fix(http-outgoingmessage-headers): crash

AugustinMauroy · AugustinMauroy · commit 0e7840bd8a13 · 2026-07-13T22:55:52.000+02:00
cause: .slip on undefined dued to catching imported type
diff --git a/recipes/http-outgoingmessage-headers/tests/cal-com-fixutres/expected.ts b/recipes/http-outgoingmessage-headers/tests/cal-com-fixutres/expected.ts
@@ -0,0 +1,91 @@
+// took form https://github.com/calcom/cal.diy/blob/e3eaa69339c549365f7749634e5d27f3aef1462f/packages/features/bot-detection/BotDetectionService.ts
+import { checkBotId } from "botid/server";
+import type { IncomingHttpHeaders } from "node:http";
+
+import type { EventTypeRepository } from "@calcom/features/eventtypes/repositories/eventTypeRepository";
+import type { FeaturesRepository } from "@calcom/features/flags/features.repository";
+import { ErrorCode } from "@calcom/lib/errorCodes";
+import { ErrorWithCode } from "@calcom/lib/errors";
+import { HttpError } from "@calcom/lib/http-error";
+import logger from "@calcom/lib/logger";
+
+interface BotDetectionConfig {
+  eventTypeId?: number;
+  headers: IncomingHttpHeaders;
+}
+
+const log = logger.getSubLogger({ prefix: ["[BotDetectionService]"] });
+
+export class BotDetectionService {
+  constructor(
+    private featuresRepository: FeaturesRepository,
+    private eventTypeRepository: EventTypeRepository
+  ) {}
+
+  private instanceHasBotIdEnabled() {
+    return process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER === "1";
+  }
+
+  async checkBotDetection(config: BotDetectionConfig): Promise<void> {
+    if (!this.instanceHasBotIdEnabled()) return;
+
+    const { eventTypeId, headers } = config;
+
+    // If no eventTypeId provided, skip bot detection
+    if (!eventTypeId) {
+      return;
+    }
+
+    if (!Number.isInteger(eventTypeId) || eventTypeId <= 0) {
+      throw new ErrorWithCode(
+        ErrorCode.BadRequest,
+        `Invalid eventTypeId: ${eventTypeId}. Must be a positive integer.`
+      );
+    }
+
+    // Fetch only the teamId from the event type
+    const eventType = await this.eventTypeRepository.getTeamIdByEventTypeId({
+      id: eventTypeId,
+    });
+
+    // Only check for team events
+    if (!eventType?.teamId) {
+      return;
+    }
+
+    // Check if BotID feature is enabled for this team (also checks global scope - enabling on all teams)
+    const isBotIDEnabled = await this.featuresRepository.checkIfTeamHasFeature(
+      eventType.teamId,
+      "booker-botid"
+    );
+
+    if (!isBotIDEnabled) {
+      return;
+    }
+
+    // Perform bot detection
+    const verification = await checkBotId({
+      advancedOptions: {
+        headers,
+      },
+    });
+
+    // Log verification results with detailed information
+    const verificationDetails = {
+      isBot: verification.isBot,
+      isHuman: verification.isHuman,
+      isVerifiedBot: verification.isVerifiedBot,
+      verifiedBotName: verification.verifiedBotName,
+      verifiedBotCategory: verification.verifiedBotCategory,
+      bypassed: verification.bypassed,
+      classificationReason: verification.classificationReason,
+      teamId: eventType.teamId,
+      eventTypeId,
+    };
+
+    if (verification.isBot) {
+      log.warn("Bot detected - blocking request", verificationDetails);
+      throw new HttpError({ statusCode: 403, message: "Access denied" });
+    }
+  }
+}
diff --git a/recipes/http-outgoingmessage-headers/tests/cal-com-fixutres/input.ts b/recipes/http-outgoingmessage-headers/tests/cal-com-fixutres/input.ts
@@ -0,0 +1,91 @@
+// took form https://github.com/calcom/cal.diy/blob/e3eaa69339c549365f7749634e5d27f3aef1462f/packages/features/bot-detection/BotDetectionService.ts
+import { checkBotId } from "botid/server";
+import type { IncomingHttpHeaders } from "node:http";
+
+import type { EventTypeRepository } from "@calcom/features/eventtypes/repositories/eventTypeRepository";
+import type { FeaturesRepository } from "@calcom/features/flags/features.repository";
+import { ErrorCode } from "@calcom/lib/errorCodes";
+import { ErrorWithCode } from "@calcom/lib/errors";
+import { HttpError } from "@calcom/lib/http-error";
+import logger from "@calcom/lib/logger";
+
+interface BotDetectionConfig {
+  eventTypeId?: number;
+  headers: IncomingHttpHeaders;
+}
+
+const log = logger.getSubLogger({ prefix: ["[BotDetectionService]"] });
+
+export class BotDetectionService {
+  constructor(
+    private featuresRepository: FeaturesRepository,
+    private eventTypeRepository: EventTypeRepository
+  ) {}
+
+  private instanceHasBotIdEnabled() {
+    return process.env.NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER === "1";
+  }
+
+  async checkBotDetection(config: BotDetectionConfig): Promise<void> {
+    if (!this.instanceHasBotIdEnabled()) return;
+
+    const { eventTypeId, headers } = config;
+
+    // If no eventTypeId provided, skip bot detection
+    if (!eventTypeId) {
+      return;
+    }
+
+    if (!Number.isInteger(eventTypeId) || eventTypeId <= 0) {
+      throw new ErrorWithCode(
+        ErrorCode.BadRequest,
+        `Invalid eventTypeId: ${eventTypeId}. Must be a positive integer.`
+      );
+    }
+
+    // Fetch only the teamId from the event type
+    const eventType = await this.eventTypeRepository.getTeamIdByEventTypeId({
+      id: eventTypeId,
+    });
+
+    // Only check for team events
+    if (!eventType?.teamId) {
+      return;
+    }
+
+    // Check if BotID feature is enabled for this team (also checks global scope - enabling on all teams)
+    const isBotIDEnabled = await this.featuresRepository.checkIfTeamHasFeature(
+      eventType.teamId,
+      "booker-botid"
+    );
+
+    if (!isBotIDEnabled) {
+      return;
+    }
+
+    // Perform bot detection
+    const verification = await checkBotId({
+      advancedOptions: {
+        headers,
+      },
+    });
+
+    // Log verification results with detailed information
+    const verificationDetails = {
+      isBot: verification.isBot,
+      isHuman: verification.isHuman,
+      isVerifiedBot: verification.isVerifiedBot,
+      verifiedBotName: verification.verifiedBotName,
+      verifiedBotCategory: verification.verifiedBotCategory,
+      bypassed: verification.bypassed,
+      classificationReason: verification.classificationReason,
+      teamId: eventType.teamId,
+      eventTypeId,
+    };
+
+    if (verification.isBot) {
+      log.warn("Bot detected - blocking request", verificationDetails);
+      throw new HttpError({ statusCode: 403, message: "Access denied" });
+    }
+  }
+}
diff --git a/recipes/http-outgoingmessage-headers/tests/check-if-exists/expected.ts b/recipes/http-outgoingmessage-headers/tests/check-if-exists/expected.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 const server = http.createServer((req, res) => {
 	res.setHeader('content-type', 'application/json');
diff --git a/recipes/http-outgoingmessage-headers/tests/check-if-exists/input.ts b/recipes/http-outgoingmessage-headers/tests/check-if-exists/input.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 const server = http.createServer((req, res) => {
 	res.setHeader('content-type', 'application/json');
diff --git a/recipes/http-outgoingmessage-headers/tests/iterating-over-headers/expected.ts b/recipes/http-outgoingmessage-headers/tests/iterating-over-headers/expected.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 const server = http.createServer((req, res) => {
 	res.setHeader('content-type', 'application/json');
diff --git a/recipes/http-outgoingmessage-headers/tests/iterating-over-headers/input.ts b/recipes/http-outgoingmessage-headers/tests/iterating-over-headers/input.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 const server = http.createServer((req, res) => {
 	res.setHeader('content-type', 'application/json');
diff --git a/recipes/http-outgoingmessage-headers/tests/reading-headers/expected.ts b/recipes/http-outgoingmessage-headers/tests/reading-headers/expected.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 function handler(req, res) {
 	res.setHeader('content-type', 'application/json');
diff --git a/recipes/http-outgoingmessage-headers/tests/reading-headers/input.ts b/recipes/http-outgoingmessage-headers/tests/reading-headers/input.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 function handler(req, res) {
 	res.setHeader('content-type', 'application/json');
diff --git a/recipes/http-outgoingmessage-headers/tests/supported-methods/expected.ts b/recipes/http-outgoingmessage-headers/tests/supported-methods/expected.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 const server = http.createServer((req, res) => {
 	res.setHeader('content-type', 'application/json');
diff --git a/recipes/http-outgoingmessage-headers/tests/supported-methods/input.ts b/recipes/http-outgoingmessage-headers/tests/supported-methods/input.ts
@@ -1,4 +1,4 @@
-const http = require('http');
+const http = require('node:http');
 
