Skip to content

feat: convert InsightsBookingService to use Prisma.sql raw queries #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
linxia0415 wants to merge 12 commits into
base: main
Choose a base branch
from
Open

feat: convert InsightsBookingService to use Prisma.sql raw queries #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
1cdce4c
fix: use raw query at InsightsBookingService
eunjae-lee Jul 9, 2025
ef96831
feat: convert InsightsBookingService to use Prisma.sql raw queries
devin-ai-integration[bot] Jul 9, 2025
4585081
feat: convert InsightsBookingService to use Prisma.sql raw queries
devin-ai-integration[bot] Jul 9, 2025
d377369
fix: update InsightsBookingService integration tests for Prisma.sql f…
devin-ai-integration[bot] Jul 9, 2025
40cfa8d
Merge branch 'fix/insights-booking-service' into devin/convert-insigh…
devin-ai-integration[bot] Jul 9, 2025
6ff44fc
fix: exclude intentionally skipped jobs from required CI check failure
devin-ai-integration[bot] Jul 9, 2025
14e0df2
fix tests
eunjae-lee Jul 9, 2025
a20bc94
Merge branch 'devin/convert-insights-booking-service-1752054886' of g…
eunjae-lee Jul 9, 2025
f626860
Revert "fix: exclude intentionally skipped jobs from required CI chec…
eunjae-lee Jul 9, 2025
4472efe
clean up tests
eunjae-lee Jul 9, 2025
95b426f
address feedback
eunjae-lee Jul 11, 2025
da09bc0
Merge branch 'main' into devin/convert-insights-booking-service-17520…
eunjae-lee Jul 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
190 changes: 41 additions & 149 deletions packages/lib/server/service/__tests__/insightsBooking.integration-test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,14 @@
import type { Team, User, Membership } from "@prisma/client";
import { Prisma } from "@prisma/client";
import { describe, expect, it } from "vitest";

import prisma from "@calcom/prisma";
import { BookingStatus, MembershipRole } from "@calcom/prisma/enums";

import { InsightsBookingService } from "../../service/insightsBooking";

const NOTHING_CONDITION = Prisma.sql`1=0`;

// Helper function to create unique test data
async function createTestData({
teamRole = MembershipRole.MEMBER,
Expand Down Expand Up @@ -204,7 +207,7 @@ describe("InsightsBookingService Integration Tests", () => {
});

const conditions = await service.getAuthorizationConditions();
expect(conditions).toEqual({ id: -1 });
expect(conditions).toEqual(NOTHING_CONDITION);
});

it("should return NOTHING for non-owner/admin user", async () => {
Expand Down Expand Up @@ -239,7 +242,7 @@ describe("InsightsBookingService Integration Tests", () => {
});

const conditions = await service.getAuthorizationConditions();
expect(conditions).toEqual({ id: -1 });
expect(conditions).toEqual(NOTHING_CONDITION);

// Clean up
await prisma.membership.delete({
Expand Down Expand Up @@ -267,14 +270,7 @@ describe("InsightsBookingService Integration Tests", () => {
});

const conditions = await service.getAuthorizationConditions();
expect(conditions).toEqual({
AND: [
{
userId: testData.user.id,
teamId: null,
},
],
});
expect(conditions).toEqual(Prisma.sql`("userId" = ${testData.user.id}) AND ("teamId" IS NULL)`);

@code-hawk-sit code-hawk-sit Bot Apr 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

使用 Prisma.sql 拼接 SQL 条件，但未验证输入是否经过参数化处理，存在潜在 SQL 注入风险

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 273

💬 详细说明：

  • 攻击者可通过恶意输入构造任意 SQL 语句，可能导致数据泄露或数据库被篡改

📝 问题代码：

expect(conditions).toEqual(Prisma.sql`("userId" = ${testData.user.id}) AND ("teamId" IS NULL)`);

💡 修复建议：

确保所有用户输入在拼接前已通过 Prisma 参数化机制处理，并对动态条件进行严格类型校验和白名单过滤

✅ 修复示例：

🔗 参考链接

无


await testData.cleanup();
});
Expand All @@ -296,24 +292,11 @@ describe("InsightsBookingService Integration Tests", () => {
});

const conditions = await service.getAuthorizationConditions();
expect(conditions).toEqual({
AND: [
{
OR: [
{
teamId: testData.team.id,
isTeamBooking: true,
},
{
userId: {
in: [testData.user.id],
},
isTeamBooking: false,
},
],
},
],
});
expect(conditions).toEqual(
Prisma.sql`(("teamId" = ${testData.team.id}) AND ("isTeamBooking" = true)) OR (("userId" = ANY(${[
testData.user.id,
]})) AND ("isTeamBooking" = false))`
);

