fix: Hosts not able to cancel/reschedule the event when Disable Rescheduling/Cancelling is enabled

apps/web/app/api/cancel/route.ts

@@ -29,6 +29,7 @@ async function handler(req: NextRequest) {
   const result = await handleCancelBooking({
     bookingData,
     userId: session?.user?.id || -1,
+    userOrgRole: session?.user?.org?.role,
   });
 
   const statusCode = result.success ? 200 : 400;

apps/web/components/booking/BookingListItem.tsx

@@ -70,7 +70,14 @@ type BookingListingStatus = RouterInputs["viewer"]["bookings"]["get"]["filters"]
 
 type BookingItem = RouterOutputs["viewer"]["bookings"]["get"]["bookings"][number];
 
-export type BookingItemProps = BookingItem & {
+type EnrichedBookingItem = BookingItem & {
+  eventType: BookingItem["eventType"] & {
+    isUserHostOrOwner?: boolean;
+    hasTeamOrOrgPermissions?: boolean;
+  };
+};
+
+export type BookingItemProps = EnrichedBookingItem & {
   listingStatus: BookingListingStatus;
   recurringInfo: RouterOutputs["viewer"]["bookings"]["get"]["recurringInfo"][number] | undefined;
   loggedInUser: {
@@ -205,6 +212,9 @@ function BookingListItem(booking: BookingItemProps) {
   const isDisabledCancelling = booking.eventType.disableCancelling;
   const isDisabledRescheduling = booking.eventType.disableRescheduling;
 
+  const isHostOrOwner = booking.eventType?.isUserHostOrOwner || false;
+  const hasTeamOrOrgPermissions = booking.eventType?.hasTeamOrOrgPermissions || false;
+
   const bookingConfirm = async (confirm: boolean) => {
     let body = {
       bookingId: booking.id,
@@ -250,6 +260,8 @@ function BookingListItem(booking: BookingItemProps) {
       (typeof booking.location === "string" && booking.location.trim() === ""),
     showPendingPayment: paymentAppData.enabled && booking.payment.length && !booking.paid,
     cardCharged,
+    isHostOrOwner,
+    hasTeamOrOrgPermissions,
     attendeeList,
     getSeatReferenceUid,
     t,

apps/web/components/booking/bookingActions.ts

@@ -22,6 +22,8 @@ export interface BookingActionContext {
   isCalVideoLocation: boolean;
   showPendingPayment: boolean;
   cardCharged: boolean;
+  isHostOrOwner: boolean;
+  hasTeamOrOrgPermissions: boolean;
   attendeeList: Array<{
     name: string;
     email: string;
@@ -101,6 +103,8 @@ export function getEditEventActions(context: BookingActionContext): ActionType[]
     isBookingInPast,
     isDisabledRescheduling,
     isBookingFromRoutingForm,
+    isHostOrOwner,
+    hasTeamOrOrgPermissions,
     getSeatReferenceUid,
     t,
   } = context;
@@ -114,15 +118,17 @@ export function getEditEventActions(context: BookingActionContext): ActionType[]
         booking.seatsReferences.length ? `?seatReferenceUid=${getSeatReferenceUid()}` : ""
       }`,
       disabled:
-        (isBookingInPast && !booking.eventType.allowReschedulingPastBookings) || isDisabledRescheduling,
+        (isBookingInPast && !booking.eventType.allowReschedulingPastBookings) || 
+        (isDisabledRescheduling && !isHostOrOwner && !hasTeamOrOrgPermissions),
     },
     {
       id: "reschedule_request",
       icon: "send",
       iconClassName: "rotate-45 w-[16px] -translate-x-0.5 ",
       label: t("send_reschedule_request"),
       disabled:
-        (isBookingInPast && !booking.eventType.allowReschedulingPastBookings) || isDisabledRescheduling,
+        (isBookingInPast && !booking.eventType.allowReschedulingPastBookings) || 
+        (isDisabledRescheduling && !isHostOrOwner && !hasTeamOrOrgPermissions),
     },
     isBookingFromRoutingForm
       ? {
@@ -202,15 +208,16 @@ export function shouldShowRecurringCancelAction(context: BookingActionContext):
 }
 
