feat: update recording, transcript endpoint and add tests

[tomerqodo]

Benchmark PR from qodo-benchmark#692

---

Note

Strengthens access control and aligns response types for media-related booking endpoints.

• Auth/PBAC enforcement: GET /v2/bookings/:bookingUid/recordings now uses @Pbac(["booking.readRecordings"]), requires @Permissions([BOOKING_WRITE]), and guards ApiAuthGuard, BookingUidGuard, BookingPbacGuard; GET /:bookingUid/transcripts adds PBAC and guarded by BookingPbacGuard, ApiAuthGuard, BookingUidGuard (keeps BOOKING_READ).
• Response shape cleanup: Removes message field from GetBookingRecordingsOutput and GetBookingTranscriptsOutput.
• Tests: Adds e2e authorization tests for recordings and transcripts (organizer allowed; unauthorized receives 403).
• Minor: getBookingRecordings no longer awaits calVideoService.getRecordings().

^{Written by Cursor Bugbot for commit d18708a. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Missing await causes Promise returned instead of recordings

High Severity

The await keyword was removed from the this.calVideoService.getRecordings(bookingUid) call, but getRecordings is an async method. Without await, the recordings variable holds a Promise instead of the resolved array, causing the API to return a Promise object in the response data field rather than the actual recordings.

 

[cursor]

Incorrect guard order causes unauthorized error on transcripts

High Severity

The UseGuards decorator for the transcripts endpoint has BookingPbacGuard listed before ApiAuthGuard, but BookingPbacGuard requires request.user which is set by ApiAuthGuard. This incorrect order causes the guard to always throw UnauthorizedException because the user isn't authenticated yet when BookingPbacGuard runs.

 

[cursor]

Recordings endpoint incorrectly requires write permission for read

Medium Severity

The recordings GET endpoint was changed from BOOKING_READ to BOOKING_WRITE permission, but this is inconsistent with similar endpoints. The transcripts and conferencing-sessions GET endpoints both use BOOKING_READ, and all three share the same @Pbac(["booking.readRecordings"]) decorator indicating a read operation. Users with read-only access can view transcripts but are unexpectedly blocked from viewing recordings.