-
-
+
+
+
+import { ref } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { copyTextToClipboard } from 'shared/helpers/clipboard';
+import { useAlert } from 'dashboard/composables';
+import Button from 'dashboard/components-next/button/Button.vue';
+import Input from 'dashboard/components-next/input/Input.vue';
+import Icon from 'dashboard/components-next/icon/Icon.vue';
+import Dialog from 'dashboard/components-next/dialog/Dialog.vue';
+
+const props = defineProps({
+ mfaEnabled: {
+ type: Boolean,
+ required: true,
+ },
+ backupCodes: {
+ type: Array,
+ default: () => [],
+ },
+});
+
+const emit = defineEmits(['disableMfa', 'regenerateBackupCodes']);
+
+const { t } = useI18n();
+
+// Dialog refs
+const disableDialogRef = ref(null);
+const regenerateDialogRef = ref(null);
+const backupCodesDialogRef = ref(null);
+
+// Form values
+const disablePassword = ref('');
+const disableOtpCode = ref('');
+const regenerateOtpCode = ref('');
+
+// Utility functions
+const copyBackupCodes = async () => {
+ const codesText = props.backupCodes.join('\n');
+ await copyTextToClipboard(codesText);
+ useAlert(t('MFA_SETTINGS.BACKUP.CODES_COPIED'));
+};
+
+const downloadBackupCodes = () => {
+ const codesText = `Chatwoot Two-Factor Authentication Backup Codes\n\n${props.backupCodes.join('\n')}\n\nKeep these codes in a safe place.`;
+ const blob = new Blob([codesText], { type: 'text/plain' });
+ const url = URL.createObjectURL(blob);
+ const a = document.createElement('a');
+ a.href = url;
+ a.download = 'chatwoot-backup-codes.txt';
+ a.click();
+ URL.revokeObjectURL(url);
+};
+
+const handleDisableMfa = async () => {
+ emit('disableMfa', {
+ password: disablePassword.value,
+ otpCode: disableOtpCode.value,
+ });
+};
+
+const handleRegenerateBackupCodes = async () => {
+ emit('regenerateBackupCodes', {
+ otpCode: regenerateOtpCode.value,
+ });
+};
+
+// Methods exposed for parent component
+const resetDisableForm = () => {
+ disablePassword.value = '';
+ disableOtpCode.value = '';
+ disableDialogRef.value?.close();
+};
+
+const resetRegenerateForm = () => {
+ regenerateOtpCode.value = '';
+ regenerateDialogRef.value?.close();
+};
+
+const showBackupCodesDialog = () => {
+ backupCodesDialogRef.value?.open();
+};
+
+defineExpose({
+ resetDisableForm,
+ resetRegenerateForm,
+ showBackupCodesDialog,
+});
+
+
+
+
+
+
-
+
+
diff --git a/app/javascript/dashboard/routes/dashboard/settings/automation/constants.js b/app/javascript/dashboard/routes/dashboard/settings/automation/constants.js
index 0a6905039..bc767040b 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/automation/constants.js
+++ b/app/javascript/dashboard/routes/dashboard/settings/automation/constants.js
@@ -68,6 +68,12 @@ export const AUTOMATIONS = {
inputType: 'plain_text',
filterOperators: OPERATOR_TYPES_6,
},
+ {
+ key: 'labels',
+ name: 'LABELS',
+ inputType: 'multi_select',
+ filterOperators: OPERATOR_TYPES_3,
+ },
],
actions: [
{
@@ -186,6 +192,12 @@ export const AUTOMATIONS = {
inputType: 'multi_select',
filterOperators: OPERATOR_TYPES_1,
},
+ {
+ key: 'labels',
+ name: 'LABELS',
+ inputType: 'multi_select',
+ filterOperators: OPERATOR_TYPES_3,
+ },
],
actions: [
{
@@ -308,6 +320,12 @@ export const AUTOMATIONS = {
inputType: 'multi_select',
filterOperators: OPERATOR_TYPES_1,
},
+ {
+ key: 'labels',
+ name: 'LABELS',
+ inputType: 'multi_select',
+ filterOperators: OPERATOR_TYPES_3,
+ },
],
actions: [
{
@@ -424,6 +442,12 @@ export const AUTOMATIONS = {
inputType: 'multi_select',
filterOperators: OPERATOR_TYPES_1,
},
+ {
+ key: 'labels',
+ name: 'LABELS',
+ inputType: 'multi_select',
+ filterOperators: OPERATOR_TYPES_3,
+ },
],
actions: [
{
diff --git a/app/javascript/dashboard/routes/dashboard/settings/profile/Index.vue b/app/javascript/dashboard/routes/dashboard/settings/profile/Index.vue
index ce0a480bb..305a6d3ef 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/profile/Index.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/profile/Index.vue
@@ -7,6 +7,7 @@ import { useBranding } from 'shared/composables/useBranding';
import { clearCookiesOnLogout } from 'dashboard/store/utils/api.js';
import { copyTextToClipboard } from 'shared/helpers/clipboard';
import { parseAPIErrorResponse } from 'dashboard/store/utils/api';
+import { parseBoolean } from '@chatwoot/utils';
import UserProfilePicture from './UserProfilePicture.vue';
import UserBasicDetails from './UserBasicDetails.vue';
import MessageSignature from './MessageSignature.vue';
@@ -18,6 +19,7 @@ import NotificationPreferences from './NotificationPreferences.vue';
import AudioNotifications from './AudioNotifications.vue';
import FormSection from 'dashboard/components/FormSection.vue';
import AccessToken from './AccessToken.vue';
+import MfaSettingsCard from './MfaSettingsCard.vue';
import Policy from 'dashboard/components/policy.vue';
import {
ROLES,
@@ -38,6 +40,7 @@ export default {
NotificationPreferences,
AudioNotifications,
AccessToken,
+ MfaSettingsCard,
},
setup() {
const { isEditorHotKeyEnabled, updateUISettings } = useUISettings();
@@ -95,6 +98,9 @@ export default {
currentUserId: 'getCurrentUserID',
globalConfig: 'globalConfig/get',
}),
+ isMfaEnabled() {
+ return parseBoolean(window.chatwootConfig?.isMfaEnabled);
+ },
},
mounted() {
if (this.currentUserId) {
@@ -283,6 +289,13 @@ export default {
>
+
+
+
+
diff --git a/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSettings.vue b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSettings.vue
new file mode 100644
index 000000000..a647bd0da
--- /dev/null
+++ b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSettings.vue
@@ -0,0 +1,178 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.MANAGEMENT.BACKUP_CODES') }} +
++ {{ $t('MFA_SETTINGS.MANAGEMENT.BACKUP_CODES_DESC') }} +
+ +
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.MANAGEMENT.DISABLE_MFA') }} +
++ {{ $t('MFA_SETTINGS.MANAGEMENT.DISABLE_MFA_DESC') }} +
+ +
+
+
+
diff --git a/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSettingsCard.vue b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSettingsCard.vue
new file mode 100644
index 000000000..673f97143
--- /dev/null
+++ b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSettingsCard.vue
@@ -0,0 +1,47 @@
+
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.TITLE') }} +
++ {{ $t('MFA_SETTINGS.SUBTITLE') }} +
+
+
+
+
+
+
diff --git a/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSetupWizard.vue b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSetupWizard.vue
new file mode 100644
index 000000000..528df7658
--- /dev/null
+++ b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaSetupWizard.vue
@@ -0,0 +1,323 @@
+
+
+
+
+
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.TITLE') }} +
++ {{ $t('MFA_SETTINGS.DESCRIPTION') }} +
+
+
+
+
+
diff --git a/app/javascript/dashboard/routes/dashboard/settings/profile/MfaStatusCard.vue b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaStatusCard.vue
new file mode 100644
index 000000000..3dc22eb4a
--- /dev/null
+++ b/app/javascript/dashboard/routes/dashboard/settings/profile/MfaStatusCard.vue
@@ -0,0 +1,63 @@
+
+
+
+
+
+
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.SETUP.STEP1_TITLE') }} +
++ {{ $t('MFA_SETTINGS.SETUP.STEP1_DESCRIPTION') }} +
+
+
+
+
+ ![MFA QR Code]()
+
+
+
+ {{ $t('MFA_SETTINGS.SETUP.LOADING_QR') }}
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.SETUP.MANUAL_ENTRY') }} +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.BACKUP.TITLE') }} +
++ {{ $t('MFA_SETTINGS.BACKUP.DESCRIPTION') }} +
+
+
+
+
+ + {{ $t('MFA_SETTINGS.BACKUP.IMPORTANT') }} + {{ $t('MFA_SETTINGS.BACKUP.IMPORTANT_NOTE') }} +
+
+
+
+
+
+
+ {{ code }}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + {{ $t('MFA_SETTINGS.ENHANCE_SECURITY') }} +
++ {{ $t('MFA_SETTINGS.ENHANCE_SECURITY_DESC') }} +
+ +
+
+
diff --git a/app/javascript/dashboard/routes/dashboard/settings/profile/profile.routes.js b/app/javascript/dashboard/routes/dashboard/settings/profile/profile.routes.js
index b99031047..ef208eae4 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/profile/profile.routes.js
+++ b/app/javascript/dashboard/routes/dashboard/settings/profile/profile.routes.js
@@ -1,7 +1,9 @@
import { frontendURL } from '../../../../helper/URLHelper';
+import { parseBoolean } from '@chatwoot/utils';
import SettingsContent from './Wrapper.vue';
import Index from './Index.vue';
+import MfaSettings from './MfaSettings.vue';
export default {
routes: [
@@ -21,6 +23,23 @@ export default {
permissions: ['administrator', 'agent', 'custom_role'],
},
},
+ {
+ path: 'mfa',
+ name: 'profile_settings_mfa',
+ component: MfaSettings,
+ meta: {
+ permissions: ['administrator', 'agent', 'custom_role'],
+ },
+ beforeEnter: (to, from, next) => {
+ // Check if MFA is enabled globally
+ if (!parseBoolean(window.chatwootConfig?.isMfaEnabled)) {
+ // Redirect to profile settings if MFA is disabled
+ next({ name: 'profile_settings_index' });
+ } else {
+ next();
+ }
+ },
+ },
],
},
],
diff --git a/app/javascript/shared/helpers/clipboard.js b/app/javascript/shared/helpers/clipboard.js
index dcd25afae..3b66c39ac 100644
--- a/app/javascript/shared/helpers/clipboard.js
+++ b/app/javascript/shared/helpers/clipboard.js
@@ -17,3 +17,22 @@ export const copyTextToClipboard = async data => {
throw new Error(`Unable to copy text to clipboard: ${error.message}`);
}
};
+
+/**
+ * Handles OTP paste events by extracting numeric digits from clipboard data.
