@agent-native/scheduling 0.1.23 → 0.1.25

package/src/actions/confirm-booking.ts

@@ -5,11 +5,15 @@ import {
   updateBookingStatus,
   getBookingByUid,
 } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Confirm a pending booking (requires-confirmation flow)",
   schema: z.object({ uid: z.string() }),
   run: async (args) => {
+    const booking = await getBookingByUid(args.uid);
+    if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "confirm this booking");
     await updateBookingStatus(args.uid, "confirmed");
     return { booking: await getBookingByUid(args.uid) };
   },

package/src/actions/duplicate-event-type.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { assertAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 
 import {
@@ -17,6 +18,7 @@ export default defineAction({
   run: async (args) => {
     const source = await getEventTypeById(args.id);
     if (!source) throw new Error("Event type not found");
+    await assertAccess("event-type", args.id, "editor");
     return {
       eventType: await createEventType({
         ownerEmail: source.teamId ? undefined : currentUserEmail(),

package/src/actions/event-type-authz.spec.ts

@@ -0,0 +1,209 @@
+/**
+ * Cross-tenant write (IDOR) regression tests for event-type-scoped actions
+ * that mutate a resource owned by another tenant: revoking a private hashed
+ * link and duplicating an event type. Mirrors the `assertAccess("event-type",
+ * ..., <role>)` guard already used by `add-private-link.ts` /
+ * `delete-event-type.ts`.
+ */
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  getRequestUserEmail,
+  runWithRequestContext,
+} from "@agent-native/core/server/request-context";
+import {
+  ForbiddenError,
+  registerShareableResource,
+} from "@agent-native/core/sharing";
+import { createClient, type Client } from "@libsql/client";
+import { drizzle } from "drizzle-orm/libsql";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import * as schema from "../schema/index.js";
+import { setSchedulingContext } from "../server/context.js";
+import duplicateEventType from "./duplicate-event-type.js";
+import revokePrivateLink from "./revoke-private-link.js";
+
+const OWNER_EMAIL = "owner@example.com";
+const OUTSIDER_EMAIL = "outsider@example.com";
+const EVENT_TYPE_ID = "event-type-1";
+const HASH = "private-link-hash-1";
+
+let client: Client;
+let dbDir: string;
+
+beforeEach(async () => {
+  dbDir = mkdtempSync(join(tmpdir(), "scheduling-eventtype-authz-test-"));
+  client = createClient({ url: `file:${join(dbDir, `${randomUUID()}.db`)}` });
+  await client.execute(`
+    CREATE TABLE event_types (
+      id TEXT PRIMARY KEY,
+      title TEXT NOT NULL,
+      slug TEXT NOT NULL,
+      description TEXT,
+      length INTEGER NOT NULL DEFAULT 30,
+      durations TEXT,
+      position INTEGER NOT NULL DEFAULT 0,
+      hidden INTEGER NOT NULL DEFAULT 0,
+      color TEXT,
+      scheduling_type TEXT NOT NULL DEFAULT 'personal',
+      team_id TEXT,
+      locations TEXT,
+      custom_fields TEXT,
+      schedule_id TEXT,
+      minimum_booking_notice INTEGER NOT NULL DEFAULT 0,
+      before_event_buffer INTEGER NOT NULL DEFAULT 0,
+      after_event_buffer INTEGER NOT NULL DEFAULT 0,
+      slot_interval INTEGER,
+      period_type TEXT NOT NULL DEFAULT 'rolling',
+      period_days INTEGER DEFAULT 60,
+      period_start_date TEXT,
+      period_end_date TEXT,
+      seats_per_time_slot INTEGER,
+      requires_confirmation INTEGER NOT NULL DEFAULT 0,
+      disable_guests INTEGER NOT NULL DEFAULT 0,
+      hide_calendar_notes INTEGER NOT NULL DEFAULT 0,
+      success_redirect_url TEXT,
+      booking_limits TEXT,
+      lock_time_zone_toggle INTEGER NOT NULL DEFAULT 0,
+      recurring_event TEXT,
+      event_name TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      owner_email TEXT NOT NULL DEFAULT 'local@localhost',
+      org_id TEXT,
+      visibility TEXT NOT NULL DEFAULT 'private'
+    );
+  `);
+  await client.execute(`
+    CREATE TABLE hashed_links (
+      id TEXT PRIMARY KEY,
+      hash TEXT NOT NULL UNIQUE,
+      event_type_id TEXT NOT NULL,
+      expires_at TEXT,
+      is_single_use INTEGER NOT NULL DEFAULT 0,
