From 3b6e07c73713de67728eeb7e4d1d42aff829ac09 Mon Sep 17 00:00:00 2001 From: Tanmay Deep Sharma Date: Wed, 22 Jul 2026 17:45:59 +0530 Subject: [PATCH] fix(security): gate custom_role and SLA assignment on their premium feature flags --- .../enterprise/api/v1/accounts/agents_controller.rb | 2 ++ .../enterprise/api/v1/accounts/conversations_controller.rb | 3 +++ .../enterprise/api/v1/accounts/agents_controller_spec.rb | 2 ++ 3 files changed, 7 insertions(+) diff --git a/enterprise/app/controllers/enterprise/api/v1/accounts/agents_controller.rb b/enterprise/app/controllers/enterprise/api/v1/accounts/agents_controller.rb index 5d334afe3..f3e99b7e8 100644 --- a/enterprise/app/controllers/enterprise/api/v1/accounts/agents_controller.rb +++ b/enterprise/app/controllers/enterprise/api/v1/accounts/agents_controller.rb @@ -15,6 +15,8 @@ module Enterprise::Api::V1::Accounts::AgentsController # `super` may render payment-required without creating an agent (seat limit lost in the locked check); # skip the association so that response is preserved instead of raising on a nil agent. return if @agent.blank? + # Custom roles are a premium feature; ignore custom_role_id assignment when the feature is disabled. + return unless Current.account.feature_enabled?('custom_roles') @agent.current_account_user.update!(custom_role_id: params[:custom_role_id]) end diff --git a/enterprise/app/controllers/enterprise/api/v1/accounts/conversations_controller.rb b/enterprise/app/controllers/enterprise/api/v1/accounts/conversations_controller.rb index f87c06658..c6ff54742 100644 --- a/enterprise/app/controllers/enterprise/api/v1/accounts/conversations_controller.rb +++ b/enterprise/app/controllers/enterprise/api/v1/accounts/conversations_controller.rb @@ -16,6 +16,9 @@ module Enterprise::Api::V1::Accounts::ConversationsController end def permitted_update_params + # SLA is a premium feature; only accept sla_policy_id assignment when it is enabled for the account. + return super unless Current.account.feature_enabled?('sla') + super.merge(params.permit(:sla_policy_id)) end diff --git a/spec/enterprise/controllers/enterprise/api/v1/accounts/agents_controller_spec.rb b/spec/enterprise/controllers/enterprise/api/v1/accounts/agents_controller_spec.rb index fbffe088e..5e47de905 100644 --- a/spec/enterprise/controllers/enterprise/api/v1/accounts/agents_controller_spec.rb +++ b/spec/enterprise/controllers/enterprise/api/v1/accounts/agents_controller_spec.rb @@ -5,6 +5,8 @@ RSpec.describe 'Enterprise Agents API', type: :request do let(:admin) { create(:user, account: account, role: :administrator) } let!(:custom_role) { create(:custom_role, account: account) } + before { account.enable_features!('custom_roles') } + describe 'POST /api/v1/accounts/{account.id}/agents' do let(:params) { { email: 'test@example.com', name: 'Test User', role: 'agent', custom_role_id: custom_role.id } }