sean-brydonGitHubsean@cal.com <Sean@brydon.io>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>* feat: add Webhook resource to PBAC system with permission enforcement - Add Webhook resource to PBAC permission registry with CRUD actions - Implement PBAC permission checks in webhook handlers (create, edit, delete) - Add webhook permission translations to common.json - Use PermissionCheckService with fallback roles [ADMIN, OWNER] for team webhooks - Maintain backward compatibility when PBAC is disabled - Follow same pattern as workflow PBAC implementation from PR #22845 Co-Authored-By: sean@cal.com <Sean@brydon.io> * fix: implement PBAC permission filtering in webhook list handler - Add PermissionCheckService to filter team webhooks by webhook.read permission - Only show webhooks from teams where user has proper permissions - Maintain backward compatibility with fallback to all team memberships Co-Authored-By: sean@cal.com <Sean@brydon.io> * add migration for default roles * new forUserMethod * update webhook repository * fix UI showing/hiding webhooks for webhoo.create teams * WIP pbac procedure migratoin + tests * add more roles to get fallback * permissions in cmponents instead of readOnly * passPermissions to list item * push instant events logic * Git merge * wip teamId accessable refactor * fix delete handler --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
85 lines
2.4 KiB
TypeScript
85 lines
2.4 KiB
TypeScript
import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
|
|
import { prisma } from "@calcom/prisma";
|
|
import type { Prisma } from "@calcom/prisma/client";
|
|
import { MembershipRole } from "@calcom/prisma/enums";
|
|
import type { TrpcSessionUser } from "@calcom/trpc/server/types";
|
|
|
|
import type { TListInputSchema } from "./list.schema";
|
|
|
|
type ListOptions = {
|
|
ctx: {
|
|
user: NonNullable<TrpcSessionUser>;
|
|
};
|
|
input: TListInputSchema;
|
|
};
|
|
|
|
export const listHandler = async ({ ctx, input }: ListOptions) => {
|
|
const where: Prisma.WebhookWhereInput = {
|
|
/* Don't mixup zapier webhooks with normal ones */
|
|
AND: [{ appId: !input?.appId ? null : input.appId }],
|
|
};
|
|
|
|
const user = await prisma.user.findUnique({
|
|
where: {
|
|
id: ctx.user.id,
|
|
},
|
|
select: {
|
|
teams: true,
|
|
},
|
|
});
|
|
|
|
if (Array.isArray(where.AND)) {
|
|
if (input?.eventTypeId) {
|
|
const managedParentEvt = await prisma.eventType.findFirst({
|
|
where: {
|
|
id: input.eventTypeId,
|
|
parentId: {
|
|
not: null,
|
|
},
|
|
},
|
|
select: {
|
|
parentId: true,
|
|
},
|
|
});
|
|
|
|
if (managedParentEvt?.parentId) {
|
|
where.AND?.push({
|
|
OR: [{ eventTypeId: input.eventTypeId }, { eventTypeId: managedParentEvt.parentId, active: true }],
|
|
});
|
|
} else {
|
|
where.AND?.push({ eventTypeId: input.eventTypeId });
|
|
}
|
|
} else {
|
|
const permissionService = new PermissionCheckService();
|
|
const teamIds = user?.teams?.map((m) => m.teamId) ?? [];
|
|
const allowedTeamIds = (
|
|
await Promise.all(
|
|
teamIds.map(async (teamId) => {
|
|
const ok = await permissionService.checkPermission({
|
|
userId: ctx.user.id,
|
|
teamId,
|
|
permission: "webhook.read",
|
|
fallbackRoles: [MembershipRole.ADMIN, MembershipRole.OWNER],
|
|
});
|
|
return ok ? teamId : null;
|
|
})
|
|
)
|
|
).filter((x): x is number => x !== null);
|
|
|
|
console.log("Allowed Team IDs:", allowedTeamIds);
|
|
|
|
where.AND?.push({
|
|
OR: [{ userId: ctx.user.id }, ...(allowedTeamIds.length ? [{ teamId: { in: allowedTeamIds } }] : [])],
|
|
});
|
|
}
|
|
|
|
if (input?.eventTriggers) {
|
|
where.AND?.push({ eventTriggers: { hasEvery: input.eventTriggers } });
|
|
}
|
|
}
|
|
|
|
return await prisma.webhook.findMany({
|
|
where,
|
|
});
|
|
};
|