From 28f58b3694dd78f97ba4ddd69f02c59bf2c20040 Mon Sep 17 00:00:00 2001 From: Vishnu Narayanan Date: Tue, 10 Mar 2026 14:11:36 +0530 Subject: [PATCH 01/16] fix: make conversation transcript rate limit configurable (#13740) ## Summary - The conversation transcript endpoint rate limit is hardcoded at 30 requests/hour per account with no way to override it - Self-hosted users with active accounts hit this limit and get 429 errors across all channels - Add `RATE_LIMIT_CONVERSATION_TRANSCRIPT` env var (default: `1000`) to make it configurable, consistent with other throttles like `RATE_LIMIT_CONTACT_SEARCH` and `RATE_LIMIT_REPORTS_API_ACCOUNT_LEVEL` --- config/initializers/rack_attack.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index b193c2e14..db7be0e43 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -185,7 +185,8 @@ class Rack::Attack ###-----------------------------------------------### ## Prevent Abuse of Converstion Transcript APIs ### - throttle('/api/v1/accounts/:account_id/conversations/:conversation_id/transcript', limit: 30, period: 1.hour) do |req| + throttle('/api/v1/accounts/:account_id/conversations/:conversation_id/transcript', + limit: ENV.fetch('RATE_LIMIT_CONVERSATION_TRANSCRIPT', '1000').to_i, period: 1.hour) do |req| match_data = %r{/api/v1/accounts/(?\d+)/conversations/(?\d+)/transcript}.match(req.path) match_data[:account_id] if match_data.present? end From 8ea93ec73dd46942934349556e9d916d98197aec Mon Sep 17 00:00:00 2001 From: Pranav Date: Tue, 10 Mar 2026 01:45:10 -0700 Subject: [PATCH 02/16] chore(docs): Update documentation for messages API (#13744) Update the documentation for messages API Co-authored-by: Muhsin Keloth --- .../resource/conversation_meta.yml | 5 ++ .../definitions/resource/message_detailed.yml | 34 +++++++- .../conversation/messages/index.yml | 11 +++ swagger/swagger.json | 81 +++++++++++++++++++ swagger/tag_groups/application_swagger.json | 81 +++++++++++++++++++ swagger/tag_groups/client_swagger.json | 63 +++++++++++++++ swagger/tag_groups/other_swagger.json | 63 +++++++++++++++ swagger/tag_groups/platform_swagger.json | 63 +++++++++++++++ 8 files changed, 400 insertions(+), 1 deletion(-) diff --git a/swagger/definitions/resource/conversation_meta.yml b/swagger/definitions/resource/conversation_meta.yml index 7cffc0fab..02ac2390f 100644 --- a/swagger/definitions/resource/conversation_meta.yml +++ b/swagger/definitions/resource/conversation_meta.yml @@ -45,6 +45,11 @@ properties: contact: $ref: '#/components/schemas/contact_detail' description: Contact details + assignee: + allOf: + - $ref: '#/components/schemas/agent' + description: The agent assigned to the conversation + nullable: true agent_last_seen_at: type: string description: Timestamp when the agent last saw the conversation diff --git a/swagger/definitions/resource/message_detailed.yml b/swagger/definitions/resource/message_detailed.yml index 49ff7aa09..8c7e9c3d1 100644 --- a/swagger/definitions/resource/message_detailed.yml +++ b/swagger/definitions/resource/message_detailed.yml @@ -32,6 +32,10 @@ properties: type: string description: ID of the message this is replying to nullable: true + echo_id: + type: string + description: The echo ID of the message, used for deduplication + nullable: true created_at: type: integer description: The timestamp when message was created @@ -44,4 +48,32 @@ properties: nullable: true sender: $ref: '#/components/schemas/contact_detail' - description: The sender of the message (only for incoming messages) \ No newline at end of file + description: The sender of the message (only for incoming messages) + attachments: + type: array + description: The list of attachments associated with the message + items: + type: object + properties: + id: + type: number + description: The ID of the attachment + message_id: + type: number + description: The ID of the message + file_type: + type: string + enum: ["image", "video", "audio", "file", "location", "fallback", "share", "story_mention", "contact", "ig_reel"] + description: The type of the attached file + account_id: + type: number + description: The ID of the account + data_url: + type: string + description: The URL of the attached file + thumb_url: + type: string + description: The thumbnail URL of the attached file + file_size: + type: number + description: The size of the attached file in bytes \ No newline at end of file diff --git a/swagger/paths/application/conversation/messages/index.yml b/swagger/paths/application/conversation/messages/index.yml index 02693a244..68aa120fc 100644 --- a/swagger/paths/application/conversation/messages/index.yml +++ b/swagger/paths/application/conversation/messages/index.yml @@ -5,6 +5,17 @@ summary: Get messages security: - userApiKey: [] description: List all messages of a conversation +parameters: + - name: after + in: query + schema: + type: integer + description: Fetch messages after the message with this ID. Returns up to 100 messages in ascending order. + - name: before + in: query + schema: + type: integer + description: Fetch messages before the message with this ID. Returns up to 20 messages in ascending order. responses: '200': description: Success diff --git a/swagger/swagger.json b/swagger/swagger.json index d721affa4..e11376bcf 100644 --- a/swagger/swagger.json +++ b/swagger/swagger.json @@ -6119,6 +6119,24 @@ } ], "description": "List all messages of a conversation", + "parameters": [ + { + "name": "after", + "in": "query", + "schema": { + "type": "integer" + }, + "description": "Fetch messages after the message with this ID. Returns up to 100 messages in ascending order." + }, + { + "name": "before", + "in": "query", + "schema": { + "type": "integer" + }, + "description": "Fetch messages before the message with this ID. Returns up to 20 messages in ascending order." + } + ], "responses": { "200": { "description": "Success", @@ -12722,6 +12740,11 @@ } } }, + "echo_id": { + "type": "string", + "description": "The echo ID of the message, used for deduplication", + "nullable": true + }, "created_at": { "type": "integer", "description": "The timestamp when message was created" @@ -12737,6 +12760,55 @@ }, "sender": { "$ref": "#/components/schemas/contact_detail" + }, + "attachments": { + "type": "array", + "description": "The list of attachments associated with the message", + "items": { + "type": "object", + "properties": { + "id": { + "type": "number", + "description": "The ID of the attachment" + }, + "message_id": { + "type": "number", + "description": "The ID of the message" + }, + "file_type": { + "type": "string", + "enum": [ + "image", + "video", + "audio", + "file", + "location", + "fallback", + "share", + "story_mention", + "contact", + "ig_reel" + ], + "description": "The type of the attached file" + }, + "account_id": { + "type": "number", + "description": "The ID of the account" + }, + "data_url": { + "type": "string", + "description": "The URL of the attached file" + }, + "thumb_url": { + "type": "string", + "description": "The thumbnail URL of the attached file" + }, + "file_size": { + "type": "number", + "description": "The size of the attached file in bytes" + } + } + } } } }, @@ -12805,6 +12877,15 @@ "contact": { "$ref": "#/components/schemas/contact_detail" }, + "assignee": { + "allOf": [ + { + "$ref": "#/components/schemas/agent" + } + ], + "description": "The agent assigned to the conversation", + "nullable": true + }, "agent_last_seen_at": { "type": "string", "description": "Timestamp when the agent last saw the conversation", diff --git a/swagger/tag_groups/application_swagger.json b/swagger/tag_groups/application_swagger.json index 844be0350..ba482c9d7 100644 --- a/swagger/tag_groups/application_swagger.json +++ b/swagger/tag_groups/application_swagger.json @@ -4662,6 +4662,24 @@ } ], "description": "List all messages of a conversation", + "parameters": [ + { + "name": "after", + "in": "query", + "schema": { + "type": "integer" + }, + "description": "Fetch messages after the message with this ID. Returns up to 100 messages in ascending order." + }, + { + "name": "before", + "in": "query", + "schema": { + "type": "integer" + }, + "description": "Fetch messages before the message with this ID. Returns up to 20 messages in ascending order." + } + ], "responses": { "200": { "description": "Success", @@ -11229,6 +11247,11 @@ } } }, + "echo_id": { + "type": "string", + "description": "The echo ID of the message, used for deduplication", + "nullable": true + }, "created_at": { "type": "integer", "description": "The timestamp when message was created" @@ -11244,6 +11267,55 @@ }, "sender": { "$ref": "#/components/schemas/contact_detail" + }, + "attachments": { + "type": "array", + "description": "The list of attachments associated with the message", + "items": { + "type": "object", + "properties": { + "id": { + "type": "number", + "description": "The ID of the attachment" + }, + "message_id": { + "type": "number", + "description": "The ID of the message" + }, + "file_type": { + "type": "string", + "enum": [ + "image", + "video", + "audio", + "file", + "location", + "fallback", + "share", + "story_mention", + "contact", + "ig_reel" + ], + "description": "The type of the attached file" + }, + "account_id": { + "type": "number", + "description": "The ID of the account" + }, + "data_url": { + "type": "string", + "description": "The URL of the attached file" + }, + "thumb_url": { + "type": "string", + "description": "The thumbnail URL of the attached file" + }, + "file_size": { + "type": "number", + "description": "The size of the attached file in bytes" + } + } + } } } }, @@ -11312,6 +11384,15 @@ "contact": { "$ref": "#/components/schemas/contact_detail" }, + "assignee": { + "allOf": [ + { + "$ref": "#/components/schemas/agent" + } + ], + "description": "The agent assigned to the conversation", + "nullable": true + }, "agent_last_seen_at": { "type": "string", "description": "Timestamp when the agent last saw the conversation", diff --git a/swagger/tag_groups/client_swagger.json b/swagger/tag_groups/client_swagger.json index ebeb4a9cb..ac6915726 100644 --- a/swagger/tag_groups/client_swagger.json +++ b/swagger/tag_groups/client_swagger.json @@ -4882,6 +4882,11 @@ } } }, + "echo_id": { + "type": "string", + "description": "The echo ID of the message, used for deduplication", + "nullable": true + }, "created_at": { "type": "integer", "description": "The timestamp when message was created" @@ -4897,6 +4902,55 @@ }, "sender": { "$ref": "#/components/schemas/contact_detail" + }, + "attachments": { + "type": "array", + "description": "The list of attachments associated with the message", + "items": { + "type": "object", + "properties": { + "id": { + "type": "number", + "description": "The ID of the attachment" + }, + "message_id": { + "type": "number", + "description": "The ID of the message" + }, + "file_type": { + "type": "string", + "enum": [ + "image", + "video", + "audio", + "file", + "location", + "fallback", + "share", + "story_mention", + "contact", + "ig_reel" + ], + "description": "The type of the attached file" + }, + "account_id": { + "type": "number", + "description": "The ID of the account" + }, + "data_url": { + "type": "string", + "description": "The URL of the attached file" + }, + "thumb_url": { + "type": "string", + "description": "The thumbnail URL of the attached file" + }, + "file_size": { + "type": "number", + "description": "The size of the attached file in bytes" + } + } + } } } }, @@ -4965,6 +5019,15 @@ "contact": { "$ref": "#/components/schemas/contact_detail" }, + "assignee": { + "allOf": [ + { + "$ref": "#/components/schemas/agent" + } + ], + "description": "The agent assigned to the