fix: v2 hidden event types

apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.ts

@@ -6,11 +6,22 @@ import { UpdateEventTypeOutput_2024_06_14 } from "@/ee/event-types/event-types_2
 import { EventTypeResponseTransformPipe } from "@/ee/event-types/event-types_2024_06_14/pipes/event-type-response.transformer";
 import { EventTypesService_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/services/event-types.service";
 import { InputEventTypesService_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/services/input-event-types.service";
+import { OutputEventTypesService_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/services/output-event-types.service";
 import { VERSION_2024_06_14_VALUE } from "@/lib/api-versions";
-import { API_KEY_OR_ACCESS_TOKEN_HEADER } from "@/lib/docs/headers";
+import {
+  API_KEY_OR_ACCESS_TOKEN_HEADER,
+  OPTIONAL_API_KEY_OR_ACCESS_TOKEN_HEADER,
+  OPTIONAL_X_CAL_CLIENT_ID_HEADER,
+  OPTIONAL_X_CAL_SECRET_KEY_HEADER,
+} from "@/lib/docs/headers";
+import {
+  AuthOptionalUser,
+  GetOptionalUser,
+} from "@/modules/auth/decorators/get-optional-user/get-optional-user.decorator";
 import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
 import { Permissions } from "@/modules/auth/decorators/permissions/permissions.decorator";
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import { OptionalApiAuthGuard } from "@/modules/auth/guards/optional-api-auth/optional-api-auth.guard";
 import { PermissionsGuard } from "@/modules/auth/guards/permissions/permissions.guard";
 import { UserWithProfile } from "@/modules/users/users.repository";
 import {
@@ -40,7 +51,6 @@ import {
   UpdateEventTypeInput_2024_06_14,
   GetEventTypesQuery_2024_06_14,
   CreateEventTypeInput_2024_06_14,
-  EventTypeOutput_2024_06_14,
 } from "@calcom/platform-types";
 
 @Controller({
@@ -62,7 +72,8 @@ export class EventTypesController_2024_06_14 {
   constructor(
     private readonly eventTypesService: EventTypesService_2024_06_14,
     private readonly inputEventTypesService: InputEventTypesService_2024_06_14,
-    private readonly eventTypeResponseTransformPipe: EventTypeResponseTransformPipe
+    private readonly eventTypeResponseTransformPipe: EventTypeResponseTransformPipe,
+    private readonly outputEventTypesService: OutputEventTypesService_2024_06_14
   ) {}
 
   @Post("/")
@@ -109,30 +120,23 @@ export class EventTypesController_2024_06_14 {
   }
 
   @Get("/")
-  @ApiOperation({ summary: "Get all event types" })
+  @ApiOperation({
+    summary: "Get all event types",
+    description:
+      "Hidden event types are returned only if authentication is provided and it belongs to the event type owner.",
+  })
+  @UseGuards(OptionalApiAuthGuard)
+  @ApiHeader(OPTIONAL_X_CAL_CLIENT_ID_HEADER)
+  @ApiHeader(OPTIONAL_X_CAL_SECRET_KEY_HEADER)
+  @ApiHeader(OPTIONAL_API_KEY_OR_ACCESS_TOKEN_HEADER)
   async getEventTypes(
-    @Query() queryParams: GetEventTypesQuery_2024_06_14
+    @Query() queryParams: GetEventTypesQuery_2024_06_14,
+    @GetOptionalUser() authUser: AuthOptionalUser
   ): Promise<GetEventTypesOutput_2024_06_14> {
-    const eventTypes = await this.eventTypesService.getEventTypes(queryParams);
-    if (!eventTypes || eventTypes.length === 0) {
-      throw new NotFoundException(`Event types not found`);
-    }
+    const eventTypes = await this.eventTypesService.getEventTypes(queryParams, authUser);
     const eventTypesFormatted = this.eventTypeResponseTransformPipe.transform(eventTypes);
-    const eventTypesWithoutHiddenFields = eventTypesFormatted.map((eventType) => {
-      return {
-        ...eventType,
-        bookingFields: Array.isArray(eventType?.bookingFields)
-          ? eventType?.bookingFields
-              .map((field) => {
-                if ("hidden" in field) {
-                  return field.hidden !== true ? field : null;
-                }
-                return field;
-              })
-              .filter((f) => f)
-          : [],
-      };
-    }) as EventTypeOutput_2024_06_14[];
+    const eventTypesWithoutHiddenFields =
+      this.outputEventTypesService.getResponseEventTypesWithoutHiddenFields(eventTypesFormatted);
 
