|
| 1 | +import { describe, it, expect, beforeAll, afterAll } from "vitest"; |
| 2 | + |
| 3 | +import { BookingRepository } from "@calcom/features/bookings/repositories/BookingRepository"; |
| 4 | +import { OrganizationRepository } from "@calcom/features/ee/organizations/repositories/OrganizationRepository"; |
| 5 | +import { TeamRepository } from "@calcom/features/ee/teams/repositories/TeamRepository"; |
| 6 | +import { EventTypeRepository } from "@calcom/features/eventtypes/repositories/eventTypeRepository"; |
| 7 | +import { MembershipRepository } from "@calcom/features/membership/repositories/MembershipRepository"; |
| 8 | +import { UserRepository } from "@calcom/features/users/repositories/UserRepository"; |
| 9 | +import { prisma } from "@calcom/prisma"; |
| 10 | +import { BookingStatus, CreationSource, MembershipRole } from "@calcom/prisma/enums"; |
| 11 | + |
| 12 | +import { BookingDetailsService } from "./BookingDetailsService"; |
| 13 | + |
| 14 | +/** |
| 15 | + * Integration tests for BookingDetailsService.getBookingDetails |
| 16 | + * |
| 17 | + * These tests verify that org/team admins can view booking details |
| 18 | + * for bookings made by team members using personal event types (no teamId). |
| 19 | + * |
| 20 | + * On main (before the fix), the access check (checkBookingAccessWithPBAC) returns false |
| 21 | + * for personal event type bookings when the viewer is not the owner/host — even if |
| 22 | + * they are an org/team admin. These tests fail on main, proving the bug. |
| 23 | + * |
| 24 | + * On the PR branch, getBookingDetails uses doesUserIdHaveAccessToBooking which |
| 25 | + * correctly checks org/team admin access for personal event type bookings. |
| 26 | + */ |
| 27 | + |
| 28 | +// Track resource IDs for cleanup |
| 29 | +const createdBookingIds: number[] = []; |
| 30 | +const createdTeamIds: number[] = []; |
| 31 | +const createdUserIds: number[] = []; |
| 32 | + |
| 33 | +describe("BookingDetailsService (Integration Tests)", () => { |
| 34 | + const timestamp = Date.now(); |
| 35 | + |
| 36 | + const orgRepo = new OrganizationRepository({ prismaClient: prisma }); |
| 37 | + const bookingRepo = new BookingRepository(prisma); |
| 38 | + const userRepo = new UserRepository(prisma); |
| 39 | + const eventTypeRepo = new EventTypeRepository(prisma); |
| 40 | + const teamRepo = new TeamRepository(prisma); |
| 41 | + |
| 42 | + // Users |
| 43 | + let bookingOwnerId: number; |
| 44 | + let orgAdminId: number; |
| 45 | + let teamAdminId: number; |
| 46 | + let regularUserId: number; |
| 47 | + |
| 48 | + // Org and team |
| 49 | + let orgId: number; |
| 50 | + let teamId: number; |
| 51 | + |
| 52 | + // Booking |
| 53 | + let personalBookingUid: string; |
| 54 | + |
| 55 | + beforeAll(async () => { |
| 56 | + // 1. Create an organization via OrganizationRepository |
| 57 | + const org = await orgRepo.create({ |
| 58 | + name: `Test Org ${timestamp}`, |
| 59 | + slug: `test-org-${timestamp}`, |
| 60 | + isOrganizationConfigured: true, |
| 61 | + isOrganizationAdminReviewed: true, |
| 62 | + autoAcceptEmail: `test-${timestamp}.com`, |
| 63 | + seats: null, |
| 64 | + pricePerSeat: null, |
| 65 | + isPlatform: false, |
| 66 | + logoUrl: null, |
| 67 | + bio: null, |
| 68 | + brandColor: null, |
| 69 | + bannerUrl: null, |
| 70 | + }); |
| 71 | + orgId = org.id; |
| 72 | + createdTeamIds.push(org.id); |
| 73 | + |
| 74 | + // 2. Create a team within the org (no production TeamRepository.create() exists) |
| 75 | + const team = await prisma.team.create({ |
| 76 | + data: { |
| 77 | + name: `Test Team ${timestamp}`, |
| 78 | + slug: `test-team-${timestamp}`, |
| 79 | + parentId: org.id, |
| 80 | + }, |
| 81 | + select: { id: true }, |
| 82 | + }); |
| 83 | + teamId = team.id; |
| 84 | + createdTeamIds.push(team.id); |
| 85 | + |
| 86 | + // 3. Create booking owner WITH organizationId via UserRepository |
| 87 | + // (eliminates need for separate updateOrganizationId call) |
| 88 | + const bookingOwner = await userRepo.create({ |