// Clean up
await testData.cleanup();
Expand Down Expand Up @@ -346,26 +329,18 @@ describe("InsightsBookingService Integration Tests", () => {

const conditions = await service.getAuthorizationConditions();

expect(conditions).toEqual({
AND: [
{
OR: [
{
teamId: {
in: [testData.org.id, testData.team.id, team2.id, team3.id],
},
isTeamBooking: true,
},
{
userId: {
in: [testData.user.id, user2.id, user3.id],
},
isTeamBooking: false,
},
],
},
],
});
expect(conditions).toEqual(
Prisma.sql`(("teamId" = ANY(${[
testData.org.id,
testData.team.id,
team2.id,
team3.id,
]})) AND ("isTeamBooking" = true)) OR (("userId" = ANY(${[
testData.user.id,
user2.id,
user3.id,
]})) AND ("isTeamBooking" = false))`
);

await testData.cleanup();
});
Expand Down Expand Up @@ -406,13 +381,9 @@ describe("InsightsBookingService Integration Tests", () => {
});

const conditions = await service.getFilterConditions();
expect(conditions).toEqual({
AND: [
{
OR: [{ eventTypeId: testData.eventType.id }, { eventParentId: testData.eventType.id }],
},
],
});
expect(conditions).toEqual(
Prisma.sql`("eventTypeId" = ${testData.eventType.id}) OR ("eventParentId" = ${testData.eventType.id})`
);

await testData.cleanup();
});
Expand All @@ -433,13 +404,7 @@ describe("InsightsBookingService Integration Tests", () => {
});

const conditions = await service.getFilterConditions();
expect(conditions).toEqual({
AND: [
{
userId: testData.user.id,
},
],
});
expect(conditions).toEqual(Prisma.sql`"userId" = ${testData.user.id}`);

await testData.cleanup();
});
Expand All @@ -461,90 +426,15 @@ describe("InsightsBookingService Integration Tests", () => {
});

const conditions = await service.getFilterConditions();
expect(conditions).toEqual({
AND: [
{
OR: [{ eventTypeId: testData.eventType.id }, { eventParentId: testData.eventType.id }],
},
{
userId: testData.user.id,
},
],
});

await testData.cleanup();
});
});

describe("Caching", () => {
it("should cache authorization conditions", async () => {
const testData = await createTestData({
teamRole: MembershipRole.OWNER,
orgRole: MembershipRole.OWNER,
});

const service = new InsightsBookingService({
prisma,
options: {
scope: "user",
userId: testData.user.id,
orgId: testData.org.id,
},
});

// First call should build conditions
const conditions1 = await service.getAuthorizationConditions();
expect(conditions1).toEqual({
AND: [
{
userId: testData.user.id,
teamId: null,
},
],
});

// Second call should use cached conditions
const conditions2 = await service.getAuthorizationConditions();
expect(conditions2).toEqual(conditions1);

// Clean up
await testData.cleanup();
});

it("should cache filter conditions", async () => {
const testData = await createTestData();

const service = new InsightsBookingService({
prisma,
options: {
scope: "user",
userId: testData.user.id,
orgId: testData.org.id,
},
filters: {
eventTypeId: testData.eventType.id,
},
});

// First call should build conditions
const conditions1 = await service.getFilterConditions();
expect(conditions1).toEqual({
AND: [
{
OR: [{ eventTypeId: testData.eventType.id }, { eventParentId: testData.eventType.id }],
},
],
});

// Second call should use cached conditions
const conditions2 = await service.getFilterConditions();
expect(conditions2).toEqual(conditions1);
expect(conditions).toEqual(
Prisma.sql`(("eventTypeId" = ${testData.eventType.id}) OR ("eventParentId" = ${testData.eventType.id})) AND ("userId" = ${testData.user.id})`
);

await testData.cleanup();
});
});

describe("findMany", () => {
describe("getBaseConditions", () => {
it("should combine authorization and filter conditions", async () => {
const testData = await createTestData({
teamRole: MembershipRole.OWNER,
Expand Down Expand Up @@ -587,16 +477,18 @@ describe("InsightsBookingService Integration Tests", () => {
},
});

const results = await service.findMany({
select: {
id: true,
title: true,
},
});
const baseConditions = await service.getBaseConditions();
const results = await prisma.$queryRaw<{ id: number }[]>`
SELECT id FROM "BookingTimeStatusDenormalized"
WHERE ${baseConditions}
`;

// Should return the user booking since it matches both conditions
expect(results).toHaveLength(1);
expect(results[0]?.id).toBe(userBooking.id);
expect(results).toEqual([
{
id: userBooking.id,
},
]);

// Clean up
await prisma.booking.delete({
Expand Down
Loading