+ *
+ * @param {ClipboardEvent} event - The paste event from the clipboard
+ * @param {number} maxLength - Maximum number of digits to extract (default: 6)
+ * @returns {string|null} - Extracted numeric string or null if invalid
+ */
+export const handleOtpPaste = (event, maxLength = 6) => {
+ if (!event?.clipboardData) return null;
+
+ const pastedData = event.clipboardData
+ .getData('text')
+ .replace(/\D/g, '') // Remove all non-digit characters
+ .slice(0, maxLength); // Limit to maxLength digits
+
+ // Only return if we have the exact expected length
+ return pastedData.length === maxLength ? pastedData : null;
+};
diff --git a/app/javascript/shared/helpers/specs/clipboard.spec.js b/app/javascript/shared/helpers/specs/clipboard.spec.js
index c675edd35..a169e0939 100644
--- a/app/javascript/shared/helpers/specs/clipboard.spec.js
+++ b/app/javascript/shared/helpers/specs/clipboard.spec.js
@@ -1,4 +1,4 @@
-import { copyTextToClipboard } from '../clipboard';
+import { copyTextToClipboard, handleOtpPaste } from '../clipboard';
const mockWriteText = vi.fn();
Object.assign(navigator, {
@@ -172,3 +172,113 @@ describe('copyTextToClipboard', () => {
});
});
});
+
+describe('handleOtpPaste', () => {
+ // Helper function to create mock clipboard event
+ const createMockPasteEvent = text => ({
+ clipboardData: {
+ getData: vi.fn().mockReturnValue(text),
+ },
+ });
+
+ describe('valid OTP paste scenarios', () => {
+ it('extracts 6-digit OTP from clean numeric string', () => {
+ const event = createMockPasteEvent('123456');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBe('123456');
+ expect(event.clipboardData.getData).toHaveBeenCalledWith('text');
+ });
+
+ it('extracts 6-digit OTP from string with spaces', () => {
+ const event = createMockPasteEvent('1 2 3 4 5 6');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBe('123456');
+ });
+
+ it('extracts 6-digit OTP from string with dashes', () => {
+ const event = createMockPasteEvent('123-456');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBe('123456');
+ });
+
+ it('handles negative numbers by extracting digits only', () => {
+ const event = createMockPasteEvent('-123456');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBe('123456');
+ });
+
+ it('handles decimal numbers by extracting digits only', () => {
+ const event = createMockPasteEvent('123.456');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBe('123456');
+ });
+
+ it('extracts 6-digit OTP from mixed alphanumeric string', () => {
+ const event = createMockPasteEvent('Your code is: 987654');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBe('987654');
+ });
+
+ it('extracts first 6 digits when more than 6 digits present', () => {
+ const event = createMockPasteEvent('12345678901234');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBe('123456');
+ });
+
+ it('handles custom maxLength parameter', () => {
+ const event = createMockPasteEvent('12345678');
+ const result = handleOtpPaste(event, 8);
+
+ expect(result).toBe('12345678');
+ });
+
+ it('extracts 4-digit OTP with custom maxLength', () => {
+ const event = createMockPasteEvent('Your PIN: 9876');
+ const result = handleOtpPaste(event, 4);
+
+ expect(result).toBe('9876');
+ });
+ });
+
+ describe('invalid OTP paste scenarios', () => {
+ it('returns null for insufficient digits', () => {
+ const event = createMockPasteEvent('12345');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBeNull();
+ });
+
+ it('returns null for text with no digits', () => {
+ const event = createMockPasteEvent('Hello World');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBeNull();
+ });
+
+ it('returns null for empty string', () => {
+ const event = createMockPasteEvent('');
+ const result = handleOtpPaste(event);
+
+ expect(result).toBeNull();
+ });
+
+ it('returns null when event is null', () => {
+ const result = handleOtpPaste(null);
+
+ expect(result).toBeNull();
+ });
+
+ it('returns null when event is undefined', () => {
+ const result = handleOtpPaste(undefined);
+
+ expect(result).toBeNull();
+ });
+ });
+});
diff --git a/app/javascript/v3/App.vue b/app/javascript/v3/App.vue
index 992c0b381..ef7107beb 100644
--- a/app/javascript/v3/App.vue
+++ b/app/javascript/v3/App.vue
@@ -15,8 +15,10 @@ export default {
setColorTheme() {
if (window.matchMedia('(prefers-color-scheme: dark)').matches) {
this.theme = 'dark';
+ document.documentElement.classList.add('dark');
} else {
- this.theme = 'light ';
+ this.theme = 'light';
+ document.documentElement.classList.remove('dark');
}
},
listenToThemeChanges() {
@@ -25,8 +27,10 @@ export default {
mql.onchange = e => {
if (e.matches) {
this.theme = 'dark';
+ document.documentElement.classList.add('dark');
} else {
this.theme = 'light';
+ document.documentElement.classList.remove('dark');
}
};
},
diff --git a/app/javascript/v3/api/auth.js b/app/javascript/v3/api/auth.js
index a4793d3d0..146db4e07 100644
--- a/app/javascript/v3/api/auth.js
+++ b/app/javascript/v3/api/auth.js
@@ -13,6 +13,16 @@ export const login = async ({
}) => {
try {
const response = await wootAPI.post('auth/sign_in', credentials);
+
+ // Check if MFA is required
+ if (response.status === 206 && response.data.mfa_required) {
+ // Return MFA data instead of throwing error
+ return {
+ mfaRequired: true,
+ mfaToken: response.data.mfa_token,
+ };
+ }
+
setAuthCredentials(response);
clearLocalStorageOnLogout();
window.location = getLoginRedirectURL({
@@ -20,8 +30,17 @@ export const login = async ({
ssoConversationId,
user: response.data.data,
});
+ return null;
} catch (error) {
+ // Check if it's an MFA required response
+ if (error.response?.status === 206 && error.response?.data?.mfa_required) {
+ return {
+ mfaRequired: true,
+ mfaToken: error.response.data.mfa_token,
+ };
+ }
throwErrorMessage(error);
+ return null;
}
};
diff --git a/app/javascript/v3/views/auth/signup/Index.vue b/app/javascript/v3/views/auth/signup/Index.vue
index 508c755f5..86baff55c 100644
--- a/app/javascript/v3/views/auth/signup/Index.vue
+++ b/app/javascript/v3/views/auth/signup/Index.vue
@@ -62,7 +62,7 @@ export default {
+
+
+
+ + {{ $t('MFA_SETTINGS.STATUS_ENABLED') }} +
++ {{ $t('MFA_SETTINGS.STATUS_ENABLED_DESC') }} +
+
- {{ $t('REGISTER.HAVE_AN_ACCOUNT') }}
+ {{ $t('REGISTER.HAVE_AN_ACCOUNT') }}
{{ replaceInstallationName($t('LOGIN.TITLE')) }}
diff --git a/app/javascript/v3/views/login/Index.vue b/app/javascript/v3/views/login/Index.vue
index 4a51b3059..ff8022714 100644
--- a/app/javascript/v3/views/login/Index.vue
+++ b/app/javascript/v3/views/login/Index.vue
@@ -15,6 +15,7 @@ import FormInput from '../../components/Form/Input.vue';
import GoogleOAuthButton from '../../components/GoogleOauth/Button.vue';
import Spinner from 'shared/components/Spinner.vue';
import NextButton from 'dashboard/components-next/button/Button.vue';
+import MfaVerification from 'dashboard/components/auth/MfaVerification.vue';
const ERROR_MESSAGES = {
'no-account-found': 'LOGIN.OAUTH.NO_ACCOUNT_FOUND',
@@ -29,6 +30,7 @@ export default {
GoogleOAuthButton,
Spinner,
NextButton,
+ MfaVerification,
},
props: {
ssoAuthToken: { type: String, default: '' },
@@ -58,6 +60,8 @@ export default {
hasErrored: false,
},
error: '',
+ mfaRequired: false,
+ mfaToken: null,
};
},
validations() {
@@ -87,8 +91,10 @@ export default {
this.submitLogin();
}
if (this.authError) {
- const message = ERROR_MESSAGES[this.authError] ?? 'LOGIN.API.UNAUTH';
- useAlert(this.$t(message));
+ const messageKey = ERROR_MESSAGES[this.authError] ?? 'LOGIN.API.UNAUTH';
+ // Use a method to get the translated text to avoid dynamic key warning
+ const translatedMessage = this.getTranslatedMessage(messageKey);
+ useAlert(translatedMessage);
// wait for idle state
this.requestIdleCallbackPolyfill(() => {
// Remove the error query param from the url
@@ -98,6 +104,18 @@ export default {
}
},
methods: {
+ getTranslatedMessage(key) {
+ // Avoid dynamic key warning by handling each case explicitly
+ switch (key) {
+ case 'LOGIN.OAUTH.NO_ACCOUNT_FOUND':
+ return this.$t('LOGIN.OAUTH.NO_ACCOUNT_FOUND');
+ case 'LOGIN.OAUTH.BUSINESS_ACCOUNTS_ONLY':
+ return this.$t('LOGIN.OAUTH.BUSINESS_ACCOUNTS_ONLY');
+ case 'LOGIN.API.UNAUTH':
+ default:
+ return this.$t('LOGIN.API.UNAUTH');
+ }
+ },
// TODO: Remove this when Safari gets wider support
// Ref: https://caniuse.com/requestidlecallback
//
@@ -140,7 +158,15 @@ export default {
};
login(credentials)
- .then(() => {
+ .then(result => {
+ // Check if MFA is required
+ if (result?.mfaRequired) {
+ this.loginApi.showLoading = false;
+ this.mfaRequired = true;
+ this.mfaToken = result.mfaToken;
+ return;
+ }
+
this.handleImpersonation();
this.showAlertMessage(this.$t('LOGIN.API.SUCCESS_MESSAGE'));
})
@@ -163,6 +189,17 @@ export default {
this.submitLogin();
},
+ handleMfaVerified() {
+ // MFA verification successful, continue with login
+ this.handleImpersonation();
+ window.location = '/app';
+ },
+ handleMfaCancel() {
+ // User cancelled MFA, reset state
+ this.mfaRequired = false;
+ this.mfaToken = null;
+ this.credentials.password = '';
+ },
},
};
@@ -193,7 +230,19 @@ export default {
+
+
+
+
+
+
> '#{attribute_key}' #{filter_operator_value} #{query_operator} "
when 'standard'
if attribute_key == 'labels'
- " tags.id #{filter_operator_value} #{query_operator} "
+ build_label_query_string(query_hash, current_index, query_operator)
else
" #{table_name}.#{attribute_key} #{filter_operator_value} #{query_operator} "
end
end
end
+ def build_label_query_string(query_hash, current_index, query_operator)
+ case query_hash['filter_operator']
+ when 'equal_to'
+ return " 1=0 #{query_operator} " if query_hash['values'].blank?
+
+ value_placeholder = "value_#{current_index}"
+ @filter_values[value_placeholder] = query_hash['values'].first
+ " tags.name = :#{value_placeholder} #{query_operator} "
+ when 'not_equal_to'
+ return " 1=0 #{query_operator} " if query_hash['values'].blank?
+
+ value_placeholder = "value_#{current_index}"
+ @filter_values[value_placeholder] = query_hash['values'].first
+ " tags.name != :#{value_placeholder} #{query_operator} "
+ when 'is_present'
+ " tags.id IS NOT NULL #{query_operator} "
+ when 'is_not_present'
+ " tags.id IS NULL #{query_operator} "
+ else
+ " tags.id #{filter_operation(query_hash, current_index)} #{query_operator} "
+ end
+ end
+
private
def base_relation
@@ -166,7 +189,21 @@ class AutomationRules::ConditionsFilterService < FilterService
).joins(
'LEFT OUTER JOIN messages on messages.conversation_id = conversations.id'
)
+
+ # Only add label joins when label conditions exist
+ if label_conditions?
+ records = records.joins(
+ 'LEFT OUTER JOIN taggings ON taggings.taggable_id = conversations.id AND taggings.taggable_type = \'Conversation\''
+ ).joins(
+ 'LEFT OUTER JOIN tags ON taggings.tag_id = tags.id'
+ )
+ end
+
records = records.where(messages: { id: @options[:message].id }) if @options[:message].present?
records
end
+
+ def label_conditions?
+ @rule.conditions.any? { |condition| condition['attribute_key'] == 'labels' }
+ end
end
diff --git a/app/services/base_token_service.rb b/app/services/base_token_service.rb
new file mode 100644
index 000000000..966404108
--- /dev/null
+++ b/app/services/base_token_service.rb
@@ -0,0 +1,27 @@
+class BaseTokenService
+ pattr_initialize [:payload, :token]
+
+ def generate_token
+ JWT.encode(token_payload, secret_key, algorithm)
+ end
+
+ def decode_token
+ JWT.decode(token, secret_key, true, algorithm: algorithm).first.symbolize_keys
+ rescue JWT::ExpiredSignature, JWT::DecodeError
+ {}
+ end
+
+ private
+
+ def token_payload
+ payload || {}
+ end
+
+ def secret_key
+ Rails.application.secret_key_base
+ end
+
+ def algorithm
+ 'HS256'
+ end
+end
diff --git a/app/services/line/incoming_message_service.rb b/app/services/line/incoming_message_service.rb
index 4761292d0..0d2f78c7a 100644
--- a/app/services/line/incoming_message_service.rb
+++ b/app/services/line/incoming_message_service.rb
@@ -76,7 +76,8 @@ class Line::IncomingMessageService
response = inbox.channel.client.get_message_content(message['id'])
- file_name = "media-#{message['id']}.#{response.content_type.split('/')[1]}"
+ extension = get_file_extension(response)
+ file_name = message['fileName'] || "media-#{message['id']}.#{extension}"
temp_file = Tempfile.new(file_name)
temp_file.binmode
temp_file << response.body
@@ -93,12 +94,25 @@ class Line::IncomingMessageService
)
end
+ def get_file_extension(response)
+ if response.content_type&.include?('/')
+ response.content_type.split('/')[1]
+ else
+ 'bin'
+ end
+ end
+
def event_type_message?(event)
event['type'] == 'message' || event['type'] == 'sticker'
end
def message_type_non_text?(type)
- [Line::Bot::Event::MessageType::Video, Line::Bot::Event::MessageType::Audio, Line::Bot::Event::MessageType::Image].include?(type)
+ [
+ Line::Bot::Event::MessageType::Video,
+ Line::Bot::Event::MessageType::Audio,
+ Line::Bot::Event::MessageType::Image,
+ Line::Bot::Event::MessageType::File
+ ].include?(type)
end
def account
diff --git a/app/services/mfa/authentication_service.rb b/app/services/mfa/authentication_service.rb
new file mode 100644
index 000000000..caad66cf7
--- /dev/null
+++ b/app/services/mfa/authentication_service.rb
@@ -0,0 +1,23 @@
+class Mfa::AuthenticationService
+ pattr_initialize [:user!, :otp_code, :backup_code]
+
+ def authenticate
+ return false unless user
+
+ return authenticate_with_otp if otp_code.present?
+ return authenticate_with_backup_code if backup_code.present?
+
+ false
+ end
+
+ private
+
+ def authenticate_with_otp
+ user.validate_and_consume_otp!(otp_code)
+ end
+
+ def authenticate_with_backup_code
+ mfa_service = Mfa::ManagementService.new(user: user)
+ mfa_service.validate_backup_code!(backup_code)
+ end
+end
diff --git a/app/services/mfa/management_service.rb b/app/services/mfa/management_service.rb
new file mode 100644
index 000000000..d4c01ec1f
--- /dev/null
+++ b/app/services/mfa/management_service.rb
@@ -0,0 +1,88 @@
+class Mfa::ManagementService
+ pattr_initialize [:user!]
+
+ def enable_two_factor!
+ user.otp_secret = User.generate_otp_secret
+ user.save!
+ end
+
+ def disable_two_factor!
+ user.otp_secret = nil
+ user.otp_required_for_login = false
+ user.otp_backup_codes = nil
+ user.save!
+ end
+
+ def verify_and_activate!
+ ActiveRecord::Base.transaction do
+ user.update!(otp_required_for_login: true)
+ backup_codes_generated? ? nil : generate_backup_codes!
+ end
+ end
+
+ def two_factor_provisioning_uri
+ return nil if user.otp_secret.blank?
+
+ issuer = 'Chatwoot'
+ label = user.email
+ user.otp_provisioning_uri(label, issuer: issuer)
+ end
+
+ def generate_backup_codes!
+ codes = Array.new(10) { SecureRandom.hex(4).upcase }
+ user.otp_backup_codes = codes
+ user.save!
+ codes
+ end
+
+ def validate_backup_code!(code)
+ return false unless valid_backup_code_input?(code)
+
+ codes = user.otp_backup_codes
+ found_index = find_matching_code_index(codes, code)
+
+ return false if found_index.nil?
+
+ mark_code_as_used(codes, found_index)
+ end
+
+ private
+
+ def valid_backup_code_input?(code)
+ user.otp_backup_codes.present? && code.present?
+ end
+
+ def find_matching_code_index(codes, code)
+ found_index = nil
+
+ # Constant-time comparison to prevent timing attacks
+ codes.each_with_index do |stored_code, idx|
+ is_match = ActiveSupport::SecurityUtils.secure_compare(stored_code, code)
+ is_unused = stored_code != 'XXXXXXXX'
+ found_index = idx if is_match && is_unused
+ end
+
+ found_index
+ end
+
+ def mark_code_as_used(codes, index)
+ codes[index] = 'XXXXXXXX'
+ user.otp_backup_codes = codes
+ user.save!
+ true
+ end
+
+ public
+
+ def backup_codes_generated?
+ user.otp_backup_codes.present?
+ end
+
+ def mfa_enabled?
+ user.otp_required_for_login?
+ end
+
+ def two_factor_setup_pending?
+ user.otp_secret.present? && !user.otp_required_for_login?
+ end
+end
diff --git a/app/services/mfa/token_service.rb b/app/services/mfa/token_service.rb
new file mode 100644
index 000000000..a7994b60c
--- /dev/null
+++ b/app/services/mfa/token_service.rb
@@ -0,0 +1,28 @@
+class Mfa::TokenService < BaseTokenService
+ pattr_initialize [:user, :token]
+
+ MFA_TOKEN_EXPIRY = 5.minutes
+
+ def generate_token
+ @payload = build_payload
+ super
+ end
+
+ def verify_token
+ decoded = decode_token
+ return nil if decoded.blank?
+
+ User.find(decoded[:user_id])
+ rescue ActiveRecord::RecordNotFound
+ nil
+ end
+
+ private
+
+ def build_payload
+ {
+ user_id: user.id,
+ exp: MFA_TOKEN_EXPIRY.from_now.to_i
+ }
+ end
+end
diff --git a/app/services/whatsapp/populate_template_parameters_service.rb b/app/services/whatsapp/populate_template_parameters_service.rb
index 278e52f64..3f9f64b91 100644
--- a/app/services/whatsapp/populate_template_parameters_service.rb
+++ b/app/services/whatsapp/populate_template_parameters_service.rb
@@ -30,12 +30,12 @@ class Whatsapp::PopulateTemplateParametersService
end
end
- def build_media_parameter(url, media_type)
+ def build_media_parameter(url, media_type, media_name = nil)
return nil if url.blank?
sanitized_url = sanitize_parameter(url)
validate_url(sanitized_url)
- build_media_type_parameter(sanitized_url, media_type.downcase)
+ build_media_type_parameter(sanitized_url, media_type.downcase, media_name)
end
def build_named_parameter(parameter_name, value)
@@ -89,14 +89,14 @@ class Whatsapp::PopulateTemplateParametersService
}
end
- def build_media_type_parameter(sanitized_url, media_type)
+ def build_media_type_parameter(sanitized_url, media_type, media_name = nil)
case media_type
when 'image'
build_image_parameter(sanitized_url)
when 'video'
build_video_parameter(sanitized_url)
when 'document'
- build_document_parameter(sanitized_url)
+ build_document_parameter(sanitized_url, media_name)
else
raise ArgumentError, "Unsupported media type: #{media_type}"
end
@@ -110,8 +110,11 @@ class Whatsapp::PopulateTemplateParametersService
{ type: 'video', video: { link: url } }
end
- def build_document_parameter(url)
- { type: 'document', document: { link: url } }
+ def build_document_parameter(url, media_name = nil)
+ document_params = { link: url }
+ document_params[:filename] = media_name if media_name.present?
+
+ { type: 'document', document: document_params }
end
def rich_formatting?(text)
diff --git a/app/services/whatsapp/providers/whatsapp_cloud_service.rb b/app/services/whatsapp/providers/whatsapp_cloud_service.rb
index 68e965595..124e1e5d3 100644
--- a/app/services/whatsapp/providers/whatsapp_cloud_service.rb
+++ b/app/services/whatsapp/providers/whatsapp_cloud_service.rb
@@ -141,7 +141,11 @@ class Whatsapp::Providers::WhatsappCloudService < Whatsapp::Providers::BaseServi
# {
# processed_params: {
# body: { '1': 'John', '2': '123 Main St' },
- # header: { media_url: 'https://...', media_type: 'image' },
+ # header: {
+ # media_url: 'https://...',
+ # media_type: 'image',
+ # media_name: 'filename.pdf' # Optional, for document templates only
+ # },
# buttons: [{ type: 'url', parameter: 'otp123456' }]
# }
# }
diff --git a/app/services/whatsapp/template_processor_service.rb b/app/services/whatsapp/template_processor_service.rb
index 3b12bf58b..4a89d684a 100644
--- a/app/services/whatsapp/template_processor_service.rb
+++ b/app/services/whatsapp/template_processor_service.rb
@@ -60,9 +60,10 @@ class Whatsapp::TemplateProcessorService
next if value.blank?
if media_url_with_type?(key, header_data)
- media_param = parameter_builder.build_media_parameter(value, header_data['media_type'])
+ media_name = header_data['media_name']
+ media_param = parameter_builder.build_media_parameter(value, header_data['media_type'], media_name)
header_params << media_param if media_param
- elsif key != 'media_type'
+ elsif key != 'media_type' && key != 'media_name'
header_params << parameter_builder.build_parameter(value)
end
end
diff --git a/app/services/widget/token_service.rb b/app/services/widget/token_service.rb
index 4eebaab9e..b50119eb1 100644
--- a/app/services/widget/token_service.rb
+++ b/app/services/widget/token_service.rb
@@ -1,24 +1,14 @@
-class Widget::TokenService
+class Widget::TokenService < BaseTokenService
DEFAULT_EXPIRY_DAYS = 180
- pattr_initialize [:payload, :token]
-
def generate_token
- JWT.encode payload_with_expiry, secret_key, 'HS256'
- end
-
- def decode_token
- JWT.decode(
- token, secret_key, true, algorithm: 'HS256'
- ).first.symbolize_keys
- rescue StandardError
- {}
+ JWT.encode(token_payload, secret_key, algorithm)
end
private
- def payload_with_expiry
- payload.merge(exp: exp, iat: iat)
+ def token_payload
+ (payload || {}).merge(exp: exp, iat: iat)
end
def iat
@@ -34,8 +24,4 @@ class Widget::TokenService
token_expiry_value = InstallationConfig.find_by(name: 'WIDGET_TOKEN_EXPIRY')&.value
(token_expiry_value.presence || DEFAULT_EXPIRY_DAYS).to_i
end
-
- def secret_key
- Rails.application.secret_key_base
- end
end
diff --git a/app/views/api/v1/profile/mfa/backup_codes.json.jbuilder b/app/views/api/v1/profile/mfa/backup_codes.json.jbuilder
new file mode 100644
index 000000000..2aafdd3cd
--- /dev/null
+++ b/app/views/api/v1/profile/mfa/backup_codes.json.jbuilder
@@ -0,0 +1 @@
+json.backup_codes @backup_codes
diff --git a/app/views/api/v1/profile/mfa/create.json.jbuilder b/app/views/api/v1/profile/mfa/create.json.jbuilder
new file mode 100644
index 000000000..52072ccfb
--- /dev/null
+++ b/app/views/api/v1/profile/mfa/create.json.jbuilder
@@ -0,0 +1,2 @@
+json.provisioning_url @user.mfa_service.two_factor_provisioning_uri
+json.secret @user.otp_secret
diff --git a/app/views/api/v1/profile/mfa/destroy.json.jbuilder b/app/views/api/v1/profile/mfa/destroy.json.jbuilder
new file mode 100644
index 000000000..a5bf2ea84
--- /dev/null
+++ b/app/views/api/v1/profile/mfa/destroy.json.jbuilder
@@ -0,0 +1 @@
+json.enabled @user.mfa_enabled?
diff --git a/app/views/api/v1/profile/mfa/show.json.jbuilder b/app/views/api/v1/profile/mfa/show.json.jbuilder
new file mode 100644
index 000000000..4568f48f9
--- /dev/null
+++ b/app/views/api/v1/profile/mfa/show.json.jbuilder
@@ -0,0 +1,3 @@
+json.feature_available Chatwoot.mfa_enabled?
+json.enabled @user.mfa_enabled?
+json.backup_codes_generated @user.mfa_service.backup_codes_generated? if Chatwoot.mfa_enabled?
diff --git a/app/views/api/v1/profile/mfa/verify.json.jbuilder b/app/views/api/v1/profile/mfa/verify.json.jbuilder
new file mode 100644
index 000000000..54be3fc35
--- /dev/null
+++ b/app/views/api/v1/profile/mfa/verify.json.jbuilder
@@ -0,0 +1,2 @@
+json.enabled @user.mfa_enabled?
+json.backup_codes @backup_codes if @backup_codes.present?
diff --git a/app/views/layouts/vueapp.html.erb b/app/views/layouts/vueapp.html.erb
index 55fba871c..4d71a547d 100644
--- a/app/views/layouts/vueapp.html.erb
+++ b/app/views/layouts/vueapp.html.erb
@@ -44,6 +44,7 @@
whatsappApiVersion: '<%= @global_config['WHATSAPP_API_VERSION'] %>',
signupEnabled: '<%= @global_config['ENABLE_ACCOUNT_SIGNUP'] %>',
isEnterprise: '<%= @global_config['IS_ENTERPRISE'] %>',
+ isMfaEnabled: '<%= Chatwoot.mfa_enabled? %>',
<% if @global_config['IS_ENTERPRISE'] %>
enterprisePlanName: '<%= @global_config['INSTALLATION_PRICING_PLAN'] %>',
<% end %>
diff --git a/config/app.yml b/config/app.yml
index d11111fbc..34d044656 100644
--- a/config/app.yml
+++ b/config/app.yml
@@ -1,5 +1,5 @@
shared: &shared
- version: '4.5.2'
+ version: '4.6.0'
development:
<<: *shared
diff --git a/config/application.rb b/config/application.rb
index 7fd1b94ba..d644dd28f 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -68,6 +68,16 @@ module Chatwoot
# Disable PDF/video preview generation as we don't use them
config.active_storage.previewers = []
+
+ # Active Record Encryption configuration
+ # Required for MFA/2FA features - skip if not using encryption
+ if ENV['ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY'].present?
+ config.active_record.encryption.primary_key = ENV['ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY']
+ config.active_record.encryption.deterministic_key = ENV.fetch('ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY', nil)
+ config.active_record.encryption.key_derivation_salt = ENV.fetch('ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT', nil)
+ config.active_record.encryption.support_unencrypted_data = true
+ config.active_record.encryption.store_key_references = true
+ end
end
def self.config
@@ -82,4 +92,16 @@ module Chatwoot
# ref: https://www.rubydoc.info/stdlib/openssl/OpenSSL/SSL/SSLContext#DEFAULT_PARAMS-constant
ENV['REDIS_OPENSSL_VERIFY_MODE'] == 'none' ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER
end
+
+ def self.encryption_configured?
+ # Check if proper encryption keys are configured
+ # MFA/2FA features should only be enabled when proper keys are set
+ ENV['ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY'].present? &&
+ ENV['ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY'].present? &&
+ ENV['ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT'].present?
+ end
+
+ def self.mfa_enabled?
+ encryption_configured?
+ end
end
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
index 4c9ecc032..18855c95f 100644
--- a/config/initializers/filter_parameter_logging.rb
+++ b/config/initializers/filter_parameter_logging.rb
@@ -2,7 +2,8 @@
# Configure sensitive parameters which will be filtered from the log file.
Rails.application.config.filter_parameters += [
- :password, :secret, :_key, :auth, :crypt, :salt, :certificate, :otp, :access, :private, :protected, :ssn
+ :password, :secret, :_key, :auth, :crypt, :salt, :certificate, :otp, :access, :private, :protected, :ssn,
+ :otp_secret, :otp_code, :backup_code, :mfa_token, :otp_backup_codes
]
# Regex to filter all occurrences of 'token' in keys except for 'website_token'
diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
index fe3f6c554..fe40974f2 100644
--- a/config/initializers/rack_attack.rb
+++ b/config/initializers/rack_attack.rb
@@ -83,12 +83,17 @@ class Rack::Attack
end
# ### Prevent Brute-Force Login Attacks ###
+ # Exclude MFA verification attempts from regular login throttling
throttle('login/ip', limit: 5, period: 5.minutes) do |req|
- req.ip if req.path_without_extentions == '/auth/sign_in' && req.post?
+ if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
+ # Skip if this is an MFA verification request
+ req.ip
+ end
end
throttle('login/email', limit: 10, period: 15.minutes) do |req|
- if req.path_without_extentions == '/auth/sign_in' && req.post?
+ # Skip if this is an MFA verification request
+ if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
# ref: https://github.com/rack/rack-attack/issues/399
# NOTE: This line used to throw ArgumentError /rails/action_mailbox/sendgrid/inbound_emails : invalid byte sequence in UTF-8
# Hence placed in the if block
@@ -114,6 +119,28 @@ class Rack::Attack
req.ip if req.path_without_extentions == '/api/v1/profile/resend_confirmation' && req.post?
end
+ ## MFA throttling - prevent brute force attacks
+ throttle('mfa_verification/ip', limit: 5, period: 1.minute) do |req|
+ if req.path_without_extentions == '/api/v1/profile/mfa'
+ req.ip if req.delete? # Throttle disable attempts
+ elsif req.path_without_extentions.match?(%r{/api/v1/profile/mfa/(verify|backup_codes)})
+ req.ip if req.post? # Throttle verify and backup_codes attempts
+ end
+ end
+
+ # Separate rate limiting for MFA verification attempts
+ throttle('mfa_login/ip', limit: 10, period: 1.minute) do |req|
+ req.ip if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].present?
+ end
+
+ throttle('mfa_login/token', limit: 10, period: 1.minute) do |req|
+ if req.path_without_extentions == '/auth/sign_in' && req.post?
+ # Track by MFA token to prevent brute force on a specific token
+ mfa_token = req.params['mfa_token'].presence
+ (mfa_token.presence)
+ end
+ end
+
## Prevent Brute-Force Signup Attacks ###
throttle('accounts/ip', limit: 5, period: 30.minutes) do |req|
req.ip if req.path_without_extentions == '/api/v1/accounts' && req.post?
diff --git a/config/locales/en.yml b/config/locales/en.yml
index d5345a411..0d869c75f 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -103,6 +103,18 @@ en:
invalid_value: Invalid value. The values provided for %{attribute_name} are invalid
custom_attribute_definition:
key_conflict: The provided key is not allowed as it might conflict with default attributes.
+ mfa:
+ already_enabled: MFA is already enabled
+ not_enabled: MFA is not enabled
+ invalid_code: Invalid verification code
+ invalid_backup_code: Invalid backup code
+ invalid_token: Invalid or expired MFA token
+ invalid_credentials: Invalid credentials or verification code
+ feature_unavailable: MFA feature is not available. Please configure encryption keys.
+ profile:
+ mfa:
+ enabled: MFA enabled successfully
+ disabled: MFA disabled successfully
account_saml_settings:
invalid_certificate: must be a valid X.509 certificate in PEM format
reports:
diff --git a/config/routes.rb b/config/routes.rb
index 5fc602e0b..244bd67bf 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -334,6 +334,14 @@ Rails.application.routes.draw do
post :resend_confirmation
post :reset_access_token
end
+
+ # MFA routes
+ scope module: 'profile' do
+ resource :mfa, controller: 'mfa', only: [:show, :create, :destroy] do
+ post :verify
+ post :backup_codes
+ end
+ end
end
resource :notification_subscriptions, only: [:create, :destroy]
diff --git a/db/migrate/20250820130619_add_two_factor_to_users.rb b/db/migrate/20250820130619_add_two_factor_to_users.rb
new file mode 100644
index 000000000..3178aae05
--- /dev/null
+++ b/db/migrate/20250820130619_add_two_factor_to_users.rb
@@ -0,0 +1,11 @@
+class AddTwoFactorToUsers < ActiveRecord::Migration[7.1]
+ def change
+ add_column :users, :otp_secret, :string
+ add_column :users, :consumed_timestep, :integer
+ add_column :users, :otp_required_for_login, :boolean, default: false, null: false
+ add_column :users, :otp_backup_codes, :text
+
+ add_index :users, :otp_secret, unique: true
+ add_index :users, :otp_required_for_login
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 36a532e86..00b6f9109 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1175,7 +1175,13 @@ ActiveRecord::Schema[7.1].define(version: 2025_09_16_024703) do
t.jsonb "custom_attributes", default: {}
t.string "type"
t.text "message_signature"
+ t.string "otp_secret"
+ t.integer "consumed_timestep"
+ t.boolean "otp_required_for_login", default: false
+ t.text "otp_backup_codes"
t.index ["email"], name: "index_users_on_email"
+ t.index ["otp_required_for_login"], name: "index_users_on_otp_required_for_login"
+ t.index ["otp_secret"], name: "index_users_on_otp_secret", unique: true
t.index ["pubsub_token"], name: "index_users_on_pubsub_token", unique: true
t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
t.index ["uid", "provider"], name: "index_users_on_uid_and_provider", unique: true
diff --git a/enterprise/app/builders/enterprise/agent_builder.rb b/enterprise/app/builders/enterprise/agent_builder.rb
new file mode 100644
index 000000000..3007dbb61
--- /dev/null
+++ b/enterprise/app/builders/enterprise/agent_builder.rb
@@ -0,0 +1,13 @@
+module Enterprise::AgentBuilder
+ def perform
+ super.tap do |user|
+ convert_to_saml_provider(user) if user.persisted? && account.saml_enabled?
+ end
+ end
+
+ private
+
+ def convert_to_saml_provider(user)
+ user.update!(provider: 'saml') unless user.provider == 'saml'
+ end
+end
diff --git a/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb
index c7b0366dd..151cf279c 100644
--- a/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb
+++ b/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb
@@ -10,21 +10,9 @@ class Api::V1::Accounts::Captain::AssistantResponsesController < Api::V1::Accoun
RESULTS_PER_PAGE = 25
def index
- base_query = @responses
- base_query = base_query.where(assistant_id: permitted_params[:assistant_id]) if permitted_params[:assistant_id].present?
-
- if permitted_params[:document_id].present?
- base_query = base_query.where(
- documentable_id: permitted_params[:document_id],
- documentable_type: 'Captain::Document'
- )
- end
-
- base_query = base_query.where(status: permitted_params[:status]) if permitted_params[:status].present?
-
- @responses_count = base_query.count
-
- @responses = base_query.page(@current_page).per(RESULTS_PER_PAGE)
+ filtered_query = apply_filters(@responses)
+ @responses_count = filtered_query.count
+ @responses = filtered_query.page(@current_page).per(RESULTS_PER_PAGE)
end
def show; end
@@ -46,6 +34,29 @@ class Api::V1::Accounts::Captain::AssistantResponsesController < Api::V1::Accoun
private
+ def apply_filters(base_query)
+ base_query = base_query.where(assistant_id: permitted_params[:assistant_id]) if permitted_params[:assistant_id].present?
+
+ if permitted_params[:document_id].present?
+ base_query = base_query.where(
+ documentable_id: permitted_params[:document_id],
+ documentable_type: 'Captain::Document'
+ )
+ end
+
+ base_query = base_query.where(status: permitted_params[:status]) if permitted_params[:status].present?
+
+ if permitted_params[:search].present?
+ search_term = "%#{permitted_params[:search]}%"
+ base_query = base_query.where(
+ 'question ILIKE :search OR answer ILIKE :search',
+ search: search_term
+ )
+ end
+
+ base_query
+ end
+
def set_assistant
@assistant = Current.account.captain_assistants.find_by(id: params[:assistant_id])
end
@@ -63,7 +74,7 @@ class Api::V1::Accounts::Captain::AssistantResponsesController < Api::V1::Accoun
end
def permitted_params
- params.permit(:id, :assistant_id, :page, :document_id, :account_id, :status)
+ params.permit(:id, :assistant_id, :page, :document_id, :account_id, :status, :search)
end
def response_params
diff --git a/enterprise/app/views/devise/mailer/confirmation_instructions.html.erb b/enterprise/app/views/devise/mailer/confirmation_instructions.html.erb
new file mode 100644
index 000000000..91837f980
--- /dev/null
+++ b/enterprise/app/views/devise/mailer/confirmation_instructions.html.erb
@@ -0,0 +1,45 @@
+
Hi <%= @resource.name %>,
+ +<% account_user = @resource&.account_users&.first %> +<% is_saml_account = account_user&.account&.saml_enabled? %> + +<% if account_user&.inviter.present? && @resource.unconfirmed_email.blank? %> + <% if is_saml_account %> +<%= account_user.inviter.name %>, with <%= account_user.account.name %>, has invited you to access <%= global_config['BRAND_NAME'] || 'Chatwoot' %> via Single Sign-On (SSO).
+Your organization uses SSO for secure authentication. You will not need a password to access your account.
+ <% else %> +<%= account_user.inviter.name %>, with <%= account_user.account.name %>, has invited you to try out <%= global_config['BRAND_NAME'] || 'Chatwoot' %>.
+ <% end %> +<% end %> + +<% if @resource.confirmed? %> +You can login to your <%= global_config['BRAND_NAME'] || 'Chatwoot' %> account through the link below:
+<% else %> + <% if account_user&.inviter.blank? %> ++ Welcome to <%= global_config['BRAND_NAME'] || 'Chatwoot' %>! We have a suite of powerful tools ready for you to explore. Before that we quickly need to verify your email address to know it's really you. +
+ <% end %> + <% unless is_saml_account %> +Please take a moment and click the link below and activate your account.
+ <% end %> +<% end %> + + +<% if @resource.unconfirmed_email.present? %> +<%= link_to 'Confirm my account', frontend_url('auth/confirmation', confirmation_token: @token) %>
+<% elsif @resource.confirmed? %> + <% if is_saml_account %> +You can now access your account by logging in through your organization's SSO portal.
+ <% else %> +<%= link_to 'Login to my account', frontend_url('auth/sign_in') %>
+ <% end %> +<% elsif account_user&.inviter.present? %> + <% if is_saml_account %> +You can access your account by logging in through your organization's SSO portal.
+ <% else %> +<%= link_to 'Confirm my account', frontend_url('auth/password/edit', reset_password_token: @resource.send(:set_reset_password_token)) %>
+ <% end %> +<% else %> +<%= link_to 'Confirm my account', frontend_url('auth/confirmation', confirmation_token: @token) %>
+<% end %> diff --git a/lib/filters/filter_keys.yml b/lib/filters/filter_keys.yml index 902b5f219..626a0cbd5 100644 --- a/lib/filters/filter_keys.yml +++ b/lib/filters/filter_keys.yml @@ -4,7 +4,7 @@ # 3. Automation Filters (app/services/automation_rules/conditions_filter_service.rb), (app/services/automation_rules/condition_validation_service.rb) -# Format +# Format # - Parent Key (conversation, contact, messages) # - Key (attribute_name) # - attribute_type: "standard" : supported ["standard", "additional_attributes (only for conversations and messages)"] @@ -138,7 +138,7 @@ contacts: - "does_not_contain" phone_number: attribute_type: "standard" - data_type: "text_case_insensitive" + data_type: "text" # Text is not explicity defined in filters, default filter will be used filter_operators: - "equal_to" - "not_equal_to" diff --git a/package.json b/package.json index 3972a328e..66dd84aa2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@chatwoot/chatwoot", - "version": "4.5.2", + "version": "4.6.0", "license": "MIT", "scripts": { "eslint": "eslint app/**/*.{js,vue}", diff --git a/spec/controllers/api/v1/accounts/portals_controller_spec.rb b/spec/controllers/api/v1/accounts/portals_controller_spec.rb index d0ea13e2b..f38660706 100644 --- a/spec/controllers/api/v1/accounts/portals_controller_spec.rb +++ b/spec/controllers/api/v1/accounts/portals_controller_spec.rb @@ -154,6 +154,25 @@ RSpec.describe 'Api::V1::Accounts::Portals', type: :request do portal.reload expect(portal.archived).to be_truthy end + + it 'clears associated web widget when inbox selection is blank' do + web_widget_inbox = create(:inbox, account: account) + portal.update!(channel_web_widget: web_widget_inbox.channel) + + expect(portal.channel_web_widget_id).to eq(web_widget_inbox.channel.id) + + put "/api/v1/accounts/#{account.id}/portals/#{portal.slug}", + params: { + portal: { name: portal.name }, + inbox_id: '' + }, + headers: admin.create_new_auth_token + + expect(response).to have_http_status(:success) + portal.reload + expect(portal.channel_web_widget_id).to be_nil + expect(response.parsed_body['inbox']).to be_nil + end end end diff --git a/spec/controllers/devise_overrides/sessions_controller_spec.rb b/spec/controllers/devise_overrides/sessions_controller_spec.rb new file mode 100644 index 000000000..31f308c8e --- /dev/null +++ b/spec/controllers/devise_overrides/sessions_controller_spec.rb @@ -0,0 +1,146 @@ +require 'rails_helper' + +RSpec.describe DeviseOverrides::SessionsController, type: :controller do + include Devise::Test::ControllerHelpers + + before do + request.env['devise.mapping'] = Devise.mappings[:user] + end + + describe 'POST #create' do + let(:user) { create(:user, password: 'Test@123456') } + + context 'with standard authentication' do + it 'authenticates with valid credentials' do + post :create, params: { email: user.email, password: 'Test@123456' } + + expect(response).to have_http_status(:success) + end + + it 'rejects invalid credentials' do + post :create, params: { email: user.email, password: 'wrong' } + + expect(response).to have_http_status(:unauthorized) + end + end + + context 'with MFA authentication' do + before do + skip('Skipping since MFA is not configured in this environment') unless Chatwoot.encryption_configured? + user.enable_two_factor! + user.update!(otp_required_for_login: true) + end + + it 'requires MFA verification after successful password authentication' do + post :create, params: { email: user.email, password: 'Test@123456' } + + expect(response).to have_http_status(:partial_content) + json_response = response.parsed_body + expect(json_response['mfa_required']).to be(true) + expect(json_response['mfa_token']).to be_present + end + + context 'when verifying MFA' do + let(:mfa_token) { Mfa::TokenService.new(user: user).generate_token } + + it 'authenticates with valid OTP' do + post :create, params: { + mfa_token: mfa_token, + otp_code: user.current_otp + } + + expect(response).to have_http_status(:success) + end + + it 'authenticates with valid backup code' do + backup_codes = user.generate_backup_codes! + + post :create, params: { + mfa_token: mfa_token, + backup_code: backup_codes.first + } + + expect(response).to have_http_status(:success) + end + + it 'rejects invalid OTP' do + post :create, params: { + mfa_token: mfa_token, + otp_code: '000000' + } + + expect(response).to have_http_status(:bad_request) + expect(response.parsed_body['error']).to eq(I18n.t('errors.mfa.invalid_code')) + end + + it 'rejects invalid backup code' do + user.generate_backup_codes! + + post :create, params: { + mfa_token: mfa_token, + backup_code: 'invalid' + } + + expect(response).to have_http_status(:bad_request) + expect(response.parsed_body['error']).to eq(I18n.t('errors.mfa.invalid_code')) + end + + it 'rejects expired MFA token' do + expired_token = JWT.encode( + { user_id: user.id, exp: 1.minute.ago.to_i }, + Rails.application.secret_key_base, + 'HS256' + ) + + post :create, params: { + mfa_token: expired_token, + otp_code: user.current_otp + } + + expect(response).to have_http_status(:unauthorized) + expect(response.parsed_body['error']).to eq(I18n.t('errors.mfa.invalid_token')) + end + + it 'requires either OTP or backup code' do + post :create, params: { mfa_token: mfa_token } + + expect(response).to have_http_status(:bad_request) + expect(response.parsed_body['error']).to eq(I18n.t('errors.mfa.invalid_code')) + end + end + end + + context 'with SSO authentication' do + it 'authenticates with valid SSO token' do + sso_token = user.generate_sso_auth_token + + post :create, params: { + email: user.email, + sso_auth_token: sso_token + } + + expect(response).to have_http_status(:success) + end + + it 'rejects invalid SSO token' do + post :create, params: { + email: user.email, + sso_auth_token: 'invalid' + } + + expect(response).to have_http_status(:unauthorized) + end + end + end + + describe 'GET #new' do + it 'redirects to frontend login page' do + allow(ENV).to receive(:fetch).and_call_original + allow(ENV).to receive(:fetch).with('FRONTEND_URL', nil).and_return('/frontend') + + get :new + + expect(response).to redirect_to('/frontend/app/login?error=access-denied') + end + end +end diff --git a/spec/enterprise/builders/agent_builder_spec.rb b/spec/enterprise/builders/agent_builder_spec.rb new file mode 100644 index 000000000..8f0ae4c17 --- /dev/null +++ b/spec/enterprise/builders/agent_builder_spec.rb @@ -0,0 +1,139 @@ +require 'rails_helper' + +RSpec.describe AgentBuilder do + let(:email) { 'agent@example.com' } + let(:name) { 'Test Agent' } + let(:account) { create(:account) } + let!(:inviter) { create(:user, account: account, role: 'administrator') } + let(:builder) do + described_class.new( + email: email, + name: name, + account: account, + inviter: inviter + ) + end + + describe '#perform with SAML enabled' do + let(:saml_settings) do + create(:account_saml_settings, account: account) + end + + before { saml_settings } + + context 'when user does not exist' do + it 'creates a new user with SAML provider' do + expect { builder.perform }.to change(User, :count).by(1) + + user = User.from_email(email) + expect(user.provider).to eq('saml') + end + + it 'creates user with correct attributes' do + user = builder.perform + + expect(user.email).to eq(email) + expect(user.name).to eq(name) + expect(user.provider).to eq('saml') + expect(user.encrypted_password).to be_present + end + + it 'adds user to the account with correct role' do + user = builder.perform + account_user = AccountUser.find_by(user: user, account: account) + + expect(account_user).to be_present + expect(account_user.role).to eq('agent') + expect(account_user.inviter).to eq(inviter) + end + end + + context 'when user already exists with email provider' do + let!(:existing_user) { create(:user, email: email, provider: 'email') } + + it 'does not create a new user' do + expect { builder.perform }.not_to change(User, :count) + end + + it 'converts existing user to SAML provider' do + expect(existing_user.provider).to eq('email') + + builder.perform + + expect(existing_user.reload.provider).to eq('saml') + end + + it 'adds existing user to the account' do + user = builder.perform + account_user = AccountUser.find_by(user: user, account: account) + + expect(account_user).to be_present + expect(account_user.inviter).to eq(inviter) + end + end + + context 'when user already exists with SAML provider' do + let!(:existing_user) { create(:user, email: email, provider: 'saml') } + + it 'does not change the provider' do + expect { builder.perform }.not_to(change { existing_user.reload.provider }) + end + + it 'still adds user to the account' do + user = builder.perform + account_user = AccountUser.find_by(user: user, account: account) + + expect(account_user).to be_present + end + end + end + + describe '#perform without SAML' do + context 'when user does not exist' do + it 'creates a new user with email provider (default behavior)' do + expect { builder.perform }.to change(User, :count).by(1) + + user = User.from_email(email) + expect(user.provider).to eq('email') + end + end + + context 'when user already exists' do + let!(:existing_user) { create(:user, email: email, provider: 'email') } + + it 'does not change the existing user provider' do + expect { builder.perform }.not_to(change { existing_user.reload.provider }) + end + end + end + + describe '#perform with different account configurations' do + context 'when account has no SAML settings' do + # No saml_settings created for this account + + it 'treats account as non-SAML enabled' do + user = builder.perform + expect(user.provider).to eq('email') + end + end + + context 'when SAML settings are deleted after user creation' do + let(:saml_settings) do + create(:account_saml_settings, account: account) + end + let(:existing_user) { create(:user, email: email, provider: 'saml') } + + before do + saml_settings + existing_user + end + + it 'does not affect existing SAML users when adding to account' do + saml_settings.destroy! + + user = builder.perform + expect(user.provider).to eq('saml') # Unchanged + end + end + end +end diff --git a/spec/enterprise/controllers/api/v1/accounts/captain/assistant_responses_controller_spec.rb b/spec/enterprise/controllers/api/v1/accounts/captain/assistant_responses_controller_spec.rb index 58c23f897..038ee5e8d 100644 --- a/spec/enterprise/controllers/api/v1/accounts/captain/assistant_responses_controller_spec.rb +++ b/spec/enterprise/controllers/api/v1/accounts/captain/assistant_responses_controller_spec.rb @@ -90,6 +90,53 @@ RSpec.describe 'Api::V1::Accounts::Captain::AssistantResponses', type: :request expect(json_response[:payload][0][:documentable][:id]).to eq(document.id) end end + + context 'when searching' do + before do + create(:captain_assistant_response, + account: account, + assistant: assistant, + question: 'How to reset password?', + answer: 'Click forgot password') + create(:captain_assistant_response, + account: account, + assistant: assistant, + question: 'How to change email?', + answer: 'Go to settings') + end + + it 'finds responses by question text' do + get "/api/v1/accounts/#{account.id}/captain/assistant_responses", + params: { search: 'password' }, + headers: agent.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:ok) + expect(json_response[:payload].length).to eq(1) + expect(json_response[:payload][0][:question]).to include('password') + end + + it 'finds responses by answer text' do + get "/api/v1/accounts/#{account.id}/captain/assistant_responses", + params: { search: 'settings' }, + headers: agent.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:ok) + expect(json_response[:payload].length).to eq(1) + expect(json_response[:payload][0][:answer]).to include('settings') + end + + it 'returns empty when no matches' do + get "/api/v1/accounts/#{account.id}/captain/assistant_responses", + params: { search: 'nonexistent' }, + headers: agent.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:ok) + expect(json_response[:payload].length).to eq(0) + end + end end describe 'GET /api/v1/accounts/:account_id/captain/assistant_responses/:id' do diff --git a/spec/enterprise/mailers/devise_mailer_spec.rb b/spec/enterprise/mailers/devise_mailer_spec.rb new file mode 100644 index 000000000..286e863f7 --- /dev/null +++ b/spec/enterprise/mailers/devise_mailer_spec.rb @@ -0,0 +1,150 @@ +# frozen_string_literal: true + +require 'rails_helper' + +RSpec.describe 'Devise::Mailer' do + describe 'confirmation_instructions with Enterprise features' do + let(:account) { create(:account) } + let!(:confirmable_user) { create(:user, inviter: inviter_val, account: account) } + let(:inviter_val) { nil } + let(:mail) { Devise::Mailer.confirmation_instructions(confirmable_user.reload, nil, {}) } + + before do + confirmable_user.update!(confirmed_at: nil) + confirmable_user.send(:generate_confirmation_token) + end + + context 'with SAML enabled account' do + let(:saml_settings) { create(:account_saml_settings, account: account) } + + before { saml_settings } + + context 'when user has no inviter' do + it 'shows standard welcome message without SSO references' do + expect(mail.body).to match('We have a suite of powerful tools ready for you to explore.') + expect(mail.body).not_to match('via Single Sign-On') + end + + it 'does not show activation instructions for SAML accounts' do + expect(mail.body).not_to match('Please take a moment and click the link below and activate your account') + end + + it 'shows confirmation link' do + expect(mail.body).to include("app/auth/confirmation?confirmation_token=#{confirmable_user.confirmation_token}") + end + end + + context 'when user has inviter and SAML is enabled' do + let(:inviter_val) { create(:user, :administrator, skip_confirmation: true, account: account) } + + it 'mentions SSO invitation' do + expect(mail.body).to match( + "#{CGI.escapeHTML(inviter_val.name)}, with #{CGI.escapeHTML(account.name)}, has invited you to access.*via Single Sign-On \\(SSO\\)" + ) + end + + it 'explains SSO authentication' do + expect(mail.body).to match('Your organization uses SSO for secure authentication') + expect(mail.body).to match('You will not need a password to access your account') + end + + it 'does not show standard invitation message' do + expect(mail.body).not_to match('has invited you to try out') + end + + it 'directs to SSO portal instead of password reset' do + expect(mail.body).to match('You can access your account by logging in through your organization\'s SSO portal') + expect(mail.body).not_to include('app/auth/password/edit') + end + end + + context 'when user is already confirmed and has inviter' do + let(:inviter_val) { create(:user, :administrator, skip_confirmation: true, account: account) } + + before do + confirmable_user.confirm + end + + it 'shows SSO login instructions' do + expect(mail.body).to match('You can now access your account by logging in through your organization\'s SSO portal') + expect(mail.body).not_to include('/auth/sign_in') + end + end + + context 'when user updates email on SAML account' do + let(:inviter_val) { create(:user, :administrator, skip_confirmation: true, account: account) } + + before do + confirmable_user.update!(email: 'updated@example.com') + end + + it 'still shows confirmation link for email verification' do + expect(mail.body).to include('app/auth/confirmation?confirmation_token') + expect(confirmable_user.unconfirmed_email.blank?).to be false + end + end + + context 'when user is already confirmed with no inviter' do + before do + confirmable_user.confirm + end + + it 'shows SSO login instructions instead of regular login' do + expect(mail.body).to match('You can now access your account by logging in through your organization\'s SSO portal') + expect(mail.body).not_to include('/auth/sign_in') + end + end + end + + context 'when account does not have SAML enabled' do + context 'when user has inviter' do + let(:inviter_val) { create(:user, :administrator, skip_confirmation: true, account: account) } + + it 'shows standard invitation without SSO references' do + expect(mail.body).to match('has invited you to try out Chatwoot') + expect(mail.body).not_to match('via Single Sign-On') + expect(mail.body).not_to match('SSO portal') + end + + it 'shows password reset link' do + expect(mail.body).to include('app/auth/password/edit') + end + end + + context 'when user has no inviter' do + it 'shows standard welcome message and activation instructions' do + expect(mail.body).to match('We have a suite of powerful tools ready for you to explore') + expect(mail.body).to match('Please take a moment and click the link below and activate your account') + end + + it 'shows confirmation link' do + expect(mail.body).to include("app/auth/confirmation?confirmation_token=#{confirmable_user.confirmation_token}") + end + end + + context 'when user is already confirmed' do + let(:inviter_val) { create(:user, :administrator, skip_confirmation: true, account: account) } + + before do + confirmable_user.confirm + end + + it 'shows regular login link' do + expect(mail.body).to include('/auth/sign_in') + expect(mail.body).not_to match('SSO portal') + end + end + + context 'when user updates email' do + before do + confirmable_user.update!(email: 'updated@example.com') + end + + it 'shows confirmation link for email verification' do + expect(mail.body).to include('app/auth/confirmation?confirmation_token') + expect(confirmable_user.unconfirmed_email.blank?).to be false + end + end + end + end +end diff --git a/spec/enterprise/models/inbox_spec.rb b/spec/enterprise/models/inbox_spec.rb index 6b0130c28..4ba1a7021 100644 --- a/spec/enterprise/models/inbox_spec.rb +++ b/spec/enterprise/models/inbox_spec.rb @@ -33,7 +33,7 @@ RSpec.describe Inbox do end it 'returns all member ids when inbox max_assignment_limit is not configured' do - expect(inbox.member_ids_with_assignment_capacity).to eq(inbox.members.ids) + expect(inbox.member_ids_with_assignment_capacity).to match_array(inbox.members.ids) end end diff --git a/spec/listeners/automation_rule_listener_labels_spec.rb b/spec/listeners/automation_rule_listener_labels_spec.rb new file mode 100644 index 000000000..36002f7f3 --- /dev/null +++ b/spec/listeners/automation_rule_listener_labels_spec.rb @@ -0,0 +1,244 @@ +require 'rails_helper' + +describe AutomationRuleListener do + let(:listener) { described_class.instance } + let!(:account) { create(:account) } + let!(:user) { create(:user, account: account) } + let!(:inbox) { create(:inbox, account: account) } + let!(:contact) { create(:contact, account: account) } + let!(:conversation) { create(:conversation, account: account, inbox: inbox, contact: contact) } + let(:label1) { create(:label, account: account, title: 'bug') } + let(:label2) { create(:label, account: account, title: 'feature') } + let(:label3) { create(:label, account: account, title: 'urgent') } + + before do + Current.user = user + end + + describe 'conversation_updated with label conditions and actions' do + context 'when label is added and automation rule has label condition' do + let(:automation_rule) do + create(:automation_rule, + event_name: 'conversation_updated', + account: account, + conditions: [ + { + attribute_key: 'labels', + filter_operator: 'equal_to', + values: ['bug'], + query_operator: nil + } + ], + actions: [ + { + action_name: 'add_label', + action_params: ['urgent'] + }, + { + action_name: 'send_message', + action_params: ['Bug report received. We will investigate this issue.'] + } + ]) + end + + it 'triggers automation when the specified label is added' do + automation_rule # Create the automation rule + expect(Messages::MessageBuilder).to receive(:new).and_call_original + + # Add the 'bug' label to trigger the automation + conversation.add_labels(['bug']) + + # Dispatch the event + event = Events::Base.new('conversation_updated', Time.zone.now, { + conversation: conversation, + changed_attributes: { label_list: [[], ['bug']] } + }) + + listener.conversation_updated(event) + + # Verify the label was added by automation + expect(conversation.reload.label_list).to include('urgent') + + # Verify a message was sent + expect(conversation.messages.last.content).to eq('Bug report received. We will investigate this issue.') + end + + it 'does not trigger automation when a different label is added' do + automation_rule # Create the automation rule + expect(Messages::MessageBuilder).not_to receive(:new) + + # Add a different label + conversation.add_labels(['feature']) + + event = Events::Base.new('conversation_updated', Time.zone.now, { + conversation: conversation, + changed_attributes: { label_list: [[], ['feature']] } + }) + + listener.conversation_updated(event) + + # Verify the automation did not run + expect(conversation.reload.label_list).not_to include('urgent') + end + end + + context 'when automation rule has is_present label condition' do + let(:automation_rule) do + create(:automation_rule, + event_name: 'conversation_updated', + account: account, + conditions: [ + { + attribute_key: 'labels', + filter_operator: 'is_present', + values: [], + query_operator: nil + } + ], + actions: [ + { + action_name: 'send_message', + action_params: ['Thank you for adding a label to categorize this conversation.'] + } + ]) + end + + it 'triggers automation when any label is added to an unlabeled conversation' do + automation_rule # Create the automation rule + expect(Messages::MessageBuilder).to receive(:new).and_call_original + + # Add any label to trigger the automation + conversation.add_labels(['feature']) + + event = Events::Base.new('conversation_updated', Time.zone.now, { + conversation: conversation, + changed_attributes: { label_list: [[], ['feature']] } + }) + + listener.conversation_updated(event) + + # Verify a message was sent + expect(conversation.messages.last.content).to eq('Thank you for adding a label to categorize this conversation.') + end + + it 'still triggers when labels are removed but conversation still has labels' do + automation_rule # Create the automation rule + # Start with multiple labels + conversation.add_labels(%w[bug feature]) + conversation.reload + + expect(Messages::MessageBuilder).to receive(:new).and_call_original + + # Remove one label but conversation still has labels + conversation.update_labels(['bug']) + + event = Events::Base.new('conversation_updated', Time.zone.now, { + conversation: conversation, + changed_attributes: { label_list: [%w[bug feature], ['bug']] } + }) + + listener.conversation_updated(event) + + # Should still trigger because conversation has labels (is_present condition) + expect(conversation.messages.last.content).to eq('Thank you for adding a label to categorize this conversation.') + end + + it 'does not trigger when all labels are removed' do + automation_rule # Create the automation rule + # Start with labels + conversation.add_labels(['bug']) + conversation.reload + + expect(Messages::MessageBuilder).not_to receive(:new) + + # Remove all labels + conversation.update_labels([]) + + event = Events::Base.new('conversation_updated', Time.zone.now, { + conversation: conversation, + changed_attributes: { label_list: [['bug'], []] } + }) + + listener.conversation_updated(event) + end + end + + context 'when automation rule has remove_label action' do + let!(:automation_rule) do + create(:automation_rule, + event_name: 'conversation_updated', + account: account, + conditions: [ + { + attribute_key: 'labels', + filter_operator: 'equal_to', + values: ['urgent'], + query_operator: nil + } + ], + actions: [ + { + action_name: 'remove_label', + action_params: ['bug'] + } + ]) + end + + it 'removes specified labels when condition is met' do + automation_rule # Create the automation rule + # Start with both labels + conversation.add_labels(%w[bug urgent]) + + event = Events::Base.new('conversation_updated', Time.zone.now, { + conversation: conversation, + changed_attributes: { label_list: [['bug'], %w[bug urgent]] } + }) + + listener.conversation_updated(event) + + # Verify the bug label was removed but urgent remains + expect(conversation.reload.label_list).to include('urgent') + expect(conversation.reload.label_list).not_to include('bug') + end + end + end + + describe 'preventing infinite loops' do + let!(:automation_rule) do + create(:automation_rule, + event_name: 'conversation_updated', + account: account, + conditions: [ + { + attribute_key: 'labels', + filter_operator: 'equal_to', + values: ['bug'], + query_operator: nil + } + ], + actions: [ + { + action_name: 'add_label', + action_params: ['processed'] + } + ]) + end + + it 'does not trigger automation when performed by automation rule' do + automation_rule # Create the automation rule + conversation.add_labels(['bug']) + + # Simulate event performed by automation rule + event = Events::Base.new('conversation_updated', Time.zone.now, { + conversation: conversation, + changed_attributes: { label_list: [[], ['bug']] }, + performed_by: automation_rule + }) + + # Should not process the event since it was performed by automation + expect(AutomationRules::ActionService).not_to receive(:new) + + listener.conversation_updated(event) + end + end +end diff --git a/spec/mailers/administrator_notifications/base_mailer_spec.rb b/spec/mailers/administrator_notifications/base_mailer_spec.rb index 619fef0a7..1524a46cc 100644 --- a/spec/mailers/administrator_notifications/base_mailer_spec.rb +++ b/spec/mailers/administrator_notifications/base_mailer_spec.rb @@ -17,8 +17,7 @@ RSpec.describe AdministratorNotifications::BaseMailer do # Call the private method admin_emails = mailer.send(:admin_emails) - expect(admin_emails).to include(admin1.email) - expect(admin_emails).to include(admin2.email) + expect(admin_emails).to contain_exactly(admin1.email, admin2.email) expect(admin_emails).not_to include(agent.email) end end @@ -49,7 +48,7 @@ RSpec.describe AdministratorNotifications::BaseMailer do # Mock the send_mail_with_liquid method expect(mailer).to receive(:send_mail_with_liquid).with( - to: [admin1.email, admin2.email], + to: contain_exactly(admin1.email, admin2.email), subject: subject ).and_return(true) diff --git a/spec/mailers/administrator_notifications/channel_notifications_mailer_spec.rb b/spec/mailers/administrator_notifications/channel_notifications_mailer_spec.rb index e5cd7327b..39bc4ee1a 100644 --- a/spec/mailers/administrator_notifications/channel_notifications_mailer_spec.rb +++ b/spec/mailers/administrator_notifications/channel_notifications_mailer_spec.rb @@ -9,6 +9,7 @@ RSpec.describe AdministratorNotifications::ChannelNotificationsMailer do let(:class_instance) { described_class.new } let!(:account) { create(:account) } let!(:administrator) { create(:user, :administrator, email: 'agent1@example.com', account: account) } + let!