 const server = http.createServer((req, res) => {
 	res.setHeader('content-type', 'application/json');
diff --git a/utils/src/ast-grep/import-statement.test.ts b/utils/src/ast-grep/import-statement.test.ts
@@ -230,4 +230,22 @@ describe("import-statement", () => {
 		assert.strictEqual(emptyImports.length, 1);
 		assert.strictEqual(getDefaultImportIdentifier(emptyImports[0]), null);
 	});
+
+	it("should ignore type imports", () => {
+		const code = dedent`
+			import fs from "fs";
+			import type fsType from "fs";
+
+			import { join } from "node:path";
+			import type { ParsedPath } from "node:path";
+
+			import type {} from "empty";
+		`;
+
+		const ast = astGrep.parse(astGrep.Lang.TypeScript, code);
+
+		assert.strictEqual(getNodeImportStatements(ast, "fs").length, 1);
+		assert.strictEqual(getNodeImportStatements(ast, "path").length, 1);
+		assert.strictEqual(getNodeImportStatements(ast, "empty").length, 0);
+	});
 });
diff --git a/utils/src/ast-grep/import-statement.ts b/utils/src/ast-grep/import-statement.ts
@@ -1,10 +1,11 @@
 import type { Rule, SgNode, SgRoot } from '@codemod.com/jssg-types/main';
 import type Js from '@codemod.com/jssg-types/langs/javascript';
+import type Ts from '@codemod.com/jssg-types/langs/typescript';
 
 export const getNodeImportStatements = (
-	rootNode: SgRoot<Js>,
+	rootNode: SgRoot<Js | Ts>,
 	nodeModuleName: string,
-): SgNode<Js>[] =>
+): SgNode<Js | Ts>[] =>
 	rootNode.root().findAll({
 		rule: {
 			kind: 'import_statement',
@@ -16,7 +17,11 @@ export const getNodeImportStatements = (
 					regex: `(node:)?${nodeModuleName}$`,
 				},
 			},
+			not: {
+				pattern: 'import type $$$IMPORTS from $SOURCE',
+			}
 		},
+
 	});
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-const http = require('http');`
	`1`	`+const http = require('node:http');`
`2`	`2`
`3`	`3`	`const server = http.createServer((req, res) => {`
`4`	`4`	`res.setHeader('content-type', 'application/json');`