fix: Booker reschedule behaviour for org admin#26530
Conversation
|
most of these are just linting changes |
| const isUserIdInBooking = theBooking.userId === userId; | ||
|
|
||
| if (!isOwnerOfBooking && !isHostOfEventType && !isUserIdInBooking) return null; | ||
| const isOrgAdmin = |
There was a problem hiding this comment.
this ensures if an org admin tries to reschedule booking belonging to members of his org we dont throw an error
There was a problem hiding this comment.
We should use PBAC here for booking.read or whatever permission you see fit with fallback roles of adminOrOwner.
This ADMIN field this checks in orgs isnt 100% true when PBAC is enabled
| user: { | ||
| select: { | ||
| id: true, | ||
| username: true, |
There was a problem hiding this comment.
for rescheduling its better to use the host username that we get from get-booking
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
| const queryClient = useQueryClient(); | ||
|
|
||
| const username = useMemo(() => { | ||
| // when rescheduling, prefer the booking host's username from bookingData |
There was a problem hiding this comment.
this is the only change thats been made in BookerPlatformWrapper, rest are just linting changes
| const isUserIdInBooking = theBooking.userId === userId; | ||
|
|
||
| if (!isOwnerOfBooking && !isHostOfEventType && !isUserIdInBooking) return null; | ||
| const isOrgAdmin = |
There was a problem hiding this comment.
We should use PBAC here for booking.read or whatever permission you see fit with fallback roles of adminOrOwner.
This ADMIN field this checks in orgs isnt 100% true when PBAC is enabled
|
@sean-brydon this is for a platform customer and platform orgs dont use PBAC. I don't think we let anyone do this on app.cal.com |
They can though right? This is still core logic that should take it into account I think? I don’t belive this is a platform specific file |
This comment was marked as outdated.
This comment was marked as outdated.
| let hasOrgAccess = false; | ||
| if (userId && theBooking.user?.organizationId) { | ||
| const permissionCheckService = new PermissionCheckService(); | ||
| hasOrgAccess = await permissionCheckService.checkPermission({ |
There was a problem hiding this comment.
@sean-brydon we use pbac now to check if user is org admin or not
E2E results are ready! |
4 participants
Summary by cubic
Fixes rescheduling so org admins can reschedule seated bookings and bookings they manage without ownership errors. Ensures the Booker loads the correct event type by using the booking host’s username during reschedule.
Written for commit 19394e7. Summary will update on new commits.