feat: api v2 DELETE booking attendees endpoint (calcom#27781)

* feat: remove attendee endpoint

* fix: remove attendee email from error logs to avoid logging PII

Co-Authored-By: unknown <>

* fix: add isBookingAuditEnabled to removeAttendee handler

Align removeAttendee.handler.ts with the new onAttendeeRemoved interface
that requires isBookingAuditEnabled, following the same pattern used in
addGuests.handler.ts.

Co-Authored-By: bot_apk <apk@cognition.ai>

* style: apply biome formatting to conflict-resolved files

Co-Authored-By: bot_apk <apk@cognition.ai>

* chore: implement PR feedback

* fixup

* revert: biome formatting changes

* chore: implement feedback part 1

* chore: implement feedback part 2

* fix: await cancellation email flow to prevent uncaught promise rejections

The fire-and-forget .then() chain on prepareAttendeePerson() left
rejections from that promise uncaught. Await both prepareAttendeePerson()
and sendCancelledEmailToAttendee() so errors are properly handled.
sendCancelledEmailToAttendee() already has an internal try/catch, so
awaiting it will not cause the overall removeAttendee flow to fail on
email errors.

Addresses Cubic AI review (confidence 9/10).

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* chore: implement feedback part 3

* chore: implement devin feedback

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: bot_apk <apk@cognition.ai>

Author: 3 people

apps/api/v2/src/ee/bookings/2024-08-13/bookings.module.ts

@@ -30,6 +30,7 @@ import { EventTypesModule_2024_06_14 } from "@/ee/event-types/event-types_2024_0
 import { EventTypesRepository_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/event-types.repository";
 import { OutputEventTypesService_2024_06_14 } from "@/ee/event-types/event-types_2024_06_14/services/output-event-types.service";
 import { SchedulesModule_2024_04_15 } from "@/ee/schedules/schedules_2024_04_15/schedules.module";
+import { BookingAttendeesModule } from "@/lib/modules/booking-attendees.module";
 import { BookingEventHandlerModule } from "@/lib/modules/booking-event-handler.module";
 import { InstantBookingModule } from "@/lib/modules/instant-booking.module";
 import { RecurringBookingModule } from "@/lib/modules/recurring-booking.module";
@@ -80,6 +81,7 @@ import { UsersModule } from "@/modules/users/users.module";
     RecurringBookingModule,
     InstantBookingModule,
     BookingEventHandlerModule,
+    BookingAttendeesModule,
   ],
   providers: [
     TokensRepository,

apps/api/v2/src/ee/bookings/2024-08-13/controllers/booking-attendees.controller.ts

@@ -1,33 +1,28 @@
-import {
-  BOOKING_WRITE,
-  BOOKING_READ,
-  SUCCESS_STATUS,
-} from "@calcom/platform-constants";
+import { BOOKING_READ, BOOKING_WRITE, SUCCESS_STATUS } from "@calcom/platform-constants";
 import { AddAttendeeInput_2024_08_13 } from "@calcom/platform-types";
 import {
   Body,
   Controller,
+  Delete,
+  Get,
   HttpCode,
   HttpStatus,
   Param,
+  ParseIntPipe,
   Post,
   UseGuards,
-  Get,
-  ParseIntPipe,
 } from "@nestjs/common";
 import { ApiHeader, ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
 import { BookingPbacGuard } from "@/ee/bookings/2024-08-13/guards/booking-pbac.guard";
 import { BookingUidGuard } from "@/ee/bookings/2024-08-13/guards/booking-uid.guard";
 import { AddAttendeeOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/add-attendee.output";
 import {
-  GetBookingAttendeesOutput_2024_08_13,
   GetBookingAttendeeOutput_2024_08_13,
+  GetBookingAttendeesOutput_2024_08_13,
 } from "@/ee/bookings/2024-08-13/outputs/get-booking-attendees.output";
+import { RemoveAttendeeOutput_2024_08_13 } from "@/ee/bookings/2024-08-13/outputs/remove-attendee.output";
 import { BookingAttendeesService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/booking-attendees.service";
-import {
-  VERSION_2024_08_13,
-  VERSION_2024_08_13_VALUE,
-} from "@/lib/api-versions";
+import { VERSION_2024_08_13, VERSION_2024_08_13_VALUE } from "@/lib/api-versions";
 import { API_KEY_OR_ACCESS_TOKEN_HEADER } from "@/lib/docs/headers";
 import { Throttle } from "@/lib/endpoint-throttler-decorator";
 import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
@@ -49,9 +44,7 @@ import { ApiAuthGuardUser } from "@/modules/auth/strategies/api-auth/api-auth.st
   required: true,
 })
 export class BookingAttendeesController_2024_08_13 {
-  constructor(
-    private readonly bookingAttendeesService: BookingAttendeesService_2024_08_13
-  ) {}
+  constructor(private readonly bookingAttendeesService: BookingAttendeesService_2024_08_13) {}
 