| 89 | + email: `booking-owner-${timestamp}@test.com`, |
| 90 | + username: `booking-owner-${timestamp}`, |
| 91 | + organizationId: orgId, |
| 92 | + creationSource: CreationSource.WEBAPP, |
| 93 | + locked: false, |
| 94 | + }); |
| 95 | + bookingOwnerId = bookingOwner.id; |
| 96 | + createdUserIds.push(bookingOwner.id); |
| 97 | + |
| 98 | + // 4. Create other users via UserRepository |
| 99 | + const orgAdmin = await userRepo.create({ |
| 100 | + email: `org-admin-${timestamp}@test.com`, |
| 101 | + username: `org-admin-${timestamp}`, |
| 102 | + organizationId: null, |
| 103 | + creationSource: CreationSource.WEBAPP, |
| 104 | + locked: false, |
| 105 | + }); |
| 106 | + orgAdminId = orgAdmin.id; |
| 107 | + createdUserIds.push(orgAdmin.id); |
| 108 | + |
| 109 | + const teamAdmin = await userRepo.create({ |
| 110 | + email: `team-admin-${timestamp}@test.com`, |
| 111 | + username: `team-admin-${timestamp}`, |
| 112 | + organizationId: null, |
| 113 | + creationSource: CreationSource.WEBAPP, |
| 114 | + locked: false, |
| 115 | + }); |
| 116 | + teamAdminId = teamAdmin.id; |
| 117 | + createdUserIds.push(teamAdmin.id); |
| 118 | + |
| 119 | + const regularUser = await userRepo.create({ |
| 120 | + email: `regular-user-${timestamp}@test.com`, |
| 121 | + username: `regular-user-${timestamp}`, |
| 122 | + organizationId: null, |
| 123 | + creationSource: CreationSource.WEBAPP, |
| 124 | + locked: false, |
| 125 | + }); |
| 126 | + regularUserId = regularUser.id; |
| 127 | + createdUserIds.push(regularUser.id); |
| 128 | + |
| 129 | + // 5. Create memberships via MembershipRepository (static method) |
| 130 | + await MembershipRepository.create({ |
| 131 | + userId: bookingOwnerId, |
| 132 | + teamId: orgId, |
| 133 | + role: MembershipRole.MEMBER, |
| 134 | + accepted: true, |
| 135 | + }); |
| 136 | + |
| 137 | + await MembershipRepository.create({ |
| 138 | + userId: bookingOwnerId, |
| 139 | + teamId: teamId, |
| 140 | + role: MembershipRole.MEMBER, |
| 141 | + accepted: true, |
| 142 | + }); |
| 143 | + |
| 144 | + await MembershipRepository.create({ |
| 145 | + userId: orgAdminId, |
| 146 | + teamId: orgId, |
| 147 | + role: MembershipRole.ADMIN, |
| 148 | + accepted: true, |
| 149 | + }); |
| 150 | + |
| 151 | + await MembershipRepository.create({ |
| 152 | + userId: teamAdminId, |
| 153 | + teamId: teamId, |
| 154 | + role: MembershipRole.ADMIN, |
| 155 | + accepted: true, |
| 156 | + }); |
| 157 | + |
| 158 | + // 6. Create a personal event type (no teamId) via EventTypeRepository |
| 159 | + const personalEventType = await eventTypeRepo.create({ |
| 160 | + title: `Personal Event ${timestamp}`, |
| 161 | + slug: `personal-event-${timestamp}`, |
| 162 | + length: 30, |
| 163 | + userId: bookingOwnerId, |
| 164 | + }); |
| 165 | + |
| 166 | + // 7. Create a booking on the personal event type via BookingRepository |
| 167 | + personalBookingUid = `personal-booking-${timestamp}`; |
| 168 | + const booking = await bookingRepo.createBookingForManagedEventReassignment({ |
| 169 | + uid: personalBookingUid, |
| 170 | + userId: bookingOwnerId, |
| 171 | + userPrimaryEmail: `booking-owner-${timestamp}@test.com`, |
| 172 | + eventTypeId: personalEventType.id, |
| 173 | + title: `Personal Booking ${timestamp}`, |
| 174 | + description: null, |
| 175 | + startTime: new Date("2026-03-01T10:00:00.000Z"), |
| 176 | + endTime: new Date("2026-03-01T10:30:00.000Z"), |
| 177 | + status: BookingStatus.ACCEPTED, |
| 178 | + location: null, |
| 179 | + smsReminderNumber: null, |
| 180 | + idempotencyKey: `idempotency-${timestamp}`, |
| 181 | + iCalUID: `ical-${timestamp}@test.com`, |
| 182 | + iCalSequence: 0, |
| 183 | + attendees: [{ email: "attendee@test.com", name: "Test Attendee", timeZone: "UTC", locale: "en" }], |
| 184 | + }); |
| 185 | + createdBookingIds.push(booking.id); |
| 186 | + }); |
| 187 | + |
| 188 | + afterAll(async () => { |
| 189 | + // Clean up bookings and attendees |
| 190 | + if (createdBookingIds.length > 0) { |
| 191 | + await prisma.attendee.deleteMany({ where: { bookingId: { in: createdBookingIds } } }); |
