feat: Add private links to API

[alishaz-polymath]

What does this PR do?

PR summary

• Introduced Event Types Private Links API (v2)

  • Base path: /v2/event-types/{eventTypeId}/private-links
  • Endpoints:
    • POST / — create a private link
    • GET / — list private links for an event type
    • PATCH /{linkId} — update a private link
    • DELETE /{linkId} — delete a private link

• New components

  • EventTypesPrivateLinksController
  • PrivateLinksService, PrivateLinksInputService, PrivateLinksOutputService
  • PrivateLinksRepository
  • Reused EventTypeOwnershipGuard for ownership checks

• Validation and behavior

  • CreatePrivateLinkInput:
    • expiresAt: string, format date-time
    • maxUsageCount: integer, min 1, default 1
    • Input service enforces one-of semantics and rejects both being present
  • UpdatePrivateLinkInput: supports expiresAt and maxUsageCount updates
  • EventTypeOwnershipGuard returns 400 for missing/invalid eventTypeId, 404 when not owned/not found, and 403 if no user

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

This is a V2 endpoint, so you would need to run the V2 API and then proceed with the following:

• Auth

  • Header: Authorization: Bearer <token> (API key prefixed with cal_ or managed user token)
  • Permissions: EVENT_TYPE_READ for GET, EVENT_TYPE_WRITE for POST/PATCH/DELETE
  • Ownership: EventTypeOwnershipGuard enforces the event type belongs to the caller

• Create

  • POST /v2/event-types/{eventTypeId}/private-links
  • Body (one-of):
    • { "expiresAt": "2025-12-31T23:59:59.000Z" }
    • { "maxUsageCount": 10 }
  • Response: { status: "success", data: TimeBasedPrivateLinkOutput | UsageBasedPrivateLinkOutput }

ℹ If neither expiresAt nor maxUsageCount is provided, it defaults to a one-time private link, so maxUsageCount is taken with the default value of 1

• List

  • GET /v2/event-types/{eventTypeId}/private-links
  • Response: { status: "success", data: Array<TimeBasedPrivateLinkOutput | UsageBasedPrivateLinkOutput> }

• Update

  • PATCH /v2/event-types/{eventTypeId}/private-links/{linkId}
  • Body: any subset of { "expiresAt": "…", "maxUsageCount": 5 }
  • Not found: 404 if link doesn’t exist for the event type
  • Response: { status: "success", data: TimeBasedPrivateLinkOutput | UsageBasedPrivateLinkOutput }

• Delete

  • DELETE /v2/event-types/{eventTypeId}/private-links/{linkId}
  • Not found: 404 if no record was deleted
  • Response: { status: "success", data: { linkId, message } }

Checklist

[coderabbitai]

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Walkthrough

Adds an Event Types Private Links feature across the API and platform packages. Introduces a NestJS module, controller, repository, input/output/core services, an ownership guard, and e2e tests; wires the module into PlatformEndpointsModule. Adds type and DTO definitions (inputs/outputs) and OpenAPI/Swagger schemas for time-based and usage-based private links. Exposes generateHashedLink and isLinkExpired via a new platform library export and updates HashedLinkService with per-event-type CRUD helpers. Adds tsconfig path alias and updates package exports and versions for platform-libraries. Also appends cal_ai_phone_call to multiple workflow action enums.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• feat: cal ai self serve architecture #1 #22919 — Adds the cal_ai_phone_call workflow action across DTO enums (same enum/value addition).
• feat: Enhance private link expiration with usage and date limits #22304 — Implements/changes hashed-link utilities, repository and service functionality that overlap with the new private-links API and exports.

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/private-links-api-v2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai generate unit tests to generate unit tests for this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

2 Skipped Deployments

Name	Status	Preview	Comments	Updated (UTC)
cal	⬜️ Ignored (Inspect)			Aug 11, 2025 8:35am
cal-eu	⬜️ Ignored (Inspect)			Aug 11, 2025 8:35am

[supalarry]

Review:

[alishaz-polymath]

These are both optional so if the user doesn't send either of these in the body, the default action is that it will create a one-time use private link

[graphite-app]

Graphite Automations

"Add ready-for-e2e label" took an action on this PR • (08/11/25)

1 label was added to this PR based on Keith Williams's automation.

[github-actions]

E2E results are ready!

• Workflow #71361.2 latest results