From 1d2e5f07ef6243f445d320c897584ecb762f338b Mon Sep 17 00:00:00 2001
From: Agusti Fernandez Pardo <git@agusti.me>
Date: Wed, 15 Jun 2022 21:10:19 +0200
Subject: [PATCH] feat: admin endpoints for bookings

---
 lib/validations/booking.ts  |  1 -
 pages/api/bookings/[id].ts  |  8 +++++---
 pages/api/bookings/index.ts | 37 ++++++++++++++++++++++++++-----------
 3 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/lib/validations/booking.ts b/lib/validations/booking.ts
index a8a4b52c37..a7a8eab730 100644
--- a/lib/validations/booking.ts
+++ b/lib/validations/booking.ts
@@ -3,7 +3,6 @@ import { z } from "zod";
 import { _BookingModel as Booking } from "@calcom/prisma/zod";
 
 const schemaBookingBaseBodyParams = Booking.pick({
-  uid: true,
   userId: true,
   eventTypeId: true,
   title: true,
diff --git a/pages/api/bookings/[id].ts b/pages/api/bookings/[id].ts
index 7e17c9613a..8603af73c8 100644
--- a/pages/api/bookings/[id].ts
+++ b/pages/api/bookings/[id].ts
@@ -11,7 +11,7 @@ import {
 } from "@lib/validations/shared/queryIdTransformParseInt";
 
 export async function bookingById(
-  { method, query, body, userId }: NextApiRequest,
+  { method, query, body, userId, isAdmin }: NextApiRequest,
   res: NextApiResponse<BookingResponse>
 ) {
   const safeQuery = schemaQueryIdParseInt.safeParse(query);
@@ -25,8 +25,10 @@ export async function bookingById(
   });
   if (!userWithBookings) throw new Error("User not found");
   const userBookingIds = userWithBookings.bookings.map((booking: { id: number }) => booking.id).flat();
-  if (!userBookingIds.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
-  else {
+
+  if (!isAdmin) {
+    if (!userBookingIds.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
+  } else {
     switch (method) {
       /**
        * @swagger
diff --git a/pages/api/bookings/index.ts b/pages/api/bookings/index.ts
index 47d9b80da3..560bca7b8e 100644
--- a/pages/api/bookings/index.ts
+++ b/pages/api/bookings/index.ts
@@ -33,16 +33,29 @@ async function createOrlistAllBookings(
      *       404:
      *         description: No bookings were found
      */
-    const data = await prisma.booking.findMany({ where: { userId } });
-    const bookings = data.map((booking) => schemaBookingReadPublic.parse(booking));
-    console.log(`Bookings requested by ${userId}`);
-    if (bookings) res.status(200).json({ bookings });
-    else
-      (error: Error) =>
-        res.status(404).json({
-          message: "No Bookings were found",
-          error,
-        });
+    if (!isAdmin) {
+      const data = await prisma.booking.findMany({ where: { userId } });
+      const bookings = data.map((booking) => schemaBookingReadPublic.parse(booking));
+      if (bookings) res.status(200).json({ bookings });
+      else {
+        (error: Error) =>
+          res.status(404).json({
+            message: "No Bookings were found",
+            error,
+          });
+      }
+    } else {
+      const data = await prisma.booking.findMany();
+      const bookings = data.map((booking) => schemaBookingReadPublic.parse(booking));
+      if (bookings) res.status(200).json({ bookings });
+      else {
+        (error: Error) =>
+          res.status(404).json({
+            message: "No Bookings were found",
+            error,
+          });
+      }
+    }
   } else if (method === "POST") {
     /**
      * @swagger
@@ -83,7 +96,9 @@ async function createOrlistAllBookings(
       res.status(400).json({ message: "Bad request. Booking body is invalid." });
       return;
     }
-    safe.data.userId = userId;
+    if (!isAdmin) {
+      safe.data.userId = userId;
+    }
     const data = await prisma.booking.create({ data: { uid: uuidv4(), ...safe.data } });
     const booking = schemaBookingReadPublic.parse(data);