From 64c5aeebeeab99f9a8fbd93de5f40d88f241e787 Mon Sep 17 00:00:00 2001
From: Pranav <pranav@chatwoot.com>
Date: Thu, 4 Jun 2026 06:34:12 -0700
Subject: [PATCH 01/34] feat(help-center): support per-locale portal title,
 name & header (#14642)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Portals can now override their name, page title and header text per
locale, with a fallback chain of locale override → default locale → base
value. Overrides are stored under portal.config.locale_translations and
validated with a JSON schema.

Editing is exposed as a "Localize content" action in each non-default
locale's menu on the Locale page, and all public-facing portal views
(classic + documentation layouts) render the localized values. The live
chat widget is also loaded in the active portal locale.


<img width="494" height="395" alt="Screenshot 2026-06-03 at 2 48 59 PM"
src="https://github.com/user-attachments/assets/e55a06e8-f20f-4d8a-9352-92fde28a9a19"
/>



https://github.com/user-attachments/assets/f5affbd2-7ad4-415a-b376-57c759fc2aaa

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../api/v1/accounts/portals_controller.rb     |  7 +-
 .../public/api/v1/portals_controller.rb       |  2 +-
 .../HelpCenter/LocaleCard/LocaleCard.vue      |  5 +-
 .../Pages/LocalePage/LocaleContentDialog.vue  | 98 +++++++++++++++++++
 .../Pages/LocalePage/LocaleList.vue           |  7 ++
 .../dashboard/helper/portalHelper.js          | 27 +++--
 .../helper/specs/portalHelper.spec.js         | 35 ++++---
 .../dashboard/i18n/locale/en/helpCenter.json  | 18 ++++
 app/models/concerns/portal_config_schema.rb   | 35 +++++++
 app/models/portal.rb                          | 29 +++++-
 .../v1/accounts/portals/_portal.json.jbuilder |  1 +
 app/views/layouts/_portal_head.html.erb       |  2 +-
 app/views/layouts/_portal_scripts.html.erb    |  4 +
 .../public/api/v1/portals/_header.html.erb    |  4 +-
 .../public/api/v1/portals/_hero.html.erb      |  8 +-
 .../api/v1/portals/articles/index.html.erb    |  2 +-
 .../api/v1/portals/articles/show.html.erb     |  2 +-
 .../api/v1/portals/categories/_hero.html.erb  |  2 +-
 .../api/v1/portals/categories/show.html.erb   |  4 +-
 .../documentation_layout/_hero.html.erb       |  2 +-
 .../documentation_layout/_topbar.html.erb     |  2 +-
 .../articles/_meta_head.html.erb              |  2 +-
 .../categories/_meta_head.html.erb            |  4 +-
 .../search/index.html+documentation.erb       |  2 +-
 .../api/v1/portals/search/index.html.erb      |  2 +-
 .../v1/accounts/portals_controller_spec.rb    |  3 +-
 spec/models/portal_spec.rb                    | 88 +++++++++++++++++
 27 files changed, 347 insertions(+), 50 deletions(-)
 create mode 100644 app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleContentDialog.vue
 create mode 100644 app/models/concerns/portal_config_schema.rb

diff --git a/app/controllers/api/v1/accounts/portals_controller.rb b/app/controllers/api/v1/accounts/portals_controller.rb
index 770018e3c..c74c0ecfc 100644
--- a/app/controllers/api/v1/accounts/portals_controller.rb
+++ b/app/controllers/api/v1/accounts/portals_controller.rb
@@ -80,10 +80,15 @@ class Api::V1::Accounts::PortalsController < Api::V1::Accounts::BaseController
       :id, :color, :custom_domain, :header_text, :homepage_link,
       :name, :page_title, :slug, :archived,
       { config: [:default_locale, :layout, { allowed_locales: [] }, { draft_locales: [] },
-                 { social_profiles: %i[facebook x instagram linkedin youtube tiktok github whatsapp] }] }
+                 { social_profiles: %i[facebook x instagram linkedin youtube tiktok github whatsapp] },
+                 { locale_translations: locale_translation_keys.index_with { %i[name page_title header_text] } }] }
     )
   end
 
+  def locale_translation_keys
+    params.dig(:portal, :config, :locale_translations)&.keys || []
+  end
+
   def live_chat_widget_params
     permitted_params = params.permit(:inbox_id)
     return {} unless permitted_params.key?(:inbox_id)
diff --git a/app/controllers/public/api/v1/portals_controller.rb b/app/controllers/public/api/v1/portals_controller.rb
index 63f44b052..57db11aec 100644
--- a/app/controllers/public/api/v1/portals_controller.rb
+++ b/app/controllers/public/api/v1/portals_controller.rb
@@ -9,7 +9,7 @@ class Public::Api::V1::PortalsController < Public::Api::V1::Portals::BaseControl
   layout 'portal'
 
   def show
-    @og_image_url = helpers.set_og_image_url('', @portal.header_text)
+    @og_image_url = helpers.set_og_image_url('', @portal.localized_value('header_text', @locale))
   end
 
   def sitemap
diff --git a/app/javascript/dashboard/components-next/HelpCenter/LocaleCard/LocaleCard.vue b/app/javascript/dashboard/components-next/HelpCenter/LocaleCard/LocaleCard.vue
index 8619e5b77..259328bec 100644
--- a/app/javascript/dashboard/components-next/HelpCenter/LocaleCard/LocaleCard.vue
+++ b/app/javascript/dashboard/components-next/HelpCenter/LocaleCard/LocaleCard.vue
@@ -53,6 +53,9 @@ const localeMenuLabels = computed(() => ({
   'publish-locale': t(
     'HELP_CENTER.LOCALES_PAGE.LOCALE_CARD.DROPDOWN_MENU.PUBLISH_LOCALE'
   ),
+  'customize-content': t(
+    'HELP_CENTER.LOCALES_PAGE.LOCALE_CARD.DROPDOWN_MENU.CUSTOMIZE_CONTENT'
+  ),
   delete: t('HELP_CENTER.LOCALES_PAGE.LOCALE_CARD.DROPDOWN_MENU.DELETE'),
 }));
 
@@ -128,7 +131,7 @@ const handleAction = ({ action, value }) => {
           <DropdownMenu
             v-if="showDropdownMenu"
             :menu-items="localeMenuItems"
-            class="ltr:right-0 rtl:left-0 mt-1 xl:ltr:left-0 xl:rtl:right-0 top-full z-60 min-w-[150px]"
+            class="ltr:right-0 rtl:left-0 mt-1 top-full z-60 min-w-[150px]"
             @action="handleAction"
           />
         </div>
diff --git a/app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleContentDialog.vue b/app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleContentDialog.vue
new file mode 100644
index 000000000..11d38f2a2
--- /dev/null
+++ b/app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleContentDialog.vue
@@ -0,0 +1,98 @@
+<script setup>
+import { ref, computed } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { useStore } from 'dashboard/composables/store';
+import { useAlert } from 'dashboard/composables';
+import Dialog from 'dashboard/components-next/dialog/Dialog.vue';
+import Input from 'dashboard/components-next/input/Input.vue';
+
+const props = defineProps({
+  portal: {
+    type: Object,
+    default: () => ({}),
+  },
+});
+
+const { t } = useI18n();
+const store = useStore();
+
+const dialogRef = ref(null);
+const activeLocale = ref('');
+const name = ref('');
+const pageTitle = ref('');
+const headerText = ref('');
+
+const localeTranslations = computed(
+  () => props.portal?.config?.locale_translations || {}
+);
+
+const openForLocale = localeCode => {
+  const existing = localeTranslations.value[localeCode] || {};
+  activeLocale.value = localeCode;
+  name.value = existing.name || '';
+  pageTitle.value = existing.page_title || '';
+  headerText.value = existing.header_text || '';
+  dialogRef.value?.open();
+};
+
+const onConfirm = async () => {
+  const translations = { ...localeTranslations.value };
+  const fields = {};
+  if (name.value.trim()) fields.name = name.value.trim();
+  if (pageTitle.value.trim()) fields.page_title = pageTitle.value.trim();
+  if (headerText.value.trim()) fields.header_text = headerText.value.trim();
+
+  if (Object.keys(fields).length) {
+    translations[activeLocale.value] = fields;
+  } else {
+    delete translations[activeLocale.value];
+  }
+
+  try {
+    await store.dispatch('portals/update', {
+      portalSlug: props.portal?.slug,
+      config: { locale_translations: translations },
+    });
+    dialogRef.value?.close();
+    useAlert(t('HELP_CENTER.LOCALES_PAGE.CONTENT_DIALOG.API.SUCCESS_MESSAGE'));
+  } catch (error) {
+    useAlert(
+      error?.message ||
+        t('HELP_CENTER.LOCALES_PAGE.CONTENT_DIALOG.API.ERROR_MESSAGE')
+    );
+  }
+};
+
+defineExpose({ openForLocale });
+</script>
+
+<template>
+  <Dialog
+    ref="dialogRef"
+    type="edit"
+    :title="t('HELP_CENTER.LOCALES_PAGE.CONTENT_DIALOG.TITLE')"
+    :description="t('HELP_CENTER.LOCALES_PAGE.CONTENT_DIALOG.DESCRIPTION')"
+    @confirm="onConfirm"
+  >
+    <div class="flex flex-col gap-4">
+      <div class="flex flex-col gap-1">
+        <label class="text-sm font-medium text-n-slate-12">
+          {{ t('HELP_CENTER.LOCALES_PAGE.CONTENT_DIALOG.NAME.LABEL') }}
+        </label>
+        <Input v-model="name" :placeholder="portal.name" />
+      </div>
+      <div class="flex flex-col gap-1">
+        <label class="text-sm font-medium text-n-slate-12">
+          {{ t('HELP_CENTER.LOCALES_PAGE.CONTENT_DIALOG.PAGE_TITLE.LABEL') }}
+        </label>
+        <Input v-model="pageTitle" :placeholder="portal.page_title" />
+      </div>
+      <div class="flex flex-col gap-1">
+        <label class="text-sm font-medium text-n-slate-12">
+          {{ t('HELP_CENTER.LOCALES_PAGE.CONTENT_DIALOG.HEADER_TEXT.LABEL') }}
+        </label>
+        <Input v-model="headerText" :placeholder="portal.header_text" />
+      </div>
+    </div>
+  </Dialog>
+</template>
diff --git a/app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleList.vue b/app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleList.vue
index 62c644655..66d389ead 100644
--- a/app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleList.vue
+++ b/app/javascript/dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleList.vue
@@ -1,5 +1,7 @@
 <script setup>
+import { ref } from 'vue';
 import LocaleCard from 'dashboard/components-next/HelpCenter/LocaleCard/LocaleCard.vue';
+import LocaleContentDialog from 'dashboard/components-next/HelpCenter/Pages/LocalePage/LocaleContentDialog.vue';
 import { useStore } from 'dashboard/composables/store';
 import { useAlert, useTrack } from 'dashboard/composables';
 import { useUISettings } from 'dashboard/composables/useUISettings';
@@ -23,6 +25,8 @@ const { t } = useI18n();
 const route = useRoute();
 const { uiSettings, updateUISettings } = useUISettings();
 
+const contentDialogRef = ref(null);
+
 const isLocaleDefault = code => {
   return props.portal?.meta?.default_locale === code;
 };
@@ -148,6 +152,8 @@ const handleAction = ({ action }, localeCode) => {
     moveLocaleToDraft({ localeCode: localeCode });
   } else if (action === 'publish-locale') {
     publishLocale({ localeCode: localeCode });
+  } else if (action === 'customize-content') {
+    contentDialogRef.value.openForLocale(localeCode);
   } else if (action === 'delete') {
     deletePortalLocale({ localeCode: localeCode });
   }
@@ -167,5 +173,6 @@ const handleAction = ({ action }, localeCode) => {
       :category-count="locale.categoriesCount || 0"
       @action="handleAction($event, locale.code)"
     />
+    <LocaleContentDialog ref="contentDialogRef" :portal="portal" />
   </ul>
 </template>
diff --git a/app/javascript/dashboard/helper/portalHelper.js b/app/javascript/dashboard/helper/portalHelper.js
index 33a2a822a..89f13f8cd 100644
--- a/app/javascript/dashboard/helper/portalHelper.js
+++ b/app/javascript/dashboard/helper/portalHelper.js
@@ -159,6 +159,13 @@ export const LOCALE_MENU_ITEMS = {
     value: 'publish',
     icon: 'i-lucide-eye',
   },
+  customizeContent: {
+    label:
+      'HELP_CENTER.LOCALES_PAGE.LOCALE_CARD.DROPDOWN_MENU.CUSTOMIZE_CONTENT',
+    action: 'customize-content',
+    value: 'customize-content',
+    icon: 'i-lucide-pencil',
+  },
   delete: {
     label: 'HELP_CENTER.LOCALES_PAGE.LOCALE_CARD.DROPDOWN_MENU.DELETE',
     action: 'delete',
@@ -172,20 +179,28 @@ const disableLocaleMenuItems = menuItems =>
 
 export const buildLocaleMenuItems = ({ isDefault, isDraft }) => {
   if (isDefault) {
-    return disableLocaleMenuItems([
-      LOCALE_MENU_ITEMS.makeDefault,
-      LOCALE_MENU_ITEMS.moveToDraft,
-      LOCALE_MENU_ITEMS.delete,
-    ]);
+    return [
+      ...disableLocaleMenuItems([
+        LOCALE_MENU_ITEMS.makeDefault,
+        LOCALE_MENU_ITEMS.moveToDraft,
+      ]),
+      LOCALE_MENU_ITEMS.customizeContent,
+      ...disableLocaleMenuItems([LOCALE_MENU_ITEMS.delete]),
+    ];
   }
 
   if (isDraft) {
-    return [LOCALE_MENU_ITEMS.publishLocale, LOCALE_MENU_ITEMS.delete];
+    return [
+      LOCALE_MENU_ITEMS.publishLocale,
+      LOCALE_MENU_ITEMS.customizeContent,
+      LOCALE_MENU_ITEMS.delete,
+    ];
   }
 
   return [
     LOCALE_MENU_ITEMS.makeDefault,
     LOCALE_MENU_ITEMS.moveToDraft,
+    LOCALE_MENU_ITEMS.customizeContent,
     LOCALE_MENU_ITEMS.delete,
   ];
 };
diff --git a/app/javascript/dashboard/helper/specs/portalHelper.spec.js b/app/javascript/dashboard/helper/specs/portalHelper.spec.js
index 631714095..e8d200518 100644
--- a/app/javascript/dashboard/helper/specs/portalHelper.spec.js
+++ b/app/javascript/dashboard/helper/specs/portalHelper.spec.js
@@ -74,37 +74,40 @@ describe('PortalHelper', () => {
   });
 
   describe('buildLocaleMenuItems', () => {
-    it('returns disabled actions for the default locale', () => {
+    it('disables other actions but keeps customize enabled for the default locale', () => {
+      const items = buildLocaleMenuItems({ isDefault: true, isDraft: false });
+      const customize = items.find(item => item.action === 'customize-content');
+
+      expect(customize).toBeTruthy();
+      expect(customize.disabled).toBeFalsy();
       expect(
-        buildLocaleMenuItems({
-          isDefault: true,
-          isDraft: false,
-        })
-      ).toEqual(
-        expect.arrayContaining([
-          expect.objectContaining({ action: 'change-default', disabled: true }),
-          expect.objectContaining({ action: 'move-to-draft', disabled: true }),
-          expect.objectContaining({ action: 'delete', disabled: true }),
-        ])
-      );
+        items
+          .filter(item => item.action !== 'customize-content')
+          .every(item => item.disabled)
+      ).toBe(true);
     });
 
-    it('returns publish and delete actions for draft locales', () => {
+    it('returns publish, customize, and delete actions for draft locales', () => {
       expect(
         buildLocaleMenuItems({
           isDefault: false,
           isDraft: true,
         }).map(({ action }) => action)
-      ).toEqual(['publish-locale', 'delete']);
+      ).toEqual(['publish-locale', 'customize-content', 'delete']);
     });
 
-    it('returns default, draft, and delete actions for live locales', () => {
+    it('returns default, draft, customize, and delete actions for live locales', () => {
       expect(
         buildLocaleMenuItems({
           isDefault: false,
           isDraft: false,
         }).map(({ action }) => action)
-      ).toEqual(['change-default', 'move-to-draft', 'delete']);
+      ).toEqual([
+        'change-default',
+        'move-to-draft',
+        'customize-content',
+        'delete',
+      ]);
     });
   });
 });
diff --git a/app/javascript/dashboard/i18n/locale/en/helpCenter.json b/app/javascript/dashboard/i18n/locale/en/helpCenter.json
index 9faa9f340..dfaec8119 100644
--- a/app/javascript/dashboard/i18n/locale/en/helpCenter.json
+++ b/app/javascript/dashboard/i18n/locale/en/helpCenter.json
@@ -700,9 +700,27 @@
           "MAKE_DEFAULT": "Make default",
           "MOVE_TO_DRAFT": "Move to draft",
           "PUBLISH_LOCALE": "Publish locale",
+          "CUSTOMIZE_CONTENT": "Localize content",
           "DELETE": "Delete"
         }
       },
+      "CONTENT_DIALOG": {
+        "TITLE": "Localize content",
+        "DESCRIPTION": "Set values specific to this locale. Anything left blank falls back to the default locale.",
+        "NAME": {
+          "LABEL": "Name"
+        },
+        "PAGE_TITLE": {
+          "LABEL": "Page title"
+        },
+        "HEADER_TEXT": {
+          "LABEL": "Header text"
+        },
+        "API": {
+          "SUCCESS_MESSAGE": "Locale content updated successfully",
+          "ERROR_MESSAGE": "Unable to update locale content. Try again."
+        }
+      },
       "ADD_LOCALE_DIALOG": {
         "TITLE": "Add a new locale",
         "DESCRIPTION": "Select the language in which this article will be written. This will be added to your list of translations, and you can add more later.",
diff --git a/app/models/concerns/portal_config_schema.rb b/app/models/concerns/portal_config_schema.rb
new file mode 100644
index 000000000..de338b830
--- /dev/null
+++ b/app/models/concerns/portal_config_schema.rb
@@ -0,0 +1,35 @@
+module PortalConfigSchema
+  extend ActiveSupport::Concern
+
+  # Per-locale overrides for portal level fields. Any locale present in
+  # `allowed_locales` may carry its own `name`, `page_title` and `header_text`.
+  # Missing values fall back to the default locale and finally to the base column.
+  LOCALE_TRANSLATION_SCHEMA = {
+    'type' => 'object',
+    'properties' => {
+      'name' => { 'type' => %w[string null] },
+      'page_title' => { 'type' => %w[string null] },
+      'header_text' => { 'type' => %w[string null] }
+    },
+    'additionalProperties' => false
+  }.freeze
+
+  CONFIG_PARAMS_SCHEMA = {
+    'type' => 'object',
+    'properties' => {
+      'allowed_locales' => { 'type' => %w[array null], 'items' => { 'type' => 'string' } },
+      'default_locale' => { 'type' => %w[string null] },
+      'draft_locales' => { 'type' => %w[array null], 'items' => { 'type' => 'string' } },
+      'layout' => { 'type' => %w[string null], 'enum' => ['classic', 'documentation', nil] },
+      # TODO: unused reserved key; remove with a migration that scrubs it from existing portals' config
+      'website_token' => { 'type' => %w[string null] },
+      'social_profiles' => { 'type' => %w[object null] },
+      'locale_translations' => {
+        'type' => %w[object null],
+        'additionalProperties' => LOCALE_TRANSLATION_SCHEMA
+      }
+    },
+    'required' => [],
+    'additionalProperties' => true
+  }.to_json.freeze
+end
diff --git a/app/models/portal.rb b/app/models/portal.rb
index 37665a15c..9d2da6965 100644
--- a/app/models/portal.rb
+++ b/app/models/portal.rb
@@ -26,6 +26,7 @@
 #
 class Portal < ApplicationRecord
   include Rails.application.routes.url_helpers
+  include PortalConfigSchema
 
   DEFAULT_COLOR = '#1f93ff'.freeze
 
@@ -43,11 +44,16 @@ class Portal < ApplicationRecord
   validates :slug, presence: true, uniqueness: true
   validates :custom_domain, uniqueness: true, allow_nil: true
   validates :color, format: { with: /\A#(?:\h{3}|\h{6})\z/ }, allow_blank: true
-  validate :config_json_format
+  before_validation :normalize_config
+  validate :validate_config
+  validates_with JsonSchemaValidator,
+                 schema: PortalConfigSchema::CONFIG_PARAMS_SCHEMA,
+                 attribute_resolver: ->(record) { record.config }
 
   scope :active, -> { where(archived: false) }
 
-  CONFIG_JSON_KEYS = %w[allowed_locales default_locale draft_locales website_token social_profiles layout].freeze
+  # TODO: 'website_token' is an unused reserved key; remove with a migration that scrubs it from existing portals' config
+  CONFIG_JSON_KEYS = %w[allowed_locales default_locale draft_locales website_token social_profiles layout locale_translations].freeze
 
   def file_base_data
     {
@@ -91,8 +97,18 @@ class Portal < ApplicationRecord
     self[:color].presence || DEFAULT_COLOR
   end
 
-  def display_title
-    page_title.presence || name
+  def display_title(locale = default_locale)
+    localized_value('page_title', locale).presence || localized_value('name', locale)
+  end
+
+  # Resolves a portal level field for a locale, falling back to the default
+  # locale's value (its override or the base column) when the locale has no
+  # override of its own.
+  def localized_value(field, locale = default_locale)
+    translations = config_value('locale_translations') || {}
+    translations.dig(locale.to_s, field).presence ||
+      translations.dig(default_locale, field).presence ||
+      self[field]
   end
 
   def layout
@@ -105,11 +121,14 @@ class Portal < ApplicationRecord
 
   private
 
-  def config_json_format
+  def normalize_config
     self.config = persisted_config.merge((config || {}).deep_stringify_keys)
     config['allowed_locales'] = allowed_locale_codes
     config['default_locale'] = default_locale
     config['draft_locales'] = draft_locale_codes
+  end
+
+  def validate_config
     denied_keys = config.keys - CONFIG_JSON_KEYS
     errors.add(:config, "in portal on #{denied_keys.join(',')} is not supported.") if denied_keys.any?
     errors.add(:config, 'default locale cannot be drafted.') if draft_locale?(default_locale)
diff --git a/app/views/api/v1/accounts/portals/_portal.json.jbuilder b/app/views/api/v1/accounts/portals/_portal.json.jbuilder
index 08b3e8b36..93626ee36 100644
--- a/app/views/api/v1/accounts/portals/_portal.json.jbuilder
+++ b/app/views/api/v1/accounts/portals/_portal.json.jbuilder
@@ -18,6 +18,7 @@ json.config do
   json.default_locale portal.default_locale
   json.layout portal.layout
   json.social_profiles portal.social_profiles
+  json.locale_translations portal.config['locale_translations'] || {}
 end
 
 if portal.channel_web_widget
diff --git a/app/views/layouts/_portal_head.html.erb b/app/views/layouts/_portal_head.html.erb
index 882064d52..64e24a150 100644
--- a/app/views/layouts/_portal_head.html.erb
+++ b/app/views/layouts/_portal_head.html.erb
@@ -16,7 +16,7 @@
 <% if content_for?(:head) %>
   <%= yield(:head) %>
 <% else %>
-  <title><%= @portal.display_title %></title>
+  <title><%= @portal.display_title(@locale) %></title>
 <% end %>
 
 <% if @portal.logo.present? %>
diff --git a/app/views/layouts/_portal_scripts.html.erb b/app/views/layouts/_portal_scripts.html.erb
index 1f2b81f12..b1479cace 100644
--- a/app/views/layouts/_portal_scripts.html.erb
+++ b/app/views/layouts/_portal_scripts.html.erb
@@ -89,5 +89,9 @@ html.light {
   };
 </script>
 <% if @portal.channel_web_widget.present? && !@is_plain_layout_enabled %>
+<script>
+  window.chatwootSettings = window.chatwootSettings || {};
+  window.chatwootSettings.locale = '<%= @locale %>';
+</script>
 <%= @portal.channel_web_widget.web_widget_script.html_safe %>
 <% end %>
diff --git a/app/views/public/api/v1/portals/_header.html.erb b/app/views/public/api/v1/portals/_header.html.erb
index 3db8efa59..189371261 100644
--- a/app/views/public/api/v1/portals/_header.html.erb
+++ b/app/views/public/api/v1/portals/_header.html.erb
@@ -5,7 +5,7 @@
         <% if @portal.logo.present? %>
           <img src="<%= url_for(@portal.logo) %>" class="w-auto h-10 ltr:mr-2 rtl:ml-2" draggable="false" />
         <% end %>
-        <span class="text-lg font-semibold text-slate-900 truncate dark:text-white <%= @portal.logo.present? ? 'hidden lg:block' : 'hidden sm:block' %>"><%= @portal.name %></span>
+        <span class="text-lg font-semibold text-slate-900 truncate dark:text-white <%= @portal.logo.present? ? 'hidden lg:block' : 'hidden sm:block' %>"><%= @portal.localized_value('name', @locale) %></span>
       </a>
     </div>
 
@@ -106,7 +106,7 @@
         <% if @portal.logo.present? %>
           <img src="<%= url_for(@portal.logo) %>" class="w-auto h-10 ltr:mr-2 rtl:ml-2" draggable="false" />
         <% end %>
-         <span class="text-lg font-semibold text-slate-900 truncate dark:text-white <%= @portal.logo.present? ? 'hidden' : 'sm:hidden block' %>"><%= @portal.name %></span>
+         <span class="text-lg font-semibold text-slate-900 truncate dark:text-white <%= @portal.logo.present? ? 'hidden' : 'sm:hidden block' %>"><%= @portal.localized_value('name', @locale) %></span>
       </a>
 
       <!-- Mobile Menu Component -->
diff --git a/app/views/public/api/v1/portals/_hero.html.erb b/app/views/public/api/v1/portals/_hero.html.erb
index c1ead0e59..1e2bf119c 100644
--- a/app/views/public/api/v1/portals/_hero.html.erb
+++ b/app/views/public/api/v1/portals/_hero.html.erb
@@ -1,7 +1,7 @@
 <% if !@is_plain_layout_enabled %>
 <% content_for :head do %>
-  <title><%= @portal.display_title %></title>
-  <meta name="title" content="<%= @portal.display_title %>">
+  <title><%= @portal.display_title(@locale) %></title>
+  <meta name="title" content="<%= @portal.display_title(@locale) %>">
 
   <% if @og_image_url.present? %>
     <meta name="twitter:card" content="summary_large_image">
@@ -13,9 +13,9 @@
 <section id="portal-bg" class="w-full bg-white dark:bg-slate-900 shadow-inner">
   <div id="portal-bg-gradient" class="pt-8 pb-8 md:pt-14 md:pb-6 min-h-[240px] md:min-h-[260px]">
     <div class="mx-auto max-w-5xl px-4 md:px-8 flex flex-col items-start">
-       <span class="text-sm leading-[24px] font-semibold text-slate-600 dark:text-slate-300 mb-1 <%= @portal.logo.present? ? 'block lg:hidden' : 'hidden' %>"><%= @portal.name %></span>
+       <span class="text-sm leading-[24px] font-semibold text-slate-600 dark:text-slate-300 mb-1 <%= @portal.logo.present? ? 'block lg:hidden' : 'hidden' %>"><%= @portal.localized_value('name', @locale) %></span>
       <h1 class="text-2xl md:text-4xl text-slate-900 dark:text-white font-semibold leading-normal">
-        <%= portal.header_text %>
+        <%= portal.localized_value('header_text', @locale) %>
       </h1>
       <p class="text-slate-600 dark:text-slate-200 text-start text-lg leading-normal pt-2 pb-4"><%= I18n.t('public_portal.hero.sub_title') %></p>
       <div id="search-wrap" class="w-full relative z-30"></div>
diff --git a/app/views/public/api/v1/portals/articles/index.html.erb b/app/views/public/api/v1/portals/articles/index.html.erb
index d040bbc24..e4dc9aa87 100644
--- a/app/views/public/api/v1/portals/articles/index.html.erb
+++ b/app/views/public/api/v1/portals/articles/index.html.erb
@@ -6,7 +6,7 @@
 			  class="leading-8 text-slate-800 hover:underline"
 		      href="<%= generate_home_link(@portal.slug, @category.present? ? @category.slug : '', @theme_from_params, @is_plain_layout_enabled) %>"
 			>
-				<%= @portal.name %> <%= I18n.t('public_portal.common.home') %>
+				<%= @portal.localized_value('name', @locale) %> <%= I18n.t('public_portal.common.home') %>
 			</a>
 		<span>/</span>
 		<span>/</span>
diff --git a/app/views/public/api/v1/portals/articles/show.html.erb b/app/views/public/api/v1/portals/articles/show.html.erb
index 784817c9c..e35b19009 100644
--- a/app/views/public/api/v1/portals/articles/show.html.erb
+++ b/app/views/public/api/v1/portals/articles/show.html.erb
@@ -1,5 +1,5 @@
 <% content_for :head do %>
-  <title><%= @article.title %> | <%= @portal.display_title %></title>
+  <title><%= @article.title %> | <%= @portal.display_title(@locale) %></title>
   <% if @article.meta["title"].present? %>
     <meta name="title" content="<%= @article.meta["title"] %>">
     <meta property="og:title" content="<%= @article.meta["title"] %>">
diff --git a/app/views/public/api/v1/portals/categories/_hero.html.erb b/app/views/public/api/v1/portals/categories/_hero.html.erb
index 0c179338d..1b481617e 100644
--- a/app/views/public/api/v1/portals/categories/_hero.html.erb
+++ b/app/views/public/api/v1/portals/categories/_hero.html.erb
@@ -1,7 +1,7 @@
 
