fix: v2 hidden event types #23584
fix: v2 hidden event types #23584
Conversation
WalkthroughThe PR makes GET /v2/event-types optional-auth aware and threads an optional auth user through controller → service to enforce visibility: hidden event types are returned only to their owner. BookingFields filtering is moved from the controller into OutputEventTypesService. Service methods were refactored to accept params objects and accept optional authUser. A repository helper to fetch public (non-hidden) user event types was added. Swagger docs now document optional auth headers. E2E tests were updated to use API keys and cover hidden/owner/non-owner behaviors. Assessment against linked issues
Out-of-scope changesNo out-of-scope functional code changes were identified relevant to the objectives in the linked issue. Possibly related PRs
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 180000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
keithwillcode
added
core
dosubot
bot
added
event-types
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts (1)
2368-2371: Syntax error: stray “+” before expectThis will break the test file parsing.
Apply this fix:
- +expect(updatedEventType.hidden).toBe(false); + expect(updatedEventType.hidden).toBe(false);
🧹 Nitpick comments (7)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts (1)
349-356: Naming nit: avoid confusion with “hidden” event types.These helpers filter hidden booking fields, not hidden event types. Consider
filterHiddenBookingFields/filterHiddenBookingFieldsInListfor clarity.apps/api/v2/swagger/documentation.json (2)
9861-9861: Clarify owner-only behavior and default exclusion in descriptionThe current phrasing is ambiguous. Recommend explicitly stating exclusion by default and owner-only inclusion when authenticated.
- "description": "Hidden event types are returned only if authentication is provided and it belongs to the event type owner.", + "description": "Hidden event types are excluded unless the request is authenticated as the owner of the event type; in that case, the owner's hidden event types are included.",
9917-9944: Tighten auth header docs and add examples
- Update the Authorization header description: capitalize “API key,” clarify token formats, and add
"example": "Bearer cal_xxxxxxxxxxxxxxxxx".- Mark
x-cal-secret-keyas a password ("format": "password") and add
"example": "sk_live_xxxxxxxxxxxxxxxxx".- Add
"example": "client_abc123"forx-cal-client-id.
Optionally model these viacomponents.securitySchemesin a follow-up to avoid duplicating header parameters.apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts (2)
207-227: Objective #2 gap: “all event types for the authenticated user” not exposedToday, when no
username,eventSlug, orusernamesare provided, you return[]. If the product intent is to add an authenticated endpoint for “my event types,” consider either adding a dedicated route (e.g.,GET /v2/me/event-types) or a safe fallback here whenauthUseris present.Example minimal fallback inside this method:
async getEventTypes(queryParams: GetEventTypesQuery_2024_06_14, authUser?: AuthOptionalUser) { const { username, eventSlug, usernames, orgSlug, orgId } = queryParams; + // Optional: return authenticated user's own event types when no explicit target is provided + if (!username && !eventSlug && !usernames && authUser?.id) { + return await this.getUserEventTypes(authUser.id); + }
42-43: Avoid eslint-disable by typing the input sans destinationCalendarInstead of suppressing the lint rule, consider typing
createEventTypeinput with anOmit<...,"destinationCalendar">at the call site, or pre-omit the field before the transform step to keep this function clean.apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts (1)
762-787: Add positive owner test for hidden eventSlugYou cover non-owner and unauth for hidden slugs; add the owner case to prevent regressions.
