feat: Add endpoint to add attendees to existing bookings

[ibex088]

What does this PR do?

Adds a new API v2 endpoint POST /v2/bookings/:bookingUid/attendees to add attendees to existing bookings.

Requested by: @SomayChauhan
Devin session: https://app.devin.ai/sessions/5709b1f8262d4a23bb4b6e7b5c8bb9dd

Implementation Details

New Files:

• booking-attendees.controller.ts - NestJS controller for the endpoint
• booking-attendees.service.ts - Service handling attendee addition logic
• add-attendees.output.ts - Output type (returns full booking with updated attendees)
• add-attendees.input.ts - Input validation (array of attendees with email, name, timeZone, phoneNumber)

Modified Files:

• bookings.module.ts - Registered new controller and service
• input.service.ts - Added validateAndTransformAddAttendeesInput() method
• Fixed pre-existing ESLint no-prototype-builtins warnings in isRescheduleSeatedBody() and isCancelSeatedBody()

Validation Logic

The endpoint validates:

• ✅ Booking exists
• ✅ Event type exists
• ✅ No duplicate attendee emails (case-insensitive check)
• ⚠️ Booking field validation placeholder - The user mentioned they will add custom validation logic for booking fields. Currently, bookingFields are fetched but not used.

Important Limitations

⚠️ This implementation ONLY updates the database. It does NOT:

• Send email notifications to new attendees
• Update external calendar events (Google Calendar, Outlook, etc.)
• Trigger webhooks
• Handle payment collection for paid events
• Update seat allocation for seated events

Default values:

• All new attendees get locale: "en" (hardcoded)

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - API v2 docs are auto-generated from OpenAPI spec
• I confirm automated tests are in place that prove my fix is effective or that my feature works. TODO - No tests added yet

How should this be tested?

Prerequisites

1. Set up API v2 authentication (OAuth or API key)
2. Create a test booking with at least one attendee
3. Get the booking UID

Test Cases

Happy Path:

POST /v2/bookings/{bookingUid}/attendees
Headers:
  cal-api-version: 2024-08-13
  Authorization: Bearer <token>
  
Body:
{
  "attendees": [
    {
      "email": "[email protected]",
      "name": "New Attendee",
      "timeZone": "America/New_York",
      "phoneNumber": "+11234567890"
    }
  ]
}

Expected: 200 OK with full booking object including new attendee

Error Cases:

1. Duplicate email: Should return 400 with clear error message
2. Booking not found: Should return 404
3. Booking without event type: Should return 400
4. Invalid email format: Should return 400 (class-validator)
5. Empty attendees array: Should return 400 (ArrayMinSize validation)

Human Review Checklist

Critical items to verify:

1. Email/Calendar Integration - Is it intentional that this endpoint doesn't send notifications or update calendar events? Should we add this functionality?

2. Booking Field Validation - The user mentioned adding custom validation logic for booking fields. The placeholder is in validateAndTransformAddAttendeesInput() where bookingFields are fetched. Is this acceptable for now?

3. Paid Events - If the event type requires payment, should adding attendees collect payment from new attendees?

4. Seated Events - If the event type uses seats (seatsPerTimeSlot), should this endpoint verify seat availability?

5. Default Locale - All attendees get locale: "en". Should this be configurable or derived from other fields?

6. Security - Verify that BookingUidGuard properly validates ownership/permissions for the booking.

7. ESLint Fixes - The PR includes fixes for pre-existing no-prototype-builtins warnings in the same file. While good hygiene, this is technically unrelated to the feature.

Checklist

• I have read the contributing guide
• My code follows the style guidelines of this project
• I have commented my code in hard-to-understand areas (left placeholder for custom validation)
• My changes generate no new warnings (fixed pre-existing warnings)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[linear]

CAL-6527 [Bug] Adding attendees to existing bookings via the API returns a 403 Forbidden error,

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch somay/cal-6527-bug-adding-attendees-to-existing-bookings-via-the-api

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
cal	Ignored			Oct 13, 2025 10:05am
cal-eu	Ignored			Oct 13, 2025 10:05am