 <section class="bg-slate-50 dark:bg-slate-800 py-16 flex flex-col items-center justify-center">
   <div class="mx-auto max-w-2xl">
-    <h1 class="text-4xl text-slate-900 dark:text-white font-semibold leading-relaxed text-center"><%= portal.header_text %></h1>
+    <h1 class="text-4xl text-slate-900 dark:text-white font-semibold leading-relaxed text-center"><%= portal.localized_value('header_text', @locale) %></h1>
     <p class="text-slate-700 dark:text-slate-100 py-2 text-center"><%= I18n.t('public_portal.hero.sub_title') %></p>
   </div>
 </section>
diff --git a/app/views/public/api/v1/portals/categories/show.html.erb b/app/views/public/api/v1/portals/categories/show.html.erb
index 6657559d0..e7179db73 100644
--- a/app/views/public/api/v1/portals/categories/show.html.erb
+++ b/app/views/public/api/v1/portals/categories/show.html.erb
@@ -1,6 +1,6 @@
 <% content_for :head do %>
-  <title><%= @category.name %> | <%= @portal.display_title %></title>
-  <meta name="title" content="<%= @category.name %> | <%= @portal.display_title %>">
+  <title><%= @category.name %> | <%= @portal.display_title(@locale) %></title>
+  <meta name="title" content="<%= @category.name %> | <%= @portal.display_title(@locale) %>">
   <% if @category.description.present? %>
     <meta name="description" content="<%= @category.description %>">
     <meta property="og:description" content="<%= @category.description %>">
diff --git a/app/views/public/api/v1/portals/documentation_layout/_hero.html.erb b/app/views/public/api/v1/portals/documentation_layout/_hero.html.erb
index c7df0517d..af80d46ac 100644
--- a/app/views/public/api/v1/portals/documentation_layout/_hero.html.erb
+++ b/app/views/public/api/v1/portals/documentation_layout/_hero.html.erb
@@ -5,7 +5,7 @@
   <div class="relative w-full px-6 md:px-10 py-12 md:py-16">
     <div class="max-w-2xl">
       <h1 class="text-4xl md:text-5xl leading-tight font-620 tracking-tight text-n-slate-12 text-balance">
-        <%= portal.header_text.presence || 'How can we help?' %>
+        <%= portal.localized_value('header_text', @locale).presence || 'How can we help?' %>
       </h1>
       <p class="mt-4 text-lg leading-normal text-n-slate-11 text-pretty">
         <%= I18n.t('public_portal.hero.sub_title') %>
diff --git a/app/views/public/api/v1/portals/documentation_layout/_topbar.html.erb b/app/views/public/api/v1/portals/documentation_layout/_topbar.html.erb
index 46d6f3558..00f408d70 100644
--- a/app/views/public/api/v1/portals/documentation_layout/_topbar.html.erb
+++ b/app/views/public/api/v1/portals/documentation_layout/_topbar.html.erb
@@ -11,7 +11,7 @@
       <% if portal.logo.present? %>
         <img src="<%= url_for(portal.logo) %>" class="w-8 h-8 rounded-full" draggable="false" />
       <% end %>
-      <span class="text-base font-semibold tracking-tight text-n-slate-12 truncate"><%= portal.name %></span>
+      <span class="text-base font-semibold tracking-tight text-n-slate-12 truncate"><%= portal.localized_value('name', locale) %></span>
       <span class="hidden sm:inline-block w-px h-5 bg-n-weak mx-1"></span>
       <span class="hidden sm:inline-block text-sm font-medium text-n-slate-11 truncate"><%= I18n.t('public_portal.sidebar.help_center') %></span>
     </a>
diff --git a/app/views/public/api/v1/portals/documentation_layout/articles/_meta_head.html.erb b/app/views/public/api/v1/portals/documentation_layout/articles/_meta_head.html.erb
index a236722ae..aeed7ff6c 100644
--- a/app/views/public/api/v1/portals/documentation_layout/articles/_meta_head.html.erb
+++ b/app/views/public/api/v1/portals/documentation_layout/articles/_meta_head.html.erb
@@ -1,4 +1,4 @@
-<title><%= article.title %> | <%= portal.display_title %></title>
+<title><%= article.title %> | <%= portal.display_title(article.locale) %></title>
 <% if article.meta["title"].present? %>
   <meta name="title" content="<%= article.meta["title"] %>">
   <meta property="og:title" content="<%= article.meta["title"] %>">
diff --git a/app/views/public/api/v1/portals/documentation_layout/categories/_meta_head.html.erb b/app/views/public/api/v1/portals/documentation_layout/categories/_meta_head.html.erb
index 7c8dec8d2..ac36496df 100644
--- a/app/views/public/api/v1/portals/documentation_layout/categories/_meta_head.html.erb
+++ b/app/views/public/api/v1/portals/documentation_layout/categories/_meta_head.html.erb
@@ -1,5 +1,5 @@
-<title><%= category.name %> | <%= portal.display_title %></title>
-<meta name="title" content="<%= category.name %> | <%= portal.display_title %>">
+<title><%= category.name %> | <%= portal.display_title(category.locale) %></title>
+<meta name="title" content="<%= category.name %> | <%= portal.display_title(category.locale) %>">
 <% if category.description.present? %>
   <meta name="description" content="<%= category.description %>">
   <meta property="og:description" content="<%= category.description %>">
diff --git a/app/views/public/api/v1/portals/search/index.html+documentation.erb b/app/views/public/api/v1/portals/search/index.html+documentation.erb
index 8577a5f4e..f77517618 100644
--- a/app/views/public/api/v1/portals/search/index.html+documentation.erb
+++ b/app/views/public/api/v1/portals/search/index.html+documentation.erb
@@ -1,5 +1,5 @@
 <% content_for :head do %>
-  <title><%= I18n.t('public_portal.search.results_for', query: @query) %> | <%= @portal.name %></title>
+  <title><%= I18n.t('public_portal.search.results_for', query: @query) %> | <%= @portal.localized_value('name', @locale) %></title>
 <% end %>
 
 <div class="px-6 md:px-10 py-8 md:py-10">
diff --git a/app/views/public/api/v1/portals/search/index.html.erb b/app/views/public/api/v1/portals/search/index.html.erb
index 82c29775f..b4a1e77ed 100644
--- a/app/views/public/api/v1/portals/search/index.html.erb
+++ b/app/views/public/api/v1/portals/search/index.html.erb
@@ -1,5 +1,5 @@
 <% content_for :head do %>
-  <title><%= I18n.t('public_portal.search.results_for', query: @query) %> | <%= @portal.name %></title>
+  <title><%= I18n.t('public_portal.search.results_for', query: @query) %> | <%= @portal.localized_value('name', @locale) %></title>
 <% end %>
 
 <% search_input_class = 'w-full px-4 py-3 border border-slate-200 dark:border-slate-700 rounded-lg bg-white dark:bg-slate-800 text-slate-900 dark:text-slate-100 placeholder-slate-500 dark:placeholder-slate-400 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-transparent' %>
diff --git a/spec/controllers/api/v1/accounts/portals_controller_spec.rb b/spec/controllers/api/v1/accounts/portals_controller_spec.rb
index 860791c0e..ccb5d7449 100644
--- a/spec/controllers/api/v1/accounts/portals_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/portals_controller_spec.rb
@@ -173,7 +173,8 @@ RSpec.describe 'Api::V1::Accounts::Portals', type: :request do
             ],
             'default_locale' => 'en',
             'layout' => 'classic',
-            'social_profiles' => {}
+            'social_profiles' => {},
+            'locale_translations' => {}
           }
         )
       end
diff --git a/spec/models/portal_spec.rb b/spec/models/portal_spec.rb
index 38d9a7da6..c71a458fd 100644
--- a/spec/models/portal_spec.rb
+++ b/spec/models/portal_spec.rb
@@ -60,6 +60,94 @@ RSpec.describe Portal do
         portal.update(custom_domain: '')
         expect(portal.custom_domain).to be_nil
       end
+
+      context 'with locale_translations' do
+        it 'allows valid locale translations' do
+          portal.update(config: { allowed_locales: %w[en es], default_locale: 'en',
+                                  locale_translations: { 'es' => { 'name' => 'Centro', 'page_title' => 'Título', 'header_text' => 'Hola' } } })
+
+          expect(portal).to be_valid
+        end
+
+        it 'rejects unknown fields within a locale translation' do
+          portal.update(config: { allowed_locales: %w[en es], default_locale: 'en',
+                                  locale_translations: { 'es' => { 'tagline' => 'nope' } } })
+
+          expect(portal).not_to be_valid
+        end
+
+        it 'retains a locale override after it becomes the default so it can still be edited' do
+          portal.update!(config: { allowed_locales: %w[en es], default_locale: 'en',
+                                   locale_translations: { 'es' => { 'name' => 'Centro' } } })
+
+          portal.update!(config: { allowed_locales: %w[en es], default_locale: 'es' })
+
+          expect(portal.config['locale_translations']).to eq({ 'es' => { 'name' => 'Centro' } })
+        end
+      end
+    end
+  end
+
+  describe '#localized_value' do
+    let!(:account) { create(:account) }
+    let!(:portal) do
+      create(:portal, account_id: account.id, name: 'Help Center', page_title: 'Help Center | Acme',
+                      config: { allowed_locales: %w[en es], default_locale: 'en',
+                                locale_translations: { 'es' => { 'name' => 'Centro de ayuda' } } })
+    end
+
+    it 'returns the override for the requested locale' do
+      expect(portal.localized_value('name', 'es')).to eq('Centro de ayuda')
+    end
+
+    it 'falls back to the base column when the locale has no override for the field' do
+      expect(portal.localized_value('page_title', 'es')).to eq('Help Center | Acme')
+    end
+
+    it 'falls back to the base column when the locale has no overrides at all' do
+      expect(portal.localized_value('name', 'fr')).to eq('Help Center')
+    end
+
+    it 'keeps serving the override for a locale that has become the default' do
+      portal.update!(config: { allowed_locales: %w[en es], default_locale: 'es' })
+
+      expect(portal.localized_value('name', 'es')).to eq('Centro de ayuda')
+    end
+
+    it "inherits the default locale's override for a locale without its own" do
+      portal.update!(config: { allowed_locales: %w[en es fr], default_locale: 'es' })
+
+      expect(portal.localized_value('name', 'fr')).to eq('Centro de ayuda')
+    end
+
+    it 'uses the default locale when no locale is given' do
+      expect(portal.localized_value('name')).to eq('Help Center')
+    end
+  end
+
+  describe '#display_title' do
+    let!(:account) { create(:account) }
+
+    it 'prefers the localized page_title' do
+      portal = create(:portal, account_id: account.id, name: 'Help Center', page_title: 'Help Center | Acme',
+                               config: { allowed_locales: %w[en es], default_locale: 'en',
+                                         locale_translations: { 'es' => { 'page_title' => 'Centro | Acme' } } })
+
+      expect(portal.display_title('es')).to eq('Centro | Acme')
+    end
+
+    it 'falls back to the localized name when no page_title is set' do
+      portal = create(:portal, account_id: account.id, name: 'Help Center',
+                               config: { allowed_locales: %w[en es], default_locale: 'en',
+                                         locale_translations: { 'es' => { 'name' => 'Centro de ayuda' } } })
+
+      expect(portal.display_title('es')).to eq('Centro de ayuda')
+    end
+
+    it 'uses the base values for the default locale' do
+      portal = create(:portal, account_id: account.id, name: 'Help Center', page_title: 'Help Center | Acme')
+
+      expect(portal.display_title).to eq('Help Center | Acme')
     end
   end
 end

From ec43975f3f6ec64fb63b752acba571e740d57693 Mon Sep 17 00:00:00 2001
From: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
Date: Fri, 5 Jun 2026 11:25:32 +0530
Subject: [PATCH 02/34] chore: use square avatars (#14656)

---
 .../components-next/Companies/CompaniesCard/CompaniesCard.vue  | 3 +--
 .../Companies/CompanyDetail/CompanyProfileCard.vue             | 1 -
 .../components-next/Contacts/ContactsCard/ContactsCard.vue     | 3 +--
 .../dashboard/components-next/sidebar/SidebarProfileMenu.vue   | 1 -
 .../components/widgets/conversation/ConversationHeader.vue     | 1 -
 .../routes/dashboard/conversation/contact/ContactInfo.vue      | 1 -
 6 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/app/javascript/dashboard/components-next/Companies/CompaniesCard/CompaniesCard.vue b/app/javascript/dashboard/components-next/Companies/CompaniesCard/CompaniesCard.vue
index fe4385bbb..d81b997c5 100644
--- a/app/javascript/dashboard/components-next/Companies/CompaniesCard/CompaniesCard.vue
+++ b/app/javascript/dashboard/components-next/Companies/CompaniesCard/CompaniesCard.vue
@@ -46,9 +46,8 @@ const formattedLastActivityAt = computed(() => {
         :src="avatarSource"
         class="shrink-0"
         :name="name"
-        :size="48"
+        :size="42"
         hide-offline-status
-        rounded-full
       />
       <div class="flex flex-col gap-0.5 flex-1 min-w-0">
         <div class="flex flex-wrap items-center gap-x-4 gap-y-1 min-w-0">
diff --git a/app/javascript/dashboard/components-next/Companies/CompanyDetail/CompanyProfileCard.vue b/app/javascript/dashboard/components-next/Companies/CompanyDetail/CompanyProfileCard.vue
index 1ffbf0c18..7615328ca 100644
--- a/app/javascript/dashboard/components-next/Companies/CompanyDetail/CompanyProfileCard.vue
+++ b/app/javascript/dashboard/components-next/Companies/CompanyDetail/CompanyProfileCard.vue
@@ -141,7 +141,6 @@ const handleUpdateCompany = async () => {
         :src="avatarSource"
         :size="72"
         :allow-upload="!isAvatarBusy"
-        rounded-full
         hide-offline-status
         @upload="handleAvatarUpload"
         @delete="handleAvatarDelete"
diff --git a/app/javascript/dashboard/components-next/Contacts/ContactsCard/ContactsCard.vue b/app/javascript/dashboard/components-next/Contacts/ContactsCard/ContactsCard.vue
index ba887b46f..50af6f0c0 100644
--- a/app/javascript/dashboard/components-next/Contacts/ContactsCard/ContactsCard.vue
+++ b/app/javascript/dashboard/components-next/Contacts/ContactsCard/ContactsCard.vue
@@ -124,10 +124,9 @@ const handleAvatarHover = isHovered => {
           <Avatar
             :name="name"
             :src="thumbnail"
-            :size="48"
+            :size="42"
             :status="availabilityStatus"
             hide-offline-status
-            rounded-full
           >
             <template v-if="selectable" #overlay="{ size }">
               <label
diff --git a/app/javascript/dashboard/components-next/sidebar/SidebarProfileMenu.vue b/app/javascript/dashboard/components-next/sidebar/SidebarProfileMenu.vue
index ffe576e3c..29023b9e9 100644
--- a/app/javascript/dashboard/components-next/sidebar/SidebarProfileMenu.vue
+++ b/app/javascript/dashboard/components-next/sidebar/SidebarProfileMenu.vue
@@ -145,7 +145,6 @@ const allowedMenuItems = computed(() => {
           :src="currentUser.avatar_url"
           :status="currentUserAvailability"
           class="flex-shrink-0"
-          rounded-full
         />
         <div v-if="!isCollapsed" class="min-w-0">
           <div class="text-sm font-medium leading-4 truncate text-n-slate-12">
diff --git a/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue b/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue
index b48930401..ccd1a8aae 100644
--- a/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue
+++ b/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue
@@ -124,7 +124,6 @@ const copyConversationId = async () => {
         :size="32"
         :status="currentContact.availability_status"
         hide-offline-status
-        rounded-full
       />
       <div
         class="flex flex-col items-start min-w-0 ml-2 overflow-hidden rtl:ml-0 rtl:mr-2"
diff --git a/app/javascript/dashboard/routes/dashboard/conversation/contact/ContactInfo.vue b/app/javascript/dashboard/routes/dashboard/conversation/contact/ContactInfo.vue
index a27b308b0..9cb6cea3d 100644
--- a/app/javascript/dashboard/routes/dashboard/conversation/contact/ContactInfo.vue
+++ b/app/javascript/dashboard/routes/dashboard/conversation/contact/ContactInfo.vue
@@ -188,7 +188,6 @@ export default {
           :status="contact.availability_status"
           :size="48"
           hide-offline-status
-          rounded-full
         />
       </div>
 

From 9d808a18df0713506ced79ed08771d296f01354a Mon Sep 17 00:00:00 2001
From: Petterson <58094725+hahuma@users.noreply.github.com>
Date: Fri, 5 Jun 2026 03:03:24 -0300
Subject: [PATCH 03/34] fix(drops): Resolve first_name for single-word contact
 and agent names (#13488)

WhatsApp template variables like `{{contact.first_name}}` previously
resolved to an empty string whenever a contact or agent had a
single-word name (e.g. "Petterson"). Because the variable came back
blank, WhatsApp template sends would either fail validation or get stuck
indefinitely in the "Sending" state. With this fix, `first_name` falls
back to the full single-word name, so templates render correctly for
everyone regardless of how many words their name has.

## Closes

- Fixes #13222

## How to reproduce

1. Create a contact with a single-word name (e.g. `Petterson`).
2. Configure a WhatsApp template action that uses
`{{contact.first_name}}`.
3. Send the template message.
4. **Before:** the variable resolves to an empty string and the message
fails / stays in "Sending".
**After:** the variable resolves to `Petterson` and the message sends.

## What changed

- Removed the "name must have 2+ words" guard from `first_name` in
`ContactDrop` and `UserDrop`, so a single-word name is returned (still
capitalized).
- Capitalization behavior introduced in #6758 is preserved; only the
single-word edge case changes.
- `last_name` still returns `nil` for single-word names, which is the
expected behavior.
- Added specs covering single-word names for both `ContactDrop` and
`UserDrop`.

---------

Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 app/drops/contact_drop.rb       | 2 +-
 app/drops/user_drop.rb          | 2 +-
 spec/drops/contact_drop_spec.rb | 5 +++++
 spec/drops/user_drop_spec.rb    | 5 +++++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/app/drops/contact_drop.rb b/app/drops/contact_drop.rb
index 1d450adb7..16240ec06 100644
--- a/app/drops/contact_drop.rb
+++ b/app/drops/contact_drop.rb
@@ -12,7 +12,7 @@ class ContactDrop < BaseDrop
   end
 
   def first_name
-    @obj.try(:name).try(:split).try(:first).try(:capitalize) if @obj.try(:name).try(:split).try(:size) > 1
+    @obj.try(:name).try(:split).try(:first).try(:capitalize)
   end
 
   def last_name
diff --git a/app/drops/user_drop.rb b/app/drops/user_drop.rb
index cf6f1b6a1..83d5e2347 100644
--- a/app/drops/user_drop.rb
+++ b/app/drops/user_drop.rb
@@ -12,7 +12,7 @@ class UserDrop < BaseDrop
   end
 
   def first_name
-    @obj.try(:name).try(:split).try(:first).try(:capitalize) if @obj.try(:name).try(:split).try(:size).to_i > 1
+    @obj.try(:name).try(:split).try(:first).try(:capitalize)
   end
 
   def last_name
diff --git a/spec/drops/contact_drop_spec.rb b/spec/drops/contact_drop_spec.rb
index d00a0924d..cd6d1a185 100644
--- a/spec/drops/contact_drop_spec.rb
+++ b/spec/drops/contact_drop_spec.rb
@@ -11,6 +11,11 @@ describe ContactDrop do
       expect(subject.first_name).to eq 'John'
     end
 
+    it 'returns the single word (capitalized) as first name when name has only one word' do
+      contact.update!(name: 'john')
+      expect(subject.first_name).to eq 'John'
+    end
+
     it('return the capitalized name') do
       contact.update!(name: 'john doe')
       expect(subject.name).to eq 'John Doe'
diff --git a/spec/drops/user_drop_spec.rb b/spec/drops/user_drop_spec.rb
index 1093ec4a0..34f8f5eaa 100644
--- a/spec/drops/user_drop_spec.rb
+++ b/spec/drops/user_drop_spec.rb
@@ -11,6 +11,11 @@ describe UserDrop do
       expect(subject.first_name).to eq 'John'
     end
 
+    it 'returns the single word as first name when name has only one word' do
+      user.update!(name: 'John')
+      expect(subject.first_name).to eq 'John'
+    end
+
     it('return the capitalized first name') do
       user.update!(name: 'john doe')
       expect(subject.first_name).to eq 'John'

From f9385a31fcda78cbf2ddd179414aa939e488b0ac Mon Sep 17 00:00:00 2001
From: Muhsin Keloth <muhsinkeramam@gmail.com>
Date: Fri, 5 Jun 2026 11:01:25 +0400
Subject: [PATCH 04/34] fix(api): allow agent bots to read conversations and
 manage labels (#14655)

Agent bots assigned to a conversation can now fetch that conversation's
details and manage its labels using their bot token. Previously these
two operations returned `Access to this endpoint is not authorized for
bots`, even though the same token worked for sending messages, updating
the conversation, and setting custom attributes.

Fixes
https://linear.app/chatwoot/issue/PLA-174/agent-bot-tokens-cannot-fetch-conversation-details-or-manage-labels

Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/controllers/concerns/access_token_auth_helper.rb | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/controllers/concerns/access_token_auth_helper.rb b/app/controllers/concerns/access_token_auth_helper.rb
index b7fc14e74..fb52a8eeb 100644
--- a/app/controllers/concerns/access_token_auth_helper.rb
+++ b/app/controllers/concerns/access_token_auth_helper.rb
@@ -1,8 +1,9 @@
 module AccessTokenAuthHelper
   BOT_ACCESSIBLE_ENDPOINTS = {
-    'api/v1/accounts/conversations' => %w[toggle_status toggle_typing_status toggle_priority create update custom_attributes],
+    'api/v1/accounts/conversations' => %w[show toggle_status toggle_typing_status toggle_priority create update custom_attributes],
     'api/v1/accounts/conversations/messages' => ['create'],
-    'api/v1/accounts/conversations/assignments' => ['create']
+    'api/v1/accounts/conversations/assignments' => ['create'],
+    'api/v1/accounts/conversations/labels' => %w[index create]
   }.freeze
 
   def ensure_access_token

From 73ba0b26e53d1ce94431f13f45c913ca77148edf Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Fri, 5 Jun 2026 14:06:45 +0530
Subject: [PATCH 05/34] fix(instagram): process webhook events after mutex
 retry exhaustion (#14647)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instagram webhooks use a Redis mutex to protect the first-message path
for a contact/account pair. When multiple webhook events for the same
Instagram contact arrive at nearly the same time, they can all enter the
“find or create” flow together.

There are two pieces involved:

`ContactInbox` maps the external Instagram scoped user id to a Chatwoot
contact inside an inbox. That side already has a unique `(inbox_id,
source_id)` index and retry handling, so duplicate contact-inbox
creation is mostly protected at the database layer.

`Conversation` creation is more fragile. The message builder looks for
an existing active conversation for the contact/inbox and creates one
when none is found. If two first-message jobs run concurrently, both can
see “no active conversation yet” and both can create a conversation. The
mutex exists to bump those jobs apart long enough for the first one to
create the conversation, so the next one appends to it instead of
creating a duplicate.

In production, the old behavior could turn that race dampener into a
drop path. Once `Webhooks::InstagramEventsJob` exhausted its lock
retries, ActiveJob stopped retrying with
`MutexApplicationJob::LockAcquisitionError`. Since ActiveJob retries are
not FIFO, later jobs could still win the lock while older jobs kept
getting deferred until exhaustion.

## Mutex Application Job Changes

This adds `retry_on_lock_conflict` as a small wrapper around the
existing `retry_on LockAcquisitionError` pattern.

The new API keeps the default behavior intact, but lets jobs explicitly
define what should happen after lock retry exhaustion:

```ruby
retry_on_lock_conflict wait: 1.second,
                       attempts: 3,
                       on_exhaustion: :process_without_lock
```

The fallback receives the original job arguments, so job classes do not
need to reach into ActiveJob internals like `arguments.first`.

## Instagram Fallback

Instagram now processes the webhook payload even after the mutex retry
window is exhausted.

This matches what the mutex was meant to do in the first place: bump
concurrent events apart long enough to avoid duplicate conversation
creation, not permanently block or drop webhook events. If a job cannot
acquire the lock after a few retries, it continues through the normal
Instagram processing path without the mutex.

## Retry And Lock Tuning

The Instagram lock retry window now uses deterministic backoff:

```ruby
retry_on_lock_conflict wait: ->(executions) { executions.seconds },
                       attempts: 3,
                       on_exhaustion: :process_without_lock
```

The lock TTL is also set explicitly:

```ruby
with_lock(key, 3.seconds)
```

This matters because Rails treats `attempts` as total executions, not
retries after the first execution. With a fixed `wait: 1.second` and
`attempts: 3`, the exhaustion handler can run roughly two seconds after
the first lock conflict. That is earlier than a 3-second lock TTL, so
the fallback could process without the lock while the original mutex is
still valid. That would reopen the duplicate-conversation race the lock
is meant to dampen.

Using a proc wait makes the timing predictable and avoids Rails jitter
for this retry path. The first conflict waits about 1 second, the second
waits about 2 seconds, and the final attempt happens around the 3-second
mark. That lines the retry window up with the Redis lock TTL before
falling back to `process_without_lock`.

The protected race window is intentionally small. `ContactInbox`
creation already has database uniqueness protection, while conversation
creation is the softer `find active conversation || create` path. We
only need to give the first job enough time to create the conversation
state that later jobs should reuse.

The mutex still does not preserve message order, and ActiveJob retries
are not FIFO. A longer retry window would mostly add latency for hot
Instagram contacts without making ordering more correct. After the lock
TTL has elapsed, processing without the lock is the better tradeoff than
dead-lettering customer messages.
---
 app/jobs/mutex_application_job.rb         | 13 ++++++
 app/jobs/webhooks/instagram_events_job.rb | 20 ++++++++-
 spec/jobs/mutex_application_job_spec.rb   | 53 +++++++++++++++++++++++
 3 files changed, 84 insertions(+), 2 deletions(-)

diff --git a/app/jobs/mutex_application_job.rb b/app/jobs/mutex_application_job.rb
index 58c7cbf36..4143eab2a 100644
--- a/app/jobs/mutex_application_job.rb
+++ b/app/jobs/mutex_application_job.rb
@@ -14,6 +14,19 @@
 class MutexApplicationJob < ApplicationJob
   class LockAcquisitionError < StandardError; end
 
+  def self.retry_on_lock_conflict(wait:, attempts:, on_exhaustion: :raise)
+    retry_on LockAcquisitionError, wait: wait, attempts: attempts do |job, error|
+      raise error if on_exhaustion == :raise
+
+      job.public_send(on_exhaustion, *job.arguments)
+    end
+  end
+
+  # Redis::LockManager#unlock is not owner-checked. If a job runs past the TTL,
+  # Redis can expire the key, a newer job can acquire it, and the older job can
+  # then delete the newer job's lock on unlock. Current mutex users treat locks as
+  # short race dampeners, so this is acceptable for now. Future iterations should
+  # move Redis::LockManager to token-checked unlocks.
   def with_lock(lock_key, timeout = Redis::LockManager::LOCK_TIMEOUT)
     lock_manager = Redis::LockManager.new
 
diff --git a/app/jobs/webhooks/instagram_events_job.rb b/app/jobs/webhooks/instagram_events_job.rb
index 6383daff8..c27363127 100644
--- a/app/jobs/webhooks/instagram_events_job.rb
+++ b/app/jobs/webhooks/instagram_events_job.rb
@@ -1,6 +1,14 @@
 class Webhooks::InstagramEventsJob < MutexApplicationJob
   queue_as :default
-  retry_on LockAcquisitionError, wait: 1.second, attempts: 8
+  # This lock is only a short race dampener for first-message conversation creation.
+  # ContactInbox creation is already protected by a unique index, but conversation
+  # lookup is `find active conversation || create`, so concurrent first messages from
+  # the same IG contact can create duplicate conversations.
+  #
+  # ActiveJob retries are not FIFO, so a longer retry window does not preserve message
+  # order. Use deterministic backoff so the final attempt happens after the 3s lock TTL,
+  # then process without the lock instead of dropping the webhook.
+  retry_on_lock_conflict wait: ->(executions) { executions.seconds }, attempts: 3, on_exhaustion: :process_without_lock
 
   # @return [Array] We will support further events like reaction or seen in future
   SUPPORTED_EVENTS = [:message, :read].freeze
@@ -9,11 +17,19 @@ class Webhooks::InstagramEventsJob < MutexApplicationJob
     @entries = entries
 
     key = format(::Redis::Alfred::IG_MESSAGE_MUTEX, sender_id: contact_instagram_id, ig_account_id: ig_account_id)
-    with_lock(key) do
+    # Keep the lock TTL just long enough for the first job to fetch profile data and
+    # create the contact/conversation. A longer TTL would add user-visible latency for
+    # hot contacts without giving us ordering guarantees.
+    with_lock(key, 3.seconds) do
       process_entries(entries)
     end
   end
 
+  def process_without_lock(entries)
+    Rails.logger.warn("[#{self.class.name}] Processing without lock after lock retry exhaustion")
+    process_entries(entries)
+  end
+
   # https://developers.facebook.com/docs/messenger-platform/instagram/features/webhook
   def process_entries(entries)
     entries.each do |entry|
diff --git a/spec/jobs/mutex_application_job_spec.rb b/spec/jobs/mutex_application_job_spec.rb
index 91a56407d..4c8fa3394 100644
--- a/spec/jobs/mutex_application_job_spec.rb
+++ b/spec/jobs/mutex_application_job_spec.rb
@@ -55,4 +55,57 @@ RSpec.describe MutexApplicationJob do
       end.to raise_error(StandardError)
     end
   end
+
+  describe '.retry_on_lock_conflict' do
+    let(:job_class) do
+      Class.new(described_class) do
+        retry_on_lock_conflict wait: 1.second, attempts: 1, on_exhaustion: :process_without_lock
+
+        attr_reader :fallback_args
+
+        def perform(lock_key, _payload)
+          with_lock(lock_key) { raise 'lock should not be acquired' }
+        end
+
+        def process_without_lock(lock_key, payload)
+          @fallback_args = [lock_key, payload]
+        end
+      end
+    end
+
+    let(:payload) { { 'message' => 'hello' } }
+
+    before do
+      stub_const('LockConflictTestJob', job_class)
+    end
+
+    it 'runs the configured handler with the original job arguments when lock retries are exhausted' do
+      allow(lock_manager).to receive(:lock).with(lock_key, Redis::LockManager::LOCK_TIMEOUT).and_return(false)
+
+      job = job_class.new(lock_key, payload)
+
+      expect { job.perform_now }.not_to raise_error
+      expect(job.fallback_args).to eq([lock_key, payload])
+    end
+
+    context 'without an exhaustion handler' do
+      let(:job_class) do
+        Class.new(described_class) do
+          retry_on_lock_conflict wait: 1.second, attempts: 1
+
+          def perform(lock_key)
+            with_lock(lock_key) { raise 'lock should not be acquired' }
+          end
+        end
+      end
+
+      it 'raises the lock acquisition error when retries are exhausted' do
+        allow(lock_manager).to receive(:lock).with(lock_key, Redis::LockManager::LOCK_TIMEOUT).and_return(false)
+
+        expect do
+          job_class.perform_now(lock_key)
+        end.to raise_error(StandardError) { |error| expect(error.class.name).to eq('MutexApplicationJob::LockAcquisitionError') }
+      end
+    end
+  end
 end

From 78a6b2457d9f0873fa6639678c3c0e248b0ce0dc Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Mon, 8 Jun 2026 13:13:20 +0530
Subject: [PATCH 06/34] refactor(onboarding): extract whatsapp and facebook
 channel connect into reusable composables (#14619)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extracts the Meta JS SDK logic for the WhatsApp embedded-signup and
Facebook Page connect flows out of their settings components into two
reusable composables. No behavior change — the settings inbox-creation
flows work exactly as before; this just makes the SDK orchestration
reusable (an upcoming onboarding PR consumes them) and adds unit
coverage.

## What changed
- `useWhatsappEmbeddedSignup` — owns the embedded-signup popup (SDK
load, FB.login, and the auth-code / postMessage race).
`WhatsappEmbeddedSignup.vue` now consumes it.
- `useFacebookPageConnect` — owns FB.login (page scopes) + page fetch,
with SDK preload split from login so the popup opens within the click's
activation window. `Facebook.vue` now consumes it.
- Adds unit specs for both composables.