Suggested test:
+ it(`/GET/event-types by username and eventSlug should return hidden event type for the owner`, async () => { + const res = await request(app.getHttpServer()) + .get(`/api/v2/event-types?username=${user.username}&eventSlug=${hiddenEventType.slug}`) + .set(CAL_API_VERSION_HEADER, VERSION_2024_06_14) + .set("Authorization", `Bearer ${apiKeyString}`) + .expect(200); + const body: ApiSuccessResponse<EventTypeOutput_2024_06_14[]> = res.body; + expect(body.data?.length).toEqual(1); + expect(body.data?.[0]?.id).toEqual(hiddenEventType.id); + expect(body.data?.[0]?.hidden).toEqual(true); + });apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.ts (1)
176-181: Parse route param to number in Delete endpoint
@Param("eventTypeId")won’t be coerced at runtime; mirror the update route and addParseIntPipeto avoid string IDs slipping through.Apply:
- async deleteEventType( - @Param("eventTypeId") eventTypeId: number, + async deleteEventType( + @Param("eventTypeId", ParseIntPipe) eventTypeId: number, @GetUser("id") userId: number ): Promise<DeleteEventTypeOutput_2024_06_14> {
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (6)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts(30 hunks)apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.ts(3 hunks)apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts(1 hunks)apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts(5 hunks)apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts(3 hunks)apps/api/v2/swagger/documentation.json(2 hunks)
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{service,repository}.ts
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
Avoid dot-suffixes like
.service.tsor.repository.tsfor new files; reserve.test.ts,.spec.ts,.types.tsfor their specific purposes
Files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts
**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
**/*.ts: For Prisma queries, only select data you need; never useinclude, always useselect
Ensure thecredential.keyfield is never returned from tRPC endpoints or APIs
Files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/review.mdc)
Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js
.utc()in hot paths like loops
Files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
Flag default exports and encourage named exports. Named exports provide better tree-shaking, easier refactoring, and clearer imports. Exempt main components like pages, layouts, and components that serve as the primary export of a module.
Files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts
🧠 Learnings (5)
📓 Common learnings
Learnt from: supalarry
PR: calcom/cal.com#23364
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/transformers/internal-to-api/internal-to-api.spec.ts:295-296
Timestamp: 2025-08-27T13:32:46.887Z
Learning: In calcom/cal.com, when transforming booking fields from internal to API format, tests in organizations-event-types.e2e-spec.ts already expect name field label and placeholder to be empty strings ("") rather than undefined. PR changes that set these to explicit empty strings are typically fixing implementation to match existing test expectations rather than breaking changes.
Learnt from: supalarry
PR: calcom/cal.com#23217
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts:93-94
Timestamp: 2025-08-21T13:44:06.805Z
Learning: In apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts, repository functions that use explicit Prisma select clauses (like getEventTypeWithSeats) are used for specific purposes and don't need to include all EventType fields like bookingRequiresAuthentication. These methods don't feed into the general OutputEventTypesService_2024_06_14 flow.
📚 Learning: 2025-08-21T13:44:06.805Z
Learnt from: supalarry
PR: calcom/cal.com#23217
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts:93-94
Timestamp: 2025-08-21T13:44:06.805Z
Learning: In apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts, repository functions that use explicit Prisma select clauses (like getEventTypeWithSeats) are used for specific purposes and don't need to include all EventType fields like bookingRequiresAuthentication. These methods don't feed into the general OutputEventTypesService_2024_06_14 flow.
Applied to files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts
📚 Learning: 2025-08-26T08:08:23.395Z
Learnt from: SinghaAnirban005
PR: calcom/cal.com#23343
File: packages/features/insights/server/trpc-router.ts:1080-1101
Timestamp: 2025-08-26T08:08:23.395Z
Learning: In packages/features/insights/server/trpc-router.ts, when filtering personal event types (userId provided, no teamId, not isAll), the query correctly uses user.id (authenticated user) instead of the input userId parameter for security reasons. This prevents users from accessing other users' personal event types by passing arbitrary user IDs.
Applied to files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts
📚 Learning: 2025-08-27T13:32:46.887Z
Learnt from: supalarry
PR: calcom/cal.com#23364
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/transformers/internal-to-api/internal-to-api.spec.ts:295-296
Timestamp: 2025-08-27T13:32:46.887Z
Learning: In calcom/cal.com, when transforming booking fields from internal to API format, tests in organizations-event-types.e2e-spec.ts already expect name field label and placeholder to be empty strings ("") rather than undefined. PR changes that set these to explicit empty strings are typically fixing implementation to match existing test expectations rather than breaking changes.