| 192 | + await prisma.booking.deleteMany({ where: { id: { in: createdBookingIds } } }); |
| 193 | + } |
| 194 | + |
| 195 | + // Delete personal event types not associated with a team |
| 196 | + if (createdUserIds.length > 0) { |
| 197 | + await prisma.eventType.deleteMany({ where: { userId: { in: createdUserIds } } }); |
| 198 | + } |
| 199 | + |
| 200 | + // Delete users (memberships, profiles, schedules, availability) |
| 201 | + // Must happen before team deletion so user.organizationId FK is removed |
| 202 | + if (createdUserIds.length > 0) { |
| 203 | + await prisma.membership.deleteMany({ where: { userId: { in: createdUserIds } } }); |
| 204 | + await prisma.profile.deleteMany({ where: { userId: { in: createdUserIds } } }); |
| 205 | + for (const userId of createdUserIds) { |
| 206 | + await prisma.availability.deleteMany({ where: { Schedule: { userId } } }); |
| 207 | + await prisma.schedule.deleteMany({ where: { userId } }); |
| 208 | + await prisma.user.delete({ where: { id: userId } }); |
| 209 | + } |
| 210 | + } |
| 211 | + |
| 212 | + // TeamRepository.deleteById handles remaining memberships + managed event types |
| 213 | + for (const id of [...createdTeamIds].reverse()) { |
| 214 | + await teamRepo.deleteById({ id }); |
| 215 | + } |
| 216 | + }); |
| 217 | + |
| 218 | + describe("getBookingDetails - personal event type bookings", () => { |
| 219 | + it("should allow the booking owner to view their own booking details", async () => { |
| 220 | + const service = new BookingDetailsService(prisma); |
| 221 | + |
| 222 | + const result = await service.getBookingDetails({ |
| 223 | + userId: bookingOwnerId, |
| 224 | + bookingUid: personalBookingUid, |
| 225 | + }); |
| 226 | + |
| 227 | + expect(result).toBeDefined(); |
| 228 | + expect(result.rescheduledToBooking).toBeNull(); |
| 229 | + expect(result.previousBooking).toBeNull(); |
| 230 | + }); |
| 231 | + |
| 232 | + it("should allow an org admin to view booking details for a team member's personal event type booking", async () => { |
| 233 | + const service = new BookingDetailsService(prisma); |
| 234 | + |
| 235 | + const result = await service.getBookingDetails({ |
| 236 | + userId: orgAdminId, |
| 237 | + bookingUid: personalBookingUid, |
| 238 | + }); |
| 239 | + |
| 240 | + expect(result).toBeDefined(); |
| 241 | + expect(result.rescheduledToBooking).toBeNull(); |
| 242 | + expect(result.previousBooking).toBeNull(); |
| 243 | + }); |
| 244 | + |
| 245 | + it("should allow a team admin to view booking details for a team member's personal event type booking", async () => { |
| 246 | + const service = new BookingDetailsService(prisma); |
| 247 | + |
| 248 | + const result = await service.getBookingDetails({ |
| 249 | + userId: teamAdminId, |
| 250 | + bookingUid: personalBookingUid, |
| 251 | + }); |
| 252 | + |
| 253 | + expect(result).toBeDefined(); |
| 254 | + expect(result.rescheduledToBooking).toBeNull(); |
| 255 | + expect(result.previousBooking).toBeNull(); |
| 256 | + }); |
| 257 | + |
| 258 | + it("should deny access to a non-admin user viewing another user's personal event type booking", async () => { |
| 259 | + const service = new BookingDetailsService(prisma); |
| 260 | + |
| 261 | + await expect( |
| 262 | + service.getBookingDetails({ |
| 263 | + userId: regularUserId, |
| 264 | + bookingUid: personalBookingUid, |
| 265 | + }) |
| 266 | + ).rejects.toThrow("You do not have permission to view this booking"); |
| 267 | + }); |
| 268 | + |
| 269 | + it("should throw when booking does not exist", async () => { |
| 270 | + const service = new BookingDetailsService(prisma); |
| 271 | + |
| 272 | + await expect( |
| 273 | + service.getBookingDetails({ |
| 274 | + userId: bookingOwnerId, |
| 275 | + bookingUid: "non-existent-booking-uid", |
| 276 | + }) |
| 277 | + ).rejects.toThrow("You do not have permission to view this booking"); |
| 278 | + }); |
| 279 | + }); |
| 280 | +}); |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?v=4&size=40){kind=avatar}
0 commit comments