## Related PRs

- https://github.com/chatwoot/chatwoot/pull/14569
- https://github.com/chatwoot/chatwoot/pull/14568
- https://github.com/chatwoot/chatwoot/pull/14567
- https://github.com/chatwoot/chatwoot/pull/14649
- https://github.com/chatwoot/chatwoot/pull/14565 (Primary onboarding
PR)
---
 .../spec/useFacebookPageConnect.spec.js       | 148 +++++++++++++
 .../spec/useWhatsappEmbeddedSignup.spec.js    | 208 ++++++++++++++++++
 .../composables/useFacebookPageConnect.js     |  81 +++++++
 .../composables/useWhatsappEmbeddedSignup.js  |  96 ++++++++
 .../settings/inbox/channels/Facebook.vue      | 109 ++-------
 .../inbox/channels/WhatsappEmbeddedSignup.vue | 183 +++------------
 6 files changed, 575 insertions(+), 250 deletions(-)
 create mode 100644 app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js
 create mode 100644 app/javascript/dashboard/composables/spec/useWhatsappEmbeddedSignup.spec.js
 create mode 100644 app/javascript/dashboard/composables/useFacebookPageConnect.js
 create mode 100644 app/javascript/dashboard/composables/useWhatsappEmbeddedSignup.js

diff --git a/app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js b/app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js
new file mode 100644
index 000000000..5d9edb993
--- /dev/null
+++ b/app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js
@@ -0,0 +1,148 @@
+import { useFacebookPageConnect } from '../useFacebookPageConnect';
+import { useMapGetter } from 'dashboard/composables/store';
+import ChannelApi from 'dashboard/api/channels';
+import { setupFacebookSdk } from 'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils';
+
+vi.mock('dashboard/composables/store', () => ({ useMapGetter: vi.fn() }));
+vi.mock('dashboard/api/channels', () => ({
+  default: { fetchFacebookPages: vi.fn() },
+}));
+vi.mock(
+  'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils',
+  () => ({ setupFacebookSdk: vi.fn() })
+);
+
+const flushPromises = () =>
+  new Promise(resolve => {
+    setTimeout(resolve, 0);
+  });
+
+const createDeferred = () => {
+  let resolve;
+  let reject;
+  const promise = new Promise((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+};
+
+const ACCOUNT_ID = 42;
+const PAGES = [
+  { id: 'p1', name: 'Page One', access_token: 'page-token-1' },
+  { id: 'p2', name: 'Page Two', access_token: 'page-token-2', exists: true },
+];
+
+const pagesResponse = {
+  data: { data: { page_details: PAGES, user_access_token: 'long-token' } },
+};
+
+// FB.login invokes its callback with the given response.
+const stubLogin = response => {
+  window.FB = { login: vi.fn(callback => callback(response)) };
+};
+
+const connected = {
+  status: 'connected',
+  authResponse: { accessToken: 'user-token' },
+};
+
+describe('useFacebookPageConnect', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    window.chatwootConfig = { fbAppId: 'fb-app', fbApiVersion: 'v22.0' };
+    useMapGetter.mockReturnValue({ value: ACCOUNT_ID });
+    setupFacebookSdk.mockResolvedValue();
+    ChannelApi.fetchFacebookPages.mockResolvedValue(pagesResponse);
+    stubLogin(connected);
+  });
+
+  it('resolves the user token and pages on a connected login', async () => {
+    const { loginAndFetchPages } = useFacebookPageConnect();
+
+    await expect(loginAndFetchPages()).resolves.toEqual({
+      userAccessToken: 'long-token',
+      pages: PAGES,
+    });
+    expect(setupFacebookSdk).toHaveBeenCalledWith('fb-app', 'v22.0');
+    expect(ChannelApi.fetchFacebookPages).toHaveBeenCalledWith(
+      'user-token',
+      ACCOUNT_ID
+    );
+    expect(window.FB.login).toHaveBeenCalledWith(expect.any(Function), {
+      scope: expect.stringContaining('pages_show_list'),
+    });
+  });
+
+  it('resolves null when the user is not authorized', async () => {
+    stubLogin({ status: 'not_authorized' });
+    const { loginAndFetchPages } = useFacebookPageConnect();
+
+    await expect(loginAndFetchPages()).resolves.toBeNull();
+    expect(ChannelApi.fetchFacebookPages).not.toHaveBeenCalled();
+  });
+
+  it('resolves null on an unknown login status', async () => {
+    stubLogin({ status: 'unknown' });
+    const { loginAndFetchPages } = useFacebookPageConnect();
+
+    await expect(loginAndFetchPages()).resolves.toBeNull();
+  });
+
+  it('rejects when fetching pages fails', async () => {
+    ChannelApi.fetchFacebookPages.mockRejectedValue(new Error('fetch failed'));
+    const { loginAndFetchPages } = useFacebookPageConnect();
+
+    await expect(loginAndFetchPages()).rejects.toThrow('fetch failed');
+  });
+
+  it('rejects when the SDK fails to load', async () => {
+    const error = new Error('script load failed');
+    error.name = 'ScriptLoaderError';
+    setupFacebookSdk.mockRejectedValue(error);
+    const { loginAndFetchPages } = useFacebookPageConnect();
+
+    await expect(loginAndFetchPages()).rejects.toThrow('script load failed');
+  });
+
+  it('ignores a second call while a run is in flight', async () => {
+    const pending = createDeferred();
+    ChannelApi.fetchFacebookPages.mockReturnValue(pending.promise);
+
+    const { loginAndFetchPages } = useFacebookPageConnect();
+    const first = loginAndFetchPages();
+    const second = loginAndFetchPages();
+
+    await expect(second).resolves.toBeNull();
+
+    pending.resolve(pagesResponse);
+    await first;
+    expect(window.FB.login).toHaveBeenCalledTimes(1);
+  });
+
+  it('toggles isAuthenticating across a run', async () => {
+    const pending = createDeferred();
+    ChannelApi.fetchFacebookPages.mockReturnValue(pending.promise);
+
+    const { isAuthenticating, loginAndFetchPages } = useFacebookPageConnect();
+    expect(isAuthenticating.value).toBe(false);
+
+    const result = loginAndFetchPages();
+    await flushPromises();
+    expect(isAuthenticating.value).toBe(true);
+
+    pending.resolve(pagesResponse);
+    await result;
+    expect(isAuthenticating.value).toBe(false);
+  });
+
+  it('preloads the SDK once and reuses it for login', async () => {
+    const { preloadSdk, loginAndFetchPages } = useFacebookPageConnect();
+
+    preloadSdk();
+    preloadSdk();
+    await loginAndFetchPages();
+
+    expect(setupFacebookSdk).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/app/javascript/dashboard/composables/spec/useWhatsappEmbeddedSignup.spec.js b/app/javascript/dashboard/composables/spec/useWhatsappEmbeddedSignup.spec.js
new file mode 100644
index 000000000..1efbad8a2
--- /dev/null
+++ b/app/javascript/dashboard/composables/spec/useWhatsappEmbeddedSignup.spec.js
@@ -0,0 +1,208 @@
+import { useWhatsappEmbeddedSignup } from '../useWhatsappEmbeddedSignup';
+import {
+  setupFacebookSdk,
+  initWhatsAppEmbeddedSignup,
+  createMessageHandler,
+} from 'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils';
+
+vi.mock(
+  'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils',
+  () => ({
+    setupFacebookSdk: vi.fn(),
+    initWhatsAppEmbeddedSignup: vi.fn(),
+    createMessageHandler: vi.fn(),
+    isValidBusinessData: vi.fn(data =>
+      Boolean(data && data.business_id && data.waba_id)
+    ),
+  })
+);
+
+const flushPromises = () =>
+  new Promise(resolve => {
+    setTimeout(resolve, 0);
+  });
+
+const createDeferred = () => {
+  let resolve;
+  let reject;
+  const promise = new Promise((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+};
+
+const VALID_BUSINESS = {
+  business_id: 'biz-1',
+  waba_id: 'waba-1',
+  phone_number_id: 'phone-1',
+};
+
+describe('useWhatsappEmbeddedSignup', () => {
+  // The mocked createMessageHandler captures the callback the composable
+  // registers, so tests can simulate Meta's WA_EMBEDDED_SIGNUP postMessages
+  // directly without the window-event + origin plumbing (that is covered by
+  // the utils' own tests).
+  let signupCallback;
+  let registeredListener;
+
+  const emit = data => signupCallback(data);
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    window.chatwootConfig = {
+      whatsappAppId: 'app-id',
+      whatsappConfigurationId: 'config-id',
+      whatsappApiVersion: 'v22.0',
+    };
+
+    setupFacebookSdk.mockResolvedValue();
+    createMessageHandler.mockImplementation(callback => {
+      signupCallback = callback;
+      registeredListener = () => {};
+      return registeredListener;
+    });
+  });
+
+  it('resolves credentials when the auth code arrives before the business data', async () => {
+    initWhatsAppEmbeddedSignup.mockResolvedValue('auth-code');
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    const result = runEmbeddedSignup();
+
+    await flushPromises(); // SDK setup + FB.login resolve the code first
+    emit({ event: 'FINISH', data: VALID_BUSINESS });
+
+    await expect(result).resolves.toEqual({
+      code: 'auth-code',
+      business_id: 'biz-1',
+      waba_id: 'waba-1',
+      phone_number_id: 'phone-1',
+    });
+    expect(setupFacebookSdk).toHaveBeenCalledWith('app-id', 'v22.0');
+    expect(initWhatsAppEmbeddedSignup).toHaveBeenCalledWith('config-id');
+  });
+
+  it('resolves credentials when the business data arrives before the auth code', async () => {
+    const code = createDeferred();
+    initWhatsAppEmbeddedSignup.mockReturnValue(code.promise);
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    const result = runEmbeddedSignup();
+
+    // Business data lands first, while FB.login is still pending.
+    emit({
+      event: 'FINISH_WHATSAPP_BUSINESS_APP_ONBOARDING',
+      data: VALID_BUSINESS,
+    });
+    code.resolve('late-code');
+
+    await expect(result).resolves.toEqual({
+      code: 'late-code',
+      business_id: 'biz-1',
+      waba_id: 'waba-1',
+      phone_number_id: 'phone-1',
+    });
+  });
+
+  it('defaults phone_number_id to an empty string when absent', async () => {
+    initWhatsAppEmbeddedSignup.mockResolvedValue('auth-code');
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    const result = runEmbeddedSignup();
+
+    await flushPromises();
+    emit({
+      event: 'FINISH',
+      data: { business_id: 'biz-1', waba_id: 'waba-1' },
+    });
+
+    await expect(result).resolves.toMatchObject({ phone_number_id: '' });
+  });
+
+  it('resolves null when FB.login is cancelled', async () => {
+    initWhatsAppEmbeddedSignup.mockRejectedValue(new Error('Login cancelled'));
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+
+    await expect(runEmbeddedSignup()).resolves.toBeNull();
+  });
+
+  it('resolves null on a CANCEL event', async () => {
+    initWhatsAppEmbeddedSignup.mockReturnValue(createDeferred().promise);
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    const result = runEmbeddedSignup();
+
+    emit({ event: 'CANCEL' });
+
+    await expect(result).resolves.toBeNull();
+  });
+
+  it('rejects with the Meta error message on an error event', async () => {
+    initWhatsAppEmbeddedSignup.mockReturnValue(createDeferred().promise);
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    const result = runEmbeddedSignup();
+
+    emit({ event: 'error', error_message: 'WABA not eligible' });
+
+    await expect(result).rejects.toThrow('WABA not eligible');
+  });
+
+  it('rejects when the business data is invalid', async () => {
+    initWhatsAppEmbeddedSignup.mockReturnValue(createDeferred().promise);
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    const result = runEmbeddedSignup();
+
+    emit({ event: 'FINISH', data: { business_id: 'biz-1' } }); // no waba_id
+
+    await expect(result).rejects.toThrow('Invalid business data');
+  });
+
+  it('rejects when the SDK or login fails for a non-cancel reason', async () => {
+    initWhatsAppEmbeddedSignup.mockRejectedValue(new Error('popup blocked'));
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+
+    await expect(runEmbeddedSignup()).rejects.toThrow('popup blocked');
+  });
+
+  it('ignores a second call while a run is in flight', async () => {
+    initWhatsAppEmbeddedSignup.mockResolvedValue('auth-code');
+
+    const { runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    const first = runEmbeddedSignup();
+    const second = runEmbeddedSignup();
+
+    await expect(second).resolves.toBeNull();
+
+    // Let the first run finish so it doesn't leak into the next test.
+    await flushPromises();
+    emit({ event: 'FINISH', data: VALID_BUSINESS });
+    await first;
+
+    expect(setupFacebookSdk).toHaveBeenCalledTimes(1);
+  });
+
+  it('toggles isAuthenticating and removes the listener once settled', async () => {
+    initWhatsAppEmbeddedSignup.mockResolvedValue('auth-code');
+    const removeSpy = vi.spyOn(window, 'removeEventListener');
+
+    const { isAuthenticating, runEmbeddedSignup } = useWhatsappEmbeddedSignup();
+    expect(isAuthenticating.value).toBe(false);
+
+    const result = runEmbeddedSignup();
+    expect(isAuthenticating.value).toBe(true);
+
+    await flushPromises();
+    emit({ event: 'FINISH', data: VALID_BUSINESS });
+    await result;
+
+    expect(isAuthenticating.value).toBe(false);
+    expect(removeSpy).toHaveBeenCalledWith('message', registeredListener);
+    removeSpy.mockRestore();
+  });
+});
diff --git a/app/javascript/dashboard/composables/useFacebookPageConnect.js b/app/javascript/dashboard/composables/useFacebookPageConnect.js
new file mode 100644
index 000000000..46a177d58
--- /dev/null
+++ b/app/javascript/dashboard/composables/useFacebookPageConnect.js
@@ -0,0 +1,81 @@
+import { ref } from 'vue';
+import { useMapGetter } from 'dashboard/composables/store';
+import ChannelApi from 'dashboard/api/channels';
+import { setupFacebookSdk } from 'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils';
+
+// Page-management + messaging scopes required to list pages and create a
+// Channel::FacebookPage inbox (mirrors the standalone settings flow).
+const FB_PAGE_SCOPES =
+  'pages_manage_metadata,business_management,pages_messaging,instagram_basic,pages_show_list,pages_read_engagement,instagram_manage_messages';
+
+// Headless half of the Facebook Page connect flow: load the Meta SDK, run
+// FB.login for page scopes, and fetch the user's pages. The caller owns the
+// page-picker UI and the channel creation, because choosing a page is an
+// interactive step (a user can manage several pages).
+//
+// Split into preloadSdk() + loginAndFetchPages() for popup safety: FB.login
+// opens a popup and needs the click's transient activation. Preloading the SDK
+// when the picker opens means the click-time `await` resolves within that
+// activation window; a cold load resolves on the script's `load` task seconds
+// later, after activation has expired, and the popup gets blocked.
+export function useFacebookPageConnect() {
+  const accountId = useMapGetter('getCurrentAccountId');
+  const isAuthenticating = ref(false);
+
+  let sdkSetupPromise = null;
+
+  // Idempotent — call this when the picker UI opens. A failed load clears the
+  // cache so a later attempt can retry instead of being stuck on a rejection.
+  const preloadSdk = () => {
+    if (!sdkSetupPromise) {
+      sdkSetupPromise = setupFacebookSdk(
+        window.chatwootConfig?.fbAppId,
+        window.chatwootConfig?.fbApiVersion
+      ).catch(error => {
+        sdkSetupPromise = null;
+        throw error;
+      });
+    }
+    return sdkSetupPromise;
+  };
+
+  // FB.login never rejects; resolve the user access token on success and null
+  // for any other status (closed popup, not_authorized, unknown).
+  const login = () =>
+    new Promise(resolve => {
+      window.FB.login(
+        response => {
+          resolve(
+            response.status === 'connected'
+              ? response.authResponse?.accessToken || null
+              : null
+          );
+        },
+        { scope: FB_PAGE_SCOPES }
+      );
+    });
+
+  // Resolves { userAccessToken, pages } on success, null when the user cancels,
+  // and rejects on SDK-load or page-fetch failure (the caller maps it to UI).
+  const loginAndFetchPages = async () => {
+    if (isAuthenticating.value) return null;
+    isAuthenticating.value = true;
+    try {
+      await preloadSdk();
+      const token = await login();
+      if (!token) return null;
+
+      const response = await ChannelApi.fetchFacebookPages(
+        token,
+        accountId.value
+      );
+      const { page_details: pages, user_access_token: userAccessToken } =
+        response.data.data;
+      return { userAccessToken, pages };
+    } finally {
+      isAuthenticating.value = false;
+    }
+  };
+
+  return { isAuthenticating, preloadSdk, loginAndFetchPages };
+}
diff --git a/app/javascript/dashboard/composables/useWhatsappEmbeddedSignup.js b/app/javascript/dashboard/composables/useWhatsappEmbeddedSignup.js
new file mode 100644
index 000000000..ead9c6d84
--- /dev/null
+++ b/app/javascript/dashboard/composables/useWhatsappEmbeddedSignup.js
@@ -0,0 +1,96 @@
+import { ref } from 'vue';
+import {
+  setupFacebookSdk,
+  initWhatsAppEmbeddedSignup,
+  createMessageHandler,
+  isValidBusinessData,
+} from 'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils';
+
+// Drives Meta's WhatsApp embedded-signup popup (Facebook JS SDK). FB.login()
+// resolves an auth `code` while the WABA identifiers (waba_id, phone_number_id)
+// arrive separately over a postMessage event — order isn't guaranteed, so we
+// hold both and resolve once both are present.
+//
+// `runEmbeddedSignup` returns the signup credentials; the caller exchanges them
+// for an inbox via `inboxes/createWhatsAppEmbeddedSignup` and owns its own UX
+// (alerts, navigation, etc). Resolves `null` when the user cancels the popup;
+// rejects on SDK load or signup errors. The window listener is scoped to a
+// single run, so this is safe to call from anywhere without lifecycle wiring.
+export function useWhatsappEmbeddedSignup() {
+  const isAuthenticating = ref(false);
+
+  const runEmbeddedSignup = () => {
+    if (isAuthenticating.value) return Promise.resolve(null);
+    isAuthenticating.value = true;
+
+    return new Promise((resolve, reject) => {
+      let authCode = null;
+      let businessData = null;
+      let settled = false;
+      let messageHandler;
+
+      const settle = (fn, value) => {
+        if (settled) return;
+        settled = true;
+        window.removeEventListener('message', messageHandler);
+        isAuthenticating.value = false;
+        fn(value);
+      };
+
+      // Both the auth code and the business data arrive asynchronously and in
+      // no fixed order; only resolve once we're holding both.
+      const resolveIfReady = () => {
+        if (!authCode || !businessData) return;
+        settle(resolve, {
+          code: authCode,
+          business_id: businessData.business_id,
+          waba_id: businessData.waba_id,
+          phone_number_id: businessData.phone_number_id || '',
+        });
+      };
+
+      messageHandler = createMessageHandler(data => {
+        if (
+          data.event === 'FINISH' ||
+          data.event === 'FINISH_WHATSAPP_BUSINESS_APP_ONBOARDING'
+        ) {
+          if (!isValidBusinessData(data.data)) {
+            settle(reject, new Error('Invalid business data'));
+            return;
+          }
+          businessData = data.data;
+          resolveIfReady();
+        } else if (data.event === 'CANCEL') {
+          settle(resolve, null);
+        } else if (data.event === 'error') {
+          settle(reject, new Error(data.error_message || 'Signup error'));
+        }
+      });
+
+      window.addEventListener('message', messageHandler);
+
+      (async () => {
+        try {
+          await setupFacebookSdk(
+            window.chatwootConfig?.whatsappAppId,
+            window.chatwootConfig?.whatsappApiVersion
+          );
+          authCode = await initWhatsAppEmbeddedSignup(
+            window.chatwootConfig?.whatsappConfigurationId
+          );
+          resolveIfReady();
+        } catch (error) {
+          // FB.login() rejects with 'Login cancelled' when the user dismisses
+          // the popup — treat it as a cancel rather than an error.
+          if (error.message === 'Login cancelled') {
+            settle(resolve, null);
+          } else {
+            settle(reject, error);
+          }
+        }
+      })();
+    });
+  };
+
+  return { isAuthenticating, runEmbeddedSignup };
+}
diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Facebook.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Facebook.vue
index 39e0df818..d08c7e607 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Facebook.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Facebook.vue
@@ -1,20 +1,16 @@
 <script>
-/* eslint-env browser */
-/* global FB */
 import { useVuelidate } from '@vuelidate/core';
 import { useAlert } from 'dashboard/composables';
-import { useAccount } from 'dashboard/composables/useAccount';
+import { useFacebookPageConnect } from 'dashboard/composables/useFacebookPageConnect';
 import { required } from '@vuelidate/validators';
 import LoadingState from 'dashboard/components/widgets/LoadingState.vue';
 
-import ChannelApi from '../../../../../api/channels';
 import PageHeader from '../../SettingsSubPageHeader.vue';
 import router from '../../../../index';
 import { useBranding } from 'shared/composables/useBranding';
 import NextButton from 'dashboard/components-next/button/Button.vue';
 import ComboBox from 'dashboard/components-next/combobox/ComboBox.vue';
 
-import { loadScript } from 'dashboard/helper/DOMHelpers';
 import * as Sentry from '@sentry/vue';
 
 export default {
@@ -25,11 +21,12 @@ export default {
     ComboBox,
   },
   setup() {
-    const { accountId } = useAccount();
     const { replaceInstallationName } = useBranding();
+    const { preloadSdk, loginAndFetchPages } = useFacebookPageConnect();
     return {
-      accountId,
       replaceInstallationName,
+      preloadSdk,
+      loginAndFetchPages,
       v$: useVuelidate(),
     };
   },
@@ -37,9 +34,7 @@ export default {
     return {
       isCreating: false,
       hasError: false,
-      omniauth_token: '',
       user_access_token: '',
-      channel: 'facebook',
       selectedPage: { name: null, id: null },
       pageName: '',
       pageList: [],
@@ -78,24 +73,29 @@ export default {
   },
 
   mounted() {
-    window.fbAsyncInit = this.runFBInit;
+    // Warm the SDK so the login click opens its popup within the gesture's
+    // activation window (see useFacebookPageConnect).
+    this.preloadSdk();
   },
 
   methods: {
     async startLogin() {
       this.hasLoginStarted = true;
       try {
-        // this will load the SDK in a promise, and resolve it when the sdk is loaded
-        // in case the SDK is already present, it will resolve immediately
-        await this.loadFBsdk();
-        this.runFBInit(); // run init anyway, `tryFBlogin` won't wait for `fbAsyncInit` otherwise.
-        this.tryFBlogin(); // make an attempt to login
+        const result = await this.loginAndFetchPages();
+        if (!result) {
+          // Cancelled popup / not authorized — surface a generic auth error.
+          this.hasError = true;
+          this.errorStateMessage = this.$t('INBOX_MGMT.DETAILS.ERROR_FB_AUTH');
+          this.errorStateDescription = '';
+          return;
+        }
+        this.pageList = result.pages;
+        this.user_access_token = result.userAccessToken;
       } catch (error) {
         if (error.name === 'ScriptLoaderError') {
-          // if the error was related to script loading, we show a toast
           useAlert(this.$t('INBOX_MGMT.DETAILS.ERROR_FB_LOADING'));
         } else {
-          // if the error was anything else, we capture it and show a toast
           Sentry.captureException(error);
           useAlert(this.$t('INBOX_MGMT.DETAILS.ERROR_FB_AUTH'));
         }
@@ -114,81 +114,6 @@ export default {
       this.v$.selectedPage.$touch();
     },
 
-    initChannelAuth(channel) {
-      if (channel === 'facebook') {
-        this.loadFBsdk();
-      }
-    },
-
-    runFBInit() {
-      FB.init({
-        appId: window.chatwootConfig.fbAppId,
-        xfbml: true,
-        version: window.chatwootConfig.fbApiVersion,
-        status: true,
-      });
-      window.fbSDKLoaded = true;
-      FB.AppEvents.logPageView();
-    },
-
-    async loadFBsdk() {
-      return loadScript('https://connect.facebook.net/en_US/sdk.js', {
-        id: 'facebook-jssdk',
-      });
-    },
-
-    tryFBlogin() {
-      FB.login(
-        response => {
-          this.hasError = false;
-          if (response.status === 'connected') {
-            this.fetchPages(response.authResponse.accessToken);
-          } else if (response.status === 'not_authorized') {
-            // eslint-disable-next-line no-console
-            console.error('FACEBOOK AUTH ERROR', response);
-            this.hasError = true;
-            // The person is logged into Facebook, but not your app.
-            this.errorStateMessage = this.$t(
-              'INBOX_MGMT.DETAILS.ERROR_FB_UNAUTHORIZED'
-            );
-            this.errorStateDescription = this.$t(
-              'INBOX_MGMT.DETAILS.ERROR_FB_UNAUTHORIZED_HELP'
-            );
-          } else {
-            // eslint-disable-next-line no-console
-            console.error('FACEBOOK AUTH ERROR', response);
-            this.hasError = true;
-            // The person is not logged into Facebook, so we're not sure if
-            // they are logged into this app or not.
-            this.errorStateMessage = this.$t(
-              'INBOX_MGMT.DETAILS.ERROR_FB_AUTH'
-            );
-            this.errorStateDescription = '';
-          }
-        },
-        {
-          scope:
-            'pages_manage_metadata,business_management,pages_messaging,instagram_basic,pages_show_list,pages_read_engagement,instagram_manage_messages',
-        }
-      );
-    },
-
-    async fetchPages(_token) {
-      try {
-        const response = await ChannelApi.fetchFacebookPages(
-          _token,
-          this.accountId
-        );
-        const {
-          data: { data },
-        } = response;
-        this.pageList = data.page_details;
-        this.user_access_token = data.user_access_token;
-      } catch (error) {
-        // Ignore error
-      }
-    },
-
     channelParams() {
       return {
         user_access_token: this.user_access_token,
diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
index 668e0709a..3dda0ad8e 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
@@ -1,21 +1,16 @@
 <script setup>
-import { ref, computed, onMounted, onBeforeUnmount } from 'vue';
+import { ref, computed } from 'vue';
 import { useStore } from 'vuex';
 import { useRouter } from 'vue-router';
 import { useI18n, I18nT } from 'vue-i18n';
 import { useAlert } from 'dashboard/composables';
+import { useWhatsappEmbeddedSignup } from 'dashboard/composables/useWhatsappEmbeddedSignup';
 import Icon from 'next/icon/Icon.vue';
 import NextButton from 'next/button/Button.vue';
 import LoadingState from 'dashboard/components/widgets/LoadingState.vue';
 import InboxesAPI from 'dashboard/api/inboxes';
 import { parseAPIErrorResponse } from 'dashboard/store/utils/api';
 import globalConstants from 'dashboard/constants/globals.js';
-import {
-  setupFacebookSdk,
-  initWhatsAppEmbeddedSignup,
-  createMessageHandler,
-  isValidBusinessData,
-} from './whatsapp/utils';
 
 const props = defineProps({
   enableCallingOnComplete: {
@@ -27,15 +22,10 @@ const props = defineProps({
 const store = useStore();
 const router = useRouter();
 const { t } = useI18n();
+const { isAuthenticating, runEmbeddedSignup } = useWhatsappEmbeddedSignup();
 
-// State
-const fbSdkLoaded = ref(false);
 const isProcessing = ref(false);
 const processingMessage = ref('');
-const authCodeReceived = ref(false);
-const authCode = ref(null);
-const businessData = ref(null);
-const isAuthenticating = ref(false);
 
 const benefits = computed(() => [
   {
@@ -54,25 +44,6 @@ const benefits = computed(() => [
 
 const showLoader = computed(() => isAuthenticating.value || isProcessing.value);
 
-// Error handling
-const handleSignupError = data => {
-  isProcessing.value = false;
-  authCodeReceived.value = false;
-  isAuthenticating.value = false;
-
-  const errorMessage =
-    data.error ||
-    data.message ||
-    t('INBOX_MGMT.ADD.WHATSAPP.API.ERROR_MESSAGE');
-  useAlert(errorMessage);
-};
-
-const handleSignupCancellation = () => {
-  isProcessing.value = false;
-  authCodeReceived.value = false;
-  isAuthenticating.value = false;
-};
-
 const enableCallingForInbox = async inboxId => {
   try {
     await InboxesAPI.enableWhatsappCalling(inboxId);
@@ -86,14 +57,12 @@ const enableCallingForInbox = async inboxId => {
 const handleSignupSuccess = async inboxData => {
   if (inboxData && inboxData.id) {
     if (props.enableCallingOnComplete) {
-      isProcessing.value = true;
       processingMessage.value = t(
         'INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.ENABLING_CALLING'
       );
       await enableCallingForInbox(inboxData.id);
     }
     isProcessing.value = false;
-    isAuthenticating.value = false;
     useAlert(t('INBOX_MGMT.FINISH.MESSAGE'));
     router.replace({
       name: 'settings_inboxes_add_agents',
@@ -104,7 +73,6 @@ const handleSignupSuccess = async inboxData => {
     });
   } else {
     isProcessing.value = false;
-    isAuthenticating.value = false;
     useAlert(t('INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.SUCCESS_FALLBACK'));
     router.replace({
       name: 'settings_inbox_list',
@@ -112,12 +80,21 @@ const handleSignupSuccess = async inboxData => {
   }
 };
 
-// Signup flow
-const completeSignupFlow = async businessDataParam => {
-  if (!authCodeReceived.value || !authCode.value) {
-    handleSignupError({
-      error: t('INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.AUTH_NOT_COMPLETED'),
-    });
+const launchEmbeddedSignup = async () => {
+  let credentials;
+  try {
+    credentials = await runEmbeddedSignup();
+  } catch (error) {
+    useAlert(
+      error.message ||
+        t('INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.SDK_LOAD_ERROR')
+    );
+    return;
+  }
+
+  // Resolves null when the user dismisses the Meta popup.
+  if (!credentials) {
+    useAlert(t('INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.CANCELLED'));
     return;
   }
 
@@ -125,130 +102,20 @@ const completeSignupFlow = async businessDataParam => {
   processingMessage.value = t(
     'INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.PROCESSING'
   );
-
   try {
-    const params = {
-      code: authCode.value,
-      business_id: businessDataParam.business_id,
-      waba_id: businessDataParam.waba_id,
-      phone_number_id: businessDataParam?.phone_number_id || '',
-    };
-
-    const responseData = await store.dispatch(
+    const inboxData = await store.dispatch(
       'inboxes/createWhatsAppEmbeddedSignup',
-      params
+      credentials
     );
-
-    authCode.value = null;
-    handleSignupSuccess(responseData);
+    await handleSignupSuccess(inboxData);
   } catch (error) {
-    const errorMessage =
+    isProcessing.value = false;
+    useAlert(
       parseAPIErrorResponse(error) ||
-      t('INBOX_MGMT.ADD.WHATSAPP.API.ERROR_MESSAGE');
-    handleSignupError({ error: errorMessage });
+        t('INBOX_MGMT.ADD.WHATSAPP.API.ERROR_MESSAGE')
+    );
   }
 };
-
-// Message handling
-const handleEmbeddedSignupData = async data => {
-  if (
-    data.event === 'FINISH' ||
-    data.event === 'FINISH_WHATSAPP_BUSINESS_APP_ONBOARDING'
-  ) {
-    const businessDataLocal = data.data;
-
-    if (isValidBusinessData(businessDataLocal)) {
-      businessData.value = businessDataLocal;
-      if (authCodeReceived.value && authCode.value) {
-        await completeSignupFlow(businessDataLocal);
-      } else {
-        processingMessage.value = t(
-          'INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.WAITING_FOR_AUTH'
-        );
-      }
-    } else {
-      handleSignupError({
-        error: t(
-          'INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.INVALID_BUSINESS_DATA'
-        ),
-      });
-    }
-  } else if (data.event === 'CANCEL') {
-    handleSignupCancellation();
-  } else if (data.event === 'error') {
-    handleSignupError({
-      error:
-        data.error_message ||
-        t('INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.SIGNUP_ERROR'),
-      error_id: data.error_id,
-      session_id: data.session_id,
-    });
-  }
-};
-
-const handleSignupMessage = createMessageHandler(handleEmbeddedSignupData);
-
-const launchEmbeddedSignup = async () => {
-  try {
-    isAuthenticating.value = true;
-    processingMessage.value = t(
-      'INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.AUTH_PROCESSING'
-    );
-
-    await setupFacebookSdk(
-      window.chatwootConfig?.whatsappAppId,
-      window.chatwootConfig?.whatsappApiVersion
-    );
-    fbSdkLoaded.value = true;
-
-    const code = await initWhatsAppEmbeddedSignup(
-      window.chatwootConfig?.whatsappConfigurationId
-    );
-
-    authCode.value = code;
-    authCodeReceived.value = true;
-    processingMessage.value = t(
-      'INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.WAITING_FOR_BUSINESS_INFO'
-    );
-
-    if (businessData.value) {
-      completeSignupFlow(businessData.value);
-    }
-  } catch (error) {
-    if (error.message === 'Login cancelled') {
-      isProcessing.value = false;
-      isAuthenticating.value = false;
-      useAlert(t('INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.CANCELLED'));
-    } else {
-      handleSignupError({
-        error:
-          error.message ||
-          t('INBOX_MGMT.ADD.WHATSAPP.EMBEDDED_SIGNUP.SDK_LOAD_ERROR'),
-      });
-    }
-  }
-};
-
-// Lifecycle
-const setupMessageListener = () => {
-  window.addEventListener('message', handleSignupMessage);
-};
-
-const cleanupMessageListener = () => {
-  window.removeEventListener('message', handleSignupMessage);
-};
-
-const initialize = () => {
-  setupMessageListener();
-};
-
-onMounted(() => {
-  initialize();
-});
-
-onBeforeUnmount(() => {
-  cleanupMessageListener();
-});
 </script>
 
 <template>

From 45f4b423ae7269dab01cbea6a31cab6d330058fe Mon Sep 17 00:00:00 2001
From: Aakash Bakhle <48802744+aakashb95@users.noreply.github.com>
Date: Mon, 8 Jun 2026 13:37:21 +0530
Subject: [PATCH 07/34] fix: captain usage for BYOK OpenAI tasks (#14587)

# Pull Request Template

## Description

Fixes:
https://linear.app/chatwoot/issue/CW-7167/label-suggestions-bad-ux

## Type of change

Please delete options that are not relevant.