conversation", + "nullable": true + }, "agent_last_seen_at": { "type": "string", "description": "Timestamp when the agent last saw the conversation", diff --git a/swagger/tag_groups/other_swagger.json b/swagger/tag_groups/other_swagger.json index 9aa9f5a7a..9fb01fa98 100644 --- a/swagger/tag_groups/other_swagger.json +++ b/swagger/tag_groups/other_swagger.json @@ -4297,6 +4297,11 @@ } } }, + "echo_id": { + "type": "string", + "description": "The echo ID of the message, used for deduplication", + "nullable": true + }, "created_at": { "type": "integer", "description": "The timestamp when message was created" @@ -4312,6 +4317,55 @@ }, "sender": { "$ref": "#/components/schemas/contact_detail" + }, + "attachments": { + "type": "array", + "description": "The list of attachments associated with the message", + "items": { + "type": "object", + "properties": { + "id": { + "type": "number", + "description": "The ID of the attachment" + }, + "message_id": { + "type": "number", + "description": "The ID of the message" + }, + "file_type": { + "type": "string", + "enum": [ + "image", + "video", + "audio", + "file", + "location", + "fallback", + "share", + "story_mention", + "contact", + "ig_reel" + ], + "description": "The type of the attached file" + }, + "account_id": { + "type": "number", + "description": "The ID of the account" + }, + "data_url": { + "type": "string", + "description": "The URL of the attached file" + }, + "thumb_url": { + "type": "string", + "description": "The thumbnail URL of the attached file" + }, + "file_size": { + "type": "number", + "description": "The size of the attached file in bytes" + } + } + } } } }, @@ -4380,6 +4434,15 @@ "contact": { "$ref": "#/components/schemas/contact_detail" }, + "assignee": { + "allOf": [ + { + "$ref": "#/components/schemas/agent" + } + ], + "description": "The agent assigned to the conversation", + "nullable": true + }, "agent_last_seen_at": { "type": "string", "description": "Timestamp when the agent last saw the conversation", diff --git a/swagger/tag_groups/platform_swagger.json b/swagger/tag_groups/platform_swagger.json index a830a8d56..ee6452319 100644 --- a/swagger/tag_groups/platform_swagger.json +++ b/swagger/tag_groups/platform_swagger.json @@ -5058,6 +5058,11 @@ } } }, + "echo_id": { + "type": "string", + "description": "The echo ID of the message, used for deduplication", + "nullable": true + }, "created_at": { "type": "integer", "description": "The timestamp when message was created" @@ -5073,6 +5078,55 @@ }, "sender": { "$ref": "#/components/schemas/contact_detail" + }, + "attachments": { + "type": "array", + "description": "The list of attachments associated with the message", + "items": { + "type": "object", + "properties": { + "id": { + "type": "number", + "description": "The ID of the attachment" + }, + "message_id": { + "type": "number", + "description": "The ID of the message" + }, + "file_type": { + "type": "string", + "enum": [ + "image", + "video", + "audio", + "file", + "location", + "fallback", + "share", + "story_mention", + "contact", + "ig_reel" + ], + "description": "The type of the attached file" + }, + "account_id": { + "type": "number", + "description": "The ID of the account" + }, + "data_url": { + "type": "string", + "description": "The URL of the attached file" + }, + "thumb_url": { + "type": "string", + "description": "The thumbnail URL of the attached file" + }, + "file_size": { + "type": "number", + "description": "The size of the attached file in bytes" + } + } + } } } }, @@ -5141,6 +5195,15 @@ "contact": { "$ref": "#/components/schemas/contact_detail" }, + "assignee": { + "allOf": [ + { + "$ref": "#/components/schemas/agent" + } + ], + "description": "The agent assigned to the conversation", + "nullable": true + }, "agent_last_seen_at": { "type": "string", "description": "Timestamp when the agent last saw the conversation", From 