+      used_at TEXT,
+      created_at TEXT NOT NULL
+    );
+  `);
+  await client.execute(`
+    CREATE TABLE event_type_shares (
+      id TEXT PRIMARY KEY,
+      resource_id TEXT NOT NULL,
+      principal_type TEXT NOT NULL,
+      principal_id TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'viewer',
+      created_by TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+  `);
+
+  const db = drizzle(client, { schema });
+  setSchedulingContext({
+    getDb: () => db,
+    schema,
+    // Mirrors real app wiring (templates/scheduling's server plugin): the
+    // scheduling package's own "current user" and the framework's
+    // request-context ALS (used by `assertAccess`) both resolve to the same
+    // identity.
+    getCurrentUserEmail: () => getRequestUserEmail(),
+  });
+  registerShareableResource({
+    type: "event-type",
+    resourceTable: schema.eventTypes,
+    sharesTable: schema.eventTypeShares,
+    displayName: "Event Type",
+    getDb: () => db,
+  });
+
+  const now = new Date().toISOString();
+  await client.execute({
+    sql: `INSERT INTO event_types (
+      id, title, slug, length, created_at, updated_at, owner_email, visibility
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      EVENT_TYPE_ID,
+      "30 Min Meeting",
+      "30min",
+      30,
+      now,
+      now,
+      OWNER_EMAIL,
+      "private",
+    ],
+  });
+  await client.execute({
+    sql: `INSERT INTO hashed_links (id, hash, event_type_id, created_at) VALUES (?, ?, ?, ?)`,
+    args: ["link-1", HASH, EVENT_TYPE_ID, now],
+  });
+});
+
+afterEach(() => {
+  client.close();
+  rmSync(dbDir, { recursive: true, force: true });
+});
+
+async function hashedLinkExists(): Promise<boolean> {
+  const { rows } = await client.execute({
+    sql: "SELECT 1 FROM hashed_links WHERE hash = ?",
+    args: [HASH],
+  });
+  return rows.length > 0;
+}
+
+async function eventTypeCount(): Promise<number> {
+  const { rows } = await client.execute("SELECT * FROM event_types");
+  return rows.length;
+}
+
+describe("revoke-private-link authorization", () => {
+  it("returns the same idempotent result for an inaccessible link and keeps it", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OUTSIDER_EMAIL },
+      () => revokePrivateLink.run({ hash: HASH }),
+    );
+    expect(result.ok).toBe(true);
+    expect(await hashedLinkExists()).toBe(true);
+  });
+
+  it("allows the owning event type's editor (the owner) to revoke the link", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OWNER_EMAIL },
+      () => revokePrivateLink.run({ hash: HASH }),
+    );
+    expect(result.ok).toBe(true);
+    expect(await hashedLinkExists()).toBe(false);
+  });
+
+  it("is idempotent for an unknown hash without requiring access", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OUTSIDER_EMAIL },
+      () => revokePrivateLink.run({ hash: "does-not-exist" }),
+    );
+    expect(result.ok).toBe(true);
+  });
+});
+
+describe("duplicate-event-type authorization", () => {
+  it("rejects a caller with no access to the source event type and does not duplicate it", async () => {
+    await expect(
+      runWithRequestContext({ userEmail: OUTSIDER_EMAIL }, () =>
+        duplicateEventType.run({ id: EVENT_TYPE_ID, newSlug: "copy" }),
+      ),
+    ).rejects.toBeInstanceOf(ForbiddenError);
+    expect(await eventTypeCount()).toBe(1);
+  });
+
+  it("allows the owner to duplicate their own event type", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OWNER_EMAIL },
+      () => duplicateEventType.run({ id: EVENT_TYPE_ID, newSlug: "copy" }),
+    );
+    expect(result.eventType?.slug).toBe("copy");
+    expect(await eventTypeCount()).toBe(2);
+  });
+});

package/src/actions/get-booking.ts

@@ -2,9 +2,15 @@ import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Get a booking by uid",
   schema: z.object({ uid: z.string() }),
-  run: async (args) => ({ booking: await getBookingByUid(args.uid) }),
+  run: async (args) => {
+    const booking = await getBookingByUid(args.uid);
+    if (!booking) return { booking: null };
+    assertBookingHost(booking, "view this booking");
+    return { booking };
+  },
 });