- [x] Bug fix (non-breaking change which fixes an issue)

## How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration.


## Checklist:

- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my code
- [ ] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules
---
 .../captain/llm/translate_query_service.rb    |  4 ++
 .../conversation_completion_service.rb        |  4 ++
 lib/captain/base_task_service.rb              | 21 ++++---
 lib/captain/csat_utility_analysis_service.rb  |  4 ++
 lib/captain/follow_up_service.rb              |  4 ++
 lib/captain/label_suggestion_service.rb       |  4 ++
 lib/captain/reply_suggestion_service.rb       |  4 ++
 lib/captain/rewrite_service.rb                |  4 ++
 lib/captain/summary_service.rb                |  4 ++
 .../lib/captain/base_task_service_spec.rb     | 63 +++++++++++++++++++
 spec/lib/captain/base_task_service_spec.rb    | 56 ++++++++++++++++-
 .../csat_utility_analysis_service_spec.rb     | 23 +++++++
 12 files changed, 185 insertions(+), 10 deletions(-)

diff --git a/enterprise/app/services/captain/llm/translate_query_service.rb b/enterprise/app/services/captain/llm/translate_query_service.rb
index 93f68b05b..3e05244d3 100644
--- a/enterprise/app/services/captain/llm/translate_query_service.rb
+++ b/enterprise/app/services/captain/llm/translate_query_service.rb
@@ -32,6 +32,10 @@ class Captain::Llm::TranslateQueryService < Captain::BaseTaskService
     @llm_credential ||= system_llm_credential
   end
 
+  def counts_toward_usage?
+    false
+  end
+
   def query_in_target_language?(query)
     detector = CLD3::NNetLanguageIdentifier.new(0, 1000)
     result = detector.find_language(query)
diff --git a/enterprise/lib/captain/conversation_completion_service.rb b/enterprise/lib/captain/conversation_completion_service.rb
index aa40e8000..c45559165 100644
--- a/enterprise/lib/captain/conversation_completion_service.rb
+++ b/enterprise/lib/captain/conversation_completion_service.rb
@@ -62,6 +62,10 @@ class Captain::ConversationCompletionService < Captain::BaseTaskService
     @llm_credential ||= system_llm_credential
   end
 
+  def counts_toward_usage?
+    false
+  end
+
   def event_name
     'captain.conversation_completion'
   end
diff --git a/lib/captain/base_task_service.rb b/lib/captain/base_task_service.rb
index a043d38e2..d382204a5 100644
--- a/lib/captain/base_task_service.rb
+++ b/lib/captain/base_task_service.rb
@@ -150,13 +150,12 @@ class Captain::BaseTaskService
   end
 
   # Extension point consulted by the Enterprise quota wrapper. Subclasses
-  # whose calls run on the operator's key (e.g. internal/onboarding tasks)
-  # should override this to return false. When false, the wrapper neither
-  # blocks the call on an exhausted captain_responses quota nor decrements
-  # it on success — the call participates in the quota system in neither
-  # direction.
+  # whose calls should not consume captain_responses should override this to
+  # return false. When false, the wrapper neither blocks the call on an
+  # exhausted captain_responses quota nor decrements it on success — the call
+  # participates in the quota system in neither direction.
   def counts_toward_usage?
-    true
+    llm_credential&.dig(:source) != :hook
   end
 
   def api_key_configured?
@@ -168,7 +167,15 @@ class Captain::BaseTaskService
   end
 
   def llm_credential
-    @llm_credential ||= hook_llm_credential || system_llm_credential
+    @llm_credential ||= if use_account_openai_hook?
+                          hook_llm_credential || system_llm_credential
+                        else
+                          system_llm_credential
+                        end
+  end
+
+  def use_account_openai_hook?
+    false
   end
 
   def hook_llm_credential
diff --git a/lib/captain/csat_utility_analysis_service.rb b/lib/captain/csat_utility_analysis_service.rb
index e04a98a7f..7aab18e6c 100644
--- a/lib/captain/csat_utility_analysis_service.rb
+++ b/lib/captain/csat_utility_analysis_service.rb
@@ -63,4 +63,8 @@ class Captain::CsatUtilityAnalysisService < Captain::BaseTaskService
   def event_name
     'csat_utility_analysis'
   end
+
+  def use_account_openai_hook?
+    true
+  end
 end
diff --git a/lib/captain/follow_up_service.rb b/lib/captain/follow_up_service.rb
index f02ba9408..c4c1225be 100644
--- a/lib/captain/follow_up_service.rb
+++ b/lib/captain/follow_up_service.rb
@@ -103,4 +103,8 @@ class Captain::FollowUpService < Captain::BaseTaskService
   def event_name
     'follow_up'
   end
+
+  def use_account_openai_hook?
+    true
+  end
 end
diff --git a/lib/captain/label_suggestion_service.rb b/lib/captain/label_suggestion_service.rb
index 02f8bd89a..a0e030963 100644
--- a/lib/captain/label_suggestion_service.rb
+++ b/lib/captain/label_suggestion_service.rb
@@ -87,6 +87,10 @@ class Captain::LabelSuggestionService < Captain::BaseTaskService
     'label_suggestion'
   end
 
+  def use_account_openai_hook?
+    true
+  end
+
   def build_follow_up_context?
     false
   end
diff --git a/lib/captain/reply_suggestion_service.rb b/lib/captain/reply_suggestion_service.rb
index 2daf0615c..039bdcf26 100644
--- a/lib/captain/reply_suggestion_service.rb
+++ b/lib/captain/reply_suggestion_service.rb
@@ -37,6 +37,10 @@ class Captain::ReplySuggestionService < Captain::BaseTaskService
   def event_name
     'reply_suggestion'
   end
+
+  def use_account_openai_hook?
+    true
+  end
 end
 
 Captain::ReplySuggestionService.prepend_mod_with('Captain::ReplySuggestionService')
diff --git a/lib/captain/rewrite_service.rb b/lib/captain/rewrite_service.rb
index 3a217d3c6..6f880e775 100644
--- a/lib/captain/rewrite_service.rb
+++ b/lib/captain/rewrite_service.rb
@@ -56,4 +56,8 @@ class Captain::RewriteService < Captain::BaseTaskService
   def event_name
     operation
   end
+
+  def use_account_openai_hook?
+    true
+  end
 end
diff --git a/lib/captain/summary_service.rb b/lib/captain/summary_service.rb
index 030c0e510..f06aa42ca 100644
--- a/lib/captain/summary_service.rb
+++ b/lib/captain/summary_service.rb
@@ -24,4 +24,8 @@ class Captain::SummaryService < Captain::BaseTaskService
   def event_name
     'summarize'
   end
+
+  def use_account_openai_hook?
+    true
+  end
 end
diff --git a/spec/enterprise/lib/captain/base_task_service_spec.rb b/spec/enterprise/lib/captain/base_task_service_spec.rb
index b3dc473eb..fb970f726 100644
--- a/spec/enterprise/lib/captain/base_task_service_spec.rb
+++ b/spec/enterprise/lib/captain/base_task_service_spec.rb
@@ -32,6 +32,7 @@ RSpec.describe Captain::BaseTaskService, type: :model do
     before do
       allow(account).to receive(:feature_enabled?).and_call_original
       allow(account).to receive(:feature_enabled?).with('captain_tasks').and_return(true)
+      allow(Integrations::Openai::KeyValidator).to receive(:valid?).and_return(true)
     end
 
     context 'when usage limit is exceeded' do
@@ -111,6 +112,68 @@ RSpec.describe Captain::BaseTaskService, type: :model do
       end.to change { account.custom_attributes['captain_responses_usage'].to_i }.by(1)
     end
 
+    context 'when account has its own OpenAI hook key' do
+      before do
+        create(:integrations_hook, :openai, account: account, settings: { 'api_key' => 'customer-own-key' })
+      end
+
+      it 'still increments usage for services that do not opt into BYOK' do
+        expect(account).to receive(:increment_response_usage)
+        service.perform
+      end
+
+      context 'when the captain_responses quota is exhausted on Cloud' do
+        before do
+          allow(ChatwootApp).to receive(:chatwoot_cloud?).and_return(true)
+          allow(account).to receive(:usage_limits).and_return({
+                                                                captain: { responses: { current_available: 0 } }
+                                                              })
+        end
+
+        it 'returns usage limit exceeded error for services that do not opt into BYOK' do
+          result = service.perform
+          expect(result[:error]).to eq(I18n.t('captain.copilot_limit'))
+          expect(result[:error_code]).to eq(429)
+        end
+      end
+    end
+
+    context 'when subclass opts into account OpenAI hook usage' do
+      let(:test_service_class) do
+        result = perform_result
+        klass = Class.new(described_class) do
+          define_method(:perform) { result }
+          define_method(:event_name) { 'test_event' }
+          define_method(:use_account_openai_hook?) { true }
+        end
+        klass.prepend(Enterprise::Captain::BaseTaskService)
+        klass
+      end
+
+      before do
+        create(:integrations_hook, :openai, account: account, settings: { 'api_key' => 'customer-own-key' })
+      end
+
+      it 'does not increment usage on a successful result' do
+        expect(account).not_to receive(:increment_response_usage)
+        service.perform
+      end
+
+      context 'when the captain_responses quota is exhausted on Cloud' do
+        before do
+          allow(ChatwootApp).to receive(:chatwoot_cloud?).and_return(true)
+          allow(account).to receive(:usage_limits).and_return({
+                                                                captain: { responses: { current_available: 0 } }
+                                                              })
+        end
+
+        it 'bypasses the 429 gate and returns the underlying result' do
+          result = service.perform
+          expect(result).to eq(perform_result)
+        end
+      end
+    end
+
     context 'when captain is disabled' do
       before do
         allow(account).to receive(:feature_enabled?).with('captain_tasks').and_return(false)
diff --git a/spec/lib/captain/base_task_service_spec.rb b/spec/lib/captain/base_task_service_spec.rb
index 5112e47ed..34c889967 100644
--- a/spec/lib/captain/base_task_service_spec.rb
+++ b/spec/lib/captain/base_task_service_spec.rb
@@ -260,11 +260,12 @@ RSpec.describe Captain::BaseTaskService do
       expect(result[:request_messages]).to eq(messages)
     end
 
-    it 'does not track exceptions for account hook failures' do
+    it 'tracks exceptions against the system key when an account hook exists' do
       create(:integrations_hook, :openai, account: account, settings: { 'api_key' => 'hook-key' })
 
-      expect(Llm::Config).to receive(:with_api_key).with('hook-key', api_base: anything).and_raise(error)
-      expect(ChatwootExceptionTracker).not_to receive(:new)
+      expect(Llm::Config).to receive(:with_api_key).with('test-key', api_base: anything).and_raise(error)
+      expect(ChatwootExceptionTracker).to receive(:new).with(error, account: account).and_return(exception_tracker)
+      expect(exception_tracker).to receive(:capture_exception)
 
       result = service.send(:make_api_call, model: model, messages: messages)
 
@@ -279,11 +280,60 @@ RSpec.describe Captain::BaseTaskService do
 
       before { hook }
 
+      it 'uses system api key by default' do
+        expect(service.send(:api_key)).to eq('test-key')
+      end
+    end
+
+    context 'when subclass opts into account OpenAI hook usage' do
+      let(:test_service_class) do
+        Class.new(described_class) do
+          def event_name
+            'test_event'
+          end
+
+          def use_account_openai_hook?
+            true
+          end
+        end
+      end
+
+      before do
+        create(:integrations_hook, account: account, app_id: 'openai', status: 'enabled', settings: { 'api_key' => 'hook-key' })
+      end
+
       it 'uses api key from hook' do
         expect(service.send(:api_key)).to eq('hook-key')
       end
     end
 
+    it 'uses account OpenAI hook for editor task services' do
+      create(:integrations_hook, account: account, app_id: 'openai', status: 'enabled', settings: { 'api_key' => 'hook-key' })
+      user = create(:user, account: account)
+      follow_up_context = {
+        'event_name' => 'professional',
+        'original_context' => 'Original text',
+        'last_response' => 'Last response'
+      }
+
+      editor_services = [
+        Captain::RewriteService.new(account: account, content: 'Text', operation: 'improve', conversation_display_id: conversation.display_id),
+        Captain::SummaryService.new(account: account, conversation_display_id: conversation.display_id),
+        Captain::ReplySuggestionService.new(account: account, conversation_display_id: conversation.display_id, user: user),
+        Captain::LabelSuggestionService.new(account: account, conversation_display_id: conversation.display_id),
+        Captain::FollowUpService.new(
+          account: account,
+          follow_up_context: follow_up_context,
+          user_message: 'Make it shorter',
+          conversation_display_id: conversation.display_id
+        )
+      ]
+
+      editor_services.each do |editor_service|
+        expect(editor_service.send(:api_key)).to eq('hook-key')
+      end
+    end
+
     context 'when openai hook is not configured' do
       it 'uses system api key' do
         expect(service.send(:api_key)).to eq('test-key')
diff --git a/spec/lib/captain/csat_utility_analysis_service_spec.rb b/spec/lib/captain/csat_utility_analysis_service_spec.rb
index e4e980e01..34e0c9ece 100644
--- a/spec/lib/captain/csat_utility_analysis_service_spec.rb
+++ b/spec/lib/captain/csat_utility_analysis_service_spec.rb
@@ -4,6 +4,11 @@ RSpec.describe Captain::CsatUtilityAnalysisService do
   let(:account) { create(:account) }
   let(:service) { described_class.new(account: account, message: 'Test message', language: 'en', baseline: {}) }
 
+  before do
+    create(:installation_config, name: 'CAPTAIN_OPEN_AI_API_KEY', value: 'test-key')
+    allow(Integrations::Openai::KeyValidator).to receive(:valid?).and_return(true)
+  end
+
   describe '#perform' do
     before do
       allow(account).to receive(:feature_enabled?).and_call_original
@@ -21,4 +26,22 @@ RSpec.describe Captain::CsatUtilityAnalysisService do
       expect(result[:message]).to eq('{"classification":"LIKELY_UTILITY","optimized_message":"Utility-safe message"}')
     end
   end
+
+  describe '#api_key' do
+    context 'when account has an OpenAI hook key' do
+      before do
+        create(:integrations_hook, :openai, account: account, settings: { 'api_key' => 'customer-own-key' })
+      end
+
+      it 'uses the account hook key' do
+        expect(service.send(:api_key)).to eq('customer-own-key')
+      end
+    end
+
+    context 'when account does not have an OpenAI hook key' do
+      it 'uses the system key' do
+        expect(service.send(:api_key)).to eq('test-key')
+      end
+    end
+  end
 end

From 7718f2a62c19af433f16ad56a31d3267ec2b4bed Mon Sep 17 00:00:00 2001
From: Sojan Jose <sojan@pepalo.com>
Date: Mon, 8 Jun 2026 15:40:43 +0530
Subject: [PATCH 08/34] fix: update puma for security advisories (#14670)

Updates Puma to the patched 7.2 line so bundle-audit no longer reports
the high-severity Puma advisories affecting the current lockfile.

Fixes: CVE-2026-47736, CVE-2026-47737
Closes: N/A

## Why

The refreshed ruby-advisory-db flagged Puma 6.4.3 for two high-severity
PROXY Protocol v1 parser advisories. The advisory-recommended fixed
versions are the Puma 7.2 patch line or Puma 8, so this keeps the update
to the smaller fixed line.

## What changed

- Constrains Puma to `~> 7.2`, `>= 7.2.1`
- Updates the lockfile from Puma 6.4.3 to 7.2.1
- Updates nio4r from 2.7.3 to 2.7.5 as the transitive Puma dependency

## Validation

- `bundle exec bundle-audit check` -> `No vulnerabilities found`
- `bundle exec rails runner 'puts "Rails #{Rails.version}; Puma
#{Puma::Const::PUMA_VERSION}; Rack #{Rack.release}"'` -> `Rails 7.1.5.2;
Puma 7.2.1; Rack 3.2.6`
- `bundle exec rails server -p 3051` booted Puma 7.2.1 successfully
- Smoke checked `/`, `/api`, unknown-route 404, and `/cable` WebSocket
upgrade
---
 Gemfile      | 2 +-
 Gemfile.lock | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile b/Gemfile
index 680a0738b..7533cf3cf 100644
--- a/Gemfile
+++ b/Gemfile
@@ -76,7 +76,7 @@ gem 'faraday_middleware-aws-sigv4'
 ##--- gems for server & infra configuration ---##
 gem 'dotenv-rails', '>= 3.0.0'
 gem 'foreman'
-gem 'puma'
+gem 'puma', '~> 7.2', '>= 7.2.1'
 gem 'vite_rails'
 # metrics on heroku
 gem 'barnes'
diff --git a/Gemfile.lock b/Gemfile.lock
index 7151d0ff1..ad2a96921 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -593,7 +593,7 @@ GEM
       sidekiq
     newrelic_rpm (9.6.0)
       base64
-    nio4r (2.7.3)
+    nio4r (2.7.5)
     nokogiri (1.19.3)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
@@ -682,7 +682,7 @@ GEM
     pry-rails (0.3.9)
       pry (>= 0.10.4)
     public_suffix (7.0.5)
-    puma (6.4.3)
+    puma (7.2.1)
       nio4r (~> 2.0)
     pundit (2.3.0)
       activesupport (>= 3.0.0)
@@ -1132,7 +1132,7 @@ DEPENDENCIES
   pgvector
   procore-sift
   pry-rails
-  puma
+  puma (~> 7.2, >= 7.2.1)
   pundit
   rack-attack (>= 6.7.0)
   rack-cors (= 2.0.0)

From e919a2cef5fd69d84da4a03f8c430ba9051084b6 Mon Sep 17 00:00:00 2001
From: Sony Mathew <sony@chatwoot.com>
Date: Mon, 8 Jun 2026 16:00:17 +0530
Subject: [PATCH 09/34] feat: add contact filter for conversations (#14629)

# Pull Request Template

## Description

Adds a Contact condition to the conversation advanced filter so agents
can search for an existing contact and filter conversations by
`conversations.contact_id`.

Fixes
[CW-7239](https://linear.app/chatwoot/issue/CW-7239/contact-filter-for-conversations)

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality not to work as expected)
- [ ] This change requires a documentation update

## How Has This Been Tested?

- `eval "$(rbenv init -)" && bundle exec rspec
spec/services/conversations/filter_service_spec.rb`
- `pnpm exec vitest --no-watch --no-cache --no-coverage --logHeapUsage
app/javascript/dashboard/components-next/filter/helper/filterHelper.spec.js
app/javascript/dashboard/store/modules/conversations/helpers/specs/filterHelpers.spec.js
app/javascript/dashboard/helper/specs/customViewsHelper.spec.js
app/javascript/dashboard/helper/specs/filterQueryGenerator.spec.js`
- `pnpm eslint`
- `eval "$(rbenv init -)" && bundle exec rubocop
spec/services/conversations/filter_service_spec.rb`

## Checklist:

- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my code
- [x] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules

---------

Co-authored-by: iamsivin <iamsivin@gmail.com>
Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
---
 .../helpers/composeConversationHelper.js      |   7 +-
 .../components-next/filter/ConditionRow.vue   |  46 +++++++-
 .../filter/helper/filterHelper.js             |   1 +
 .../filter/helper/filterHelper.spec.js        |  89 +++++++++++++++
 .../filter/inputs/SingleSelect.vue            |  34 +++++-
 .../components-next/filter/provider.js        |  39 ++++++-
 .../dashboard/components/ChatList.vue         |   4 +
 .../conversation/advancedFilterItems/index.js |  12 ++
 .../dashboard/helper/customViewsHelper.js     |  10 ++
 .../helper/specs/customViewsHelper.spec.js    |  35 ++++++
 .../helper/specs/filterQueryGenerator.spec.js |  21 ++++
 .../i18n/locale/en/advancedFilters.json       |   3 +
 .../conversations/helpers/filterHelpers.js    |   6 +
 .../helpers/specs/filterHelpers.spec.js       |  26 +++++
 .../dashboard/store/modules/customViews.js    |  14 ++-
 .../modules/specs/customViews/actions.spec.js |  30 ++++-
 .../modules/specs/customViews/fixtures.js     |  15 +++
 .../modules/specs/customViews/getters.spec.js |  18 ++-
 lib/filters/filter_keys.yml                   |   6 +
 .../conversations/filter_service_spec.rb      | 108 +++++++++++++++---
 20 files changed, 496 insertions(+), 28 deletions(-)

diff --git a/app/javascript/dashboard/components-next/NewConversation/helpers/composeConversationHelper.js b/app/javascript/dashboard/components-next/NewConversation/helpers/composeConversationHelper.js
index 5c002d9bd..8e933cd84 100644
--- a/app/javascript/dashboard/components-next/NewConversation/helpers/composeConversationHelper.js
+++ b/app/javascript/dashboard/components-next/NewConversation/helpers/composeConversationHelper.js
@@ -182,7 +182,10 @@ const MIN_SEARCH_LENGTH = 2;
 export const createContactSearcher = () => {
   let controller = null;
 
-  return async (query, { skipMinLength = false } = {}) => {
+  return async (
+    query,
+    { skipMinLength = false, reachableOnly = true } = {}
+  ) => {
     const trimmed = typeof query === 'string' ? query.trim() : '';
 
     controller?.abort();
@@ -199,6 +202,8 @@ export const createContactSearcher = () => {
       } = await ContactAPI.search(trimmed, 1, 'name', '', { signal });
 
       const camelCasedPayload = camelcaseKeys(payload, { deep: true });
+      if (!reachableOnly) return camelCasedPayload || [];
+
       // Filter contacts that have either phone_number or email
       const filteredPayload = camelCasedPayload?.filter(
         contact => contact.phoneNumber || contact.email
diff --git a/app/javascript/dashboard/components-next/filter/ConditionRow.vue b/app/javascript/dashboard/components-next/filter/ConditionRow.vue
index cc620de32..30709babd 100644
--- a/app/javascript/dashboard/components-next/filter/ConditionRow.vue
+++ b/app/javascript/dashboard/components-next/filter/ConditionRow.vue
@@ -1,6 +1,7 @@
 <script setup>
 import { computed, h, watch, ref } from 'vue';
 import { useI18n } from 'vue-i18n';
+import { debounce } from '@chatwoot/utils';
 import Button from 'next/button/Button.vue';
 import Input from 'dashboard/components-next/input/Input.vue';
 import FilterSelect from './inputs/FilterSelect.vue';
@@ -109,6 +110,34 @@ const inputFieldType = computed(() => {
   return 'text';
 });
 
+const asyncOptions = ref([]);
+const isSearching = ref(false);
+const lastSearchQuery = ref('');
+
+const performAsyncSearch = async query => {
+  let results;
+  try {
+    results = await currentFilter.value.searchOptions(query);
+  } catch {
+    results = [];
+  }
+  // skip stale responses — a newer search in this row owns the UI
+  if (query !== lastSearchQuery.value) return;
+  // null means another row's search aborted ours, reset instead of staying stuck on the searching state
+  if (results !== null) asyncOptions.value = results;
+  isSearching.value = false;
+};
+
+const debouncedAsyncSearch = debounce(performAsyncSearch, 300);
+
+const onAsyncSearch = query => {
+  const hasQuery = !!query.trim();
+  lastSearchQuery.value = query;
+  if (!hasQuery) asyncOptions.value = [];
+  isSearching.value = hasQuery;
+  debouncedAsyncSearch(query);
+};
+
 const resetModelOnAttributeKeyChange = newAttributeKey => {
   /**
    * Resets the filter values and operator when the attribute key changes. This ensures that
@@ -121,11 +150,16 @@ const resetModelOnAttributeKeyChange = newAttributeKey => {
   const newInputType = getInputType(newOperator, filter);
   if (newInputType === 'multiSelect') {
     values.value = [];
-  } else if (['searchSelect', 'booleanSelect'].includes(newInputType)) {
+  } else if (
+    ['searchSelect', 'asyncSearchSelect', 'booleanSelect'].includes(
+      newInputType
+    )
+  ) {
     values.value = {};
   } else {
     values.value = '';
   }
+  asyncOptions.value = [];
   filterOperator.value = newOperator.value;
 };
 
@@ -185,6 +219,16 @@ defineExpose({ validate, resetValidation });
           :options="currentFilter.options"
           dropdown-max-height="max-h-64"
         />
+        <SingleSelect
+          v-else-if="inputType === 'asyncSearchSelect'"
+          v-model="values"
+          async-search
+          :options="asyncOptions"
+          :is-searching="isSearching"
+          :search-placeholder="currentFilter.searchPlaceholder"
+          dropdown-max-height="max-h-64"
+          @search="onAsyncSearch"
+        />
         <SingleSelect
           v-else-if="inputType === 'booleanSelect'"
           v-model="values"
diff --git a/app/javascript/dashboard/components-next/filter/helper/filterHelper.js b/app/javascript/dashboard/components-next/filter/helper/filterHelper.js
index ba0dd24fa..5e3e9b74a 100644
--- a/app/javascript/dashboard/components-next/filter/helper/filterHelper.js
+++ b/app/javascript/dashboard/components-next/filter/helper/filterHelper.js
@@ -7,6 +7,7 @@ export const CONVERSATION_ATTRIBUTES = {
   ASSIGNEE_ID: 'assignee_id',
   INBOX_ID: 'inbox_id',
   TEAM_ID: 'team_id',
+  CONTACT_ID: 'contact_id',
   DISPLAY_ID: 'display_id',
   CAMPAIGN_ID: 'campaign_id',
   LABELS: 'labels',
diff --git a/app/javascript/dashboard/components-next/filter/helper/filterHelper.spec.js b/app/javascript/dashboard/components-next/filter/helper/filterHelper.spec.js
index 58cf92cf3..6e7a58354 100644
--- a/app/javascript/dashboard/components-next/filter/helper/filterHelper.spec.js
+++ b/app/javascript/dashboard/components-next/filter/helper/filterHelper.spec.js
@@ -1,9 +1,37 @@
+import { ref } from 'vue';
+import ContactAPI from 'dashboard/api/contacts';
+import { useMapGetter } from 'dashboard/composables/store.js';
+import { useConversationFilterContext } from '../provider';
 import {
+  CONVERSATION_ATTRIBUTES,
   getCustomAttributeInputType,
   buildAttributesFilterTypes,
   replaceUnderscoreWithSpace,
 } from './filterHelper';
 
+vi.mock('dashboard/api/contacts', () => ({
+  default: {
+    search: vi.fn(),
+  },
+}));
+
+vi.mock('dashboard/composables/store.js', () => ({
+  useMapGetter: vi.fn(),
+}));
+
+vi.mock('next/icon/provider', () => ({
+  useChannelIcon: () => ref('i-test-channel'),
+}));
+
+vi.mock('vue-i18n', () => ({
+  useI18n: () => ({
+    t: (key, params = {}) => {
+      if (key === 'FILTER.CONTACT_FALLBACK') return `Contact #${params.id}`;
+      return key;
+    },
+  }),
+}));
+
 describe('filterHelper', () => {
   describe('getCustomAttributeInputType', () => {
     it('returns date for date type', () => {
@@ -135,3 +163,64 @@ describe('filterHelper', () => {
     });
   });
 });
+
+const storeValues = {
+  'attributes/getConversationAttributes': ref([]),
+  'labels/getLabels': ref([]),
+  'agents/getAgents': ref([]),
+  'inboxes/getInboxes': ref([]),
+  'teams/getTeams': ref([]),
+  'campaigns/getAllCampaigns': ref([]),
+};
+
+describe('useConversationFilterContext', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    useMapGetter.mockImplementation(key => storeValues[key] || ref([]));
+  });
+
+  it('exposes contact as an async searchable conversation filter', () => {
+    const { filterTypes } = useConversationFilterContext();
+    const contactFilter = filterTypes.value.find(
+      filter => filter.attributeKey === CONVERSATION_ATTRIBUTES.CONTACT_ID
+    );
+
+    expect(contactFilter).toMatchObject({
+      attributeKey: 'contact_id',
+      label: 'FILTER.ATTRIBUTES.CONTACT',
+      inputType: 'asyncSearchSelect',
+      dataType: 'number',
+      attributeModel: 'standard',
+    });
+    expect(
+      contactFilter.filterOperators.map(operator => operator.value)
+    ).toEqual(['equal_to', 'not_equal_to']);
+  });
+
+  it('uses the existing contact search API for contact filter options', async () => {
+    ContactAPI.search.mockResolvedValue({
+      data: {
+        payload: [
+          { id: 1, name: 'Jane Doe' },
+          { id: 2, email: 'alex@example.com' },
+          { id: 3 },
+        ],
+      },
+    });
+
+    const { filterTypes } = useConversationFilterContext();
+    const contactFilter = filterTypes.value.find(
+      filter => filter.attributeKey === CONVERSATION_ATTRIBUTES.CONTACT_ID
+    );
+    const options = await contactFilter.searchOptions('jane');
+
+    expect(ContactAPI.search).toHaveBeenCalledWith('jane', 1, 'name', '', {
+      signal: expect.any(AbortSignal),
+    });
+    expect(options).toEqual([
+      { id: 1, name: 'Jane Doe' },
+      { id: 2, name: 'alex@example.com' },
+      { id: 3, name: 'Contact #3' },
+    ]);
+  });
+});
diff --git a/app/javascript/dashboard/components-next/filter/inputs/SingleSelect.vue b/app/javascript/dashboard/components-next/filter/inputs/SingleSelect.vue
index c9465aa12..85c4e6220 100644
--- a/app/javascript/dashboard/components-next/filter/inputs/SingleSelect.vue
+++ b/app/javascript/dashboard/components-next/filter/inputs/SingleSelect.vue
@@ -11,6 +11,8 @@ import DropdownItem from 'next/dropdown-menu/base/DropdownItem.vue';
 
 const {
   options,
+  asyncSearch,
+  isSearching,
   disableSearch,
   disableDeselect,
   placeholderIcon,
@@ -23,6 +25,14 @@ const {
     type: Array,
     required: true,
   },
+  asyncSearch: {
+    type: Boolean,
+    default: false,
+  },
+  isSearching: {
+    type: Boolean,
+    default: false,
+  },
   disableSearch: {
     type: Boolean,
     default: false,
@@ -53,6 +63,12 @@ const {
   },
 });
 
+const emit = defineEmits(['search']);
+
+// the input is re-inserted on every dropdown open (v-if),
+// where the native autofocus attribute is ignored so focus it via a directive instead
+const vFocus = { mounted: el => el.focus() };
+
 const { t } = useI18n();
 const selected = defineModel({
   type: Object,
@@ -60,7 +76,9 @@ const selected = defineModel({
 });
 
 const searchTerm = ref('');
+
 const searchResults = computed(() => {
+  if (asyncSearch) return options;
   if (!options) return [];
   return picoSearch(options, searchTerm.value, ['name']);
 });
@@ -77,7 +95,11 @@ const selectedItem = computed(() => {
   if (!optionToSearch) return null;
   // extract the selected item from the options array
   // this ensures that options like icon is also included
-  return options.find(option => option.id === optionToSearch.id);
+  return (
+    options.find(option => option.id === optionToSearch.id) ||
+    // async options may not include the selected option, fall back to it
+    (asyncSearch && optionToSearch.id !== undefined ? optionToSearch : null)
+  );
 });
 
 const toggleSelected = option => {
@@ -131,13 +153,19 @@ const toggleSelected = option => {
         <Icon class="absolute size-4 left-2 top-2" icon="i-lucide-search" />
         <input
           v-model="searchTerm"
-          autofocus
+          v-focus
           class="p-1.5 pl-8 text-n-slate-11 bg-n-alpha-1 rounded-lg w-full"
           :placeholder="searchPlaceholder || t('COMBOBOX.SEARCH_PLACEHOLDER')"
+          @input="emit('search', $event.target.value)"
         />
       </div>
       <DropdownSection :height="dropdownMaxHeight">
-        <template v-if="searchResults.length">
+        <template v-if="isSearching">
+          <DropdownItem disabled>
+            {{ t('DROPDOWN_MENU.SEARCHING') }}
+          </DropdownItem>
+        </template>
+        <template v-else-if="searchResults.length">
           <DropdownItem
             v-for="option in searchResults"
             :key="option.id"
diff --git a/app/javascript/dashboard/components-next/filter/provider.js b/app/javascript/dashboard/components-next/filter/provider.js
index fc418b132..ede25c505 100644
--- a/app/javascript/dashboard/components-next/filter/provider.js
+++ b/app/javascript/dashboard/components-next/filter/provider.js
@@ -3,6 +3,7 @@ import { useI18n } from 'vue-i18n';
 import { useOperators } from './operators';
 import { useMapGetter } from 'dashboard/composables/store.js';
 import { useChannelIcon } from 'next/icon/provider';
+import { createContactSearcher } from 'dashboard/components-next/NewConversation/helpers/composeConversationHelper';
 import {
   buildAttributesFilterTypes,
   CONVERSATION_ATTRIBUTES,
@@ -30,7 +31,7 @@ import languages from 'dashboard/components/widgets/conversation/advancedFilterI
  * @property {string} value - This is a proxy for the attribute key used in FilterSelect
  * @property {string} attributeName - The attribute name used to display on the UI
  * @property {string} label - This is a proxy for the attribute name used in FilterSelect
- * @property {'multiSelect'|'searchSelect'|'plainText'|'date'|'booleanSelect'} inputType - The input type for the attribute
+ * @property {'multiSelect'|'searchSelect'|'asyncSearchSelect'|'plainText'|'date'|'booleanSelect'} inputType - The input type for the attribute
  * @property {FilterOption[]} [options] - The options available for the attribute if it is a multiSelect or singleSelect type
  * @property {'text'|'number'} dataType
  * @property {FilterOperator[]} filterOperators - The operators available for the attribute
@@ -68,6 +69,30 @@ export function useConversationFilterContext() {
     getOperatorTypes,
   } = useOperators();
 