824164852cd0f547e210e62482237702b06af4b4 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Tue, 10 Mar 2026 14:15:52 +0530 Subject: [PATCH 03/16] refactor: extract custom attribute methods from FilterService (#13743) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Extracted 6 custom attribute methods (`custom_attribute_query`, `attribute_model`, `attribute_data_type`, `build_custom_attr_query`, `custom_attribute`, `not_in_custom_attr_query`) into a new `Filters::CustomAttributeFilterHelper` module. - Added an inline `rubocop:disable` for the intentional `Lint/ShadowedException` in `coerce_lt_gt_value` — `Date::Error` is a subclass of `ArgumentError`, but both are listed explicitly for clarity. ## Why `app/services/filters/` The existing `Filters::FilterHelper` lives in `app/helpers/filters/`, but that location triggers `Rails/HelperInstanceVariable` for any module that uses instance variables. The extracted methods share state with `FilterService` via instance variables (`@attribute_key`, `@account`, `@custom_attribute`, etc.), so placing them in `app/helpers/` would require a cop disable. `app/services/filters/` is a better fit because: - The module is a service mixin, not a view helper — it's only included by `FilterService` and its subclasses (`Conversations::FilterService`, `Contacts::FilterService`, `AutomationRules::ConditionsFilterService`). - It sits alongside the services that use it. - No cop disables needed. --------- Co-authored-by: Vishnu Narayanan --- app/services/filter_service.rb | 55 +------------------ .../filters/custom_attribute_filter_helper.rb | 55 +++++++++++++++++++ .../fields/confirmed_at_field/_show.html.erb | 3 + 3 files changed, 60 insertions(+), 53 deletions(-) create mode 100644 app/services/filters/custom_attribute_filter_helper.rb create mode 100644 app/views/fields/confirmed_at_field/_show.html.erb diff --git a/app/services/filter_service.rb b/app/services/filter_service.rb index 33e4092c8..25f118d48 100644 --- a/app/services/filter_service.rb +++ b/app/services/filter_service.rb @@ -2,6 +2,7 @@ require 'json' class FilterService include Filters::FilterHelper + include Filters::CustomAttributeFilterHelper include CustomExceptions::CustomFilter ATTRIBUTE_MODEL = 'conversation_attribute'.freeze @@ -137,26 +138,8 @@ class FilterService end end - def custom_attribute_query(query_hash, custom_attribute_type, current_index) - @attribute_key = query_hash[:attribute_key] - @custom_attribute_type = custom_attribute_type - attribute_data_type - return '' if @custom_attribute.blank? - - build_custom_attr_query(query_hash, current_index) - end - private - def attribute_model - @attribute_model = @custom_attribute_type.presence || self.class::ATTRIBUTE_MODEL - end - - def attribute_data_type - attribute_type = custom_attribute(@attribute_key, @account, attribute_model).try(:attribute_display_type) - @attribute_data_type = self.class::ATTRIBUTE_TYPES[attribute_type] - end - def standard_attribute_data_type(attribute_key) @filters.each_value do |section| return section.dig(attribute_key, 'data_type') if section.is_a?(Hash) && section.key?(attribute_key) @@ -173,44 +156,10 @@ class FilterService else raise CustomExceptions::CustomFilter::InvalidValue.new(attribute_name: attribute_key) end - rescue Date::Error, ArgumentError, FloatDomainError, TypeError + rescue ArgumentError, FloatDomainError, TypeError raise CustomExceptions::CustomFilter::InvalidValue.new(attribute_name: attribute_key) end - def build_custom_attr_query(query_hash, current_index) - filter_operator_value = filter_operation(query_hash, current_index) - query_operator = query_hash[:query_operator] - table_name = attribute_model == 'conversation_attribute' ? 'conversations' : 'contacts' - - query = if attribute_data_type == 'text' - ActiveRecord::Base.sanitize_sql_array( - ["LOWER(#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} #{filter_operator_value} #{query_operator} ", @attribute_key] - ) - else - ActiveRecord::Base.sanitize_sql_array( - ["(#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} #{filter_operator_value} #{query_operator} ", @attribute_key] - ) - end - - query + not_in_custom_attr_query(table_name, query_hash, attribute_data_type) - end - - def custom_attribute(attribute_key, account, custom_attribute_type) - current_account = account || Current.account - attribute_model = custom_attribute_type.presence || self.class::ATTRIBUTE_MODEL - @custom_attribute = current_account.custom_attribute_definitions.where( - attribute_model: attribute_model - ).find_by(attribute_key: attribute_key) - end - - def not_in_custom_attr_query(table_name, query_hash, attribute_data_type) - return '' unless query_hash[:filter_operator] == 'not_equal_to' - - ActiveRecord::Base.sanitize_sql_array( - [" OR (#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} IS NULL ", @attribute_key] - ) - end - def equals_to_filter_string(filter_operator, current_index) return "IN (:value_#{current_index})" if filter_operator == 'equal_to' diff --git a/app/services/filters/custom_attribute_filter_helper.rb b/app/services/filters/custom_attribute_filter_helper.rb new file mode 100644 index 000000000..f0715c611 --- /dev/null +++ b/app/services/filters/custom_attribute_filter_helper.rb @@ -0,0 +1,55 @@ +module Filters::CustomAttributeFilterHelper + def custom_attribute_query(query_hash, custom_attribute_type, current_index) + @attribute_key = query_hash[:attribute_key] + @custom_attribute_type = custom_attribute_type + attribute_data_type + return '' if @custom_attribute.blank? + + build_custom_attr_query(query_hash, current_index) + end + + private + + def attribute_model + @attribute_model = @custom_attribute_type.presence || self.class::ATTRIBUTE_MODEL + end + + def attribute_data_type + attribute_type = custom_attribute(@attribute_key, @account, attribute_model).try(:attribute_display_type) + @attribute_data_type = self.class::ATTRIBUTE_TYPES[attribute_type] + end + + def build_custom_attr_query(query_hash, current_index) + filter_operator_value = filter_operation(query_hash, current_index) + query_operator = query_hash[:query_operator] + table_name = attribute_model == 'conversation_attribute' ? 'conversations' : 'contacts' + + query = if attribute_data_type == 'text' + ActiveRecord::Base.sanitize_sql_array( + ["LOWER(#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} #{filter_operator_value} #{query_operator} ", @attribute_key] + ) + else + ActiveRecord::Base.sanitize_sql_array( + ["(#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} #{filter_operator_value} #{query_operator} ", @attribute_key] + ) + end + + query + not_in_custom_attr_query(table_name, query_hash, attribute_data_type) + end + + def custom_attribute(attribute_key, account, custom_attribute_type) + current_account = account || Current.account + attribute_model = custom_attribute_type.presence || self.class::ATTRIBUTE_MODEL + @custom_attribute = current_account.custom_attribute_definitions.where( + attribute_model: attribute_model + ).find_by(attribute_key: attribute_key) + end + + def not_in_custom_attr_query(table_name, query_hash, attribute_data_type) + return '' unless query_hash[:filter_operator] == 'not_equal_to' + + ActiveRecord::Base.sanitize_sql_array( + [" OR (#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} IS NULL ", @attribute_key] + ) + end +end diff --git a/app/views/fields/confirmed_at_field/_show.html.erb b/app/views/fields/confirmed_at_field/_show.html.erb new file mode 100644 index 000000000..7f06246f7 --- /dev/null +++ b/app/views/fields/confirmed_at_field/_show.html.erb @@ -0,0 +1,3 @@ +<% if field.data %> + <%= field.datetime %> +<% end %> From 9f376c43b5b782425a486ef62bf8884ea896a0ef Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Tue, 10 Mar 2026 16:35:09 +0530 Subject: [PATCH 04/16] fix(signup): normalize account signup config checks (#13745) This makes account signup enforcement consistent when signup is disabled at the installation level. Email signup and Google signup now stay blocked regardless of whether the config value is stored as a string or a boolean. This effectively covers the config-loader path, where `YAML.safe_load` reads `value: false` from `installation_config.yml` as a native boolean and persists it that way. - Normalized the account signup check so disabled signup is handled consistently across config value types. - Reused the same check across API signup and Google signup entry points. - Added regression coverage for the disabled-signup cases in the existing controller specs. --------- Co-authored-by: Vishnu Narayanan --- app/controllers/api/v1/accounts_controller.rb | 2 +- app/controllers/api/v2/accounts_controller.rb | 2 +- .../omniauth_callbacks_controller.rb | 3 +-- lib/global_config_service.rb | 4 ++++ .../api/v1/accounts_controller_spec.rb | 23 +++++++++++++++++++ .../api/v2/accounts_controller_spec.rb | 23 +++++++++++++++++++ .../omniauth_callbacks_controller_spec.rb | 20 ++++++++++++++++ 7 files changed, 73 insertions(+), 4 deletions(-) diff --git a/app/controllers/api/v1/accounts_controller.rb b/app/controllers/api/v1/accounts_controller.rb index bcbf80355..3e513a4b2 100644 --- a/app/controllers/api/v1/accounts_controller.rb +++ b/app/controllers/api/v1/accounts_controller.rb @@ -100,7 +100,7 @@ class Api::V1::AccountsController < Api::BaseController end def check_signup_enabled - raise ActionController::RoutingError, 'Not Found' if GlobalConfigService.load('ENABLE_ACCOUNT_SIGNUP', 'false') == 'false' + raise ActionController::RoutingError, 'Not Found' unless GlobalConfigService.account_signup_enabled? end def validate_captcha diff --git a/app/controllers/api/v2/accounts_controller.rb b/app/controllers/api/v2/accounts_controller.rb index bed0a212a..5a19ddeed 100644 --- a/app/controllers/api/v2/accounts_controller.rb +++ b/app/controllers/api/v2/accounts_controller.rb @@ -58,7 +58,7 @@ class Api::V2::AccountsController < Api::BaseController end def check_signup_enabled - raise ActionController::RoutingError, 'Not Found' if GlobalConfigService.load('ENABLE_ACCOUNT_SIGNUP', 'false') == 'false' + raise ActionController::RoutingError, 'Not Found' unless GlobalConfigService.account_signup_enabled? end def validate_captcha diff --git a/app/controllers/devise_overrides/omniauth_callbacks_controller.rb b/app/controllers/devise_overrides/omniauth_callbacks_controller.rb index 900125670..af759af54 100644 --- a/app/controllers/devise_overrides/omniauth_callbacks_controller.rb +++ b/app/controllers/devise_overrides/omniauth_callbacks_controller.rb @@ -51,8 +51,7 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa end def account_signup_allowed? - # set it to true by default, this is the behaviour across the app - GlobalConfigService.load('ENABLE_ACCOUNT_SIGNUP', 'false') != 'false' + GlobalConfigService.account_signup_enabled? end def resource_class(_mapping = nil) diff --git a/lib/global_config_service.rb b/lib/global_config_service.rb index 0649c24af..31612a240 100644 --- a/lib/global_config_service.rb +++ b/lib/global_config_service.rb @@ -14,4 +14,8 @@ class GlobalConfigService GlobalConfig.clear_cache i.value end + + def self.account_signup_enabled? + load('ENABLE_ACCOUNT_SIGNUP', 'false').to_s != 'false' + end end diff --git a/spec/controllers/api/v1/accounts_controller_spec.rb b/spec/controllers/api/v1/accounts_controller_spec.rb index ec49ecd39..d773cafa7 100644 --- a/spec/controllers/api/v1/accounts_controller_spec.rb +++ b/spec/controllers/api/v1/accounts_controller_spec.rb @@ -81,6 +81,29 @@ RSpec.describe 'Accounts API', type: :request do end end + context 'when ENABLE_ACCOUNT_SIGNUP is stored as boolean false' do + before do + GlobalConfig.clear_cache + InstallationConfig.where(name: 'ENABLE_ACCOUNT_SIGNUP').delete_all + InstallationConfig.create!