     return {
       status: SUCCESS_STATUS,

apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts

@@ -75,6 +75,16 @@ export class EventTypesRepository_2024_06_14 {
     });
   }
 
+  async getUserEventTypesPublic(userId: number) {
+    return this.dbRead.prisma.eventType.findMany({
+      where: {
+        userId,
+        hidden: false,
+      },
+      include: { users: true, schedule: true, destinationCalendar: true },
+    });
+  }
+
   async getEventTypeById(eventTypeId: number) {
     return this.dbRead.prisma.eventType.findUnique({
       where: { id: eventTypeId },

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts

@@ -3,6 +3,7 @@ import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_20
 import { InputEventTransformed_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/transformed";
 import { SystemField, CustomField } from "@/ee/event-types/event-types_2024_06_14/transformers";
 import { SchedulesRepository_2024_06_11 } from "@/ee/schedules/schedules_2024_06_11/schedules.repository";
+import { AuthOptionalUser } from "@/modules/auth/decorators/get-optional-user/get-optional-user.decorator";
 import { MembershipsRepository } from "@/modules/memberships/memberships.repository";
 import { PrismaWriteService } from "@/modules/prisma/prisma-write.service";
 import { SelectedCalendarsRepository } from "@/modules/selected-calendars/selected-calendars.repository";
@@ -38,6 +39,7 @@ export class EventTypesService_2024_06_14 {
     }
     await this.checkCanCreateEventType(user.id, body);
     const eventTypeUser = await this.getUserToCreateEvent(user);
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     const { destinationCalendar: _destinationCalendar, ...rest } = body;
 
     const { eventType: eventTypeCreated } = await createEventType({
@@ -93,34 +95,47 @@ export class EventTypesService_2024_06_14 {
     }
   }
 
-  async getEventTypeByUsernameAndSlug(
-    username: string,
-    eventTypeSlug: string,
-    orgSlug?: string,
-    orgId?: number
-  ) {
-    const user = await this.usersRepository.findByUsername(username, orgSlug, orgId);
+  async getEventTypeByUsernameAndSlug(params: {
+    username: string;
+    eventTypeSlug: string;
+    orgSlug?: string;
+    orgId?: number;
+    authUser?: AuthOptionalUser;
+  }) {
+    const user = await this.usersRepository.findByUsername(params.username, params.orgSlug, params.orgId);
     if (!user) {
       return null;
     }
 
-    const eventType = await this.eventTypesRepository.getUserEventTypeBySlug(user.id, eventTypeSlug);
+    const eventType = await this.eventTypesRepository.getUserEventTypeBySlug(user.id, params.eventTypeSlug);
 
     if (!eventType) {
       return null;
     }
 
+    if (eventType.hidden && params.authUser?.id !== user.id) {
+      return null;
+    }
+
     return {
       ownerId: user.id,
       ...eventType,
     };
   }
 
-  async getEventTypesByUsername(username: string, orgSlug?: string, orgId?: number) {
-    const user = await this.usersRepository.findByUsername(username, orgSlug, orgId);
+  async getEventTypesByUsername(params: {
+    username: string;
+    orgSlug?: string;
+    orgId?: number;
+    authUser?: AuthOptionalUser;
+  }) {
+    const user = await this.usersRepository.findByUsername(params.username, params.orgSlug, params.orgId);
     if (!user) {
       return [];
     }
+    if (params.authUser?.id !== user.id) {
+      return await this.getUserEventTypesPublic(user.id);
+    }
     return await this.getUserEventTypes(user.id);
   }
 
