports, need concrete for plainToClass
* Better typing and tests for unlinkConnectedAccount.handler
* Small type fix
* Disable calendar cache tests as they are dependent on prismock
* chore: bump platform lib
* getRoutedUrl test remove of unused import
* Extract select to external const on getEventTypesFromDB
* Direct select of userSelect from selects/user
* fix type error from merging 23653
* Fixed integration tests by removing hardcoded values that were possible due to mocking, but as its now directly hitting the db no longer
* fix: vite config atoms prisma client type location
* revert: example app prisma client
* revert: example app prisma client
* bump platform libs
* fix: use class instead of type for DI of PlatformBookingsService
* update platform libs
* remove unused variable
* chore: generate prisma client for api v2
* fix: api v2 e2e
* fix: atoms e2e
* fix: atoms e2e
* fix: atoms e2e
* fix: api v2 e2e
* fix: tsconfig apiv2 enums
* publish libraries
* Simplify check for existence teamId
---------
Signed-off-by: Omar López <zomars@me.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Joe Au-Yeung <j.auyeung419@gmail.com>
Co-authored-by: supalarry <laurisskraucis@gmail.com>
Co-authored-by: cal.com <morgan@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Co-authored-by: Benny Joo <sldisek783@gmail.com>
* Revert "fix: remove fallback permssions on organization Id. (#22769)"
This reverts commit 30061c0d58.
Removes the manage permission concept and fallback logic to simplify
permission checking back to direct role-based checks.
* remove manage from workflows
* fix type error and remove manage from components
* add fallback to service
* fix: org memebership fallback
* remove log
* remove log
* add merge test case
* add test for no parentId on team for getResources
* fix readonly to all to readonly
* fix sheet not showing correct all,readonly,none state until refresh
* update test to include the correct roleId
---------
Co-authored-by: Alex van Andel <me@alexvanandel.com>
* migration plus feature flag
* show navigation route + inital roles migration
* add a check permission use case to take in the feature flags for a team
* bulk update script
* inital frontend work for displaying roles
* move to a more "anemic domain models" approach
* update test to match new DDD strutcture
* fix tests
* update transaction call back types to include trx
* align fe types after transaction to DDD
* move away from usecases to a more domain tailored approach
* get permissions per resource and map them to domain permission string
* update permision logic
* correctly get the logic for *.* permissions on owner
* wip sheet logic for ssr
* role list
* use nuqs for sheet parsing on handle change
* fox
* improve hook usage
* enable PBAC router
* delete modal etc
* i18n and inital rough layout of roles + permisions creating
* add color to migrations
* add colors and new method to tests
* move hooks out of infra into client with provider
* move hooks out of infra into client with provider
* memo features and ensure render once
* remove comment
* seed color
* use role colours
* match i18n
* add custom color picker to edit/create form
* fix advanced mode toggle
* more work on adv permission group
* update migrations
* abstract lots of core form logic to a custom hook
* improve UX for selecting all and toggling all
* improve code quality and use domain mappers in role repositoryu
* call server action to revalidate cache
* call invalidate cache on delete
* fix re-render + improves update logic wip
* fix txn for assinging role to member
* wip on assigning users custom roles
* fix repo
* update logic for checking if users can update roles
* remove member from permission check
* check users permission and assign roles
* move to factory approach
* move default rolesIDs to constant
* add facuted values to table
* display custom role in table
* fix type error
* fix role filter
* check pbac feature flag to see what column to filter on
* push repo mocks and other mocks to fix unit tests
* fix and add test for empty permissions when creating a role
* pass updates to repo so we actually update roles
* fix types
* fix types
* restore lock changes
* fix role service test for new updates section
* fix updated at types
* update mocks to use feature repository mock
* remove roletype from db in model
* prevent multiple queries
* fix typeof in role model
* fix and migrate i18n to one registery
* fix and update i18n to be in registery
* fix type error + fall back in service instead of repo for BL
* more type errors
* update members faceted values to bennys refactor
* fix types
* remove the _resource from type conditionally
* fix managment factory types to expose PBAC enbaled obol
* narrow down types
* wip fix for types
* more fix types
* cast role
* fix tests
* attempt of fixing _resoucre key access type
* attempt of fixing _resoucre key access type
* seperate migraations to batches
* add invalidate time to team features
* restore router to main
* push main lock
* Update packages/features/pbac/domain/types/permission-registry.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/features/pbac/domain/mappers/PermissionMapper.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/prisma/migrations/20250527091330_add_color_to_pbac_role/migration.sql
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/prisma/migrations/20250617070118_update_memberships_one_time/migration.sql
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsx
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix mapped type
* restore migration
* skip _resource
* use partical
* fix type errors in tests and hooks
* Simplified the role field in the editSchema to use z.nativeEnum(MembershipRole)
* fix type errors for editsheet
* fix type errors for editsheet
* Apply suggestion from comment 2151515295
* remove footer since we dont have docs yet
* add i18n
* lock all toggle chevron
* use prisma
* tidy up old manage permission
* fix i18n
* remove can manage from role permission check
* auto select read
* address benny feedback
* fix type
* fix type
* update function name due to merge
* fix types
* update tests to match new membership method from merge
* address cubic feedback
---------
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2025-07-07 10:20:24 +01:00
sean-brydonGitHubsean@cal.com <sean@cal.com>sean@cal.com <sean@cal.com>sean@cal.com <sean@cal.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* inital pbac setup
* fix tests
* docs intro
* more docs
* add comments in docs
* revert pr_todo
* update to use action + custom as defaults
* use enums
* move to change user role + multi check
* add beforeEach import
* docs: add PERMISSIONS.md documenting team/organization role usages
Co-Authored-By: sean@cal.com <sean@cal.com>
* docs: add permission string alternatives for helper functions
Co-Authored-By: sean@cal.com <sean@cal.com>
* feat: enhance permission registry and default role permissions
Co-Authored-By: sean@cal.com <sean@cal.com>
* add routers
* add hooks + rsc. Also adjsuted test to use prismock
* make hooks type safe + add some tests
* add a permission context - trpc router to populate context
* update docs
* explore global and default roles member,admin,owner
* fix tests
* use kysley and abstract uril
* tidy up
* update trpc to use pbac route in endpoint + distinct on teamId
* make transform util
* remove role service dependancy from permission check class
* checkTeamId fall back to orgId if team is parent
* todos
* remove manual migrations to launch softly
* address feedback
* move permission checks to a repo
* move role service database calls to repo. improve mocks
* update tests to have describe import
* fix types
* remove router that is not used to pass build
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