(name: 'ENABLE_ACCOUNT_SIGNUP', value: false, locked: false) + end + + after do + InstallationConfig.where(name: 'ENABLE_ACCOUNT_SIGNUP').delete_all + GlobalConfig.clear_cache + end + + it 'responds 404 on requests' do + params = { account_name: 'test', email: email, user_full_name: user_full_name, password: 'Password1!' } + + post api_v1_accounts_url, + params: params, + as: :json + + expect(response).to have_http_status(:not_found) + end + end + context 'when ENABLE_ACCOUNT_SIGNUP env variable is set to api_only' do it 'does not respond 404 on requests' do params = { account_name: 'test', email: email, user_full_name: user_full_name, password: 'Password1!' } diff --git a/spec/controllers/api/v2/accounts_controller_spec.rb b/spec/controllers/api/v2/accounts_controller_spec.rb index 182ebadac..a39e37a91 100644 --- a/spec/controllers/api/v2/accounts_controller_spec.rb +++ b/spec/controllers/api/v2/accounts_controller_spec.rb @@ -94,6 +94,29 @@ RSpec.describe 'Accounts API', type: :request do end end + context 'when ENABLE_ACCOUNT_SIGNUP is stored as boolean false' do + before do + GlobalConfig.clear_cache + InstallationConfig.where(name: 'ENABLE_ACCOUNT_SIGNUP').delete_all + InstallationConfig.create!(name: 'ENABLE_ACCOUNT_SIGNUP', value: false, locked: false) + end + + after do + InstallationConfig.where(name: 'ENABLE_ACCOUNT_SIGNUP').delete_all + GlobalConfig.clear_cache + end + + it 'responds 404 on requests' do + params = { email: email, password: 'Password1!' } + + post api_v2_accounts_url, + params: params, + as: :json + + expect(response).to have_http_status(:not_found) + end + end + context 'when ENABLE_ACCOUNT_SIGNUP env variable is set to api_only' do let(:account_builder) { double } let(:account) { create(:account) } diff --git a/spec/controllers/devise/omniauth_callbacks_controller_spec.rb b/spec/controllers/devise/omniauth_callbacks_controller_spec.rb index 1a775f88f..603458a01 100644 --- a/spec/controllers/devise/omniauth_callbacks_controller_spec.rb +++ b/spec/controllers/devise/omniauth_callbacks_controller_spec.rb @@ -106,6 +106,26 @@ RSpec.describe 'DeviseOverrides::OmniauthCallbacksController', type: :request do end end + it 'blocks signup if config is stored as boolean false' do + GlobalConfig.clear_cache + InstallationConfig.where(name: 'ENABLE_ACCOUNT_SIGNUP').delete_all + InstallationConfig.create!(name: 'ENABLE_ACCOUNT_SIGNUP', value: false, locked: false) + + with_modified_env FRONTEND_URL: 'http://www.example.com' do + set_omniauth_config('does-not-exist-for-sure@example.com') + allow(email_validation_service).to receive(:perform).and_return(true) + + get '/omniauth/google_oauth2/callback' + + expect(response).to redirect_to('http://www.example.com/auth/google_oauth2/callback') + follow_redirect! + expect(response).to redirect_to(%r{/app/login\?error=no-account-found$}) + end + ensure + InstallationConfig.where(name: 'ENABLE_ACCOUNT_SIGNUP').delete_all + GlobalConfig.clear_cache + end + it 'allows login' do with_modified_env FRONTEND_URL: 'http://www.example.com' do create(:user, email: 'test@example.com') From 8d9dd99012fc1220c0ffa0b0a24066b0b7788b60 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Tue, 10 Mar 2026 18:32:44 +0530 Subject: [PATCH 05/16] fix: scenario label (#13746) --- .../routes/dashboard/captain/assistants/scenarios/Index.vue | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/javascript/dashboard/routes/dashboard/captain/assistants/scenarios/Index.vue b/app/javascript/dashboard/routes/dashboard/captain/assistants/scenarios/Index.vue index 27deb4070..c4914f354 100644 --- a/app/javascript/dashboard/routes/dashboard/captain/assistants/scenarios/Index.vue +++ b/app/javascript/dashboard/routes/dashboard/captain/assistants/scenarios/Index.vue @@ -191,7 +191,7 @@ onMounted(() => {