@@ -172,6 +187,14 @@ export class EventTypesService_2024_06_14 {
     });
   }
 
+  async getUserEventTypesPublic(userId: number) {
+    const eventTypes = await this.eventTypesRepository.getUserEventTypesPublic(userId);
+
+    return eventTypes.map((eventType) => {
+      return { ownerId: userId, ...eventType };
+    });
+  }
+
   async getEventTypesPublicByUsername(username: string): Promise<EventTypesPublic> {
     const user = await this.usersRepository.findByUsername(username);
     if (!user) {
@@ -181,15 +204,26 @@ export class EventTypesService_2024_06_14 {
     return await getEventTypesPublic(user.id);
   }
 
-  async getEventTypes(queryParams: GetEventTypesQuery_2024_06_14) {
+  async getEventTypes(queryParams: GetEventTypesQuery_2024_06_14, authUser?: AuthOptionalUser) {
     const { username, eventSlug, usernames, orgSlug, orgId } = queryParams;
     if (username && eventSlug) {
-      const eventType = await this.getEventTypeByUsernameAndSlug(username, eventSlug, orgSlug, orgId);
+      const eventType = await this.getEventTypeByUsernameAndSlug({
+        username,
+        eventTypeSlug: eventSlug,
+        orgSlug,
+        orgId,
+        authUser,
+      });
       return eventType ? [eventType] : [];
     }
 
     if (username) {
-      return await this.getEventTypesByUsername(username, orgSlug, orgId);
+      return await this.getEventTypesByUsername({
+        username,
+        orgSlug,
+        orgId,
+        authUser,
+      });
     }
 
     if (usernames) {

apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts

@@ -31,6 +31,7 @@ import {
   EventTypeOutput_2024_06_14,
   OutputUnknownLocation_2024_06_14,
   OutputUnknownBookingField_2024_06_14,
+  OutputBookingField_2024_06_14,
 } from "@calcom/platform-types";
 
 type EventTypeRelations = {
@@ -253,7 +254,7 @@ export class OutputEventTypesService_2024_06_14 {
           type: "unknown",
           slug: "unknown",
           bookingField: JSON.stringify(bookingField),
-        });
+        } satisfies OutputUnknownBookingField_2024_06_14);
       }
     }
 
@@ -344,4 +345,26 @@ export class OutputEventTypesService_2024_06_14 {
       seatsShowAvailabilityCount: !!seatsShowAvailabilityCount,
     });
   }
+
+  getResponseEventTypesWithoutHiddenFields(
+    eventTypes: EventTypeOutput_2024_06_14[]
+  ): EventTypeOutput_2024_06_14[] {
+    return eventTypes.map((eventType) => this.getResponseEventTypeWithoutHiddenFields(eventType));
+  }
+
+  getResponseEventTypeWithoutHiddenFields(eventType: EventTypeOutput_2024_06_14): EventTypeOutput_2024_06_14 {
+    if (!Array.isArray(eventType?.bookingFields) || eventType.bookingFields.length === 0) return eventType;
+
+    const visibleBookingFields: OutputBookingField_2024_06_14[] = [];
+    for (const bookingField of eventType.bookingFields) {
+      if ("hidden" in bookingField && bookingField.hidden === true) {
+        continue;
+      }
+      visibleBookingFields.push(bookingField);
+    }
+    return {
+      ...eventType,
+      bookingFields: visibleBookingFields,
+    };
+  }
 }

apps/api/v2/swagger/documentation.json

@@ -9858,6 +9858,7 @@
       "get": {
         "operationId": "EventTypesController_2024_06_14_getEventTypes",
         "summary": "Get all event types",
+        "description": "Hidden event types are returned only if authentication is provided and it belongs to the event type owner.",
         "parameters": [
           {
             "name": "cal-api-version",
@@ -9913,6 +9914,33 @@
             "schema": {
               "type": "number"
             }
+          },
+          {
+            "name": "Authorization",
+            "in": "header",
+            "description": "value must be `Bearer <token>` where `<token>` is api key prefixed with cal_ or managed user access token",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "x-cal-secret-key",
+            "in": "header",
+            "description": "For platform customers - OAuth client secret key",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "x-cal-client-id",
+            "in": "header",
+            "description": "For platform customers - OAuth client ID",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {