feat: use tokens for public mutating endpoints

apps/web/modules/bookings/views/bookings-single-view.tsx

@@ -31,6 +31,7 @@ import {
   TITLE_FIELD,
 } from "@calcom/features/bookings/lib/SystemField";
 import { APP_NAME } from "@calcom/lib/constants";
+import { symmetricEncrypt } from "@calcom/lib/crypto";
 import {
   formatToLocalizedDate,
   formatToLocalizedTime,
@@ -193,7 +194,9 @@ export default function Success(props: PageProps) {
   }, []);
 
   const sendFeedback = async (rating: string, comment: string) => {
-    mutation.mutate({ bookingUid: bookingInfo.uid, rating: rateValue, comment: comment });
+    const data = { bookingUid: bookingInfo.uid, rating: rateValue, comment: comment };
+    const token = symmetricEncrypt(JSON.stringify(data), process.env.CALENDSO_ENCRYPTION_KEY || "");
+    mutation.mutate({ ...data, token });
   };
 
   function setIsCancellationMode(value: boolean) {

packages/trpc/server/routers/publicViewer/_router.tsx

@@ -1,3 +1,5 @@
+import { symmetricDecrypt } from "@calcom/lib/crypto";
+
 import publicProcedure from "../../procedures/publicProcedure";
 import { importHandler, router } from "../../trpc";
 import { slotsRouter } from "../viewer/slots/_router";
@@ -25,8 +27,14 @@ export const publicViewerRouter = router({
     return handler(opts);
   }),
   submitRating: publicProcedure.input(ZSubmitRatingInputSchema).mutation(async (opts) => {
-    const handler = await importHandler(namespaced("submitRating"), () => import("./submitRating.handler"));
-    return handler(opts);
+    const { token, ...rest } = opts.input;
+    const data = symmetricDecrypt(token, process.env.CALENDSO_ENCRYPTION_KEY || "");
+    if (data === JSON.stringify(rest)) {
+      const handler = await importHandler(namespaced("submitRating"), () => import("./submitRating.handler"));
+      return handler(opts);
+    } else {
+      throw new Error("Invalid token");
+    }
   }),
   noShow: publicProcedure.input(ZNoShowInputSchema).mutation(async (opts) => {
     const handler = await importHandler(namespaced("noShow"), () => import("./noShow.handler"));

packages/trpc/server/routers/publicViewer/submitRating.schema.ts

@@ -4,6 +4,7 @@ export const ZSubmitRatingInputSchema = z.object({
   bookingUid: z.string(),
   rating: z.number(),
   comment: z.string().optional(),
+  token: z.string(),
 });
 
 export type TSubmitRatingInputSchema = z.infer<typeof ZSubmitRatingInputSchema>;