95120e1ff4
* feat: add bookingRequiresAuthentication validation to 2024-04-15 booking controller - Add checkBookingRequiresAuthentication method to validate authentication requirements - Check if user is event type owner, host, team admin/owner, or org admin/owner - Add comprehensive e2e tests for bookingRequiresAuthentication feature - Ensure parity with 2024-08-13 controller implementation - Fix type issue in setPlatformAttendeesEmails method Co-Authored-By: morgan@cal.com <morgan@cal.com> * refactor: move Prisma calls to repository pattern - Add findByIdIncludeHostsAndTeamMembers method to EventTypeRepository - Inject PrismaEventTypeRepository and PrismaTeamRepository into controller - Replace direct Prisma calls with repository methods in checkBookingRequiresAuthentication - Use getTeamByIdIfUserIsAdmin for org admin/owner check - Add repositories to BookingsModule_2024_04_15 providers Co-Authored-By: morgan@cal.com <morgan@cal.com> * handle httpException in handleBookingErrors * test: add test case for authenticated but unauthorized user booking - Create second user who is not authorized to book the event type - Verify that authenticated user without proper permissions receives 403 Forbidden - Test validates that bookingRequiresAuthentication properly checks authorization levels - Cleanup unauthorized user in afterAll hook Co-Authored-By: morgan@cal.com <morgan@cal.com> * fix: add accepted filter to team members and handle org-owned event types Addresses PR comments from cubic-dev-ai and @ThyMinimalDev: 1. Add accepted: true filter to team.members query - Prevents pending team invitations from being treated as authorized - Also filter by role to only fetch ADMIN and OWNER roles - Reduces payload size and improves query performance 2. Add isOrganization field to team select - Enables proper handling of org-owned event types 3. Update authorization logic for org-owned event types - Handle case where team.isOrganization is true with no parent - Ensure org admins/owners are properly authorized for org-owned events - Matches behavior of 2024-08-13 controller Changes: - packages/features/eventtypes/repositories/eventTypeRepository.ts: * Add where clause to members query with accepted: true and role filter * Add isOrganization: true to team select - apps/api/v2/src/ee/bookings/2024-04-15/controllers/bookings.controller.ts: * Update authorization logic to handle org-owned event types * Check if team.isOrganization is true when no parentId exists Co-Authored-By: morgan@cal.com <morgan@cal.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>