Applied to files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.tsapps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts
📚 Learning: 2025-09-03T11:54:05.409Z
Learnt from: supalarry
PR: calcom/cal.com#23514
File: apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts:579-582
Timestamp: 2025-09-03T11:54:05.409Z
Learning: In calcom/cal.com bookings repository methods, when Prisma select uses `eventType: true`, all eventType fields including seatsShowAttendees are automatically included in the selection. Explicit field selection is not required when using `true` for nested relations.
Applied to files:
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts
🧬 Code graph analysis (4)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts (1)
packages/platform/types/event-types/event-types_2024_06_14/outputs/booking-fields.output.ts (2)
OutputUnknownBookingField_2024_06_14(620-629)OutputBookingField_2024_06_14(658-661)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts (1)
apps/api/v2/src/modules/auth/decorators/get-optional-user/get-optional-user.decorator.ts (1)
AuthOptionalUser(5-5)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.ts (3)
apps/api/v2/src/modules/auth/guards/optional-api-auth/optional-api-auth.guard.ts (1)
OptionalApiAuthGuard(4-14)apps/api/v2/src/lib/docs/headers.ts (3)
OPTIONAL_X_CAL_CLIENT_ID_HEADER(5-9)OPTIONAL_X_CAL_SECRET_KEY_HEADER(11-15)OPTIONAL_API_KEY_OR_ACCESS_TOKEN_HEADER(49-54)apps/api/v2/src/modules/auth/decorators/get-optional-user/get-optional-user.decorator.ts (2)
GetOptionalUser(7-32)AuthOptionalUser(5-5)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts (3)
apps/api/v2/test/fixtures/repository/api-keys.repository.fixture.ts (1)
ApiKeysRepositoryFixture(6-37)packages/platform/constants/api.ts (3)
CAL_API_VERSION_HEADER(72-72)VERSION_2024_06_14(56-56)SUCCESS_STATUS(9-9)packages/platform/types/api.ts (1)
ApiSuccessResponse(8-8)
🪛 Biome (2.1.2)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts
[error] 359-359: Unsafe usage of optional chaining.
If it short-circuits with 'undefined' the evaluation will throw TypeError here:
(lint/correctness/noUnsafeOptionalChaining)
🔇 Additional comments (12)
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts (2)
34-35: LGTM: import is correct and used below.
257-257: Good use ofsatisfiesfor type safety.Keeps unknown booking fields well-typed without runtime cost. Ensure TS >= 4.9 in this package.
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/event-types.service.ts (3)
98-119: Hidden event-type suppression for non-owners — LGTMThe auth-aware early return on hidden types is correct and aligns with the issue goal.
126-139: Public vs owner listing — LGTMBranching to public-only when the requester isn’t the owner is clear and correct.
190-197: Confirm repository filter and minimal selectsEnsure
getUserEventTypesPublic(userId)enforceshidden = falseat the DB level and uses Prismaselect(neverinclude) per guidelines.apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.e2e-spec.ts (5)
594-624: Hidden event-type creation test — LGTMGood coverage to persist and assert
hidden: trueandownerId.
625-674: Owner sees hidden types; hidden bookingFields filtered — LGTMThe expectations match the new visibility model and output filtering.
676-714: Non-owner and unauth cases correctly exclude hidden types — LGTMClear assertions on result counts and visibility flags.
715-760: eventSlug path for owner (visible case) — LGTMEnd-to-end validation looks solid.
174-208: API key-based auth setup — LGTMNice move to real API keys; it exercises the OptionalApiAuthGuard path realistically.
apps/api/v2/src/ee/event-types/event-types_2024_06_14/controllers/event-types.controller.ts (2)
122-145: Optional auth + output filtering — LGTMGuarding with
OptionalApiAuthGuardand delegating hidden-field removal to the output service is clean and matches the stated behavior.
11-16: Docs: optional headers — LGTMGood API docs for optional auth (client id/secret and bearer token).
apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts
Show resolved
Hide resolved
apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts
Show resolved
Hide resolved
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
E2E results are ready! |
Fixes CAL-6074