package/src/actions/mark-no-show.ts

@@ -2,6 +2,8 @@ import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 
 import { markNoShow } from "../server/booking-service.js";
+import { getBookingByUid } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Mark an attendee as no-show on a booking",
@@ -10,6 +12,9 @@ export default defineAction({
     attendeeEmail: z.string(),
   }),
   run: async (args) => {
+    const booking = await getBookingByUid(args.uid);
+    if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "mark no-show on this booking");
     await markNoShow(args.uid, args.attendeeEmail);
     return { ok: true };
   },

package/src/actions/remove-booking-attendee.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Remove an attendee from a booking",
@@ -11,6 +12,7 @@ export default defineAction({
   run: async (args) => {
     const booking = await getBookingByUid(args.uid);
     if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "remove an attendee from this booking");
     const { getDb, schema } = getSchedulingContext();
     await getDb()
       .delete(schema.bookingAttendees)

package/src/actions/revoke-private-link.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { assertAccess } from "@agent-native/core/sharing";
 import { eq } from "drizzle-orm";
 import { z } from "zod";
 
@@ -9,7 +10,21 @@ export default defineAction({
   schema: z.object({ hash: z.string() }),
   run: async (args) => {
     const { getDb, schema } = getSchedulingContext();
-    await getDb()
+    const db = getDb();
+    const [link] = await db
+      .select({ eventTypeId: schema.hashedLinks.eventTypeId })
+      .from(schema.hashedLinks)
+      .where(eq(schema.hashedLinks.hash, args.hash))
+      .limit(1);
+    if (!link) return { ok: true };
+    try {
+      await assertAccess("event-type", link.eventTypeId, "editor");
+    } catch {
+      // Keep private-link hashes unprobeable: callers without access receive
+      // the same idempotent result as callers presenting an unknown hash.
+      return { ok: true };
+    }
+    await db
       .delete(schema.hashedLinks)
       .where(eq(schema.hashedLinks.hash, args.hash));
     return { ok: true };

package/src/actions/send-reschedule-link.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description:
@@ -11,6 +12,7 @@ export default defineAction({
   run: async (args) => {
     const booking = await getBookingByUid(args.uid);
     if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "view the reschedule link for this booking");
     const baseUrl = getSchedulingContext().publicBaseUrl ?? "";
     return {
       url: `${baseUrl}/reschedule/${booking.uid}?token=${booking.rescheduleToken}`,

package/src/manifest.test.ts

@@ -0,0 +1,19 @@
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+import { assertAgentNativePackageManifest } from "../../core/src/package-lifecycle/manifest.js";
+import { MANIFEST } from "./manifest.js";
+
+describe("scheduling package manifest", () => {
+  it("keeps the published static manifest in parity with the typed manifest", () => {
+    const file = fileURLToPath(
+      new URL("../agent-native.package.json", import.meta.url),
+    );
+    const published = JSON.parse(fs.readFileSync(file, "utf8"));
+    assertAgentNativePackageManifest(published);
+    expect(published).toEqual(MANIFEST);
+    expect(published.peerProviders).toContain("teams");
+  });
+});

package/src/manifest.ts

@@ -9,22 +9,19 @@
  */
 
 export interface SchedulingManifest {
+  manifestVersion: 1;
   name: string;
-  version: string;
   actions: string[];
   schemaEntryPoint: string;
-  docs: {
-    llms: string;
-    llmsFull: string;
-    skills: string[];
-  };
+  docs: { llms: string; llmsFull: string; skills: string[] };
   requiredSecrets: { key: string; label: string; optional?: boolean }[];
   peerProviders: string[];
+  eject?: { sourceRoot: string; targetDirectory: string };
 }
 
 export const MANIFEST: SchedulingManifest = {
+  manifestVersion: 1,
   name: "@agent-native/scheduling",
-  version: "0.1.0",
   actions: [
     // Event types
     "list-event-types",
@@ -168,7 +165,12 @@ export const MANIFEST: SchedulingManifest = {
     "google-calendar",
     "office365",
     "zoom",
+    "teams",
     "google-meet",
     "builtin-video",
   ],
+  eject: {
+    sourceRoot: "src",
+    targetDirectory: "packages/scheduling",
+  },
 };