fix: managed orgs bookings by bookingUid#23183
Conversation
|
@romitg2 is attempting to deploy a commit to the cal Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughAdds bookingUid to the filter payload in InputBookingsService_2024_08_13.transformGetBookingsFilters to enable filtering bookings by UID. Introduces two e2e tests in managed-organizations-bookings.controller.e2e-spec.ts: one verifies fetching bookings by organizationId and bookingUid returns only the matching booking; another verifies a non-existent bookingUid returns an empty result. No public API signatures changed. Assessment against linked issues
Possibly related PRs
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
github-actions
bot
added
api
Graphite Automations"Add consumer team as reviewer" took an action on this PR • (08/19/25)1 reviewer was added to this PR based on Keith Williams's automation. "Add community label" took an action on this PR • (08/19/25)1 label was added to this PR based on Keith Williams's automation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
apps/api/v2/src/modules/organizations/bookings/managed-organizations-bookings.controller.e2e-spec.ts (2)
525-556: Positive-path e2e test for bookingUid filter looks goodThis verifies happy-path filtering by
bookingUidfor managed orgs and asserts the returned record matches the requested UID and org event type. Solid coverage.Minor: the
.then(async (response) => { … })callback doesn’t need to beasyncsince there are no awaits inside.
558-576: Good negative test — consider adding a cross-organization isolation checkValidates empty results for a non-existent
bookingUid. To harden isolation, add a test ensuring a valid UID from a different organization does not leak through this endpoint.Apply this diff to add the isolation test after the current block:
@@ it("should return empty results for non-existent bookingUid", async () => { return request(app.getHttpServer()) .get(`/v2/organizations/${managedOrganization.id}/bookings?bookingUid=non-existent-uid`) .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13) .set(X_CAL_CLIENT_ID, oAuthClient.id) .set(X_CAL_SECRET_KEY, oAuthClient.secret) .expect(200) .then(async (response) => { const responseBody: GetBookingsOutput_2024_08_13 = response.body; expect(responseBody.status).toEqual(SUCCESS_STATUS); expect(responseBody.data).toBeDefined(); const data: ( | BookingOutput_2024_08_13 | RecurringBookingOutput_2024_08_13 | GetSeatedBookingOutput_2024_08_13 )[] = responseBody.data; expect(data.length).toEqual(0); }); }); + + it("should not return bookings from other organizations when bookingUid belongs to a different org", async () => { + // Fetch a booking from the manager organization + const managerBookingsResponse = await request(app.getHttpServer()) + .get(`/v2/organizations/${managerOrganization.id}/bookings`) + .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13) + .set(X_CAL_CLIENT_ID, oAuthClient.id) + .set(X_CAL_SECRET_KEY, oAuthClient.secret) + .expect(200); + + const foreignUid = managerBookingsResponse.body.data[0].uid; + + // Query managed org endpoint using a foreign org bookingUid -> should not return results + const response = await request(app.getHttpServer()) + .get(`/v2/organizations/${managedOrganization.id}/bookings?bookingUid=${foreignUid}`) + .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13) + .set(X_CAL_CLIENT_ID, oAuthClient.id) + .set(X_CAL_SECRET_KEY, oAuthClient.secret) + .expect(200); + + const responseBody: GetBookingsOutput_2024_08_13 = response.body; + expect(responseBody.status).toEqual(SUCCESS_STATUS); + expect(responseBody.data).toBeDefined(); + expect(responseBody.data.length).toEqual(0); + });
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts(1 hunks)apps/api/v2/src/modules/organizations/bookings/managed-organizations-bookings.controller.e2e-spec.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.ts
📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)
**/*.ts: For Prisma queries, only select data you need; never useinclude, always useselect
Ensure thecredential.keyfield is never returned from tRPC endpoints or APIs
Files:
apps/api/v2/src/modules/organizations/bookings/managed-organizations-bookings.controller.e2e-spec.tsapps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts
**/*.{ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)
Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js
.utc()in hot paths like loops
Files:
apps/api/v2/src/modules/organizations/bookings/managed-organizations-bookings.controller.e2e-spec.tsapps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts
**/*.{service,repository}.ts
📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)
Avoid dot-suffixes like
.service.tsor.repository.tsfor new files; reserve.test.ts,.spec.ts,.types.tsfor their specific purposes
Files:
apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts
🧬 Code Graph Analysis (1)
apps/api/v2/src/modules/organizations/bookings/managed-organizations-bookings.controller.e2e-spec.ts (2)
packages/platform/constants/api.ts (5)
CAL_API_VERSION_HEADER(72-72)VERSION_2024_08_13(59-59)X_CAL_CLIENT_ID(50-50)X_CAL_SECRET_KEY(49-49)SUCCESS_STATUS(9-9)packages/platform/types/bookings/2024-08-13/outputs/booking.output.ts (3)
BookingOutput_2024_08_13(280-306)RecurringBookingOutput_2024_08_13(308-323)GetSeatedBookingOutput_2024_08_13(325-331)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Install dependencies / Yarn install & cache
- GitHub Check: Codacy Static Code Analysis
🔇 Additional comments (1)
apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts (1)
692-707: Booking UID passthrough added — confirm downstream filter keyYou’ve wired
bookingUid: queryParams.bookingUidintotransformGetBookingsFilters, but the shared listing helper (getAllUserBookings) or its underlying Kysely/Prisma query likely filters on the actual column name (uid), notbookingUid. Please verify that:
- The
getAllUserBookingsfunction accepts abookingUidfield and maps it towhere: { uid: … }, or- If it doesn’t, update
transformGetBookingsFiltersto emituid: queryParams.bookingUid(or the correct filter key) instead ofbookingUid.
1 participant
What does this PR do?
Mandatory Tasks (DO NOT REMOVE)
How should this be tested?
Checklist