+  const searchContacts = createContactSearcher();
+
+  const contactOptionName = contact =>
+    contact.name ||
+    contact.email ||
+    contact.phoneNumber ||
+    contact.identifier ||
+    t('FILTER.CONTACT_FALLBACK', { id: contact.id });
+
+  const searchContactOptions = async query => {
+    const contacts = await searchContacts(query, {
+      skipMinLength: true,
+      reachableOnly: false,
+    });
+
+    // null means the request was aborted (a newer search is in-flight)
+    if (contacts === null) return null;
+
+    return contacts.map(contact => ({
+      id: contact.id,
+      name: contactOptionName(contact),
+    }));
+  };
+
   /**
    * @type {import('vue').ComputedRef<FilterType[]>}
    */
@@ -158,6 +183,18 @@ export function useConversationFilterContext() {
       filterOperators: presenceOperators.value,
       attributeModel: 'standard',
     },
+    {
+      attributeKey: CONVERSATION_ATTRIBUTES.CONTACT_ID,
+      value: CONVERSATION_ATTRIBUTES.CONTACT_ID,
+      attributeName: t('FILTER.ATTRIBUTES.CONTACT'),
+      label: t('FILTER.ATTRIBUTES.CONTACT'),
+      inputType: 'asyncSearchSelect',
+      searchOptions: searchContactOptions,
+      searchPlaceholder: t('FILTER.CONTACT_SEARCH_PLACEHOLDER'),
+      dataType: 'number',
+      filterOperators: equalityOperators.value,
+      attributeModel: 'standard',
+    },
     {
       attributeKey: CONVERSATION_ATTRIBUTES.DISPLAY_ID,
       value: CONVERSATION_ATTRIBUTES.DISPLAY_ID,
diff --git a/app/javascript/dashboard/components/ChatList.vue b/app/javascript/dashboard/components/ChatList.vue
index 0630f9c64..c96716c5d 100644
--- a/app/javascript/dashboard/components/ChatList.vue
+++ b/app/javascript/dashboard/components/ChatList.vue
@@ -151,6 +151,9 @@ const activeFolder = computed(() => {
   return undefined;
 });
 
+const getContact = useMapGetter('contacts/getContact');
+const folderContactId = useMapGetter('customViews/getActiveFolderContactId');
+
 const activeFolderName = computed(() => {
   return activeFolder.value?.name;
 });
@@ -456,6 +459,7 @@ function setParamsForEditFolderModal() {
     inboxes: inboxesList.value,
     labels: labels.value,
     campaigns: campaigns.value,
+    contacts: [getContact.value(folderContactId.value)],
     languages: languages,
     countries: countries,
     priority: [
diff --git a/app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/index.js b/app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/index.js
index 2c3c2fd13..06ff259f0 100644
--- a/app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/index.js
+++ b/app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/index.js
@@ -46,6 +46,14 @@ const filterTypes = [
     filterOperators: OPERATOR_TYPES_2,
     attributeModel: 'standard',
   },
+  {
+    attributeKey: 'contact_id',
+    attributeI18nKey: 'CONTACT',
+    inputType: 'search_select',
+    dataType: 'number',
+    filterOperators: OPERATOR_TYPES_1,
+    attributeModel: 'standard',
+  },
   {
     attributeKey: 'display_id',
     attributeI18nKey: 'CONVERSATION_IDENTIFIER',
@@ -133,6 +141,10 @@ export const filterAttributeGroups = [
         key: 'team_id',
         i18nKey: 'TEAM_NAME',
       },
+      {
+        key: 'contact_id',
+        i18nKey: 'CONTACT',
+      },
       {
         key: 'display_id',
         i18nKey: 'CONVERSATION_IDENTIFIER',
diff --git a/app/javascript/dashboard/helper/customViewsHelper.js b/app/javascript/dashboard/helper/customViewsHelper.js
index c837ce613..f1e750353 100644
--- a/app/javascript/dashboard/helper/customViewsHelper.js
+++ b/app/javascript/dashboard/helper/customViewsHelper.js
@@ -37,6 +37,13 @@ export const getValuesName = (values, list, idKey, nameKey) => {
   };
 };
 
+const getValuesForContact = (values, contacts) => ({
+  id: values[0],
+  name:
+    contacts?.find(contact => contact.id === values[0])?.name ||
+    `Contact #${values[0]}`,
+});
+
 export const getValuesForStatus = values => {
   return values.map(value => ({ id: value, name: value }));
 };
@@ -84,6 +91,7 @@ export const getValuesForFilter = (filter, params) => {
     campaigns,
     labels,
     priority,
+    contacts,
   } = params;
   switch (attribute_key) {
     case 'status':
@@ -94,6 +102,8 @@ export const getValuesForFilter = (filter, params) => {
       return getValuesName(values, inboxes, 'id', 'name');
     case 'team_id':
       return getValuesName(values, teams, 'id', 'name');
+    case 'contact_id':
+      return getValuesForContact(values, contacts);
     case 'campaign_id':
       return getValuesName(values, campaigns, 'id', 'title');
     case 'labels':
diff --git a/app/javascript/dashboard/helper/specs/customViewsHelper.spec.js b/app/javascript/dashboard/helper/specs/customViewsHelper.spec.js
index 0709c4e8d..e5d6b8de6 100644
--- a/app/javascript/dashboard/helper/specs/customViewsHelper.spec.js
+++ b/app/javascript/dashboard/helper/specs/customViewsHelper.spec.js
@@ -273,6 +273,41 @@ describe('customViewsHelper', () => {
       };
       expect(generateValuesForEditCustomViews(filter, params)).toEqual('1');
     });
+
+    it('returns contact name for contact filters when contact is available', () => {
+      const filter = {
+        attribute_key: 'contact_id',
+        filter_operator: 'equal_to',
+        values: [123],
+      };
+      const params = {
+        contacts: [{ id: 123, name: 'John Doe' }],
+        filterTypes: advancedFilterTypes,
+        allCustomAttributes: [],
+      };
+
+      expect(generateValuesForEditCustomViews(filter, params)).toEqual({
+        id: 123,
+        name: 'John Doe',
+      });
+    });
+
+    it('returns fallback contact display value when contact is not available', () => {
+      const filter = {
+        attribute_key: 'contact_id',
+        filter_operator: 'equal_to',
+        values: [123],
+      };
+      const params = {
+        filterTypes: advancedFilterTypes,
+        allCustomAttributes: [],
+      };
+
+      expect(generateValuesForEditCustomViews(filter, params)).toEqual({
+        id: 123,
+        name: 'Contact #123',
+      });
+    });
   });
 
   describe('#generateCustomAttributesInputType', () => {
diff --git a/app/javascript/dashboard/helper/specs/filterQueryGenerator.spec.js b/app/javascript/dashboard/helper/specs/filterQueryGenerator.spec.js
index 723ab8ef4..7585ad159 100644
--- a/app/javascript/dashboard/helper/specs/filterQueryGenerator.spec.js
+++ b/app/javascript/dashboard/helper/specs/filterQueryGenerator.spec.js
@@ -64,4 +64,25 @@ describe('#filterQueryGenerator', () => {
       filterQueryGenerator(testData).payload.every(i => Array.isArray(i.values))
     ).toBe(true);
   });
+
+  it('serializes a selected contact object to contact id', () => {
+    const result = filterQueryGenerator([
+      {
+        attribute_key: 'contact_id',
+        filter_operator: 'equal_to',
+        values: { id: 123, name: 'Jane Doe' },
+        query_operator: 'and',
+      },
+    ]);
+
+    expect(result).toMatchObject({
+      payload: [
+        {
+          attribute_key: 'contact_id',
+          filter_operator: 'equal_to',
+          values: [123],
+        },
+      ],
+    });
+  });
 });
diff --git a/app/javascript/dashboard/i18n/locale/en/advancedFilters.json b/app/javascript/dashboard/i18n/locale/en/advancedFilters.json
index a991cb25b..89143c62a 100644
--- a/app/javascript/dashboard/i18n/locale/en/advancedFilters.json
+++ b/app/javascript/dashboard/i18n/locale/en/advancedFilters.json
@@ -19,6 +19,8 @@
       "OR": "OR"
     },
     "INPUT_PLACEHOLDER": "Enter value",
+    "CONTACT_SEARCH_PLACEHOLDER": "Search contacts",
+    "CONTACT_FALLBACK": "Contact #{id}",
     "OPERATOR_LABELS": {
       "equal_to": "Equal to",
       "not_equal_to": "Not equal to",
@@ -49,6 +51,7 @@
       "ASSIGNEE_NAME": "Assignee name",
       "INBOX_NAME": "Inbox name",
       "TEAM_NAME": "Team name",
+      "CONTACT": "Contact",
       "CONVERSATION_IDENTIFIER": "Conversation identifier",
       "CAMPAIGN_NAME": "Campaign name",
       "LABELS": "Labels",
diff --git a/app/javascript/dashboard/store/modules/conversations/helpers/filterHelpers.js b/app/javascript/dashboard/store/modules/conversations/helpers/filterHelpers.js
index 63a592375..4603da83b 100644
--- a/app/javascript/dashboard/store/modules/conversations/helpers/filterHelpers.js
+++ b/app/javascript/dashboard/store/modules/conversations/helpers/filterHelpers.js
@@ -73,6 +73,12 @@ const getValueFromConversation = (conversation, attributeKey) => {
       return conversation.display_id || conversation.id;
     case 'assignee_id':
       return conversation.meta?.assignee?.id;
+    case 'contact_id':
+      return (
+        conversation.meta?.sender?.id ||
+        conversation.contact?.id ||
+        conversation.contact_id
+      );
     case 'inbox_id':
       return conversation.inbox_id;
     case 'team_id':
diff --git a/app/javascript/dashboard/store/modules/conversations/helpers/specs/filterHelpers.spec.js b/app/javascript/dashboard/store/modules/conversations/helpers/specs/filterHelpers.spec.js
index adcf5c96f..7b20b94e1 100644
--- a/app/javascript/dashboard/store/modules/conversations/helpers/specs/filterHelpers.spec.js
+++ b/app/javascript/dashboard/store/modules/conversations/helpers/specs/filterHelpers.spec.js
@@ -244,6 +244,32 @@ describe('filterHelpers', () => {
       expect(matchesFilters(conversation, filters)).toBe(false);
     });
 
+    it('should match conversation with equal_to operator for contact_id', () => {
+      const conversation = { meta: { sender: { id: 42 } } };
+      const filters = [
+        {
+          attribute_key: 'contact_id',
+          filter_operator: 'equal_to',
+          values: { id: 42, name: 'Jane Doe' },
+          query_operator: 'and',
+        },
+      ];
+      expect(matchesFilters(conversation, filters)).toBe(true);
+    });
+
+    it('should match conversation with saved contact_id filter values', () => {
+      const conversation = { meta: { sender: { id: 42 } } };
+      const filters = [
+        {
+          attribute_key: 'contact_id',
+          filter_operator: 'equal_to',
+          values: [42],
+          query_operator: 'and',
+        },
+      ];
+      expect(matchesFilters(conversation, filters)).toBe(true);
+    });
+
     // Standard attribute tests - priority
     it('should match conversation with equal_to operator for priority', () => {
       const conversation = { priority: 'urgent' };
diff --git a/app/javascript/dashboard/store/modules/customViews.js b/app/javascript/dashboard/store/modules/customViews.js
index a69bc2c17..388388e0f 100644
--- a/app/javascript/dashboard/store/modules/customViews.js
+++ b/app/javascript/dashboard/store/modules/customViews.js
@@ -15,6 +15,12 @@ const FILTER_KEYS = {
   [VIEW_TYPES.CONTACT]: VIEW_TYPES.CONTACT,
 };
 
+// a folder's contact_id filter stores only the id, extract it so the
+// contact can be fetched and its name shown in the edit folder modal
+const getFolderContactId = folder =>
+  folder?.query?.payload?.find(filter => filter.attribute_key === 'contact_id')
+    ?.values?.[0];
+
 export const state = {
   [VIEW_TYPES.CONVERSATION]: {
     records: [],
@@ -47,6 +53,9 @@ export const getters = {
   getActiveConversationFolder(_state) {
     return _state.activeConversationFolder;
   },
+  getActiveFolderContactId(_state) {
+    return getFolderContactId(_state.activeConversationFolder);
+  },
 };
 
 export const actions = {
@@ -104,8 +113,11 @@ export const actions = {
       commit(types.SET_CUSTOM_VIEW_UI_FLAG, { isDeleting: false });
     }
   },
-  setActiveConversationFolder({ commit }, data) {
+  setActiveConversationFolder({ commit, dispatch }, data) {
     commit(types.SET_ACTIVE_CONVERSATION_FOLDER, data);
+    // prefetch the contact of a contact filter so the UI can show its name
+    const contactId = getFolderContactId(data);
+    if (contactId) dispatch('contacts/show', { id: contactId }, { root: true });
   },
 };
 
diff --git a/app/javascript/dashboard/store/modules/specs/customViews/actions.spec.js b/app/javascript/dashboard/store/modules/specs/customViews/actions.spec.js
index f303eb5b6..a09dda17f 100644
--- a/app/javascript/dashboard/store/modules/specs/customViews/actions.spec.js
+++ b/app/javascript/dashboard/store/modules/specs/customViews/actions.spec.js
@@ -1,7 +1,11 @@
 import axios from 'axios';
-import { actions } from '../../customViews';
 import * as types from '../../../mutation-types';
-import { customViewList, updateCustomViewList } from './fixtures';
+import { actions } from '../../customViews';
+import {
+  contactFilterView,
+  customViewList,
+  updateCustomViewList,
+} from './fixtures';
 
 const commit = vi.fn();
 global.axios = axios;
@@ -106,5 +110,27 @@ describe('#actions', () => {
         [types.default.SET_ACTIVE_CONVERSATION_FOLDER, customViewList[0]],
       ]);
     });
+
+    it('prefetches the contact of a contact filter', async () => {
+      const dispatch = vi.fn();
+      await actions.setActiveConversationFolder(
+        { commit, dispatch },
+        contactFilterView
+      );
+      expect(dispatch).toHaveBeenCalledWith(
+        'contacts/show',
+        { id: 42 },
+        { root: true }
+      );
+    });
+
+    it('does not prefetch without a contact filter', async () => {
+      const dispatch = vi.fn();
+      await actions.setActiveConversationFolder(
+        { commit, dispatch },
+        customViewList[0]
+      );
+      expect(dispatch).not.toHaveBeenCalled();
+    });
   });
 });
diff --git a/app/javascript/dashboard/store/modules/specs/customViews/fixtures.js b/app/javascript/dashboard/store/modules/specs/customViews/fixtures.js
index c244467ed..6b0d06acf 100644
--- a/app/javascript/dashboard/store/modules/specs/customViews/fixtures.js
+++ b/app/javascript/dashboard/store/modules/specs/customViews/fixtures.js
@@ -15,6 +15,21 @@ export const contactViewList = [
   },
 ];
 
+export const contactFilterView = {
+  name: 'Contact view',
+  filter_type: 0,
+  query: {
+    payload: [
+      {
+        attribute_key: 'contact_id',
+        filter_operator: 'equal_to',
+        values: [42],
+        query_operator: null,
+      },
+    ],
+  },
+};
+
 export const customViewList = [
   {
     name: 'Custom view',
diff --git a/app/javascript/dashboard/store/modules/specs/customViews/getters.spec.js b/app/javascript/dashboard/store/modules/specs/customViews/getters.spec.js
index 709abc7a0..9d40ccf28 100644
--- a/app/javascript/dashboard/store/modules/specs/customViews/getters.spec.js
+++ b/app/javascript/dashboard/store/modules/specs/customViews/getters.spec.js
@@ -1,5 +1,5 @@
 import { getters } from '../../customViews';
-import { contactViewList, customViewList } from './fixtures';
+import { contactFilterView, contactViewList, customViewList } from './fixtures';
 
 describe('#getters', () => {
   it('getCustomViewsByFilterType', () => {
@@ -43,4 +43,20 @@ describe('#getters', () => {
       customViewList[0]
     );
   });
+
+  it('getActiveFolderContactId', () => {
+    expect(
+      getters.getActiveFolderContactId({
+        activeConversationFolder: contactFilterView,
+      })
+    ).toEqual(42);
+  });
+
+  it('getActiveFolderContactId returns undefined without a contact filter', () => {
+    expect(
+      getters.getActiveFolderContactId({
+        activeConversationFolder: customViewList[0],
+      })
+    ).toBeUndefined();
+  });
 });
diff --git a/lib/filters/filter_keys.yml b/lib/filters/filter_keys.yml
index 25d0e5196..006a862b2 100644
--- a/lib/filters/filter_keys.yml
+++ b/lib/filters/filter_keys.yml
@@ -44,6 +44,12 @@ conversations:
       - "not_equal_to"
       - "is_present"
       - "is_not_present"
+  contact_id:
+    attribute_type: "standard"
+    data_type: "number"
+    filter_operators:
+      - "equal_to"
+      - "not_equal_to"
   priority:
     attribute_type: "standard"
     data_type: "text"
diff --git a/spec/services/conversations/filter_service_spec.rb b/spec/services/conversations/filter_service_spec.rb
index 1bf5c219d..fa054b330 100644
--- a/spec/services/conversations/filter_service_spec.rb
+++ b/spec/services/conversations/filter_service_spec.rb
@@ -72,8 +72,8 @@ describe Conversations::FilterService do
       it 'filter conversations by additional_attributes and status' do
         params[:payload] = payload
         result = filter_service.new(params, user_1, account).perform
-        conversations = Conversation.where("additional_attributes ->> 'browser_language' IN (?) AND status IN (?)", ['en'], [1, 2])
-        expect(result[:count][:all_count]).to be conversations.count
+        conversations = account.conversations.where("additional_attributes ->> 'browser_language' IN (?) AND status IN (?)", ['en'], [1, 2])
+        expect(result[:count][:all_count]).to eq conversations.count
       end
 
       it 'filter conversations by priority' do
@@ -133,12 +133,84 @@ describe Conversations::FilterService do
         expect(result[:conversations].pluck(:id)).to include(low_priority.id, medium_priority.id)
       end
 
+      it 'filters conversations by contact' do
+        account.conversations.destroy_all
+
+        contact = create(:contact, :with_email, account: account)
+        other_contact = create(:contact, :with_email, account: account)
+        matching_conversation = create(:conversation, account: account, inbox: inbox, assignee: user_1, contact: contact)
+        create(:conversation, account: account, inbox: inbox, assignee: user_1, contact: other_contact)
+
+        params[:payload] = [
+          {
+            attribute_key: 'contact_id',
+            filter_operator: 'equal_to',
+            values: [contact.id],
+            query_operator: nil,
+            custom_attribute_type: ''
+          }.with_indifferent_access
+        ]
+
+        result = filter_service.new(params, user_1, account).perform
+
+        expect(result[:count][:all_count]).to eq 1
+        expect(result[:conversations].pluck(:id)).to contain_exactly(matching_conversation.id)
+      end
+
+      it 'filters conversations using not_equal_to contact operator' do
+        account.conversations.destroy_all
+
+        contact = create(:contact, :with_email, account: account)
+        other_contact = create(:contact, :with_email, account: account)
+        create(:conversation, account: account, inbox: inbox, assignee: user_1, contact: contact)
+        other_conversation = create(:conversation, account: account, inbox: inbox, assignee: user_1, contact: other_contact)
+
+        params[:payload] = [
+          {
+            attribute_key: 'contact_id',
+            filter_operator: 'not_equal_to',
+            values: [contact.id],
+            query_operator: nil,
+            custom_attribute_type: ''
+          }.with_indifferent_access
+        ]
+
+        result = filter_service.new(params, user_1, account).perform
+
+        expect(result[:count][:all_count]).to eq 1
+        expect(result[:conversations].pluck(:id)).to contain_exactly(other_conversation.id)
+      end
+
+      it 'applies inbox permissions when filtering conversations by contact' do
+        account.conversations.destroy_all
+
+        contact = create(:contact, :with_email, account: account)
+        restricted_inbox = create(:inbox, account: account)
+        accessible_conversation = create(:conversation, account: account, inbox: inbox, assignee: user_1, contact: contact)
+        create(:conversation, account: account, inbox: restricted_inbox, contact: contact)
+
+        params[:payload] = [
+          {
+            attribute_key: 'contact_id',
+            filter_operator: 'equal_to',
+            values: [contact.id],
+            query_operator: nil,
+            custom_attribute_type: ''
+          }.with_indifferent_access
+        ]
+
+        result = filter_service.new(params, user_1, account).perform
+
+        expect(result[:count][:all_count]).to eq 1
+        expect(result[:conversations].pluck(:id)).to contain_exactly(accessible_conversation.id)
+      end
+
       it 'filter conversations by additional_attributes and status with pagination' do
         params[:payload] = payload
         params[:page] = 2
         result = filter_service.new(params, user_1, account).perform
-        conversations = Conversation.where("additional_attributes ->> 'browser_language' IN (?) AND status IN (?)", ['en'], [1, 2])
-        expect(result[:count][:all_count]).to be conversations.count
+        conversations = account.conversations.where("additional_attributes ->> 'browser_language' IN (?) AND status IN (?)", ['en'], [1, 2])
+        expect(result[:count][:all_count]).to eq conversations.count
       end
 
       it 'filters items with contains filter_operator with values being an array' do
@@ -184,10 +256,10 @@ describe Conversations::FilterService do
                      custom_attribute_type: 'conversation_attribute' }.with_indifferent_access]
         params[:payload] = payload
         result = filter_service.new(params, user_1, account).perform
-        conversations = Conversation.where(
+        conversations = account.conversations.where(
           "custom_attributes ->> 'conversation_type' NOT IN (?) OR custom_attributes ->> 'conversation_type' IS NULL", ['platinum']
         )
-        expect(result[:count][:all_count]).to be conversations.count
+        expect(result[:count][:all_count]).to eq conversations.count
       end
 
       it 'filter conversations by tags' do
@@ -413,8 +485,8 @@ describe Conversations::FilterService do
           }.with_indifferent_access
         ]
         result = filter_service.new(params, user_1, account).perform
-        expected_count = Conversation.where('created_at > ?', DateTime.parse('2022-01-20')).count
-        expect(result[:conversations].length).to be expected_count
+        expected_count = account.conversations.where('created_at > ?', DateTime.parse('2022-01-20')).count
+        expect(result[:conversations].length).to eq expected_count
       end
 
       it 'binds created_at comparison values as dates' do
@@ -470,10 +542,10 @@ describe Conversations::FilterService do
           }.with_indifferent_access
         ]
         result = filter_service.new(params, user_1, account).perform
-        expected_count = Conversation.where("created_at > ? AND custom_attributes->>'conversation_type' = ?", DateTime.parse('2022-01-20'),
-                                            'platinum').count
+        expected_count = account.conversations.where("created_at > ? AND custom_attributes->>'conversation_type' = ?",
+                                                     DateTime.parse('2022-01-20'), 'platinum').count
 
-        expect(result[:conversations].length).to be expected_count
+        expect(result[:conversations].length).to eq expected_count
       end
 
       context 'with x_days_before filter' do
@@ -502,11 +574,11 @@ describe Conversations::FilterService do
             }.with_indifferent_access
           ]
 
-          expected_count = Conversation.where("last_activity_at < ? AND custom_attributes->>'conversation_type' = ?", (Time.zone.today - 3.days),
-                                              'platinum').count
+          expected_count = account.conversations.where("last_activity_at < ? AND custom_attributes->>'conversation_type' = ?",
+                                                       (Time.zone.today - 3.days), 'platinum').count
 
           result = filter_service.new(params, user_1, account).perform
-          expect(result[:conversations].length).to be expected_count
+          expect(result[:conversations].length).to eq expected_count
         end
 
         it 'filter by last_activity_at 2_days_before' do
@@ -520,10 +592,10 @@ describe Conversations::FilterService do
             }.with_indifferent_access
           ]
 
-          expected_count = Conversation.where('last_activity_at < ?', (Time.zone.today - 2.days)).count
+          expected_count = account.conversations.where('last_activity_at < ?', (Time.zone.today - 2.days)).count
 
           result = filter_service.new(params, user_1, account).perform
-          expect(result[:conversations].length).to be expected_count
+          expect(result[:conversations].length).to eq expected_count
         end
       end
     end
@@ -548,10 +620,10 @@ describe Conversations::FilterService do
           }.with_indifferent_access
         ]
         result = filter_service.new(params, user_1, account).perform
-        expected_count = Conversation.where('created_at > ?', DateTime.parse('2022-01-20')).count
+        expected_count = account.conversations.where('created_at > ?', DateTime.parse('2022-01-20')).count
 
         expect(Current.account).to be_nil
-        expect(result[:conversations].length).to be expected_count
+        expect(result[:conversations].length).to eq expected_count
       end
     end
   end

From d8656edc6182200cfe55ada0d872e1a14f00ca84 Mon Sep 17 00:00:00 2001
From: jaroenchai_t <84191989+jaroenchai-t@users.noreply.github.com>
Date: Mon, 8 Jun 2026 18:28:36 +0700
Subject: [PATCH 10/34] fix(facebook): Stop force tagging Messenger replies
 with MESSAGE_TAG/ACCOUNT_UPDATE (#14329)

Outbound Facebook Messenger replies were always sent with
`messaging_type: MESSAGE_TAG` and a `tag` of either `HUMAN_AGENT` or
`ACCOUNT_UPDATE` (fallback). `ACCOUNT_UPDATE` is reserved by Meta policy
for non-recurring account notifications (password resets, suspicious
activity, account-status changes), so general agent replies were getting
rejected by Facebook with "Invalid parameter" and risked page-level
penalties. After this fix, Facebook treats default replies as standard
`RESPONSE` messages within the 24-hour window, and only attaches
`HUMAN_AGENT` tagging when the operator opts in via
`ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT`.

## Closes

<!-- Add the relevant issue link, e.g. Closes #1234 -->

## How to reproduce

1. Connect a Facebook page inbox.
2. Leave `ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT` disabled (default).
3. From the dashboard, reply to an active Messenger conversation with a
regular/promotional message.
4. Before this PR: the request to Graph API includes
`messaging_type=MESSAGE_TAG&tag=ACCOUNT_UPDATE`. Facebook returns
"Invalid parameter" for content that does not match the `ACCOUNT_UPDATE`
use case, and the message is marked failed in Chatwoot.
5. After this PR: the request omits `messaging_type` and `tag`, so
Facebook treats it as a standard `RESPONSE` and accepts it within the
24-hour customer service window.

## What changed

- `app/services/facebook/send_on_facebook_service.rb` now mirrors the
Instagram service pattern: text and attachment params are built without
`messaging_type`/`tag` by default, and a shared `merge_human_agent_tag`
helper attaches `MESSAGE_TAG`/`HUMAN_AGENT` only when
`ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT` is enabled.
- Removed the unused `sent_first_outgoing_message_after_24_hours?`
helper (dead code with no callers).
- Updated `spec/services/facebook/send_on_facebook_service_spec.rb`:
dropped `ACCOUNT_UPDATE` expectations, added a spec asserting no
`messaging_type`/`tag` is sent by default, and tightened the HUMAN_AGENT
spec to verify both `messaging_type` and `tag`.

## Operator note

Operators who were relying on the prior `ACCOUNT_UPDATE` fallback to
bypass the 24-hour window were already in violation of Meta policy and
likely seeing send failures. They should enable
`ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT` (and request the Human Agent
permission from Meta) for the 7-day extended window

---------

Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
---
 .../facebook/send_on_facebook_service.rb      | 32 ++++++++++---------
 .../facebook/send_on_facebook_service_spec.rb | 21 ++++++++----
 2 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/app/services/facebook/send_on_facebook_service.rb b/app/services/facebook/send_on_facebook_service.rb
index baf72ef6e..0b2f45590 100644
--- a/app/services/facebook/send_on_facebook_service.rb
+++ b/app/services/facebook/send_on_facebook_service.rb
@@ -45,12 +45,12 @@ class Facebook::SendOnFacebookService < Base::SendOnChannelService
   end
 
   def fb_text_message_params
-    {
+    params = {
       recipient: { id: contact.get_source_id(inbox.id) },
-      message: fb_text_message_payload,
-      messaging_type: 'MESSAGE_TAG',
-      tag: message_tag
+      message: fb_text_message_payload
     }
+
+    merge_human_agent_tag(params)
   end
 
   def fb_text_message_payload
@@ -79,7 +79,7 @@ class Facebook::SendOnFacebookService < Base::SendOnChannelService
   end
 
   def fb_attachment_message_params(attachment)
-    {
+    params = {
       recipient: { id: contact.get_source_id(inbox.id) },
       message: {
         attachment: {
@@ -88,14 +88,21 @@ class Facebook::SendOnFacebookService < Base::SendOnChannelService
             url: attachment.download_url
           }
         }
-      },
-      messaging_type: 'MESSAGE_TAG',
-      tag: message_tag
+      }
     }
+
+    merge_human_agent_tag(params)
   end
 
-  def message_tag
-    @message_tag ||= GlobalConfigService.load('ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT', nil) ? 'HUMAN_AGENT' : 'ACCOUNT_UPDATE'
+  def merge_human_agent_tag(params)
+    unless GlobalConfigService.load('ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT', nil)
+      params[:messaging_type] = 'RESPONSE'
+      return params
+    end
+
+    params[:messaging_type] = 'MESSAGE_TAG'
+    params[:tag] = 'HUMAN_AGENT'
+    params
   end
 
   def attachment_type(attachment)
@@ -104,11 +111,6 @@ class Facebook::SendOnFacebookService < Base::SendOnChannelService
     'file'
   end
 
-  def sent_first_outgoing_message_after_24_hours?
-    # we can send max 1 message after 24 hour window
-    conversation.messages.outgoing.where('id > ?', conversation.last_incoming_message.id).count == 1
-  end
-
   def handle_facebook_error(exception)
     # Refer: https://github.com/jgorset/facebook-messenger/blob/64fe1f5cef4c1e3fca295b205037f64dfebdbcab/lib/facebook/messenger/error.rb
     return unless exception.to_s.include?('The session has been invalidated') || exception.to_s.include?('Error validating access token')
diff --git a/spec/services/facebook/send_on_facebook_service_spec.rb b/spec/services/facebook/send_on_facebook_service_spec.rb
index f99b1c469..0a2b6407c 100644
--- a/spec/services/facebook/send_on_facebook_service_spec.rb
+++ b/spec/services/facebook/send_on_facebook_service_spec.rb
@@ -73,8 +73,7 @@ describe Facebook::SendOnFacebookService do
         expect(bot).to have_received(:deliver).with({
                                                       recipient: { id: contact_inbox.source_id },
                                                       message: { text: message.content },
-                                                      messaging_type: 'MESSAGE_TAG',
-                                                      tag: 'ACCOUNT_UPDATE'
+                                                      messaging_type: 'RESPONSE'
                                                     }, { page_id: facebook_channel.page_id })
         expect(bot).to have_received(:deliver).with({
                                                       recipient: { id: contact_inbox.source_id },
@@ -86,17 +85,26 @@ describe Facebook::SendOnFacebookService do
                                                           }
                                                         }
                                                       },
-                                                      messaging_type: 'MESSAGE_TAG',
-                                                      tag: 'ACCOUNT_UPDATE'
+                                                      messaging_type: 'RESPONSE'
                                                     }, { page_id: facebook_channel.page_id })
       end
 
+      it 'sends as a standard RESPONSE without a tag by default' do
+        message = create(:message, message_type: 'outgoing', inbox: facebook_inbox, account: account, conversation: conversation)
+        described_class.new(message: message).perform
+        expect(bot).to have_received(:deliver).with(
+          hash_including(messaging_type: 'RESPONSE'),
+          { page_id: facebook_channel.page_id }
+        )
+        expect(bot).not_to have_received(:deliver).with(hash_including(:tag), anything)
+      end
+
       it 'sends with HUMAN_AGENT tag when ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT is enabled' do
         with_modified_env ENABLE_MESSENGER_CHANNEL_HUMAN_AGENT: 'true' do
           message = create(:message, message_type: 'outgoing', inbox: facebook_inbox, account: account, conversation: conversation)
           described_class.new(message: message).perform
           expect(bot).to have_received(:deliver).with(
-            hash_including(tag: 'HUMAN_AGENT'),
+            hash_including(messaging_type: 'MESSAGE_TAG', tag: 'HUMAN_AGENT'),
             { page_id: facebook_channel.page_id }
           )
         end
@@ -201,8 +209,7 @@ describe Facebook::SendOnFacebookService do
                                                           { content_type: 'text', payload: 'text 2', title: 'text 2' }
                                                         ]
                                                       },
-                                                      messaging_type: 'MESSAGE_TAG',
-                                                      tag: 'ACCOUNT_UPDATE'
+                                                      messaging_type: 'RESPONSE'
                                                     }, { page_id: facebook_channel.page_id })
       end
     end

From d1c482cb644fb015306af8b56c64c8593e773550 Mon Sep 17 00:00:00 2001
From: Vishnu Narayanan <iamwishnu@gmail.com>
Date: Mon, 8 Jun 2026 17:12:25 +0530
Subject: [PATCH 11/34] fix(email): strip null bytes from inbound mailbox
 messages (#14546)

Inbound emails containing null bytes could fail while Chatwoot persisted
the incoming message, causing IMAP sync to drop and repeatedly retry the
same malformed email. This strips null bytes at the inbound mailbox
message persistence boundary so the rest of the email can be saved
normally.