(:another_administrator) { create(:user, :administrator, email: 'agent2@example.com', account: account) } describe 'facebook_disconnect' do before do @@ -26,7 +27,7 @@ RSpec.describe AdministratorNotifications::ChannelNotificationsMailer do end it 'renders the receiver email' do - expect(mail.to).to eq([administrator.email]) + expect(mail.to).to contain_exactly(administrator.email, another_administrator.email) end end end @@ -41,7 +42,7 @@ RSpec.describe AdministratorNotifications::ChannelNotificationsMailer do end it 'renders the receiver email' do - expect(mail.to).to eq([administrator.email]) + expect(mail.to).to contain_exactly(administrator.email, another_administrator.email) end end @@ -55,7 +56,7 @@ RSpec.describe AdministratorNotifications::ChannelNotificationsMailer do end it 'renders the receiver email' do - expect(mail.to).to eq([administrator.email]) + expect(mail.to).to contain_exactly(administrator.email, another_administrator.email) end end end diff --git a/spec/mailers/administrator_notifications/integrations_notification_mailer_spec.rb b/spec/mailers/administrator_notifications/integrations_notification_mailer_spec.rb index 331d33d06..04bc405f4 100644 --- a/spec/mailers/administrator_notifications/integrations_notification_mailer_spec.rb +++ b/spec/mailers/administrator_notifications/integrations_notification_mailer_spec.rb @@ -6,6 +6,7 @@ RSpec.describe AdministratorNotifications::IntegrationsNotificationMailer do let!(:account) { create(:account) } let!(:administrator) { create(:user, :administrator, email: 'admin@example.com', account: account) } + let!(:another_administrator) { create(:user, :administrator, email: 'owner@example.com', account: account) } describe 'slack_disconnect' do let(:mail) { described_class.with(account: account).slack_disconnect.deliver_now } @@ -15,7 +16,7 @@ RSpec.describe AdministratorNotifications::IntegrationsNotificationMailer do end it 'renders the receiver email' do - expect(mail.to).to eq([administrator.email]) + expect(mail.to).to contain_exactly(administrator.email, another_administrator.email) end it 'includes reconnect instructions in the body' do @@ -35,7 +36,7 @@ RSpec.describe AdministratorNotifications::IntegrationsNotificationMailer do end it 'renders the receiver email' do - expect(mail.to).to eq([administrator.email]) + expect(mail.to).to contain_exactly(administrator.email, another_administrator.email) end end end diff --git a/spec/models/automation_rule_spec.rb b/spec/models/automation_rule_spec.rb index 53ebfa0c7..91452b8a4 100644 --- a/spec/models/automation_rule_spec.rb +++ b/spec/models/automation_rule_spec.rb @@ -60,6 +60,32 @@ RSpec.describe AutomationRule do expect(rule.valid?).to be false expect(rule.errors.messages[:conditions]).to eq(['Automation conditions should have query operator.']) end + + it 'allows labels as a valid condition attribute' do + params[:conditions] = [ + { + attribute_key: 'labels', + filter_operator: 'equal_to', + values: ['bug'], + query_operator: nil + } + ] + rule = FactoryBot.build(:automation_rule, params) + expect(rule.valid?).to be true + end + + it 'validates label condition operators' do + params[:conditions] = [ + { + attribute_key: 'labels', + filter_operator: 'is_present', + values: [], + query_operator: nil + } + ] + rule = FactoryBot.build(:automation_rule, params) + expect(rule.valid?).to be true + end end describe 'reauthorizable' do diff --git a/spec/models/conversation_spec.rb b/spec/models/conversation_spec.rb index a29359528..007ce987f 100644 --- a/spec/models/conversation_spec.rb +++ b/spec/models/conversation_spec.rb @@ -136,7 +136,7 @@ RSpec.describe Conversation do notifiable_assignee_change: false, changed_attributes: changed_attributes, performed_by: nil - ).exactly(2).times + ) end it 'runs after_update callbacks' do diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 845ec0625..213988a0d 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -111,6 +111,113 @@ RSpec.describe User do end end + describe '2FA/MFA functionality' do + before do + skip('Skipping since MFA is not configured in this environment') unless Chatwoot.encryption_configured? + end + + let(:user) { create(:user, password: 'Test@123456') } + + describe '#enable_two_factor!' do + it 'generates OTP secret for 2FA setup' do + expect(user.otp_secret).to be_nil + expect(user.otp_required_for_login).to be_falsey + + user.enable_two_factor! + + expect(user.otp_secret).not_to be_nil + # otp_required_for_login is false until verification is complete + expect(user.otp_required_for_login).to be_falsey + end + end + + describe '#disable_two_factor!' do + before do + user.enable_two_factor! + user.update!(otp_required_for_login: true) # Simulate verified 2FA + user.generate_backup_codes! + end + + it 'disables 2FA and clears OTP secret' do + user.disable_two_factor! + + expect(user.otp_secret).to be_nil + expect(user.otp_required_for_login).to be_falsey + expect(user.otp_backup_codes).to be_blank # Can be nil or empty array + end + end + + describe '#generate_backup_codes!' do + before do + user.enable_two_factor! + end + + it 'generates 10 backup codes' do + codes = user.generate_backup_codes! + + expect(codes).to be_an(Array) + expect(codes.length).to eq(10) + expect(codes.first).to match(/\A[A-F0-9]{8}\z/) # 8-character hex codes + expect(user.otp_backup_codes).not_to be_nil + end + end + + describe '#two_factor_provisioning_uri' do + before do + user.enable_two_factor! + end + + it 'generates a valid provisioning URI for QR code' do + uri = user.two_factor_provisioning_uri + + expect(uri).to include('otpauth://totp/') + expect(uri).to include(CGI.escape(user.email)) + expect(uri).to include('Chatwoot') + end + end + + describe '#validate_backup_code!' do + let(:backup_codes) { user.generate_backup_codes! } + + before do + user.enable_two_factor! + backup_codes + end + + it 'validates and invalidates correct backup code' do + code = backup_codes.first + result = user.validate_backup_code!(code) + expect(result).to be_truthy + + # Verify it's marked as used + user.reload + expect(user.otp_backup_codes).to include('XXXXXXXX') + end + + it 'rejects invalid backup code' do + result = user.validate_backup_code!('invalid') + expect(result).to be_falsey + end + + it 'rejects already used backup code' do + code = backup_codes.first + user.validate_backup_code!(code) + + # Try to use the same code again + result = user.validate_backup_code!(code) + expect(result).to be_falsey + end + + it 'handles blank code' do + result = user.validate_backup_code!(nil) + expect(result).to be_falsey + + result = user.validate_backup_code!('') + expect(result).to be_falsey + end + end + end + describe '#active_account_user' do let(:user) { create(:user) } let(:account1) { create(:account) } diff --git a/spec/requests/api/v1/profile/mfa_controller_spec.rb b/spec/requests/api/v1/profile/mfa_controller_spec.rb new file mode 100644 index 000000000..97a2e206f --- /dev/null +++ b/spec/requests/api/v1/profile/mfa_controller_spec.rb @@ -0,0 +1,274 @@ +require 'rails_helper' + +RSpec.describe 'MFA API', type: :request do + before do + skip('Skipping since MFA is not configured in this environment') unless Chatwoot.encryption_configured? + allow(Chatwoot).to receive(:mfa_enabled?).and_return(true) + end + + let(:account) { create(:account) } + let(:user) { create(:user, account: account, password: 'Test@123456') } + + describe 'GET /api/v1/profile/mfa' do + context 'when 2FA is disabled' do + it 'returns MFA disabled status' do + get '/api/v1/profile/mfa', + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['enabled']).to be_falsey + expect(json_response['backup_codes_generated']).to be_falsey + end + end + + context 'when 2FA is enabled' do + before do + user.enable_two_factor! + user.update!(otp_required_for_login: true) + end + + it 'returns MFA enabled status' do + get '/api/v1/profile/mfa', + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['enabled']).to be_truthy + end + + context 'with backup codes generated' do + before do + user.generate_backup_codes! + end + + it 'indicates backup codes are generated' do + get '/api/v1/profile/mfa', + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['backup_codes_generated']).to be_truthy + end + end + end + end + + describe 'POST /api/v1/profile/mfa' do + context 'when 2FA is not enabled' do + it 'enables 2FA and returns QR code URL' do + post '/api/v1/profile/mfa', + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['provisioning_url']).not_to be_nil + expect(json_response['provisioning_url']).to include('otpauth://totp') + expect(json_response['secret']).not_to be_nil + + user.reload + expect(user.otp_secret).not_to be_nil + end + end + + context 'when 2FA is already enabled' do + before do + user.enable_two_factor! + user.update!(otp_required_for_login: true) + end + + it 'returns error message' do + post '/api/v1/profile/mfa', + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to eq(I18n.t('errors.mfa.already_enabled')) + end + end + end + + describe 'POST /api/v1/profile/mfa/verify' do + before do + user.enable_two_factor! + end + + context 'with valid OTP code' do + it 'verifies and confirms 2FA setup with backup codes' do + otp_code = user.current_otp + + post '/api/v1/profile/mfa/verify', + params: { otp_code: otp_code }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['enabled']).to be_truthy + expect(json_response['backup_codes']).to be_an(Array) + expect(json_response['backup_codes'].length).to eq(10) + + user.reload + expect(user.otp_required_for_login).to be_truthy + expect(user.otp_backup_codes).not_to be_nil + end + end + + context 'with invalid OTP code' do + it 'returns error message' do + post '/api/v1/profile/mfa/verify', + params: { otp_code: '000000' }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to eq(I18n.t('errors.mfa.invalid_code')) + end + end + + context 'when 2FA is already verified' do + before do + user.update!(otp_required_for_login: true) + end + + it 'returns already enabled error' do + post '/api/v1/profile/mfa/verify', + params: { otp_code: user.current_otp }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to eq(I18n.t('errors.mfa.already_enabled')) + end + end + end + + describe 'DELETE /api/v1/profile/mfa' do + context 'when 2FA is enabled' do + before do + user.enable_two_factor! + user.update!(otp_required_for_login: true) + user.generate_backup_codes! + end + + context 'with valid password and OTP' do + it 'disables 2FA successfully' do + otp_code = user.current_otp + + delete '/api/v1/profile/mfa', + params: { password: 'Test@123456', otp_code: otp_code }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['enabled']).to be_falsey + + user.reload + expect(user.otp_required_for_login).to be_falsey + expect(user.otp_secret).to be_nil + expect(user.otp_backup_codes).to be_blank + end + end + + context 'with invalid password' do + it 'returns error message' do + otp_code = user.current_otp + + delete '/api/v1/profile/mfa', + params: { password: 'wrong_password', otp_code: otp_code }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to include('Invalid') + end + end + + context 'with invalid OTP' do + it 'returns error message' do + delete '/api/v1/profile/mfa', + params: { password: 'Test@123456', otp_code: '000000' }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to include('Invalid') + end + end + end + + context 'when 2FA is not enabled' do + it 'returns not enabled error' do + delete '/api/v1/profile/mfa', + params: { password: 'Test@123456', otp_code: '123456' }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to eq(I18n.t('errors.mfa.not_enabled')) + end + end + end + + describe 'POST /api/v1/profile/mfa/backup_codes' do + context 'when 2FA is enabled' do + before do + user.enable_two_factor! + user.update!(otp_required_for_login: true) + end + + context 'with valid OTP' do + it 'generates new backup codes' do + otp_code = user.current_otp + + post '/api/v1/profile/mfa/backup_codes', + params: { otp_code: otp_code }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['backup_codes']).to be_an(Array) + expect(json_response['backup_codes'].length).to eq(10) + end + end + + context 'with invalid OTP' do + it 'returns error message' do + post '/api/v1/profile/mfa/backup_codes', + params: { otp_code: '000000' }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to eq(I18n.t('errors.mfa.invalid_code')) + end + end + end + + context 'when 2FA is not enabled' do + it 'returns not enabled error' do + post '/api/v1/profile/mfa/backup_codes', + params: { otp_code: '123456' }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:unprocessable_entity) + json_response = response.parsed_body + expect(json_response['error']).to eq(I18n.t('errors.mfa.not_enabled')) + end + end + end +end diff --git a/spec/services/automation_rules/action_service_spec.rb b/spec/services/automation_rules/action_service_spec.rb index e63fd7545..b4eaa5dd0 100644 --- a/spec/services/automation_rules/action_service_spec.rb +++ b/spec/services/automation_rules/action_service_spec.rb @@ -118,6 +118,45 @@ RSpec.describe AutomationRules::ActionService do end end + describe '#perform with add_label action' do + before do + rule.actions << { action_name: 'add_label', action_params: %w[bug feature] } + rule.save + end + + it 'will add labels to conversation' do + described_class.new(rule, account, conversation).perform + expect(conversation.reload.label_list).to include('bug', 'feature') + end + + it 'will not duplicate existing labels' do + conversation.add_labels(['bug']) + described_class.new(rule, account, conversation).perform + expect(conversation.reload.label_list.count('bug')).to eq(1) + expect(conversation.reload.label_list).to include('feature') + end + end + + describe '#perform with remove_label action' do + before do + conversation.add_labels(%w[bug feature support]) + rule.actions << { action_name: 'remove_label', action_params: %w[bug feature] } + rule.save + end + + it 'will remove specified labels from conversation' do + described_class.new(rule, account, conversation).perform + expect(conversation.reload.label_list).not_to include('bug', 'feature') + expect(conversation.reload.label_list).to include('support') + end + + it 'will not fail if labels do not exist on conversation' do + conversation.update_labels(['support']) # Remove bug and feature first + expect { described_class.new(rule, account, conversation).perform }.not_to raise_error + expect(conversation.reload.label_list).to include('support') + end + end + describe '#perform with add_private_note action' do let(:message_builder) { double } diff --git a/spec/services/automation_rules/conditions_filter_service_spec.rb b/spec/services/automation_rules/conditions_filter_service_spec.rb index 7082d31b1..5efd26341 100644 --- a/spec/services/automation_rules/conditions_filter_service_spec.rb +++ b/spec/services/automation_rules/conditions_filter_service_spec.rb @@ -134,5 +134,86 @@ RSpec.describe AutomationRules::ConditionsFilterService do end end end + + context 'when conditions based on labels' do + before do + conversation.add_labels(['bug']) + end + + context 'when filter_operator is equal_to' do + before do + rule.conditions = [ + { 'values': ['bug'], 'attribute_key': 'labels', 'query_operator': nil, 'filter_operator': 'equal_to' } + ] + rule.save + end + + it 'will return true when conversation has the label' do + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(true) + end + + it 'will return false when conversation does not have the label' do + rule.conditions = [ + { 'values': ['feature'], 'attribute_key': 'labels', 'query_operator': nil, 'filter_operator': 'equal_to' } + ] + rule.save + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(false) + end + end + + context 'when filter_operator is not_equal_to' do + before do + rule.conditions = [ + { 'values': ['feature'], 'attribute_key': 'labels', 'query_operator': nil, 'filter_operator': 'not_equal_to' } + ] + rule.save + end + + it 'will return true when conversation does not have the label' do + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(true) + end + + it 'will return false when conversation has the label' do + conversation.add_labels(['feature']) + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(false) + end + end + + context 'when filter_operator is is_present' do + before do + rule.conditions = [ + { 'values': [], 'attribute_key': 'labels', 'query_operator': nil, 'filter_operator': 'is_present' } + ] + rule.save + end + + it 'will return true when conversation has any labels' do + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(true) + end + + it 'will return false when conversation has no labels' do + conversation.update_labels([]) + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(false) + end + end + + context 'when filter_operator is is_not_present' do + before do + rule.conditions = [ + { 'values': [], 'attribute_key': 'labels', 'query_operator': nil, 'filter_operator': 'is_not_present' } + ] + rule.save + end + + it 'will return false when conversation has any labels' do + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(false) + end + + it 'will return true when conversation has no labels' do + conversation.update_labels([]) + expect(described_class.new(rule, conversation, { changed_attributes: {} }).perform).to be(true) + end + end + end end end diff --git a/spec/services/base_token_service_spec.rb b/spec/services/base_token_service_spec.rb new file mode 100644 index 000000000..1b34aedf2 --- /dev/null +++ b/spec/services/base_token_service_spec.rb @@ -0,0 +1,42 @@ +require 'rails_helper' + +describe BaseTokenService do + let(:payload) { { user_id: 1, exp: 5.minutes.from_now.to_i } } + let(:token_service) { described_class.new(payload: payload) } + + describe '#generate_token' do + it 'generates a JWT token with the provided payload' do + token = token_service.generate_token + expect(token).to be_present + expect(token).to be_a(String) + end + + it 'encodes the payload correctly' do + token = token_service.generate_token + decoded = JWT.decode(token, Rails.application.secret_key_base, true, algorithm: 'HS256').first + expect(decoded['user_id']).to eq(1) + end + end + + describe '#decode_token' do + let(:token) { token_service.generate_token } + let(:decoder_service) { described_class.new(token: token) } + + it 'decodes a valid JWT token' do + decoded = decoder_service.decode_token + expect(decoded[:user_id]).to eq(1) + end + + it 'returns empty hash for invalid token' do + invalid_service = described_class.new(token: 'invalid_token') + expect(invalid_service.decode_token).to eq({}) + end + + it 'returns empty hash for expired token' do + expired_payload = { user_id: 1, exp: 1.minute.ago.to_i } + expired_token = JWT.encode(expired_payload, Rails.application.secret_key_base, 'HS256') + expired_service = described_class.new(token: expired_token) + expect(expired_service.decode_token).to eq({}) + end + end +end diff --git a/spec/services/line/incoming_message_service_spec.rb b/spec/services/line/incoming_message_service_spec.rb index 3bcdf8b04..9160efff2 100644 --- a/spec/services/line/incoming_message_service_spec.rb +++ b/spec/services/line/incoming_message_service_spec.rb @@ -105,6 +105,40 @@ describe Line::IncomingMessageService do }.with_indifferent_access end + let(:file_params) do + { + 'destination': '2342234234', + 'events': [ + { + 'replyToken': '0f3779fba3b349968c5d07db31eab56f', + 'type': 'message', + 'mode': 'active', + 'timestamp': 1_462_629_479_859, + 'source': { + 'type': 'user', + 'userId': 'U4af4980629' + }, + 'message': { + 'type': 'file', + 'id': '354718', + 'fileName': 'contacts.csv', + 'fileSize': 2978 + } + }, + { + 'replyToken': '8cf9239d56244f4197887e939187e19e', + 'type': 'follow', + 'mode': 'active', + 'timestamp': 1_462_629_479_859, + 'source': { + 'type': 'user', + 'userId': 'U4af4980629' + } + } + ] + }.with_indifferent_access + end + let(:sticker_params) do { 'destination': '2342234234', @@ -241,5 +275,35 @@ describe Line::IncomingMessageService do expect(line_channel.inbox.messages.first.attachments.first.file.blob.filename.to_s).to eq('media-354718.mp4') end end + + context 'when valid file message params' do + it 'creates appropriate conversations, message and contacts' do + line_bot = double + line_user_profile = double + allow(Line::Bot::Client).to receive(:new).and_return(line_bot) + allow(line_bot).to receive(:get_profile).and_return(line_user_profile) + file = fixture_file_upload(Rails.root.join('spec/assets/contacts.csv'), 'text/csv') + allow(line_bot).to receive(:get_message_content).and_return( + OpenStruct.new({ + body: Base64.encode64(file.read), + content_type: 'text/csv' + }) + ) + allow(line_user_profile).to receive(:body).and_return( + { + 'displayName': 'LINE Test', + 'userId': 'U4af4980629', + 'pictureUrl': 'https://test.com' + }.to_json + ) + described_class.new(inbox: line_channel.inbox, params: file_params).perform + expect(line_channel.inbox.conversations).not_to eq(0) + expect(Contact.all.first.name).to eq('LINE Test') + expect(Contact.all.first.additional_attributes['social_line_user_id']).to eq('U4af4980629') + expect(line_channel.inbox.messages.first.content).to be_nil + expect(line_channel.inbox.messages.first.attachments.first.file_type).to eq('file') + expect(line_channel.inbox.messages.first.attachments.first.file.blob.filename.to_s).to eq('contacts.csv') + end + end end end diff --git a/spec/services/mfa/authentication_service_spec.rb b/spec/services/mfa/authentication_service_spec.rb new file mode 100644 index 000000000..c4cc5ef5e --- /dev/null +++ b/spec/services/mfa/authentication_service_spec.rb @@ -0,0 +1,106 @@ +require 'rails_helper' + +describe Mfa::AuthenticationService do + before do + skip('Skipping since MFA is not configured in this environment') unless Chatwoot.encryption_configured? + user.enable_two_factor! + user.update!(otp_required_for_login: true) + end + + let(:user) { create(:user) } + + describe '#authenticate' do + context 'with OTP code' do + context 'when OTP is valid' do + it 'returns true' do + valid_otp = user.current_otp + service = described_class.new(user: user, otp_code: valid_otp) + expect(service.authenticate).to be_truthy + end + end + + context 'when OTP is invalid' do + it 'returns false' do + service = described_class.new(user: user, otp_code: '000000') + expect(service.authenticate).to be_falsey + end + end + + context 'when OTP is nil' do + it 'returns false' do + service = described_class.new(user: user, otp_code: nil) + expect(service.authenticate).to be_falsey + end + end + end + + context 'with backup code' do + let(:backup_codes) { user.generate_backup_codes! } + + context 'when backup code is valid' do + it 'returns true and invalidates the code' do + valid_code = backup_codes.first + service = described_class.new(user: user, backup_code: valid_code) + + expect(service.authenticate).to be_truthy + + # Code should be invalidated after use + user.reload + expect(user.otp_backup_codes).to include('XXXXXXXX') + end + end + + context 'when backup code is invalid' do + it 'returns false' do + service = described_class.new(user: user, backup_code: 'invalid') + expect(service.authenticate).to be_falsey + end + end + + context 'when backup code has already been used' do + it 'returns false' do + valid_code = backup_codes.first + # Use the code once + service = described_class.new(user: user, backup_code: valid_code) + service.authenticate + + # Try to use it again + service2 = described_class.new(user: user.reload, backup_code: valid_code) + expect(service2.authenticate).to be_falsey + end + end + end + + context 'with neither OTP nor backup code' do + it 'returns false' do + service = described_class.new(user: user) + expect(service.authenticate).to be_falsey + end + end + + context 'when user is nil' do + it 'returns false' do + service = described_class.new(user: nil, otp_code: '123456') + expect(service.authenticate).to be_falsey + end + end + + context 'when both OTP and backup code are provided' do + it 'uses OTP authentication first' do + valid_otp = user.current_otp + backup_codes = user.generate_backup_codes! + + service = described_class.new( + user: user, + otp_code: valid_otp, + backup_code: backup_codes.first + ) + + expect(service.authenticate).to be_truthy + # Backup code should not be consumed + user.reload + expect(user.otp_backup_codes).not_to include('XXXXXXXX') + end + end + end +end diff --git a/spec/services/mfa/token_service_spec.rb b/spec/services/mfa/token_service_spec.rb new file mode 100644 index 000000000..7d4fe55b6 --- /dev/null +++ b/spec/services/mfa/token_service_spec.rb @@ -0,0 +1,72 @@ +require 'rails_helper' + +describe Mfa::TokenService do + before do + skip('Skipping since MFA is not configured in this environment') unless Chatwoot.encryption_configured? + end + + let(:user) { create(:user) } + let(:token_service) { described_class.new(user: user) } + + describe '#generate_token' do + it 'generates a JWT token with user_id' do + token = token_service.generate_token + expect(token).to be_present + expect(token).to be_a(String) + end + + it 'includes user_id in the payload' do + token = token_service.generate_token + decoded = JWT.decode(token, Rails.application.secret_key_base, true, algorithm: 'HS256').first + expect(decoded['user_id']).to eq(user.id) + end + + it 'sets expiration to 5 minutes from now' do + allow(Time).to receive(:now).and_return(Time.zone.parse('2024-01-01 12:00:00')) + token = token_service.generate_token + decoded = JWT.decode(token, Rails.application.secret_key_base, true, algorithm: 'HS256').first + expected_exp = Time.zone.parse('2024-01-01 12:05:00').to_i + expect(decoded['exp']).to eq(expected_exp) + end + end + + describe '#verify_token' do + let(:valid_token) { token_service.generate_token } + + context 'with valid token' do + it 'returns the user' do + verifier = described_class.new(token: valid_token) + verified_user = verifier.verify_token + expect(verified_user).to eq(user) + end + end + + context 'with invalid token' do + it 'returns nil for malformed token' do + verifier = described_class.new(token: 'invalid_token') + expect(verifier.verify_token).to be_nil + end + + it 'returns nil for expired token' do + expired_payload = { user_id: user.id, exp: 1.minute.ago.to_i } + expired_token = JWT.encode(expired_payload, Rails.application.secret_key_base, 'HS256') + verifier = described_class.new(token: expired_token) + expect(verifier.verify_token).to be_nil + end + + it 'returns nil for non-existent user' do + payload = { user_id: 999_999, exp: 5.minutes.from_now.to_i } + token = JWT.encode(payload, Rails.application.secret_key_base, 'HS256') + verifier = described_class.new(token: token) + expect(verifier.verify_token).to be_nil + end + end + + context 'with blank token' do + it 'returns nil' do + verifier = described_class.new(token: nil) + expect(verifier.verify_token).to be_nil + end + end + end +end diff --git a/spec/services/widget/token_service_spec.rb b/spec/services/widget/token_service_spec.rb new file mode 100644 index 000000000..724728b51 --- /dev/null +++ b/spec/services/widget/token_service_spec.rb @@ -0,0 +1,43 @@ +require 'rails_helper' + +describe Widget::TokenService do + let(:payload) { { source_id: 'contact_123', inbox_id: 1 } } + let(:token_service) { described_class.new(payload: payload) } + + describe 'inheritance' do + it 'inherits from BaseTokenService' do + expect(described_class.superclass).to eq(BaseTokenService) + end + end + + describe '#generate_token' do + it 'generates a JWT token with the provided payload' do + token = token_service.generate_token + expect(token).to be_present + expect(token).to be_a(String) + end + + it 'encodes the payload correctly' do + token = token_service.generate_token + decoded = JWT.decode(token, Rails.application.secret_key_base, true, algorithm: 'HS256').first + expect(decoded['source_id']).to eq('contact_123') + expect(decoded['inbox_id']).to eq(1) + end + end + + describe '#decode_token' do + let(:token) { token_service.generate_token } + let(:decoder_service) { described_class.new(token: token) } + + it 'decodes a valid JWT token' do + decoded = decoder_service.decode_token + expect(decoded[:source_id]).to eq('contact_123') + expect(decoded[:inbox_id]).to eq(1) + end + + it 'returns empty hash for invalid token' do + invalid_service = described_class.new(token: 'invalid_token') + expect(invalid_service.decode_token).to eq({}) + end + end +end