   @Get("/")
   @Permissions([BOOKING_READ])
@@ -68,9 +61,7 @@ export class BookingAttendeesController_2024_08_13 {
     @Param("bookingUid") bookingUid: string,
     @GetUser() user: ApiAuthGuardUser
   ): Promise<GetBookingAttendeesOutput_2024_08_13> {
-    const attendees = await this.bookingAttendeesService.getBookingAttendees(
-      bookingUid
-    );
+    const attendees = await this.bookingAttendeesService.getBookingAttendees(bookingUid);
 
     return {
       status: SUCCESS_STATUS,
@@ -93,10 +84,7 @@ export class BookingAttendeesController_2024_08_13 {
     @Param("bookingUid") bookingUid: string,
     @Param("attendeeId", ParseIntPipe) attendeeId: number
   ): Promise<GetBookingAttendeeOutput_2024_08_13> {
-    const attendee = await this.bookingAttendeesService.getBookingAttendee(
-      bookingUid,
-      attendeeId
-    );
+    const attendee = await this.bookingAttendeesService.getBookingAttendee(bookingUid, attendeeId);
 
     return {
       status: SUCCESS_STATUS,
@@ -135,15 +123,42 @@ export class BookingAttendeesController_2024_08_13 {
     @Body() body: AddAttendeeInput_2024_08_13,
     @GetUser() user: ApiAuthGuardUser
   ): Promise<AddAttendeeOutput_2024_08_13> {
-    const attendee = await this.bookingAttendeesService.addAttendee(
-      bookingUid,
-      body,
-      user
-    );
+    const attendee = await this.bookingAttendeesService.addAttendee(bookingUid, body, user);
 
     return {
       status: SUCCESS_STATUS,
       data: attendee,
     };
   }
+
+  @Delete("/:attendeeId")
+  @HttpCode(HttpStatus.OK)
+  @Permissions([BOOKING_WRITE])
+  @UseGuards(ApiAuthGuard, BookingUidGuard)
+  @Throttle({
+    limit: 5,
+    ttl: 60000,
+    blockDuration: 60000,
+    name: "booking_attendees_remove",
+  })
+  @ApiHeader(API_KEY_OR_ACCESS_TOKEN_HEADER)
+  @ApiOperation({
+    summary: "Remove an attendee from a booking",
+    description: `Remove an attendee from an existing booking by their attendee ID. The primary attendee (first attendee) cannot be removed — to remove them, cancel the booking instead. The removed attendee will receive a cancellation email notification.
+
+    <Note>The cal-api-version header is required for this endpoint. Without it, the request will fail with a 404 error.</Note>
+    `,
+  })
+  async removeAttendee(
+    @Param("bookingUid") bookingUid: string,
+    @Param("attendeeId", ParseIntPipe) attendeeId: number,
+    @GetUser() user: ApiAuthGuardUser
+  ): Promise<RemoveAttendeeOutput_2024_08_13> {
+    const removedAttendee = await this.bookingAttendeesService.removeAttendee(bookingUid, attendeeId, user);
+
+    return {
+      status: SUCCESS_STATUS,
+      data: removedAttendee,
+    };
+  }
 }