Fixes
https://linear.app/chatwoot/issue/CW-7165/argumenterror-string-contains-null-byte-argumenterror
Sentry: https://chatwoot-p3.sentry.io/issues/7405946944/

## Test
- [x] added specs
- [x] manually tested the logic on prod for the inbox(email) which was
throwing the error

## What changed

- Sanitizes null bytes only while building attributes for inbound
mailbox message persistence.
- Uses the sanitized source ID for both duplicate lookup and message
creation.
- Adds regression coverage for the mailbox message creation path.

---------

Co-authored-by: Sony Mathew <2040199+sony-mathew@users.noreply.github.com>
Co-authored-by: Sony Mathew <sony@chatwoot.com>
---
 app/mailboxes/imap/imap_mailbox.rb            | 19 +++++++----
 app/mailboxes/mailbox_helper.rb               | 30 ++++++----------
 app/mailboxes/mailbox_sanitizer.rb            | 34 +++++++++++++++++++
 .../base_strategy.rb                          |  2 ++
 .../in_reply_to_strategy.rb                   |  2 +-
 .../new_conversation_strategy.rb              |  8 ++---
 .../references_strategy.rb                    |  2 +-
 spec/mailboxes/imap/imap_mailbox_spec.rb      | 27 +++++++++++++++
 spec/mailboxes/mailbox_helper_spec.rb         | 25 ++++++++++++++
 spec/mailboxes/reply_mailbox_spec.rb          | 34 +++++++++++++++++++
 10 files changed, 151 insertions(+), 32 deletions(-)
 create mode 100644 app/mailboxes/mailbox_sanitizer.rb

diff --git a/app/mailboxes/imap/imap_mailbox.rb b/app/mailboxes/imap/imap_mailbox.rb
index 27bc88e06..25b8f4d85 100644
--- a/app/mailboxes/imap/imap_mailbox.rb
+++ b/app/mailboxes/imap/imap_mailbox.rb
@@ -65,11 +65,10 @@ class Imap::ImapMailbox
   end
 
   def in_reply_to
-    @processed_mail.in_reply_to
+    sanitize_mailbox_value(@processed_mail.in_reply_to)
   end
 
   def find_conversation_by_references
-    references = Array.wrap(@inbound_mail.references)
     references.each do |message_id|
       match = FALLBACK_CONVERSATION_PATTERN.match(message_id)
 
@@ -80,8 +79,6 @@ class Imap::ImapMailbox
   def find_message_by_references
     message_to_return = nil
 
-    references = Array.wrap(@inbound_mail.references)
-
     references.each do |message_id|
       message = @inbox.messages.find_by(source_id: message_id)
       message_to_return = message if message.present?
@@ -100,7 +97,7 @@ class Imap::ImapMailbox
           source: 'email',
           in_reply_to: in_reply_to,
           auto_reply: @processed_mail.auto_reply?,
-          mail_subject: @processed_mail.subject,
+          mail_subject: sanitize_mailbox_value(@processed_mail.subject),
           initiated_at: {
             timestamp: Time.now.utc
           }
@@ -110,7 +107,7 @@ class Imap::ImapMailbox
   end
 
   def find_or_create_contact
-    @contact = @inbox.contacts.from_email(@processed_mail.original_sender)
+    @contact = @inbox.contacts.from_email(original_sender_email)
     if @contact.present?
       @contact_inbox = ContactInbox.find_by(inbox: @inbox, contact: @contact)
     else
@@ -119,6 +116,14 @@ class Imap::ImapMailbox
   end
 
   def identify_contact_name
-    processed_mail.sender_name || processed_mail.from.first.split('@').first
+    sanitize_mailbox_value(processed_mail.sender_name || processed_mail.from.first.split('@').first)
+  end
+
+  def original_sender_email
+    sanitize_mailbox_value(@processed_mail.original_sender)
+  end
+
+  def references
+    sanitize_mailbox_value(Array.wrap(@inbound_mail.references))
   end
 end
diff --git a/app/mailboxes/mailbox_helper.rb b/app/mailboxes/mailbox_helper.rb
index edabfd4ce..fd3e0fb16 100644
--- a/app/mailboxes/mailbox_helper.rb
+++ b/app/mailboxes/mailbox_helper.rb
@@ -1,27 +1,16 @@
 module MailboxHelper
   include MailboxInlineAttachmentHelper
+  include MailboxSanitizer
   include ::FileTypeHelper
 
   private
 
   def create_message
     Rails.logger.info "[MailboxHelper] Creating message #{processed_mail.message_id}"
-    return if @conversation.messages.find_by(source_id: processed_mail.message_id).present?
+    source_id = sanitize_mailbox_value(processed_mail.message_id)
+    return if @conversation.messages.find_by(source_id: source_id).present?
 
-    @message = @conversation.messages.create!(
-      account_id: @conversation.account_id,
-      sender: @conversation.contact,
-      content: mail_content&.truncate(150_000),
-      inbox_id: @conversation.inbox_id,
-      message_type: 'incoming',
-      content_type: 'incoming_email',
-      source_id: processed_mail.message_id,
-      content_attributes: {
-        email: processed_mail.serialized_data,
-        cc_email: processed_mail.cc,
-        bcc_email: processed_mail.bcc
-      }
-    )
+    @message = @conversation.messages.create!(sanitized_message_attributes(source_id))
   end
 
   def add_attachments_to_message
@@ -101,13 +90,16 @@ module MailboxHelper
   end
 
   def create_contact
+    sender_email = sanitize_mailbox_value(processed_mail.original_sender)
+    message_id = sanitize_mailbox_value(processed_mail.message_id)
+
     @contact_inbox = ::ContactInboxWithContactBuilder.new(
-      source_id: processed_mail.original_sender,
+      source_id: sender_email,
       inbox: @inbox,
       contact_attributes: {
-        name: identify_contact_name,
-        email: processed_mail.original_sender,
-        additional_attributes: { source_id: "email:#{processed_mail.message_id}" }
+        name: sanitize_mailbox_value(identify_contact_name),
+        email: sender_email,
+        additional_attributes: { source_id: "email:#{message_id}" }
       }
     ).perform
 
diff --git a/app/mailboxes/mailbox_sanitizer.rb b/app/mailboxes/mailbox_sanitizer.rb
new file mode 100644
index 000000000..b78bb1258
--- /dev/null
+++ b/app/mailboxes/mailbox_sanitizer.rb
@@ -0,0 +1,34 @@
+module MailboxSanitizer
+  NULL_BYTE = "\u0000".freeze
+
+  private
+
+  def sanitized_message_attributes(source_id)
+    {
+      account_id: @conversation.account_id,
+      sender: @conversation.contact,
+      content: sanitize_mailbox_value(mail_content)&.truncate(150_000),
+      inbox_id: @conversation.inbox_id,
+      message_type: 'incoming',
+      content_type: 'incoming_email',
+      source_id: source_id,
+      content_attributes: sanitized_content_attributes
+    }
+  end
+
+  def sanitized_content_attributes
+    sanitize_mailbox_value(
+      email: processed_mail.serialized_data,
+      cc_email: processed_mail.cc,
+      bcc_email: processed_mail.bcc
+    )
+  end
+
+  def sanitize_mailbox_value(value)
+    return value.delete(NULL_BYTE) if value.is_a?(String)
+    return value.map { |item| sanitize_mailbox_value(item) } if value.is_a?(Array)
+    return value.transform_values { |item| sanitize_mailbox_value(item) } if value.is_a?(Hash)
+
+    value
+  end
+end
diff --git a/app/services/mailbox/conversation_finder_strategies/base_strategy.rb b/app/services/mailbox/conversation_finder_strategies/base_strategy.rb
index c1e738805..fd61fd9e0 100644
--- a/app/services/mailbox/conversation_finder_strategies/base_strategy.rb
+++ b/app/services/mailbox/conversation_finder_strategies/base_strategy.rb
@@ -1,4 +1,6 @@
 class Mailbox::ConversationFinderStrategies::BaseStrategy
+  include MailboxSanitizer
+
   attr_reader :mail
 
   def initialize(mail)
diff --git a/app/services/mailbox/conversation_finder_strategies/in_reply_to_strategy.rb b/app/services/mailbox/conversation_finder_strategies/in_reply_to_strategy.rb
index b14f851f5..e3d8270f1 100644
--- a/app/services/mailbox/conversation_finder_strategies/in_reply_to_strategy.rb
+++ b/app/services/mailbox/conversation_finder_strategies/in_reply_to_strategy.rb
@@ -14,7 +14,7 @@ class Mailbox::ConversationFinderStrategies::InReplyToStrategy < Mailbox::Conver
   def find
     return nil if mail.in_reply_to.blank?
 
-    in_reply_to_addresses = Array.wrap(mail.in_reply_to)
+    in_reply_to_addresses = sanitize_mailbox_value(Array.wrap(mail.in_reply_to))
 
     in_reply_to_addresses.each do |in_reply_to|
       # Try extracting UUID from patterns
diff --git a/app/services/mailbox/conversation_finder_strategies/new_conversation_strategy.rb b/app/services/mailbox/conversation_finder_strategies/new_conversation_strategy.rb
index a21fcebe5..f9f5c3cf8 100644
--- a/app/services/mailbox/conversation_finder_strategies/new_conversation_strategy.rb
+++ b/app/services/mailbox/conversation_finder_strategies/new_conversation_strategy.rb
@@ -45,11 +45,11 @@ class Mailbox::ConversationFinderStrategies::NewConversationStrategy < Mailbox::
   end
 
   def original_sender_email
-    @processed_mail.original_sender&.downcase
+    sanitize_mailbox_value(@processed_mail.original_sender)&.downcase
   end
 
   def identify_contact_name
-    @processed_mail.sender_name || @processed_mail.from.first.split('@').first
+    sanitize_mailbox_value(@processed_mail.sender_name || @processed_mail.from.first.split('@').first)
   end
 
   def build_conversation
@@ -63,7 +63,7 @@ class Mailbox::ConversationFinderStrategies::NewConversationStrategy < Mailbox::
         in_reply_to: in_reply_to,
         source: 'email',
         auto_reply: @processed_mail.auto_reply?,
-        mail_subject: @processed_mail.subject,
+        mail_subject: sanitize_mailbox_value(@processed_mail.subject),
         initiated_at: {
           timestamp: Time.now.utc
         }
@@ -72,7 +72,7 @@ class Mailbox::ConversationFinderStrategies::NewConversationStrategy < Mailbox::
   end
 
   def in_reply_to
-    mail['In-Reply-To'].try(:value)
+    sanitize_mailbox_value(mail['In-Reply-To'].try(:value))
   end
 
   def find_conversation_by_in_reply_to
diff --git a/app/services/mailbox/conversation_finder_strategies/references_strategy.rb b/app/services/mailbox/conversation_finder_strategies/references_strategy.rb
index 86a0aa3c5..4420c5c7d 100644
--- a/app/services/mailbox/conversation_finder_strategies/references_strategy.rb
+++ b/app/services/mailbox/conversation_finder_strategies/references_strategy.rb
@@ -21,7 +21,7 @@ class Mailbox::ConversationFinderStrategies::ReferencesStrategy < Mailbox::Conve
     return nil if mail.references.blank?
     return nil unless @channel # No valid channel found
 
-    references = Array.wrap(mail.references)
+    references = sanitize_mailbox_value(Array.wrap(mail.references))
 
     references.each do |reference|
       conversation = find_conversation_from_reference(reference)
diff --git a/spec/mailboxes/imap/imap_mailbox_spec.rb b/spec/mailboxes/imap/imap_mailbox_spec.rb
index 309a38a65..9a6797aaf 100644
--- a/spec/mailboxes/imap/imap_mailbox_spec.rb
+++ b/spec/mailboxes/imap/imap_mailbox_spec.rb
@@ -99,6 +99,33 @@ RSpec.describe Imap::ImapMailbox do
       end
     end
 
+    context 'when a new email contains null bytes' do
+      let(:inbound_mail) do
+        Mail.new.tap do |mail|
+          mail.from = 'email@gmail.com'
+          mail.to = 'imap@gmail.com'
+          mail.subject = "Hello\u0000"
+          mail.message_id = "message\u0000@example.com"
+          mail['In-Reply-To'] = "source\u0000@example.com"
+          mail.references = ["reference\u0000@example.com"]
+          mail.content_type = 'text/plain'
+          mail.body = "Body\u0000 text"
+        end
+      end
+
+      it 'creates sanitized conversation and message records' do
+        expect { class_instance.process(inbound_mail, channel) }.to change(Conversation, :count).by(1)
+
+        message = conversation.messages.last
+
+        expect(conversation.additional_attributes['in_reply_to']).to eq('source@example.com')
+        expect(conversation.additional_attributes['mail_subject']).to eq('Hello')
+        expect(message.source_id).to eq('message@example.com')
+        expect(message.content).to eq('Body text')
+        expect(message.content_attributes.to_json).not_to include('\u0000')
+      end
+    end
+
     context 'when a new email with invalid from' do
       let(:inbound_mail) { create_inbound_email_from_mail(from: 'invalidemail', to: 'imap@gmail.com', subject: 'Hello!') }
 
diff --git a/spec/mailboxes/mailbox_helper_spec.rb b/spec/mailboxes/mailbox_helper_spec.rb
index 613040cb3..4b02205ec 100644
--- a/spec/mailboxes/mailbox_helper_spec.rb
+++ b/spec/mailboxes/mailbox_helper_spec.rb
@@ -47,6 +47,31 @@ RSpec.describe MailboxHelper do
         helper_instance.send(:create_message)
       end
     end
+
+    context 'when message data contains null bytes' do
+      let(:mail) do
+        mail = Mail.new
+        mail.from = 'Sender <sender@example.com>'
+        mail.to = 'Inbox <inbox@example.com>'
+        mail.subject = "Hello\u0000"
+        mail.message_id = "message\u0000@example.com"
+        mail.content_type = 'text/plain'
+        mail.body = "Body\u0000 text"
+        mail
+      end
+
+      it 'creates the message with sanitized values' do
+        helper_instance = mailbox_helper_obj.new(conversation, processed_mail)
+
+        expect { helper_instance.send(:create_message) }.to change(conversation.messages, :count).by(1)
+
+        message = conversation.messages.last
+        expect(message.source_id).to eq('message@example.com')
+        expect(message.content).to eq('Body text')
+        expect(message.content_attributes.dig('email', 'message_id')).to eq('message@example.com')
+        expect(message.content_attributes.to_json).not_to include('\u0000')
+      end
+    end
   end
 
   describe '#embed_plain_text_email_with_inline_image' do
diff --git a/spec/mailboxes/reply_mailbox_spec.rb b/spec/mailboxes/reply_mailbox_spec.rb
index d062c7d73..20ce60dad 100644
--- a/spec/mailboxes/reply_mailbox_spec.rb
+++ b/spec/mailboxes/reply_mailbox_spec.rb
@@ -67,6 +67,40 @@ RSpec.describe ReplyMailbox do
       end
     end
 
+    context 'when new conversation email contains null bytes' do
+      let(:email_channel) { create(:channel_email, email: 'test@example.com', account: account) }
+      let(:null_byte_mail) { create_inbound_email_from_mail(from: 'sender@example.com', to: email_channel.email, subject: 'Hello') }
+      let(:mail_with_null_bytes) do
+        Mail.new.tap do |mail|
+          mail.from = 'sender@example.com'
+          mail.to = email_channel.email
+          mail.subject = "Hello\u0000"
+          mail.message_id = "message\u0000@example.com"
+          mail['In-Reply-To'] = "source\u0000@example.com"
+          mail.references = ["reference\u0000@example.com"]
+          mail.content_type = 'text/plain'
+          mail.body = "Body\u0000 text"
+        end
+      end
+
+      before do
+        allow(null_byte_mail).to receive(:mail).and_return(mail_with_null_bytes)
+      end
+
+      it 'creates sanitized conversation and message records' do
+        expect { described_class.receive null_byte_mail }.to change(Conversation, :count).by(1)
+
+        conversation = Conversation.last
+        message = conversation.messages.last
+
+        expect(conversation.additional_attributes['in_reply_to']).to eq('source@example.com')
+        expect(conversation.additional_attributes['mail_subject']).to eq('Hello')
+        expect(message.source_id).to eq('message@example.com')
+        expect(message.content).to eq('Body text')
+        expect(message.content_attributes.to_json).not_to include('\u0000')
+      end
+    end
+
     context 'with inline attachments' do
       let(:mail_with_inline_images) { create_inbound_email_from_fixture('mail_with_inline_images.eml') }
       let(:described_subject) { described_class.receive mail_with_inline_images }

From af1dfc21f6354904413137362b7bf76748e37994 Mon Sep 17 00:00:00 2001
From: Tony Vincent <tony.thayilyesudas@dampsoft.de>
Date: Tue, 9 Jun 2026 08:42:46 +0200
Subject: [PATCH 12/34] fix: include account data in webhook payloads (#12445)

Conversation and inbox webhook payloads now include the account object
(`{ id, name }`) so integrations can reliably identify the account
without depending on nested message data.

## Closes

Closes #11753
Closes #12442

## Why

Message, contact, and contact inbox webhook payloads already expose
`account`. Conversation and inbox webhook payloads were outliers, which
forced webhook consumers to infer account context from nested messages
or other fields that may not always be present.

## What changed

- Adds `account: { id, name }` to conversation webhook payloads.
- Adds webhook-specific inbox payload data with `account: { id, name }`
for inbox created/updated events.
- Keeps non-webhook conversation and inbox push payload behavior
unchanged.

## How to test

- Configure an account webhook for `conversation_created`, trigger a new
conversation, and confirm the webhook payload includes `account.id` and
`account.name`.
- Configure an account webhook for `inbox_created`, create a new inbox,
and confirm the webhook payload includes `account.id` and
`account.name`.
- Configure a webhook agent bot and update a conversation status, then
confirm the bot webhook payload includes the same account object.

---------

Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
Co-authored-by: Sojan Jose <sojan@pepalo.com>
---
 app/listeners/webhook_listener.rb             |  4 +--
 .../conversations/event_data_presenter.rb     |  5 +++-
 app/presenters/inbox/event_data_presenter.rb  |  4 +++
 spec/listeners/agent_bot_listener_spec.rb     | 20 +++++++++++++-
 spec/listeners/webhook_listener_spec.rb       | 26 +++++++++++++++++--
 .../event_data_presenter_spec.rb              |  4 +++
 6 files changed, 57 insertions(+), 6 deletions(-)

diff --git a/app/listeners/webhook_listener.rb b/app/listeners/webhook_listener.rb
index 835d03661..c64b36ca0 100644
--- a/app/listeners/webhook_listener.rb
+++ b/app/listeners/webhook_listener.rb
@@ -68,7 +68,7 @@ class WebhookListener < BaseListener
 
   def inbox_created(event)
     inbox, account = extract_inbox_and_account(event)
-    inbox_webhook_data = Inbox::EventDataPresenter.new(inbox).push_data
+    inbox_webhook_data = Inbox::EventDataPresenter.new(inbox).webhook_data
     payload = inbox_webhook_data.merge(event: __method__.to_s)
     deliver_account_webhooks(payload, account)
   end
@@ -78,7 +78,7 @@ class WebhookListener < BaseListener
     changed_attributes = extract_changed_attributes(event)
     return if changed_attributes.blank?
 
-    inbox_webhook_data = Inbox::EventDataPresenter.new(inbox).push_data
+    inbox_webhook_data = Inbox::EventDataPresenter.new(inbox).webhook_data
     payload = inbox_webhook_data.merge(event: __method__.to_s, changed_attributes: changed_attributes)
     deliver_account_webhooks(payload, account)
   end
diff --git a/app/presenters/conversations/event_data_presenter.rb b/app/presenters/conversations/event_data_presenter.rb
index ae0e69608..4dfa10abe 100644
--- a/app/presenters/conversations/event_data_presenter.rb
+++ b/app/presenters/conversations/event_data_presenter.rb
@@ -23,7 +23,10 @@ class Conversations::EventDataPresenter < SimpleDelegator
 
   # Like #push_data but with message text normalized for external integrations (webhooks).
   def webhook_data
-    push_data.merge(messages: webhook_push_messages)
+    push_data.merge(
+      account: account.webhook_data,
+      messages: webhook_push_messages
+    )
   end
 
   private
diff --git a/app/presenters/inbox/event_data_presenter.rb b/app/presenters/inbox/event_data_presenter.rb
index a408424ae..7f832bb5a 100644
--- a/app/presenters/inbox/event_data_presenter.rb
+++ b/app/presenters/inbox/event_data_presenter.rb
@@ -32,4 +32,8 @@ class Inbox::EventDataPresenter < SimpleDelegator
       channel: channel
     }
   end
+
+  def webhook_data
+    push_data.merge(account: account.webhook_data)
+  end
 end
diff --git a/spec/listeners/agent_bot_listener_spec.rb b/spec/listeners/agent_bot_listener_spec.rb
index 08deeb6c4..e3f9f0402 100644
--- a/spec/listeners/agent_bot_listener_spec.rb
+++ b/spec/listeners/agent_bot_listener_spec.rb
@@ -82,7 +82,7 @@ describe AgentBotListener do
         create(:agent_bot_inbox, inbox: inbox, agent_bot: agent_bot)
         expect(AgentBots::WebhookJob).to receive(:perform_later).with(
           agent_bot.outgoing_url,
-          hash_including(event: 'conversation_status_changed', changed_attributes: anything),
+          hash_including(event: 'conversation_status_changed', account: account.webhook_data, changed_attributes: anything),
           :agent_bot_webhook,
           hash_including(secret: agent_bot.secret)
         ).once
@@ -158,6 +158,24 @@ describe AgentBotListener do
     end
   end
 
+  describe '#conversation_resolved' do
+    let(:event_name) { 'conversation.resolved' }
+    let!(:event) { Events::Base.new(event_name, Time.zone.now, conversation: conversation) }
+
+    context 'when agent bot is configured' do
+      it 'sends account details in the conversation payload' do
+        create(:agent_bot_inbox, inbox: inbox, agent_bot: agent_bot)
+        expect(AgentBots::WebhookJob).to receive(:perform_later).with(
+          agent_bot.outgoing_url,
+          hash_including(event: 'conversation_resolved', account: account.webhook_data),
+          :agent_bot_webhook,
+          hash_including(secret: agent_bot.secret)
+        ).once
+        listener.conversation_resolved(event)
+      end
+    end
+  end
+
   describe '#webwidget_triggered' do
     let(:event_name) { 'webwidget.triggered' }
 
diff --git a/spec/listeners/webhook_listener_spec.rb b/spec/listeners/webhook_listener_spec.rb
index a7a64f175..b63f43c2f 100644
--- a/spec/listeners/webhook_listener_spec.rb
+++ b/spec/listeners/webhook_listener_spec.rb
@@ -101,6 +101,17 @@ describe WebhookListener do
         ).once
         listener.conversation_created(conversation_created_event)
       end
+
+      it 'includes account details in the conversation payload' do
+        webhook = create(:webhook, inbox: inbox, account: account)
+        expect(WebhookJob).to receive(:perform_later).with(
+          webhook.url,
+          hash_including(account: account.webhook_data),
+          :account_webhook,
+          hash_including(secret: webhook.secret)
+        ).once
+        listener.conversation_created(conversation_created_event)
+      end
     end
 
     context 'when inbox is an API Channel' do
@@ -250,7 +261,7 @@ describe WebhookListener do
 
     context 'when webhook is configured' do
       it 'triggers webhook' do
-        inbox_data = Inbox::EventDataPresenter.new(inbox).push_data
+        inbox_data = Inbox::EventDataPresenter.new(inbox).webhook_data
         webhook = create(:webhook, account: account, subscriptions: ['inbox_created'])
         expect(WebhookJob).to receive(:perform_later).with(
           webhook.url, inbox_data.merge(event: 'inbox_created'), :account_webhook,
@@ -258,6 +269,17 @@ describe WebhookListener do
         ).once
         listener.inbox_created(inbox_created_event)
       end
+
+      it 'includes account details in the inbox payload' do
+        webhook = create(:webhook, account: account, subscriptions: ['inbox_created'])
+        expect(WebhookJob).to receive(:perform_later).with(
+          webhook.url,
+          hash_including(account: account.webhook_data),
+          :account_webhook,
+          hash_including(secret: webhook.secret)
+        ).once
+        listener.inbox_created(inbox_created_event)
+      end
     end
   end
 
@@ -287,7 +309,7 @@ describe WebhookListener do
       it 'triggers webhook' do
         webhook = create(:webhook, account: account, subscriptions: ['inbox_updated'])
 
-        inbox_data = Inbox::EventDataPresenter.new(inbox).push_data
+        inbox_data = Inbox::EventDataPresenter.new(inbox).webhook_data
         changed_attributes_data = [{ 'name' => { 'previous_value': 'Inbox 1', 'current_value': inbox.name } }]
 
         expect(WebhookJob).to receive(:perform_later).with(
diff --git a/spec/presenters/conversations/event_data_presenter_spec.rb b/spec/presenters/conversations/event_data_presenter_spec.rb
index 76fd8f8a8..21cb26c98 100644
--- a/spec/presenters/conversations/event_data_presenter_spec.rb
+++ b/spec/presenters/conversations/event_data_presenter_spec.rb
@@ -46,6 +46,10 @@ RSpec.describe Conversations::EventDataPresenter do
   end
 
   describe '#webhook_data' do
+    it 'includes account details for webhook consumers' do
+      expect(presenter.webhook_data[:account]).to eq(conversation.account.webhook_data)
+    end
+
     it 'normalizes hard-break backslashes in message content' do
       message = create(:message, conversation: conversation, account: conversation.account,
                                  message_type: :outgoing, content: "Hello\\\nWorld")

From 8a3b1292927b51a5a7b3fd51b03c7da332b911a7 Mon Sep 17 00:00:00 2001
From: Shivam Kumar <csautomaytic@gmail.com>
Date: Tue, 9 Jun 2026 12:42:03 +0530
Subject: [PATCH 13/34] fix: Disable re-oauth flow for manual whatsapp (#13599)

Restrict the WhatsApp reauthorization flag to channels whose
provider_config source is 'embedded_signup'. Previously the view exposed
resource.channel.reauthorization_required? for all WhatsApp channels;
now it only returns true when (provider_config || {}).to_h['source'] ==
'embedded_signup' && resource.channel.reauthorization_required?. This
prevents showing reauthorization prompts for manual/API-key flows
(non-OAuth) and safely handles nil provider_config.

# Pull Request Template

## Description

Please include a summary of the change and issue(s) fixed. Also, mention
relevant motivation, context, and any dependencies that this change
requires.
Fixes  #13553

## Type of change

Please delete options that are not relevant.

