fix: Exclude locked users by default (calcom#17889)

packages/prisma/extensions/exclude-locked-users.ts

@@ -0,0 +1,43 @@
+import { Prisma } from "@prisma/client";
+import type { DefaultArgs, InternalArgs } from "@prisma/client/runtime/library";
+
+export function excludeLockedUsersExtension() {
+  return Prisma.defineExtension({
+    query: {
+      user: {
+        async findUnique({ args, query }) {
+          return excludeLockedUsers(args, query);
+        },
+        async findFirst({ args, query }) {
+          return excludeLockedUsers(args, query);
+        },
+        async findMany({ args, query }) {
+          return excludeLockedUsers(args, query);
+        },
+        async findUniqueOrThrow({ args, query }) {
+          return excludeLockedUsers(args, query);
+        },
+        async findFirstOrThrow({ args, query }) {
+          return excludeLockedUsers(args, query);
+        },
+      },
+    },
+  });
+}
+
+async function excludeLockedUsers(
+  args:
+    | Prisma.UserFindUniqueArgs<InternalArgs & DefaultArgs>
+    | Prisma.UserFindFirstArgs<InternalArgs & DefaultArgs>
+    | Prisma.UserFindManyArgs<InternalArgs & DefaultArgs>
+    | Prisma.UserFindUniqueOrThrowArgs<InternalArgs & DefaultArgs>
+    | Prisma.UserFindFirstOrThrowArgs<InternalArgs & DefaultArgs>,
+  query: <T>(args: T) => Promise<unknown>
+) {
+  args.where = args.where || {};
+  // Unless explicitly specified, we exclude locked users
+  if (args.where.locked === undefined) {
+    args.where.locked = false;
+  }
+  return query(args);
+}

packages/prisma/index.ts

@@ -4,6 +4,7 @@ import { withAccelerate } from "@prisma/extension-accelerate";
 
 import { bookingIdempotencyKeyExtension } from "./extensions/booking-idempotency-key";
 import { disallowUndefinedDeleteUpdateManyExtension } from "./extensions/disallow-undefined-delete-update-many";
+import { excludeLockedUsersExtension } from "./extensions/exclude-locked-users";
 import { excludePendingPaymentsExtension } from "./extensions/exclude-pending-payment-teams";
 import { usageTrackingExtention } from "./extensions/usage-tracking";
 import { bookingReferenceMiddleware } from "./middleware";
@@ -43,6 +44,7 @@ const prismaWithoutClientExtensions =
 export const customPrisma = (options?: Prisma.PrismaClientOptions) =>
   new PrismaClientWithoutExtension({ ...prismaOptions, ...options })
     .$extends(usageTrackingExtention())
+    .$extends(excludeLockedUsersExtension())
     .$extends(excludePendingPaymentsExtension())
     .$extends(bookingIdempotencyKeyExtension())
     .$extends(disallowUndefinedDeleteUpdateManyExtension())
@@ -56,6 +58,7 @@ bookingReferenceMiddleware(prismaWithoutClientExtensions);
 // Specifically we get errors like `Type 'string | Date | null | undefined' is not assignable to type 'Exact<string | Date | null | undefined, string | Date | null | undefined>'`
 const prismaWithClientExtensions = prismaWithoutClientExtensions
   .$extends(usageTrackingExtention())
+  .$extends(excludeLockedUsersExtension())
   .$extends(excludePendingPaymentsExtension())
   .$extends(bookingIdempotencyKeyExtension())
   .$extends(disallowUndefinedDeleteUpdateManyExtension())

packages/trpc/server/routers/viewer/admin/listPaginated.handler.ts

@@ -38,7 +38,11 @@ const listPaginatedHandler = async ({ input }: GetOptions) => {
   const users = await prisma.user.findMany({
     cursor: cursor ? { id: cursor } : undefined,
     take: limit + 1, // We take +1 as itll be used for the next cursor
-    where: searchFilters,
+    where: {
+      ...searchFilters,
+      // To bypass the excludeLockedUsersExtension
+      OR: [{ locked: false }, { locked: true }],
+    },
     orderBy: {
       id: "asc",
     },