 export function isActionDisabled(actionId: string, context: BookingActionContext): boolean {
-  const { booking, isBookingInPast, isDisabledRescheduling, isDisabledCancelling, isPending, isConfirmed } =
+  const { booking, isBookingInPast, isDisabledRescheduling, isDisabledCancelling, isPending, isConfirmed, isHostOrOwner, hasTeamOrOrgPermissions } =
     context;
 
   switch (actionId) {
     case "reschedule":
     case "reschedule_request":
-      return (isBookingInPast && !booking.eventType.allowReschedulingPastBookings) || isDisabledRescheduling;
+      return (isBookingInPast && !booking.eventType.allowReschedulingPastBookings) || 
+             (isDisabledRescheduling && !isHostOrOwner && !hasTeamOrOrgPermissions);
     case "cancel":
-      return isDisabledCancelling || isBookingInPast;
+      return (isDisabledCancelling && !isHostOrOwner && !hasTeamOrOrgPermissions) || isBookingInPast;
     case "view_recordings":
       return !(isBookingInPast && booking.status === BookingStatus.ACCEPTED && context.isCalVideoLocation);
     case "meeting_session_details":

apps/web/lib/booking.ts

@@ -71,6 +71,7 @@ export const getEventTypesFromDB = async (id: number) => {
           slug: true,
           name: true,
           hideBranding: true,
+          parentId: true,
           parent: {
             select: {
               hideBranding: true,

apps/web/lib/reschedule/[uid]/getServerSideProps.ts

@@ -3,10 +3,13 @@ import type { GetServerSidePropsContext } from "next";
 import { URLSearchParams } from "url";
 import { z } from "zod";
 
+import { checkAdminOrOwner } from "@calcom/features/auth/lib/checkAdminOrOwner";
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
 import { getFullName } from "@calcom/features/form-builder/utils";
 import { buildEventUrlFromBooking } from "@calcom/lib/bookings/buildEventUrlFromBooking";
 import { getDefaultEvent } from "@calcom/lib/defaultEvents";
+import { checkIfUserIsHost } from "@calcom/lib/event-types/utils/checkIfUserIsHost";
+import { isTeamAdmin } from "@calcom/lib/server/queries/teams";
 import { getSafe } from "@calcom/lib/getSafe";
 import { maybeGetBookingUidFromSeat } from "@calcom/lib/server/maybeGetBookingUidFromSeat";
 import { UserRepository } from "@calcom/lib/server/repository/user";
@@ -55,6 +58,8 @@ export async function getServerSideProps(context: GetServerSidePropsContext) {
           users: {
             select: {
               username: true,
+              email: true,
+              id: true,
             },
           },
           slug: true,
@@ -63,6 +68,7 @@ export async function getServerSideProps(context: GetServerSidePropsContext) {
           allowReschedulingCancelledBookings: true,
           team: {
             select: {
+              id: true,
               parentId: true,
               slug: true,
             },
@@ -79,6 +85,7 @@ export async function getServerSideProps(context: GetServerSidePropsContext) {
               user: {
                 select: {
                   id: true,
+                  email: true,
                 },
               },
             },
@@ -122,7 +129,28 @@ export async function getServerSideProps(context: GetServerSidePropsContext) {
   const isNonRescheduleableBooking =
     booking.status === BookingStatus.CANCELLED || booking.status === BookingStatus.REJECTED;
 