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality not to work as expected)
- [ ] This change requires a documentation update

## How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration.


## Checklist:

- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my code
- [x] I have commented on my code, particularly in hard-to-understand
areas
- [x] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules

---------

Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
---
 app/jobs/webhooks/whatsapp_events_job.rb      |  7 ++++-
 app/views/api/v1/models/_inbox.json.jbuilder  |  6 +++-
 .../v1/accounts/inboxes_controller_spec.rb    | 29 +++++++++++++++++++
 .../jobs/webhooks/whatsapp_events_job_spec.rb |  8 +++++
 4 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/app/jobs/webhooks/whatsapp_events_job.rb b/app/jobs/webhooks/whatsapp_events_job.rb
index f904b3723..14429e61c 100644
--- a/app/jobs/webhooks/whatsapp_events_job.rb
+++ b/app/jobs/webhooks/whatsapp_events_job.rb
@@ -126,12 +126,17 @@ class Webhooks::WhatsappEventsJob < MutexApplicationJob
 
   def channel_is_inactive?(channel)
     return true if channel.blank?
-    return true if channel.reauthorization_required?
+    # Only skip for embedded signup when reauth is required; manual flow uses API keys and should still receive webhooks
+    return true if channel.reauthorization_required? && embedded_signup_channel?(channel)
     return true unless channel.account.active?
 
     false
   end
 
+  def embedded_signup_channel?(channel)
+    (channel.provider_config || {}).to_h['source'] == 'embedded_signup'
+  end
+
   def find_channel_by_url_param(params)
     return unless params[:phone_number]
 
diff --git a/app/views/api/v1/models/_inbox.json.jbuilder b/app/views/api/v1/models/_inbox.json.jbuilder
index 0ae0745cd..b34bbe95b 100644
--- a/app/views/api/v1/models/_inbox.json.jbuilder
+++ b/app/views/api/v1/models/_inbox.json.jbuilder
@@ -130,7 +130,11 @@ json.bot_name resource.channel.try(:bot_name) if resource.telegram?
 if resource.whatsapp?
   json.message_templates resource.channel.try(:message_templates)
   json.provider_config resource.channel.try(:provider_config) if Current.account_user&.administrator?
-  json.reauthorization_required resource.channel.try(:reauthorization_required?)
+  # Only show reauthorization for embedded signup; manual flow uses API keys, not OAuth
+  json.reauthorization_required(
+    (resource.channel.try(:provider_config) || {}).to_h['source'] == 'embedded_signup' &&
+    resource.channel.try(:reauthorization_required?)
+  )
 end
 
 ## Voice attributes for TwilioSms
diff --git a/spec/controllers/api/v1/accounts/inboxes_controller_spec.rb b/spec/controllers/api/v1/accounts/inboxes_controller_spec.rb
index 9e03e2587..0fd6ad7bf 100644
--- a/spec/controllers/api/v1/accounts/inboxes_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/inboxes_controller_spec.rb
@@ -100,6 +100,35 @@ RSpec.describe 'Inboxes API', type: :request do
         expect(JSON.parse(response.body, symbolize_names: true)[:id]).to eq(inbox.id)
       end
 
+      it 'returns reauthorization_required for embedded signup whatsapp channel when reauth required' do
+        whatsapp_channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud', sync_templates: false,
+                                                     validate_provider_config: false)
+        whatsapp_inbox = create(:inbox, channel: whatsapp_channel, account: account)
+        whatsapp_channel.prompt_reauthorization!
+
+        get "/api/v1/accounts/#{account.id}/inboxes/#{whatsapp_inbox.id}",
+            headers: admin.create_new_auth_token,
+            as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(response.parsed_body['reauthorization_required']).to be(true)
+      end
+
+      it 'does not flag reauthorization_required for manual whatsapp channel even when reauth required' do
+        whatsapp_channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud', sync_templates: false,
+                                                     validate_provider_config: false)
+        whatsapp_channel.update!(provider_config: whatsapp_channel.provider_config.merge('source' => 'manual'))
+        whatsapp_inbox = create(:inbox, channel: whatsapp_channel, account: account)
+        whatsapp_channel.prompt_reauthorization!
+
+        get "/api/v1/accounts/#{account.id}/inboxes/#{whatsapp_inbox.id}",
+            headers: admin.create_new_auth_token,
+            as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(response.parsed_body['reauthorization_required']).to be(false)
+      end
+
       it 'returns the inbox if assigned inbox is assigned as agent' do
         create(:inbox_member, user: agent, inbox: inbox)
         get "/api/v1/accounts/#{account.id}/inboxes/#{inbox.id}",
diff --git a/spec/jobs/webhooks/whatsapp_events_job_spec.rb b/spec/jobs/webhooks/whatsapp_events_job_spec.rb
index d82658102..8d1b24b52 100644
--- a/spec/jobs/webhooks/whatsapp_events_job_spec.rb
+++ b/spec/jobs/webhooks/whatsapp_events_job_spec.rb
@@ -62,6 +62,14 @@ RSpec.describe Webhooks::WhatsappEventsJob do
       job.perform_now(params)
     end
 
+    it 'still enqueues for manual channels even when reauthorization required' do
+      channel.update!(provider_config: channel.provider_config.merge('source' => 'manual'))
+      channel.prompt_reauthorization!
+      allow(Whatsapp::IncomingMessageWhatsappCloudService).to receive(:new).and_return(process_service)
+      expect(Whatsapp::IncomingMessageWhatsappCloudService).to receive(:new)
+      job.perform_now(params)
+    end
+
     it 'will not enqueue if channel is not present' do
       allow(Whatsapp::IncomingMessageWhatsappCloudService).to receive(:new).and_return(process_service)
       allow(Whatsapp::IncomingMessageService).to receive(:new).and_return(process_service)

From 59d869d1edcbc9b748e3521f7d12ac7f592b6d04 Mon Sep 17 00:00:00 2001
From: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
Date: Tue, 9 Jun 2026 18:04:48 +0530
Subject: [PATCH 14/34] feat: Ability to resize table column width (#14611)

---
 .../shared/helpers/MessageFormatter.js        |  9 +-
 .../helpers/specs/MessageFormatter.spec.js    | 10 +++
 lib/custom_markdown_renderer.rb               | 82 ++++++++++++++++++-
 package.json                                  |  2 +-
 pnpm-lock.yaml                                | 10 +--
 spec/lib/custom_markdown_renderer_spec.rb     | 53 ++++++++++++
 6 files changed, 157 insertions(+), 9 deletions(-)

diff --git a/app/javascript/shared/helpers/MessageFormatter.js b/app/javascript/shared/helpers/MessageFormatter.js
index eb8fecf01..85ce67bc6 100644
--- a/app/javascript/shared/helpers/MessageFormatter.js
+++ b/app/javascript/shared/helpers/MessageFormatter.js
@@ -63,6 +63,13 @@ const createMarkdownInstance = (linkify = true) => {
     });
 };
 
+// Help center article tables persist column widths as an internal
+// `<!--cw-colwidths:...-->` comment before the table. It exists only for the
+// editor's markdown round-trip and must never surface as text — markdown-it runs
+// with `html: false`, which would otherwise escape it into a visible comment in
+// rendered/plain output (e.g. dashboard search snippets). Strip it on the way in.
+const COLWIDTHS_MARKER_REGEX = /<!--cw-colwidths:[\d,]+-->\r?\n?/g;
+
 const TWITTER_USERNAME_REGEX = /(^|[^@\w])@(\w{1,15})\b/g;
 const TWITTER_USERNAME_REPLACEMENT = '$1[@$2](http://twitter.com/$2)';
 const TWITTER_HASH_REGEX = /(^|\s)#(\w+)/g;
@@ -75,7 +82,7 @@ class MessageFormatter {
     isAPrivateNote = false,
     linkify = true
   ) {
-    this.message = message || '';
+    this.message = (message || '').replace(COLWIDTHS_MARKER_REGEX, '');
     this.isAPrivateNote = isAPrivateNote;
     this.isATweet = isATweet;
     this.linkify = linkify;
diff --git a/app/javascript/shared/helpers/specs/MessageFormatter.spec.js b/app/javascript/shared/helpers/specs/MessageFormatter.spec.js
index 12b84085c..3350399eb 100644
--- a/app/javascript/shared/helpers/specs/MessageFormatter.spec.js
+++ b/app/javascript/shared/helpers/specs/MessageFormatter.spec.js
@@ -126,6 +126,16 @@ describe('#MessageFormatter', () => {
     });
   });
 
+  describe('help center table colwidth marker', () => {
+    it('strips the internal colwidths marker from rendered output', () => {
+      const message =
+        '<!--cw-colwidths:120,200-->\n| A | B |\n| --- | --- |\n| 1 | 2 |';
+      const formatter = new MessageFormatter(message);
+      expect(formatter.formattedMessage).not.toContain('cw-colwidths');
+      expect(formatter.plainText).not.toContain('cw-colwidths');
+    });
+  });
+
   describe('#sanitize', () => {
     it('sanitizes markup and removes all unnecessary elements', () => {
       const message =
diff --git a/lib/custom_markdown_renderer.rb b/lib/custom_markdown_renderer.rb
index 665d4c80c..fa191f5ed 100644
--- a/lib/custom_markdown_renderer.rb
+++ b/lib/custom_markdown_renderer.rb
@@ -9,9 +9,32 @@ class CustomMarkdownRenderer < CommonMarker::HtmlRenderer
     @embed_regexes ||= config.transform_values { |embed_config| Regexp.new(embed_config['regex']) }
   end
 
+  # Matches columnResizing({ cellMinWidth: 50 }) in @chatwoot/prosemirror-schema
+  # so cells without an explicit colwidth render the same minimum here as in the editor.
+  TABLE_CELL_MIN_WIDTH_PX = 50
+  COLWIDTHS_COMMENT = /<!--cw-colwidths:([\d,]+)-->/
+
+  # The article editor serializes column widths as a `<!--cw-colwidths:...-->` HTML
+  # comment immediately before each resized table. Capture it (emitting nothing) so the
+  # next `table` can size itself; any other raw HTML keeps its default rendering.
+  def html(node)
+    match = node.string_content.match(COLWIDTHS_COMMENT)
+    return super unless match
+
+    @pending_colwidths = match[1].split(',').map(&:to_i)
+  end
+
   def table(node)
-    out('<div class="tableWrapper">')
-    super
+    widths = @pending_colwidths
+    @pending_colwidths = nil
+
+    if sized_widths?(widths)
+      out(table_wrapper_open(widths))
+      out(inject_table_sizing(capture_html { super(node) }, widths))
+    else
+      out('<div class="tableWrapper">')
+      super
+    end
     out('</div>')
   end
 
@@ -47,6 +70,61 @@ class CustomMarkdownRenderer < CommonMarker::HtmlRenderer
 
   private
 
+  def sized_widths?(widths)
+    widths.is_a?(Array) && widths.any? { |w| w.to_i.positive? }
+  end
+
+  def fully_sized?(widths)
+    widths.all? { |w| w.to_i.positive? }
+  end
+
+  # Fully-sized tables hug their exact width so the card doesn't trail empty space;
+  # partial tables stay a plain full-width card so flexible columns can expand.
+  def table_wrapper_open(widths)
+    return '<div class="tableWrapper">' unless fully_sized?(widths)
+
+    %(<div class="tableWrapper" style="width: #{total_width(widths)}px; max-width: 100%;">)
+  end
+
+  # Let the gem render the whole table, then splice a <colgroup> and sizing style
+  # into the opening <table> tag. Delegating the row/cell/tbody/alignment markup to
+  # super keeps this working across commonmarker upgrades.
+  # `!important` overrides the portal's `[&_table]:!min-w-full` Tailwind rule.
+  def inject_table_sizing(html, widths)
+    opening = %(<table style="#{table_sizing_style(widths)}">\n#{colgroup_html(widths)})
+    html.sub(/<table[^>]*>\n?/, opening)
+  end
+
+  # Capture everything `super` writes by swapping the renderer's output buffer.
+  def capture_html
+    original = @stream
+    @stream = StringIO.new(+'')
+    yield
+    @stream.string
+  ensure
+    @stream = original
+  end
+
+  # Total table width: each column's saved width, or the cell min for unsized ones.
+  def total_width(widths)
+    widths.sum { |w| w.to_i.positive? ? w.to_i : TABLE_CELL_MIN_WIDTH_PX }
+  end
+
+  # Fully sized → lock to the exact total (min-width too, so a narrow saved width
+  # beats the portal's `[&_table]:!min-w-full`). Partial → `max(100%, total)` fills
+  # the container (flexible columns) yet scrolls when the sized columns exceed it.
+  def table_sizing_style(widths)
+    total = total_width(widths)
+    return "table-layout: fixed; min-width: max(100%, #{total}px) !important;" unless fully_sized?(widths)
+
+    "table-layout: fixed; width: #{total}px !important; min-width: #{total}px !important;"
+  end
+
+  def colgroup_html(widths)
+    cols = widths.map { |w| w.to_i.positive? ? %(<col style="width: #{w.to_i}px;">) : '<col>' }
+    "<colgroup>#{cols.join}</colgroup>\n"
+  end
+
   def extract_image_width(src)
     query = URI.parse(src).query
     raw = query && CGI.parse(query)['cw_image_width']&.first
diff --git a/package.json b/package.json
index d8527051d..41313c8b3 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "@amplitude/analytics-browser": "^2.11.10",
     "@breezystack/lamejs": "^1.2.7",
     "@chatwoot/ninja-keys": "1.2.3",
-    "@chatwoot/prosemirror-schema": "1.3.17",
+    "@chatwoot/prosemirror-schema": "1.3.19",
     "@chatwoot/utils": "^0.0.55",
     "@formkit/core": "^1.7.2",
     "@formkit/vue": "^1.7.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a4b61061c..68e667953 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25,8 +25,8 @@ importers:
         specifier: 1.2.3
         version: 1.2.3
       '@chatwoot/prosemirror-schema':
-        specifier: 1.3.17
-        version: 1.3.17
+        specifier: 1.3.19
+        version: 1.3.19
       '@chatwoot/utils':
         specifier: ^0.0.55
         version: 0.0.55
@@ -458,8 +458,8 @@ packages:
   '@chatwoot/ninja-keys@1.2.3':
     resolution: {integrity: sha512-xM8d9P5ikDMZm2WbaCTk/TW5HFauylrU3cJ75fq5je6ixKwyhl/0kZbVN/vbbZN4+AUX/OaSIn6IJbtCgIF67g==}
 
-  '@chatwoot/prosemirror-schema@1.3.17':
-    resolution: {integrity: sha512-n78ZfMIzSrylImIN5cjCeEdTJ8ub0JtCybwUlqFyOyLy3ZzAZpOHvCSo+w/KmV4dCgOH2mBmYlxBQ9Rww+e0Rw==}
+  '@chatwoot/prosemirror-schema@1.3.19':
+    resolution: {integrity: sha512-LbATIAeTzclvbIK6WjtrGUO37AtMWkzCJi+s/KpUIp81TORhc0fHnclGT3353AbxeH6dF51/4hFTTsmF+ziqGA==}
 
   '@chatwoot/utils@0.0.55':
     resolution: {integrity: sha512-8G6HYQe1ZEYfJEsSYfDVvE+uhf98JDRjtGlpB+bzMko+yltbrk4yACSo/ImC3jSaJ6K8yPTSjJToSRmsQbL2iQ==}
@@ -5128,7 +5128,7 @@ snapshots:
       hotkeys-js: 3.8.7
       lit: 2.2.6
 
-  '@chatwoot/prosemirror-schema@1.3.17':
+  '@chatwoot/prosemirror-schema@1.3.19':
     dependencies:
       markdown-it-sup: 2.0.0
       prosemirror-commands: 1.7.1
diff --git a/spec/lib/custom_markdown_renderer_spec.rb b/spec/lib/custom_markdown_renderer_spec.rb
index 28c5e069c..6484f2e6c 100644
--- a/spec/lib/custom_markdown_renderer_spec.rb
+++ b/spec/lib/custom_markdown_renderer_spec.rb
@@ -258,6 +258,59 @@ describe CustomMarkdownRenderer do
     end
   end
 
+  describe '#table' do
+    def render_table(markdown)
+      doc = CommonMarker.render_doc(markdown, :DEFAULT, [:table])
+      described_class.new.render(doc)
+    end
+
+    let(:plain_table) { "| A | B |\n| --- | --- |\n| 1 | 2 |\n" }
+
+    it 'renders a table without column widths when no marker is present' do
+      output = render_table(plain_table)
+      expect(output).to include('<div class="tableWrapper"><table>')
+      expect(output).not_to include('colgroup')
+      expect(output).not_to include('cw-colwidths')
+    end
+
+    context 'when every column has a saved width' do
+      it 'lays the table out at the total width with a sized colgroup' do
+        output = render_table("<!--cw-colwidths:120,200-->\n#{plain_table}")
+        # Wrapper hugs the table; min-width is set alongside width so a narrow saved width beats min-w-full.
+        expect(output).to include('<div class="tableWrapper" style="width: 320px; max-width: 100%;">')
+        expect(output).to include('<table style="table-layout: fixed; width: 320px !important; min-width: 320px !important;">')
+        expect(output).to include('<colgroup><col style="width: 120px;"><col style="width: 200px;"></colgroup>')
+      end
+    end
+
+    context 'when only some columns have a saved width' do
+      it 'fills the container so unsized columns stay flexible, floored at the sized total' do
+        output = render_table("<!--cw-colwidths:150,0-->\n#{plain_table}")
+        # max(100%, 200px): fills the container (flexible) but scrolls if the sized columns exceed it.
+        expect(output).to include('table-layout: fixed; min-width: max(100%, 200px) !important;')
+        expect(output).to include('<colgroup><col style="width: 150px;"><col></colgroup>')
+        # No exact-width lock on the wrapper or table — the table must be free to expand.
+        expect(output).to include('<div class="tableWrapper"><table')
+        expect(output).not_to include('width: 200px !important')
+      end
+    end
+
+    it 'associates each marker with the table that follows it' do
+      markdown = "#{plain_table}\n<!--cw-colwidths:150,250-->\n| P | Q |\n| --- | --- |\n| a | b |\n"
+      output = render_table(markdown)
+
+      # First table has no marker and stays unsized; the marker applies to the second table.
+      expect(output).to include('<div class="tableWrapper"><table>')
+      expect(output).to include('width: 400px !important;')
+      expect(output).to include('<col style="width: 250px;">')
+      expect(output.scan('colgroup').length).to eq(2)
+    end
+
+    it 'does not emit the marker comment into the rendered html' do
+      expect(render_table("<!--cw-colwidths:120,200-->\n#{plain_table}")).not_to include('cw-colwidths')
+    end
+  end
+
   describe '#image' do
     it 'renders width in px with responsive cap and auto height' do
       markdown = '![Sample](https://example.com/image.jpg?cw_image_width=400px)'

From 33f75505259362d1a2e23cdcbb70918ced58470c Mon Sep 17 00:00:00 2001
From: Muhsin Keloth <muhsinkeramam@gmail.com>
Date: Wed, 10 Jun 2026 08:52:34 +0400
Subject: [PATCH 15/34] fix(whatsapp): restrict OGG voice recording to WhatsApp
 Cloud inboxes (#14692)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Recording and sending an audio message from a **Twilio WhatsApp** inbox
failed silently — Twilio rejected the media with delivery error `63019`
("Media failed to download") and the voice note never reached the
customer. This restores audio sending for Twilio WhatsApp (and
360dialog) inboxes.

Closes Regression from #14606

## How to reproduce

1. Open a conversation in a **Twilio WhatsApp** inbox.
2. Record a voice message in the reply box and send it.
3. Before this fix: the message fails to deliver and a
`Webhooks::TwilioDeliveryStatusJob` is enqueued with `ErrorCode: 63019`,
`ErrorMessage: "Media failed to download"`.
4. After this fix: the audio is recorded as MP3 and delivers normally.

## What changed

PR #14606 added WhatsApp **Cloud** voice notes, which require OGG/Opus.
It changed `audioRecordFormat` in `ReplyBox.vue` to return OGG for
`isAWhatsAppChannel` — but that getter is also `true` for Twilio
WhatsApp inboxes. The OGG handling (content-type normalization + the
`voice: true` flag) lives only in `WhatsappCloudService`, so Twilio
could not download/process the remuxed OGG file.

This change scopes OGG to `isAWhatsAppCloudChannel`. Twilio WhatsApp,
360dialog, and Telegram fall back to MP3 exactly as they did before the
PR.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../dashboard/components/widgets/conversation/ReplyBox.vue    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/javascript/dashboard/components/widgets/conversation/ReplyBox.vue b/app/javascript/dashboard/components/widgets/conversation/ReplyBox.vue
index 17f5559f1..fc93ff2c7 100644
--- a/app/javascript/dashboard/components/widgets/conversation/ReplyBox.vue
+++ b/app/javascript/dashboard/components/widgets/conversation/ReplyBox.vue
@@ -375,10 +375,10 @@ export default {
       return `draft-${this.conversationIdByRoute}-${this.replyType}`;
     },
     audioRecordFormat() {
-      if (this.isAWhatsAppChannel) {
+      if (this.isAWhatsAppCloudChannel) {
         return AUDIO_FORMATS.OGG;
       }
-      if (this.isATelegramChannel) {
+      if (this.isAWhatsAppChannel || this.isATelegramChannel) {
         return AUDIO_FORMATS.MP3;
       }
       if (this.isAPIInbox) {

From cabe9bc7332e89656cdd1ec8e30f4134d6b993a9 Mon Sep 17 00:00:00 2001
From: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
Date: Wed, 10 Jun 2026 10:56:17 +0530
Subject: [PATCH 16/34] fix: populate general settings form on hard reload
 (#14685)

---
 .../routes/dashboard/settings/account/Index.vue      | 12 +++++++++++-
 .../settings/account/components/AccountId.vue        |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/app/javascript/dashboard/routes/dashboard/settings/account/Index.vue b/app/javascript/dashboard/routes/dashboard/settings/account/Index.vue
index 0502ebc1b..55c1e7f03 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/account/Index.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/account/Index.vue
@@ -94,8 +94,18 @@ export default {
       return this.getAccount(this.accountId) || {};
     },
   },
+  watch: {
+    'currentAccount.id'(id) {
+      if (id) {
+        this.initializeAccount();
+      }
+    },
+  },
   mounted() {
-    this.initializeAccount();
+    // Account already in the store (navigated in): seed immediately.
+    if (this.currentAccount.id) {
+      this.initializeAccount();
+    }
   },
   methods: {
     async initializeAccount() {
diff --git a/app/javascript/dashboard/routes/dashboard/settings/account/components/AccountId.vue b/app/javascript/dashboard/routes/dashboard/settings/account/components/AccountId.vue
index f02efcdc2..941d79fb1 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/account/components/AccountId.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/account/components/AccountId.vue
@@ -8,7 +8,7 @@ import SectionLayout from './SectionLayout.vue';
 const { t } = useI18n();
 const { currentAccount } = useAccount();
 
-const getAccountId = computed(() => currentAccount.value.id.toString());
+const getAccountId = computed(() => currentAccount.value?.id?.toString());
 </script>
 
 <template>

From 72a59e4795804775d6babacbd584e498572035f2 Mon Sep 17 00:00:00 2001
From: Vishnu Narayanan <iamwishnu@gmail.com>
Date: Wed, 10 Jun 2026 12:33:46 +0530
Subject: [PATCH 17/34] fix: update oauth dependencies (#14691)

Updates the locked OAuth dependencies to patched versions so bundle
audit no longer reports the current OAuth advisories.

What changed
- Updated `oauth` from `1.1.0` to `1.1.6` for `GHSA-prq8-7wvh-44qh`.
- Updated `oauth2` from `2.0.9` to `2.0.22` for `GHSA-pp92-crg2-gfv9`.
- Accepted Bundler's required transitive lockfile updates for the
patched OAuth gems.

How to test
1. Run `bundle exec bundle audit update && bundle exec bundle audit
check -v` and confirm no vulnerabilities are reported.
2. Smoke test OAuth-based authentication and email integration flows.

Co-authored-by: Shivam Mishra <scm.mymail@gmail.com>
---
 Gemfile.lock                                  | 51 +++++++++++--------
 .../base_refresh_oauth_token_service.rb       |  2 +
 2 files changed, 33 insertions(+), 20 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index ad2a96921..141afc122 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -136,6 +136,8 @@ GEM
     audited (5.4.1)
       activerecord (>= 5.0, < 7.7)
       activesupport (>= 5.0, < 7.7)
+    auth-sanitizer (0.2.1)
+      version_gem (~> 1.1, >= 1.1.10)
     aws-actionmailbox-ses (0.1.0)
       actionmailbox (>= 7.1.0)
       aws-sdk-s3 (~> 1, >= 1.123.0)
@@ -168,7 +170,7 @@ GEM
     base64 (0.3.0)
     bcrypt (3.1.22)
     benchmark (0.4.1)
-    bigdecimal (3.2.2)
+    bigdecimal (3.3.1)
     bindex (0.8.1)
     bootsnap (1.16.0)
       msgpack (~> 1.2)
@@ -184,6 +186,7 @@ GEM
       bundler (>= 1.2.0, < 3)
       thor (~> 1.0)
     byebug (11.1.3)
+    cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     cld3 (3.7.0)
@@ -312,7 +315,7 @@ GEM
       hashie
     faraday-multipart (1.2.0)
       multipart-post (~> 2.0)
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
       net-http (~> 0.5)
     faraday-net_http_persistent (2.1.0)
       faraday (~> 2.5)
@@ -435,7 +438,8 @@ GEM
     hana (1.3.7)
     hash_diff (1.1.1)
     hashdiff (1.1.0)
-    hashie (5.0.0)
+    hashie (5.1.0)
+      logger
     html2text (0.4.0)
       nokogiri (>= 1.0, < 2.0)
     http (5.1.1)
@@ -470,7 +474,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    json (2.19.5)
+    json (2.19.8)
     json_refs (0.1.8)
       hana
     json_schemer (0.2.24)
@@ -568,7 +572,7 @@ GEM
       ruby2_keywords
     msgpack (1.8.0)
     multi_json (1.15.0)
-    multi_xml (0.8.0)
+    multi_xml (0.9.1)
       bigdecimal (>= 3.1, < 5)
     multipart-post (2.4.1)
     mutex_m (0.3.0)
@@ -603,19 +607,26 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.3-x86_64-linux-gnu)
       racc (~> 1.4)
-    oauth (1.1.0)
-      oauth-tty (~> 1.0, >= 1.0.1)
-      snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
-    oauth-tty (1.0.5)
-      version_gem (~> 1.1, >= 1.1.1)
-    oauth2 (2.0.9)
-      faraday (>= 0.17.3, < 3.0)
-      jwt (>= 1.0, < 3.0)
+    oauth (1.1.6)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
+      base64 (~> 0.1)
+      cgi
+      oauth-tty (~> 1.0, >= 1.0.8)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
+    oauth-tty (1.0.8)
+      auth-sanitizer (~> 0.1, >= 0.1.3)
+      cgi
+      version_gem (~> 1.1, >= 1.1.9)
+    oauth2 (2.0.22)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
-      snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
     oj (3.16.10)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
@@ -935,9 +946,9 @@ GEM
       gli
       hashie
       logger
-    snaky_hash (2.0.1)
-      hashie
-      version_gem (~> 1.1, >= 1.1.1)
+    snaky_hash (2.0.5)
+      hashie (>= 0.1.0, < 6)
+      version_gem (>= 1.1.8, < 3)
     sorbet-runtime (0.5.11934)
     spring (4.1.1)
     spring-watcher-listen (2.1.0)
@@ -995,7 +1006,7 @@ GEM
     valid_email2 (5.2.6)
       activemodel (>= 3.2)
       mail (~> 2.5)
-    version_gem (1.1.4)
+    version_gem (1.1.11)
     vite_rails (3.10.0)
       railties (>= 5.1, < 9)
       vite_ruby (~> 3.0, >= 3.2.2)
diff --git a/app/services/base_refresh_oauth_token_service.rb b/app/services/base_refresh_oauth_token_service.rb
index caf4a839c..1e89c212c 100644
--- a/app/services/base_refresh_oauth_token_service.rb
+++ b/app/services/base_refresh_oauth_token_service.rb
@@ -23,6 +23,8 @@ class BaseRefreshOauthTokenService
   # Refresh the access tokens using the refresh token
   # Refer: https://github.com/microsoftgraph/msgraph-sample-rubyrailsapp/tree/b4a6869fe4a438cde42b161196484a929f1bee46
   def refresh_tokens
+    raise 'A refresh_token is not available' if provider_config[:refresh_token].blank?
+
     oauth_strategy = build_oauth_strategy
     token_service = build_token_service(oauth_strategy)
 

From 3dfb5061e13395e290625a9d9b2f60d78818e92b Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Wed, 10 Jun 2026 14:01:30 +0530
Subject: [PATCH 18/34] refactor: route captain custom tool requests through
 SafeFetch (#14620)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Captain custom tools previously used their own hand-rolled `Net::HTTP`
request code. This moves them onto `SafeFetch`, the same shared
HTTP-fetching helper already used by webhooks, uploads, avatar imports,
and the Captain page crawler. Behavior for normal tools is unchanged —
they just now share one consistent path for host resolution, timeouts,
response size limits, and redirect handling.

**What changed**
- `HttpTool#execute_http_request` now delegates to `SafeFetch.fetch`
instead of building `Net::HTTP` requests by hand. Auth headers, basic
auth, metadata headers, JSON content-type, and the 1 MB response cap all
map onto `SafeFetch` options.
- Removed ~80 lines of bespoke request/validation plumbing from
`HttpTool`.
- The custom tools `test` endpoint now reads the response body string
directly (the executor returns the body rather than a response object).

**How to test**
1. Enable `custom_tools` (or `captain_integration_v2`) for an account.
2. Create a Captain custom tool pointing at a public HTTPS endpoint
(e.g. a test API).
3. Use the **Test** button in the tool form — you should get a success
result.
4. Run the tool from a Captain conversation and confirm the response is
returned/templated as before.

**Gotchas**
- **Local dev:** `SafeFetch` blocks requests to private/loopback
addresses by default. If you're testing a custom tool against a service
on `localhost` or a private IP during development, set
`SAFE_FETCH_ALLOW_PRIVATE_NETWORK=true` or the request will be rejected.
(This matches how the rest of `SafeFetch` already behaves locally.)
- **Test endpoint status field:** on success the `test` response now
reports `status: 200` rather than the exact 2xx code (201/204/etc.),
because `SafeFetch` signals success-vs-failure rather than exposing the
raw response. The UI only checks the 2xx range, so this is invisible
there — but worth knowing if anything consumes the API directly.
- **Non-2xx responses** still surface as an error (same as before), now
via `SafeFetch::HttpError`.
---
 .../captain/custom_tools_controller.rb        |  4 +-
 enterprise/lib/captain/tools/http_tool.rb     | 97 ++++---------------
 2 files changed, 22 insertions(+), 79 deletions(-)

diff --git a/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb
index fab952960..874197870 100644
--- a/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb
+++ b/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb
@@ -27,8 +27,8 @@ class Api::V1::Accounts::Captain::CustomToolsController < Api::V1::Accounts::Bas
 
   def test
     tool = account_custom_tools.new(custom_tool_params)
-    result = execute_test_request(tool)
-    render json: { status: result.code.to_i, body: result.body.to_s.truncate(500) }
+    body = execute_test_request(tool)
+    render json: { status: 200, body: body.to_s.truncate(500) }
   rescue StandardError => e
     render json: { error: e.message }, status: :unprocessable_content
   end
diff --git a/enterprise/lib/captain/tools/http_tool.rb b/enterprise/lib/captain/tools/http_tool.rb
index b4593d27f..18ebcf53a 100644
--- a/enterprise/lib/captain/tools/http_tool.rb
+++ b/enterprise/lib/captain/tools/http_tool.rb
@@ -15,8 +15,8 @@ class Captain::Tools::HttpTool < Agents::Tool
     url = @custom_tool.build_request_url(params)
     body = @custom_tool.build_request_body(params)
 
-    response = execute_http_request(url, body, tool_context)
-    @custom_tool.format_response(response.body)
+    response_body = execute_http_request(url, body, tool_context)
+    @custom_tool.format_response(response_body)
   rescue StandardError => e
     Rails.logger.error("HttpTool execution error for #{@custom_tool.slug}: #{e.class} - #{e.message}")
     'An error occurred while executing the request'
@@ -24,89 +24,32 @@ class Captain::Tools::HttpTool < Agents::Tool
 
   private
 
-  PRIVATE_IP_RANGES = [
-    IPAddr.new('127.0.0.0/8'),    # IPv4 Loopback
-    IPAddr.new('10.0.0.0/8'),     # IPv4 Private network
-    IPAddr.new('172.16.0.0/12'),  # IPv4 Private network
-    IPAddr.new('192.168.0.0/16'), # IPv4 Private network
-    IPAddr.new('169.254.0.0/16'), # IPv4 Link-local
-    IPAddr.new('::1'),            # IPv6 Loopback
-    IPAddr.new('fc00::/7'),       # IPv6 Unique local addresses
-    IPAddr.new('fe80::/10')       # IPv6 Link-local
-  ].freeze
-
   # Limit response size to prevent memory exhaustion and match LLM token limits
   # 1MB of text ≈ 250K tokens, which exceeds most LLM context windows
   MAX_RESPONSE_SIZE = 1.megabyte
 
+  # Route through SafeFetch so custom tool requests share the app's centralized HTTP
+  # fetching (resolution, timeouts, response size limits, and redirect handling).
   def execute_http_request(url, body, tool_context)
-    uri = URI.parse(url)
+    json_body = body if @custom_tool.http_method == 'POST'
 
-    # Check if resolved IP is private
-    check_private_ip!(uri.host)
-
-    http = Net::HTTP.new(uri.host, uri.port)
-    http.use_ssl = uri.scheme == 'https'
-    http.read_timeout = 30
-    http.open_timeout = 10
-    http.max_retries = 0 # Disable redirects
-
-    request = build_http_request(uri, body)
-    apply_authentication(request)
-    apply_metadata_headers(request, tool_context)
-
-    response = http.request(request)
-
-    raise "HTTP request failed with status #{response.code}" unless response.is_a?(Net::HTTPSuccess)
-
-    validate_response!(response)
-
-    response
+    response_body = +''
+    SafeFetch.fetch(
+      url,
+      method: @custom_tool.http_method == 'POST' ? :post : :get,
+      body: json_body,
+      headers: request_headers(tool_context, json_body),
+      http_basic_authentication: @custom_tool.build_basic_auth_credentials,
+      max_bytes: MAX_RESPONSE_SIZE,
+      validate_content_type: false
+    ) { |result| response_body = result.tempfile.read }
+    response_body
   end
 
-  def check_private_ip!(hostname)
-    ip_address = IPAddr.new(Resolv.getaddress(hostname))
-
-    raise 'Request blocked: hostname resolves to private IP address' if PRIVATE_IP_RANGES.any? { |range| range.include?(ip_address) }
-  rescue Resolv::ResolvError, SocketError => e
-    raise "DNS resolution failed: #{e.message}"
-  end
-
-  def validate_response!(response)
-    content_length = response['content-length']&.to_i
-    if content_length && content_length > MAX_RESPONSE_SIZE
-      raise "Response size #{content_length} bytes exceeds maximum allowed #{MAX_RESPONSE_SIZE} bytes"
-    end
-
-    return unless response.body && response.body.bytesize > MAX_RESPONSE_SIZE
-
-    raise "Response body size #{response.body.bytesize} bytes exceeds maximum allowed #{MAX_RESPONSE_SIZE} bytes"
-  end
-
-  def build_http_request(uri, body)
-    if @custom_tool.http_method == 'POST'
-      request = Net::HTTP::Post.new(uri.request_uri)
-      if body
-        request.body = body
-        request['Content-Type'] = 'application/json'
-      end
-    else
-      request = Net::HTTP::Get.new(uri.request_uri)
-    end
-    request
-  end
-
-  def apply_authentication(request)
+  def request_headers(tool_context, json_body)
     headers = @custom_tool.build_auth_headers
-    headers.each { |key, value| request[key] = value }
-
-    credentials = @custom_tool.build_basic_auth_credentials
-    request.basic_auth(*credentials) if credentials
-  end
-
-  def apply_metadata_headers(request, tool_context)
-    state = tool_context&.state || {}
-    metadata_headers = @custom_tool.build_metadata_headers(state)
-    metadata_headers.each { |key, value| request[key] = value }
+    headers.merge!(@custom_tool.build_metadata_headers(tool_context&.state || {}))
+    headers['Content-Type'] = 'application/json' if json_body.present?
+    headers
   end
 end

From f93f2067b6fed98a8b8b8e9b20b359314da548b7 Mon Sep 17 00:00:00 2001
From: Tanmay Deep Sharma <32020192+tds-1@users.noreply.github.com>
Date: Wed, 10 Jun 2026 14:52:30 +0530
Subject: [PATCH 19/34] fix(whatsapp): Drop obsolete WABA scope check broken by
 Meta embedded signup (#14697)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

Fixes WhatsApp embedded signup failing with "No WABA scope found in
token." Meta recently changed which scopes embedded-signup tokens carry
(whatsapp_business_manage_events instead of
whatsapp_business_management), which tripped a brittle scope-string
check. That check was redundant anyway — PhoneInfoService already
verifies the token's access to the specific WABA by calling its
/phone_numbers endpoint right before it. This removes the obsolete
TokenValidationService and relies on the functional check.

