fix: Booker reschedule behaviour for org admin #26530
Conversation
|
most of these are just linting changes |
| const isUserIdInBooking = theBooking.userId === userId; | ||
|
|
||
| if (!isOwnerOfBooking && !isHostOfEventType && !isUserIdInBooking) return null; | ||
| const isOrgAdmin = |
There was a problem hiding this comment.
this ensures if an org admin tries to reschedule booking belonging to members of his org we dont throw an error
There was a problem hiding this comment.
We should use PBAC here for booking.read or whatever permission you see fit with fallback roles of adminOrOwner.
This ADMIN field this checks in orgs isnt 100% true when PBAC is enabled
| user: { | ||
| select: { | ||
| id: true, | ||
| username: true, |
There was a problem hiding this comment.
for rescheduling its better to use the host username that we get from get-booking
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
| const queryClient = useQueryClient(); | ||
|
|
||
| const username = useMemo(() => { | ||
| // when rescheduling, prefer the booking host's username from bookingData |
There was a problem hiding this comment.
this is the only change thats been made in BookerPlatformWrapper
| const isUserIdInBooking = theBooking.userId === userId; | ||
|
|
||
| if (!isOwnerOfBooking && !isHostOfEventType && !isUserIdInBooking) return null; | ||
| const isOrgAdmin = |
There was a problem hiding this comment.
We should use PBAC here for booking.read or whatever permission you see fit with fallback roles of adminOrOwner.
This ADMIN field this checks in orgs isnt 100% true when PBAC is enabled
|
@sean-brydon this is for a platform customer and platform orgs dont use PBAC. I don't think we let anyone do this on app.cal.com |
They can though right? This is still core logic that should take it into account I think? I don’t belive this is a platform specific file |
no they cant use PBAC |
Summary by cubic
Fixes rescheduling so org admins can reschedule seated bookings and bookings they manage without ownership errors. Ensures the Booker loads the correct event type by using the booking host’s username during reschedule.
Written for commit d85c9a8. Summary will update on new commits.