-  if (isDisabledRescheduling) {
+  // Check if user is a host or owner of the event type
+  const userId = session?.user?.id;
+  const userIsHost = userId
+    ? checkIfUserIsHost(
+        userId,
+        {
+          user: booking.user,
+          attendees: booking.attendees,
+        },
+        {
+          users: booking.eventType?.users,
+          hosts: booking.eventType?.hosts,
+        }
+      )
+    : false;
+  const userIsOwnerOfEventType = userId !== undefined && booking?.eventType?.owner?.id === userId;
+
+  const hasTeamOrOrgPermissions = userId !== undefined ? !!(await isTeamAdmin(userId, booking?.eventType?.team?.id ?? 0)) : false;
+  const isOrgAdminOrOwner = checkAdminOrOwner(session?.user?.org?.role);
+
+  const isHostOrOwner = !!userIsHost || !!userIsOwnerOfEventType || !!hasTeamOrOrgPermissions || isOrgAdminOrOwner;
+  if (isDisabledRescheduling && !isHostOrOwner) {
     return {
       redirect: {
         destination: `/booking/${uid}`,
@@ -182,13 +210,23 @@ export async function getServerSideProps(context: GetServerSidePropsContext) {
         },
       };
     }
-    const userIsHost = booking?.eventType.hosts.find((host) => {
-      if (host.user.id === userId) return true;
-    });
+    const userIsHost = userId
+      ? checkIfUserIsHost(
+          userId,
+          {
+            user: booking.user,
+            attendees: booking.attendees,
+          },
+          {
+            users: booking.eventType?.users,
+            hosts: booking.eventType?.hosts,
+          }
+        )
+      : false;
 
     const userIsOwnerOfEventType = booking?.eventType.owner?.id === userId;
 
-    if (!userIsHost && !userIsOwnerOfEventType) {
+    if (!userIsHost && !userIsOwnerOfEventType && !hasTeamOrOrgPermissions && !isOrgAdminOrOwner) {
       return {
         notFound: true,
       } as {

apps/web/lib/team/[slug]/[type]/getServerSideProps.tsx

@@ -1,14 +1,17 @@
 import type { GetServerSidePropsContext } from "next";
 import { z } from "zod";
 
+import { checkAdminOrOwner } from "@calcom/features/auth/lib/checkAdminOrOwner";
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
 import type { GetBookingType } from "@calcom/features/bookings/lib/get-booking";
 import { getBookingForReschedule } from "@calcom/features/bookings/lib/get-booking";
 import { getSlugOrRequestedSlug, orgDomainConfig } from "@calcom/features/ee/organizations/lib/orgDomains";
 import { getOrganizationSEOSettings } from "@calcom/features/ee/organizations/lib/orgSettings";
 import { FeaturesRepository } from "@calcom/features/flags/features.repository";
 import { getPlaceholderAvatar } from "@calcom/lib/defaultAvatarImage";
+import { isTeamAdmin } from "@calcom/lib/server/queries/teams";
 import { shouldHideBrandingForTeamEvent } from "@calcom/lib/hideBranding";
+import { BookingRepository } from "@calcom/lib/server/repository/booking";
 import slugify from "@calcom/lib/slugify";
 import { prisma } from "@calcom/prisma";
 import type { User } from "@calcom/prisma/client";
@@ -58,7 +61,23 @@ export const getServerSideProps = async (context: GetServerSidePropsContext) =>
     return { notFound: true } as const;
   }
 
-  if (rescheduleUid && eventData.disableRescheduling) {
+  const userId = session?.user?.id;
+  const hasTeamOrOrgPermissions = userId !== undefined ? !!(await isTeamAdmin(userId, eventData.team?.id ?? 0)) : false;
+  const isOrgAdminOrOwner = checkAdminOrOwner(session?.user?.org?.role);
+
+  let isHostOrOwner = (eventData.owner?.id && eventData.owner?.id === userId) || hasTeamOrOrgPermissions || isOrgAdminOrOwner;
+
+  // We will only check the database if the user is not the owner or has team or org permissions
+  if (userId && rescheduleUid && !isHostOrOwner) {
+    const bookingRepo = new BookingRepository(prisma);
+    const userIsHost = await bookingRepo.checkIfUserIsHost({
+      userId,
+      bookingId: `${rescheduleUid}`,
+    });
+    isHostOrOwner = !!userIsHost;
+  }
+
+  if (rescheduleUid && eventData.disableRescheduling && !isHostOrOwner) {
     return { redirect: { destination: `/booking/${rescheduleUid}`, permanent: false } };
   }
 
