chore: Review fix

app/controllers/api/v1/accounts/portals_controller.rb

@@ -79,14 +79,21 @@ class Api::V1::Accounts::PortalsController < Api::V1::Accounts::BaseController
     params.require(:portal).permit(
       :id, :color, :custom_domain, :header_text, :homepage_link,
       :name, :page_title, :slug, :archived,
-      { config: [:default_locale, :layout, { allowed_locales: [] }, { draft_locales: [] },
-                 { analytics: %i[ga4 gtm clarity hotjar meta_pixel] },
-                 { social_profiles: %i[facebook x instagram linkedin youtube tiktok github whatsapp] },
-                 { locale_translations: locale_translation_keys.index_with { %i[name page_title header_text] } },
-                 { popular_content: popular_content_keys.index_with { { category_ids: [], article_ids: [] } } }] }
+      { config: config_param_keys }
     )
   end
 
+  def config_param_keys
+    keys = [:default_locale, :layout, { allowed_locales: [] }, { draft_locales: [] },
+            { social_profiles: %i[facebook x instagram linkedin youtube tiktok github whatsapp] },
+            { locale_translations: locale_translation_keys.index_with { %i[name page_title header_text] } },
+            { popular_content: popular_content_keys.index_with { { category_ids: [], article_ids: [] } } }]
+    # Analytics injects tracking scripts into every public page, so keep it admin-only even though
+    # Enterprise lets knowledge_base_manage roles edit other portal settings.
+    keys << { analytics: %i[ga4 gtm clarity hotjar meta_pixel] } if Current.account_user&.administrator?
+    keys
+  end
+
   def locale_translation_keys
     params.dig(:portal, :config, :locale_translations)&.keys || []
   end

spec/controllers/api/v1/accounts/portals_controller_spec.rb

@@ -181,6 +181,15 @@ RSpec.describe 'Api::V1::Accounts::Portals', type: :request do
         )
       end
 
+      it 'allows administrators to set analytics config' do
+        put "/api/v1/accounts/#{account.id}/portals/#{portal.slug}",
+            params: { portal: { config: { analytics: { ga4: 'G-ADMIN12345' } } } },
+            headers: admin.create_new_auth_token
+
+        expect(response).to have_http_status(:success)
+        expect(portal.reload.config['analytics']).to eq('ga4' => 'G-ADMIN12345')
+      end
+
       it 'preserves drafted locales when draft_locales is omitted' do
         portal.update!(config: { allowed_locales: %w[en es fr], draft_locales: ['es'], default_locale: 'en' })
 

spec/enterprise/controllers/enterprise/api/v1/accounts/portals_controller_spec.rb

@@ -85,6 +85,17 @@ RSpec.describe 'Enterprise Portal API', type: :request do
         json_response = response.parsed_body
         expect(json_response['name']).to eq('updated_portal')
       end
+
+      it 'ignores analytics config for knowledge_base_manage users' do
+        put "/api/v1/accounts/#{account.id}/portals/#{portal.slug}",
+            params: { portal: { name: 'updated_portal', config: { analytics: { ga4: 'G-KBMANAGER1' } } } },
+            headers: agent_with_role.create_new_auth_token,
+            as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(portal.reload.name).to eq('updated_portal')
+        expect(portal.config['analytics']).to be_blank
+      end
     end
   end