-
Notifications
You must be signed in to change notification settings - Fork 12k
fix: event host unable to cancel event when Disable Cancelling is enabled.
#24021
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
cff3778
f13782b
786b702
7666088
35d6eb1
dd435b5
9a7316b
635059c
6b98b56
34a5fb0
f97bb6a
18ac758
0148bdb
9348f9c
7fe57a9
d32a8a0
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -208,16 +208,35 @@ async function handler(input: CancelBookingInput, dependencies?: Dependencies) { | |
| throw new HttpError({ statusCode: 400, message: "User not found" }); | ||
| } | ||
|
|
||
| if (bookingToDelete.eventType?.disableCancelling) { | ||
| let isCancellationUserHost = false; | ||
| if (userId) { | ||
| if (bookingToDelete.userId === userId) { | ||
| isCancellationUserHost = true; | ||
| } | ||
| else if (bookingToDelete.eventType?.hosts?.some((host) => host.user.id === userId)) { | ||
| isCancellationUserHost = true; | ||
| } | ||
| else if (bookingToDelete.eventType?.owner?.id === userId) { | ||
| isCancellationUserHost = true; | ||
| } | ||
| else if ( | ||
| await PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost( | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P3: Duplicated host-authorization logic triggers the org-admin DB lookup twice for seated events, adding redundant query work and risking drift between the two authorization checks. Consider reusing the earlier computed result (e.g., cache the org-admin check or reuse isCancellationUserHost) instead of repeating the same call. Prompt for AI agents |
||
| userId, | ||
| bookingToDelete.userId | ||
| ) | ||
| ) { | ||
| isCancellationUserHost = true; | ||
| } | ||
| } | ||
|
|
||
| // Only the host can cancel the booking even when the cancellation is disabled for the event | ||
| if (!isCancellationUserHost && bookingToDelete.eventType?.disableCancelling) { | ||
| throw new HttpError({ | ||
| statusCode: 400, | ||
| message: "This event type does not allow cancellations", | ||
| }); | ||
| } | ||
|
|
||
| const isCancellationUserHost = | ||
| bookingToDelete.userId === userId || bookingToDelete.user.email === cancelledBy; | ||
|
|
||
| if ( | ||
| !platformClientId && | ||
| !cancellationReason?.trim() && | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
P2: isHost is computed using only userId equality, which doesn’t account for team host assignments that depend on attendee email. This diverges from server-side host determination and can block legitimate hosts from canceling/rescheduling when Disable Cancelling is enabled.
Prompt for AI agents