@@ -242,6 +261,17 @@ const getTeamWithEventsData = async (
               },
             },
           },
+          team: {
+            select: {
+              id: true,
+              parentId: true,
+            },
+          },
+          owner: {
+            select: {
+              id: true,
+            },
+          },
         },
       },
       isOrganization: true,

apps/web/modules/bookings/views/bookings-listing-view.tsx

@@ -181,6 +181,7 @@ function BookingsContent({ status }: BookingsProps) {
         ? dayjs(dateRange?.startDate).startOf("day").toISOString()
         : undefined,
       beforeEndDate: dateRange?.endDate ? dayjs(dateRange?.endDate).endOf("day").toISOString() : undefined,
+      includeHostAndTeamPermissions: true,
     },
   });
 

apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx

@@ -7,6 +7,7 @@ import { orgDomainConfig } from "@calcom/ee/organizations/lib/orgDomains";
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
 import getBookingInfo from "@calcom/features/bookings/lib/getBookingInfo";
 import { getDefaultEvent } from "@calcom/lib/defaultEvents";
+import { isTeamAdmin } from "@calcom/lib/server/queries/teams";
 import { shouldHideBrandingForEvent } from "@calcom/lib/hideBranding";
 import { parseRecurringEvent } from "@calcom/lib/isRecurringEvent";
 import { markdownToSafeHTML } from "@calcom/lib/markdownToSafeHTML";
@@ -15,6 +16,7 @@ import { BookingRepository } from "@calcom/lib/server/repository/booking";
 import prisma from "@calcom/prisma";
 import { customInputSchema } from "@calcom/prisma/zod-utils";
 import { meRouter } from "@calcom/trpc/server/routers/viewer/me/_router";
+import { checkAdminOrOwner } from "@calcom/features/auth/lib/checkAdminOrOwner";
 
 import type { inferSSRProps } from "@lib/types/inferSSRProps";
 
@@ -175,6 +177,8 @@ export async function getServerSideProps(context: GetServerSidePropsContext) {
   };
 
   const isLoggedInUserHost = checkIfUserIsHost(userId);
+  const isOrgAdminOrOwner = checkAdminOrOwner(session?.user?.org?.role);
+  const hasTeamOrOrgPermissions = userId !== undefined ? !!(await isTeamAdmin(userId, eventType.team?.id ?? 0)) : false;
 
   if (bookingInfo !== null && eventType.seatsPerTimeSlot) {
     await handleSeatsEventTypeOnBooking(eventType, bookingInfo, seatReferenceUid, isLoggedInUserHost);
@@ -256,6 +260,7 @@ export async function getServerSideProps(context: GetServerSidePropsContext) {
       requiresLoginToUpdate,
       rescheduledToUid,
       isLoggedInUserHost,
+      hasTeamOrOrgPermissions: hasTeamOrOrgPermissions || isOrgAdminOrOwner,
       internalNotePresets: internalNotes,
     },
   };

apps/web/modules/bookings/views/bookings-single-view.tsx

@@ -153,6 +153,7 @@ export default function Success(props: PageProps) {
   );
   const { data: session } = useSession();
   const isHost = props.isLoggedInUserHost;
+  const isAdminOrOwner = props.hasTeamOrOrgPermissions;
 
   const [showUtmParams, setShowUtmParams] = useState(false);
 
@@ -377,11 +378,13 @@ export default function Success(props: PageProps) {
   const isRerouting = searchParams?.get("cal.rerouting") === "true";
   const isRescheduled = bookingInfo?.rescheduled;
 
-  const canCancelOrReschedule = !eventType?.disableCancelling || !eventType?.disableRescheduling;
-  const canCancelAndReschedule = !eventType?.disableCancelling && !eventType?.disableRescheduling;
+  const canCancelOrReschedule =
+    !eventType?.disableCancelling || !eventType?.disableRescheduling || isHost || isAdminOrOwner;
+  const canCancelAndReschedule =
+    (!eventType?.disableCancelling && !eventType?.disableRescheduling) || isHost || isAdminOrOwner;
 
-  const canCancel = !eventType?.disableCancelling;
-  const canReschedule = !eventType?.disableRescheduling;
+  const canCancel = !eventType?.disableCancelling || isHost || isAdminOrOwner;
+  const canReschedule = !eventType?.disableRescheduling || isHost || isAdminOrOwner;
 
   const successPageHeadline = (() => {
     if (needsConfirmationAndReschedulable) {