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)

## Checklist:

- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my code
- [ ] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules

Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
---
 .../whatsapp/embedded_signup_service.rb       |  5 -
 .../whatsapp/token_validation_service.rb      | 42 --------
 .../whatsapp/embedded_signup_service_spec.rb  |  5 -
 .../whatsapp/token_validation_service_spec.rb | 99 -------------------
 4 files changed, 151 deletions(-)
 delete mode 100644 app/services/whatsapp/token_validation_service.rb
 delete mode 100644 spec/services/whatsapp/token_validation_service_spec.rb

diff --git a/app/services/whatsapp/embedded_signup_service.rb b/app/services/whatsapp/embedded_signup_service.rb
index 1a5b13c8f..2e8a5028e 100644
--- a/app/services/whatsapp/embedded_signup_service.rb
+++ b/app/services/whatsapp/embedded_signup_service.rb
@@ -13,7 +13,6 @@ class Whatsapp::EmbeddedSignupService
 
     access_token = exchange_code_for_token
     phone_info = fetch_phone_info(access_token)
-    validate_token_access(access_token)
 
     channel = create_or_reauthorize_channel(access_token, phone_info)
     # NOTE: We call setup_webhooks explicitly here instead of relying on after_commit callback because:
@@ -42,10 +41,6 @@ class Whatsapp::EmbeddedSignupService
     Whatsapp::PhoneInfoService.new(@waba_id, @phone_number_id, access_token).perform
   end
 
-  def validate_token_access(access_token)
-    Whatsapp::TokenValidationService.new(access_token, @waba_id).perform
-  end
-
   def create_or_reauthorize_channel(access_token, phone_info)
     if @inbox_id.present?
       Whatsapp::ReauthorizationService.new(
diff --git a/app/services/whatsapp/token_validation_service.rb b/app/services/whatsapp/token_validation_service.rb
deleted file mode 100644
index 863f9da51..000000000
--- a/app/services/whatsapp/token_validation_service.rb
+++ /dev/null
@@ -1,42 +0,0 @@
-class Whatsapp::TokenValidationService
-  def initialize(access_token, waba_id)
-    @access_token = access_token
-    @waba_id = waba_id
-    @api_client = Whatsapp::FacebookApiClient.new(access_token)
-  end
-
-  def perform
-    validate_parameters!
-    validate_token_waba_access
-  end
-
-  private
-
-  def validate_parameters!
-    raise ArgumentError, 'Access token is required' if @access_token.blank?
-    raise ArgumentError, 'WABA ID is required' if @waba_id.blank?
-  end
-
-  def validate_token_waba_access
-    token_debug_data = @api_client.debug_token(@access_token)
-    waba_scope = extract_waba_scope(token_debug_data)
-    verify_waba_authorization(waba_scope)
-  end
-
-  def extract_waba_scope(token_data)
-    granular_scopes = token_data.dig('data', 'granular_scopes')
-    waba_scope = granular_scopes&.find { |scope| scope['scope'] == 'whatsapp_business_management' }
-
-    raise 'No WABA scope found in token' unless waba_scope
-
-    waba_scope
-  end
-
-  def verify_waba_authorization(waba_scope)
-    authorized_waba_ids = waba_scope['target_ids'] || []
-
-    return if authorized_waba_ids.include?(@waba_id)
-
-    raise "Token does not have access to WABA #{@waba_id}. Authorized WABAs: #{authorized_waba_ids}"
-  end
-end
diff --git a/spec/services/whatsapp/embedded_signup_service_spec.rb b/spec/services/whatsapp/embedded_signup_service_spec.rb
index a20e36ac8..560b1993e 100644
--- a/spec/services/whatsapp/embedded_signup_service_spec.rb
+++ b/spec/services/whatsapp/embedded_signup_service_spec.rb
@@ -36,11 +36,6 @@ describe Whatsapp::EmbeddedSignupService do
         .with(params[:waba_id], params[:phone_number_id], access_token).and_return(phone_service)
       allow(phone_service).to receive(:perform).and_return(phone_info)
 
-      validation_service = instance_double(Whatsapp::TokenValidationService)
-      allow(Whatsapp::TokenValidationService).to receive(:new)
-        .with(access_token, params[:waba_id]).and_return(validation_service)
-      allow(validation_service).to receive(:perform)
-
       channel_creation = instance_double(Whatsapp::ChannelCreationService)
       allow(Whatsapp::ChannelCreationService).to receive(:new)
         .with(account, { waba_id: params[:waba_id], business_name: 'Test Business' }, phone_info, access_token)
diff --git a/spec/services/whatsapp/token_validation_service_spec.rb b/spec/services/whatsapp/token_validation_service_spec.rb
deleted file mode 100644
index d9cf40257..000000000
--- a/spec/services/whatsapp/token_validation_service_spec.rb
+++ /dev/null
@@ -1,99 +0,0 @@
-require 'rails_helper'
-
-describe Whatsapp::TokenValidationService do
-  let(:access_token) { 'test_access_token' }
-  let(:waba_id) { 'test_waba_id' }
-  let(:service) { described_class.new(access_token, waba_id) }
-  let(:api_client) { instance_double(Whatsapp::FacebookApiClient) }
-
-  before do
-    allow(Whatsapp::FacebookApiClient).to receive(:new).with(access_token).and_return(api_client)
-  end
-
-  describe '#perform' do
-    context 'when token has access to WABA' do
-      let(:debug_response) do
-        {
-          'data' => {
-            'granular_scopes' => [
-              {
-                'scope' => 'whatsapp_business_management',
-                'target_ids' => [waba_id, 'another_waba_id']
-              }
-            ]
-          }
-        }
-      end
-
-      before do
-        allow(api_client).to receive(:debug_token).with(access_token).and_return(debug_response)
-      end
-
-      it 'validates successfully' do
-        expect { service.perform }.not_to raise_error
-      end
-    end
-
-    context 'when token does not have access to WABA' do
-      let(:debug_response) do
-        {
-          'data' => {
-            'granular_scopes' => [
-              {
-                'scope' => 'whatsapp_business_management',
-                'target_ids' => ['different_waba_id']
-              }
-            ]
-          }
-        }
-      end
-
-      before do
-        allow(api_client).to receive(:debug_token).with(access_token).and_return(debug_response)
-      end
-
-      it 'raises an error' do
-        expect { service.perform }.to raise_error(/Token does not have access to WABA/)
-      end
-    end
-
-    context 'when no WABA scope is found' do
-      let(:debug_response) do
-        {
-          'data' => {
-            'granular_scopes' => [
-              {
-                'scope' => 'some_other_scope',
-                'target_ids' => ['some_id']
-              }
-            ]
-          }
-        }
-      end
-
-      before do
-        allow(api_client).to receive(:debug_token).with(access_token).and_return(debug_response)
-      end
-
-      it 'raises an error' do
-        expect { service.perform }.to raise_error('No WABA scope found in token')
-      end
-    end
-
-    context 'when access_token is blank' do
-      let(:access_token) { '' }
-
-      it 'raises ArgumentError' do
-        expect { service.perform }.to raise_error(ArgumentError, 'Access token is required')
-      end
-    end
-
-    context 'when waba_id is blank' do
-      let(:waba_id) { '' }
-
-      it 'raises ArgumentError' do
-        expect { service.perform }.to raise_error(ArgumentError, 'WABA ID is required')
-      end
-    end
-  end
-end

From d9c07fe2e9c2e133423b96b5e9ae4c7d6618abbc Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Wed, 10 Jun 2026 16:24:37 +0530
Subject: [PATCH 20/34] feat: expose onboarding help center generation status
 (#14671)

This PR adds a reload-safe onboarding Help Center generation status
path. Previously, generation progress was pushed through ActionCable,
which meant the onboarding UI could lose context after a page reload or
missed websocket event. The new endpoint exposes the current generation
id, raw Redis generation state, and Help Center article/category counts
so clients can recover state by fetching from the backend.

**What changed**

- Added an onboarding Help Center generation status endpoint.
- Persisted `help_center_generation_id` when generation is enqueued.
- Removed Help Center generation ActionCable broadcasts completely.
- Kept generation progress in Redis as the backend source of truth.
- Kept Help Center generation out of the onboarding hot path; the
existing onboarding controller does not start generation yet.

**How to test**

1. Start Help Center generation for an account.
2. Fetch the onboarding generation status endpoint and verify it returns
the generation id, Redis state, and article/category counts.
3. Reload the onboarding UI or client state and fetch again to confirm
progress can be recovered without relying on websocket events.
4. Verify skipped/completed generation states are reflected from Redis.

## Related PRs

- https://github.com/chatwoot/chatwoot/pull/14569
- https://github.com/chatwoot/chatwoot/pull/14568
- https://github.com/chatwoot/chatwoot/pull/14567
- https://github.com/chatwoot/chatwoot/pull/14619
- https://github.com/chatwoot/chatwoot/pull/14565 (Primary onboarding
PR)
---
 .../api/v1/accounts/onboardings_controller.rb | 15 ++++++
 app/javascript/dashboard/api/onboarding.js    |  4 ++
 .../api/v1/models/_account.json.jbuilder      |  3 ++
 config/routes.rb                              |  4 +-
 .../api/v1/accounts/onboardings_controller.rb | 38 +++++++++++++
 .../help_center_article_generation_job.rb     | 13 ++---
 .../help_center_article_writer_job.rb         | 34 ++++--------
 .../onboarding/help_center_broadcaster.rb     | 29 ----------
 .../help_center_creation_service.rb           |  1 +
 .../accounts/onboardings_controller_spec.rb   | 36 +++++++++++++
 .../builders/saml_user_builder_spec.rb        |  8 +--
 .../accounts/onboardings_controller_spec.rb   | 42 +++++++++++++++
 ...help_center_article_generation_job_spec.rb | 27 ++--------
 .../help_center_article_writer_job_spec.rb    | 54 +++----------------
 spec/jobs/mutex_application_job_spec.rb       |  4 +-
 15 files changed, 174 insertions(+), 138 deletions(-)
 create mode 100644 enterprise/app/controllers/enterprise/api/v1/accounts/onboardings_controller.rb
 delete mode 100644 enterprise/app/services/onboarding/help_center_broadcaster.rb
 create mode 100644 spec/enterprise/controllers/api/v1/accounts/onboardings_controller_spec.rb

diff --git a/app/controllers/api/v1/accounts/onboardings_controller.rb b/app/controllers/api/v1/accounts/onboardings_controller.rb
index 77c6245ea..181e4965e 100644
--- a/app/controllers/api/v1/accounts/onboardings_controller.rb
+++ b/app/controllers/api/v1/accounts/onboardings_controller.rb
@@ -16,6 +16,10 @@ class Api::V1::Accounts::OnboardingsController < Api::V1::Accounts::BaseControll
     render 'api/v1/accounts/update', format: :json
   end
 
+  def help_center_generation
+    render json: help_center_generation_status
+  end
+
   private
 
   def finalizing_account_details?
@@ -33,4 +37,15 @@ class Api::V1::Accounts::OnboardingsController < Api::V1::Accounts::BaseControll
   def custom_attributes_params
     params.permit(:industry, :company_size, :timezone, :referral_source, :user_role, :website)
   end
+
+  def help_center_generation_status
+    {
+      generation_id: nil,
+      state: nil,
+      articles_count: 0,
+      categories_count: 0
+    }
+  end
 end
+
+Api::V1::Accounts::OnboardingsController.prepend_mod_with('Api::V1::Accounts::OnboardingsController')
diff --git a/app/javascript/dashboard/api/onboarding.js b/app/javascript/dashboard/api/onboarding.js
index 2bc098eef..e15d16da3 100644
--- a/app/javascript/dashboard/api/onboarding.js
+++ b/app/javascript/dashboard/api/onboarding.js
@@ -9,6 +9,10 @@ class OnboardingAPI extends ApiClient {
   update(data) {
     return axios.patch(this.url, data);
   }
+
+  getHelpCenterGeneration() {
+    return axios.get(`${this.url}/help_center_generation`);
+  }
 }
 
 export default new OnboardingAPI();
diff --git a/app/views/api/v1/models/_account.json.jbuilder b/app/views/api/v1/models/_account.json.jbuilder
index 7506592ba..02b3480d5 100644
--- a/app/views/api/v1/models/_account.json.jbuilder
+++ b/app/views/api/v1/models/_account.json.jbuilder
@@ -14,6 +14,9 @@ if resource.custom_attributes.present?
     json.referral_source resource.custom_attributes['referral_source'] if resource.custom_attributes['referral_source'].present?
     json.brand_info resource.custom_attributes['brand_info'] if resource.custom_attributes['brand_info'].present?
     json.onboarding_step resource.onboarding_step if resource.onboarding_step.present?
+    if resource.custom_attributes['help_center_generation_id'].present?
+      json.help_center_generation_id resource.custom_attributes['help_center_generation_id']
+    end
     json.marked_for_deletion_at resource.custom_attributes['marked_for_deletion_at'] if resource.custom_attributes['marked_for_deletion_at'].present?
     if resource.custom_attributes['marked_for_deletion_reason'].present?
       json.marked_for_deletion_reason resource.custom_attributes['marked_for_deletion_reason']
diff --git a/config/routes.rb b/config/routes.rb
index 351808744..d78831343 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -55,7 +55,9 @@ Rails.application.routes.draw do
             resource :contact_merge, only: [:create]
           end
           resource :bulk_actions, only: [:create]
-          resource :onboarding, only: [:update]
+          resource :onboarding, only: [:update] do
+            get :help_center_generation
+          end
           resources :agents, only: [:index, :create, :update, :destroy] do
             post :bulk_create, on: :collection
           end
diff --git a/enterprise/app/controllers/enterprise/api/v1/accounts/onboardings_controller.rb b/enterprise/app/controllers/enterprise/api/v1/accounts/onboardings_controller.rb
new file mode 100644
index 000000000..1311bc3fc
--- /dev/null
+++ b/enterprise/app/controllers/enterprise/api/v1/accounts/onboardings_controller.rb
@@ -0,0 +1,38 @@
+module Enterprise::Api::V1::Accounts::OnboardingsController
+  def help_center_generation
+    @account = Current.account
+    render json: help_center_generation_status
+  end
+
+  private
+
+  def help_center_generation_status
+    generation_id = help_center_generation_id
+    return super if generation_id.blank?
+
+    state = Onboarding::HelpCenterGenerationState.current(generation_id)
+
+    {
+      generation_id: generation_id,
+      state: state,
+      articles_count: articles_count,
+      categories_count: categories_count
+    }
+  end
+
+  def help_center_generation_id
+    @account.custom_attributes['help_center_generation_id']
+  end
+
+  def articles_count
+    onboarding_portal&.articles&.count || 0
+  end
+
+  def categories_count
+    onboarding_portal&.categories&.count || 0
+  end
+
+  def onboarding_portal
+    @onboarding_portal ||= @account.portals.first
+  end
+end
diff --git a/enterprise/app/jobs/onboarding/help_center_article_generation_job.rb b/enterprise/app/jobs/onboarding/help_center_article_generation_job.rb
index ed561d668..b5f7eb247 100644
--- a/enterprise/app/jobs/onboarding/help_center_article_generation_job.rb
+++ b/enterprise/app/jobs/onboarding/help_center_article_generation_job.rb
@@ -2,10 +2,10 @@ class Onboarding::HelpCenterArticleGenerationJob < ApplicationJob
   queue_as :low
 
   retry_on Firecrawl::FirecrawlError, wait: :polynomially_longer, attempts: 3 do |job, error|
-    _account_id, _portal_id, user_id, generation_id = job.arguments
+    _account_id, _portal_id, _user_id, generation_id = job.arguments
     reason = "firecrawl exhausted: #{error.message}"
     Rails.logger.warn "[HelpCenterGenerationJob] gen=#{generation_id} #{reason}"
-    job.send(:skip_and_broadcast, user: User.find_by(id: user_id), generation_id: generation_id, reason: reason)
+    job.send(:skip_generation, generation_id: generation_id, reason: reason)
   end
 
   def perform(account_id, portal_id, user_id, generation_id)
@@ -19,7 +19,7 @@ class Onboarding::HelpCenterArticleGenerationJob < ApplicationJob
     )
   rescue Onboarding::HelpCenterErrors::CurationSkipped => e
     Rails.logger.info "[HelpCenterGenerationJob] gen=#{generation_id} skipped: #{e.message}"
-    skip_and_broadcast(user: User.find_by(id: user_id), generation_id: generation_id, reason: e.message)
+    skip_generation(generation_id: generation_id, reason: e.message)
   end
 
   private
@@ -89,15 +89,12 @@ class Onboarding::HelpCenterArticleGenerationJob < ApplicationJob
   def enqueue_writer_jobs(account_id:, portal_id:, user_id:, generation_id:, articles:)
     articles.each do |article|
       Onboarding::HelpCenterArticleWriterJob.perform_later(
-        account_id, portal_id, user_id, generation_id, { article: article }
+        account_id, portal_id, user_id, generation_id, article
       )
     end
   end
 
-  def skip_and_broadcast(user:, generation_id:, reason:)
+  def skip_generation(generation_id:, reason:)
     Onboarding::HelpCenterGenerationState.skip(generation_id, reason: reason)
-    Onboarding::HelpCenterBroadcaster.completed(
-      user: user, generation_id: generation_id, status: 'skipped', skip_reason: reason
-    )
   end
 end
diff --git a/enterprise/app/jobs/onboarding/help_center_article_writer_job.rb b/enterprise/app/jobs/onboarding/help_center_article_writer_job.rb
index 2c25b86e9..68c218a19 100644
--- a/enterprise/app/jobs/onboarding/help_center_article_writer_job.rb
+++ b/enterprise/app/jobs/onboarding/help_center_article_writer_job.rb
@@ -9,43 +9,27 @@ class Onboarding::HelpCenterArticleWriterJob < ApplicationJob
     job.send(:on_writer_failure, error)
   end
 
-  def perform(account_id, portal_id, user_id, generation_id, article_payload)
-    user = User.find(user_id)
-    payload = article_payload.with_indifferent_access
-    article = Onboarding::HelpCenterArticleBuilder.new(
+  def perform(account_id, portal_id, user_id, generation_id, article)
+    Onboarding::HelpCenterArticleBuilder.new(
       account: Account.find(account_id),
       portal: Portal.find(portal_id),
-      user: user,
-      article: payload[:article]
+      user: User.find(user_id),
+      article: article
     ).perform
 
-    finalize(user: user, generation_id: generation_id, article: article)
+    finalize(generation_id: generation_id)
   end
 
   private
 
   def on_writer_failure(error)
-    user, generation_id = failure_context
+    generation_id = arguments[3]
     Rails.logger.warn "[HelpCenterWriterJob] gen=#{generation_id} failed: #{error.class} #{error.message}"
-    finalize(user: user, generation_id: generation_id, article: nil)
+    finalize(generation_id: generation_id)
   end
 
-  def failure_context
-    _account_id, _portal_id, user_id, generation_id = arguments
-    [User.find_by(id: user_id), generation_id]
-  end
-
-  def finalize(user:, generation_id:, article:)
-    result = Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
-
-    if article
-      Onboarding::HelpCenterBroadcaster.article_generated(
-        user: user, generation_id: generation_id, article: article, articles_finished: result[:finished]
-      )
-    end
-    return unless result[:completed]
-
-    Onboarding::HelpCenterBroadcaster.completed(user: user, generation_id: generation_id, status: 'completed')
+  def finalize(generation_id:)
+    Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
   rescue Onboarding::HelpCenterGenerationState::Missing => e
     Rails.logger.warn "[HelpCenterWriterJob] gen=#{generation_id} #{e.message}"
   end
diff --git a/enterprise/app/services/onboarding/help_center_broadcaster.rb b/enterprise/app/services/onboarding/help_center_broadcaster.rb
deleted file mode 100644
index e12ed4287..000000000
--- a/enterprise/app/services/onboarding/help_center_broadcaster.rb
+++ /dev/null
@@ -1,29 +0,0 @@
-module Onboarding::HelpCenterBroadcaster
-  ARTICLE_GENERATED = 'help_center.article_generated'.freeze
-  GENERATION_COMPLETED = 'help_center.generation_completed'.freeze
-
-  module_function
-
-  def article_generated(user:, generation_id:, article:, articles_finished:)
-    broadcast(user, ARTICLE_GENERATED, {
-                generation_id: generation_id,
-                article_id: article.id,
-                articles_finished: articles_finished
-              })
-  end
-
-  def completed(user:, generation_id:, status:, skip_reason: nil)
-    broadcast(user, GENERATION_COMPLETED, {
-                generation_id: generation_id,
-                status: status,
-                skip_reason: skip_reason
-              })
-  end
-
-  def broadcast(user, event, payload)
-    token = user&.pubsub_token
-    return if token.blank?
-
-    ActionCableBroadcastJob.perform_later([token], event, payload)
-  end
-end
diff --git a/enterprise/app/services/onboarding/help_center_creation_service.rb b/enterprise/app/services/onboarding/help_center_creation_service.rb
index 7ccd9bff3..9bbf053b5 100644
--- a/enterprise/app/services/onboarding/help_center_creation_service.rb
+++ b/enterprise/app/services/onboarding/help_center_creation_service.rb
@@ -77,6 +77,7 @@ class Onboarding::HelpCenterCreationService
 
     generation_id = SecureRandom.uuid
     Onboarding::HelpCenterArticleGenerationJob.perform_later(@account.id, portal.id, @user.id, generation_id)
+    @account.update!(custom_attributes: @account.custom_attributes.merge('help_center_generation_id' => generation_id))
   rescue StandardError => e
     Rails.logger.error "[HelpCenterCreation] Failed to enqueue article generation for account #{@account.id}: #{e.class} - #{e.message}"
   end
diff --git a/spec/controllers/api/v1/accounts/onboardings_controller_spec.rb b/spec/controllers/api/v1/accounts/onboardings_controller_spec.rb
index ec2b4dcaa..6f118624b 100644
--- a/spec/controllers/api/v1/accounts/onboardings_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/onboardings_controller_spec.rb
@@ -111,4 +111,40 @@ RSpec.describe 'Onboarding API', type: :request do
       end
     end
   end
+
+  describe 'GET /api/v1/accounts/{account.id}/onboarding/help_center_generation' do
+    context 'when unauthenticated' do
+      it 'returns unauthorized' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation", as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when authenticated as an agent (non-admin)' do
+      let(:agent) { create(:user, account: account, role: :agent) }
+
+      it 'returns unauthorized' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation",
+            headers: agent.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when no help center generation has started' do
+      it 'returns not_started with zero counts' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation",
+            headers: admin.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(response.parsed_body).to include(
+          'generation_id' => nil,
+          'state' => nil,
+          'articles_count' => 0,
+          'categories_count' => 0
+        )
+      end
+    end
+  end
 end
diff --git a/spec/enterprise/builders/saml_user_builder_spec.rb b/spec/enterprise/builders/saml_user_builder_spec.rb
index 9ebaf3a55..d3f3cb601 100644
--- a/spec/enterprise/builders/saml_user_builder_spec.rb
+++ b/spec/enterprise/builders/saml_user_builder_spec.rb
@@ -122,8 +122,8 @@ RSpec.describe SamlUserBuilder do
         it 'does not add the user to the target account' do
           expect do
             builder.perform
-          rescue SamlUserBuilder::AuthenticationFailed
-            nil
+          rescue StandardError => e
+            raise unless e.class.name == 'SamlUserBuilder::AuthenticationFailed' # rubocop:disable Style/ClassEqualityComparison
           end.not_to change(AccountUser, :count)
           expect(existing_user.reload.accounts).not_to include(account)
         end
@@ -131,8 +131,8 @@ RSpec.describe SamlUserBuilder do
         it 'does not convert the user provider to saml' do
           expect do
             builder.perform
-          rescue SamlUserBuilder::AuthenticationFailed
-            nil
+          rescue StandardError => e
+            raise unless e.class.name == 'SamlUserBuilder::AuthenticationFailed' # rubocop:disable Style/ClassEqualityComparison
           end.not_to(change { existing_user.reload.provider })
         end
       end
diff --git a/spec/enterprise/controllers/api/v1/accounts/onboardings_controller_spec.rb b/spec/enterprise/controllers/api/v1/accounts/onboardings_controller_spec.rb
new file mode 100644
index 000000000..59d0564fa
--- /dev/null
+++ b/spec/enterprise/controllers/api/v1/accounts/onboardings_controller_spec.rb
@@ -0,0 +1,42 @@
+require 'rails_helper'
+
+RSpec.describe 'Enterprise Onboarding API', type: :request do
+  let(:account) { create(:account, domain: 'example.com') }
+  let(:admin) { create(:user, account: account, role: :administrator) }
+
+  describe 'GET /api/v1/accounts/{account.id}/onboarding/help_center_generation' do
+    context 'when help center generation is in progress' do
+      let(:generation_id) { 'generation-123' }
+      let!(:portal) { create(:portal, account_id: account.id) }
+      let!(:category) { create(:category, portal: portal, account_id: account.id) }
+
+      before do
+        account.update!(custom_attributes: { 'help_center_generation_id' => generation_id })
+        create(:article, portal: portal, category: category, account_id: account.id, author_id: admin.id)
+        Onboarding::HelpCenterGenerationState.start(generation_id, total: 3)
+        Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
+      end
+
+      after do
+        Redis::Alfred.delete(Onboarding::HelpCenterGenerationState.key(generation_id))
+      end
+
+      it 'returns Redis state and help center counts' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation",
+            headers: admin.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(response.parsed_body).to include(
+          'generation_id' => generation_id,
+          'articles_count' => 1,
+          'categories_count' => 1
+        )
+        expect(response.parsed_body['state']).to include(
+          'status' => 'generating',
+          'finished' => '1',
+          'total' => '3'
+        )
+      end
+    end
+  end
+end
diff --git a/spec/enterprise/jobs/onboarding/help_center_article_generation_job_spec.rb b/spec/enterprise/jobs/onboarding/help_center_article_generation_job_spec.rb
index 62529866d..b281f0c10 100644
--- a/spec/enterprise/jobs/onboarding/help_center_article_generation_job_spec.rb
+++ b/spec/enterprise/jobs/onboarding/help_center_article_generation_job_spec.rb
@@ -53,11 +53,9 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
             admin.id,
             generation_id,
             hash_including(
-              'article' => hash_including(
-                'title' => 'Hello',
-                'urls' => ['https://x.test/a'],
-                'category_id' => portal.categories.first.id
-              )
+              'title' => 'Hello',
+              'urls' => ['https://x.test/a'],
+              'category_id' => portal.categories.first.id
             )
           )
         )
@@ -83,7 +81,7 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
       writer_jobs = enqueued_jobs.select { |job| job['job_class'] == Onboarding::HelpCenterArticleWriterJob.name }
       expect(writer_jobs.size).to eq(1)
       expect(writer_jobs.first['arguments']).to include(
-        hash_including('article' => hash_including('title' => 'Valid'))
+        hash_including('title' => 'Valid')
       )
     end
   end
@@ -106,7 +104,7 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
       writer_jobs = enqueued_jobs.select { |job| job['job_class'] == Onboarding::HelpCenterArticleWriterJob.name }
       expect(writer_jobs.size).to eq(1)
       expect(writer_jobs.first['arguments']).to include(
-        hash_including('article' => hash_including('title' => 'Approved', 'urls' => ['https://x.test/a']))
+        hash_including('title' => 'Approved', 'urls' => ['https://x.test/a'])
       )
       expect(Onboarding::HelpCenterGenerationState.current(generation_id)).to include('total' => '1')
     end
@@ -170,19 +168,4 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
       expect(state['skip_reason']).to include('firecrawl exhausted')
     end
   end
-
-  describe 'broadcasts' do
-    it 'broadcasts generation_completed with status: skipped on CurationSkipped' do
-      curator = instance_double(Onboarding::HelpCenterCurator)
-      allow(curator).to receive(:perform).and_raise(
-        Onboarding::HelpCenterErrors::CurationSkipped, 'no website url'
-      )
-      allow(Onboarding::HelpCenterCurator).to receive(:new).and_return(curator)
-
-      payload = hash_including(generation_id: generation_id, status: 'skipped', skip_reason: 'no website url')
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', payload)
-    end
-  end
 end
diff --git a/spec/enterprise/jobs/onboarding/help_center_article_writer_job_spec.rb b/spec/enterprise/jobs/onboarding/help_center_article_writer_job_spec.rb
index a4db6b1d3..b01ec35e3 100644
--- a/spec/enterprise/jobs/onboarding/help_center_article_writer_job_spec.rb
+++ b/spec/enterprise/jobs/onboarding/help_center_article_writer_job_spec.rb
@@ -6,8 +6,7 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
   let!(:admin) { create(:user, account: account, role: :administrator) }
   let(:generation_id) { 'generation-123' }
   let(:article_spec) { { 'urls' => ['https://x.test/a'], 'title' => 'A', 'category_id' => nil } }
-  let(:article_payload) { { 'article' => article_spec } }
-  let(:job_args) { [account.id, portal.id, admin.id, generation_id, article_payload] }
+  let(:job_args) { [account.id, portal.id, admin.id, generation_id, article_spec] }
   let(:state_key) { Onboarding::HelpCenterGenerationState.key(generation_id) }
 
   before do
@@ -68,16 +67,14 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
       expect(Onboarding::HelpCenterGenerationState.current(generation_id)).to include('finished' => '1')
     end
 
-    it 'broadcasts completion when the final writer fails with ArticleBuildFailed' do
+    it 'marks generation completed when the final writer fails with ArticleBuildFailed' do
       allow(Onboarding::HelpCenterArticleBuilder).to receive(:new).and_raise(
         Onboarding::HelpCenterErrors::ArticleBuildFailed, 'no source urls'
       )
       Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
-      payload = hash_including(generation_id: generation_id, status: 'completed')
 
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', payload)
+      described_class.perform_now(*job_args)
+
       expect(Onboarding::HelpCenterGenerationState.current(generation_id)).to include(
         'status' => 'completed', 'finished' => '2'
       )
@@ -105,7 +102,7 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
     end
   end
 
-  describe 'broadcasts' do
+  describe 'missing state' do
     let(:built_article) { instance_double(Article, id: 9876) }
 
     before do
@@ -113,47 +110,10 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
       allow(Onboarding::HelpCenterArticleBuilder).to receive(:new).and_return(builder)
     end
 
-    it 'broadcasts help_center.article_generated on success' do
-      payload = hash_including(generation_id: generation_id, article_id: 9876, articles_finished: 1)
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.article_generated', payload)
-    end
-
-    it 'broadcasts help_center.generation_completed when the last writer finishes' do
-      described_class.perform_now(*job_args)
-      payload = hash_including(generation_id: generation_id, status: 'completed')
-
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', payload)
-    end
-
-    it 'does not broadcast article_generated on builder failure' do
-      allow(Onboarding::HelpCenterArticleBuilder).to receive(:new).and_raise(
-        Onboarding::HelpCenterErrors::ArticleBuildFailed, 'no source urls'
-      )
-
-      expect { described_class.perform_now(*job_args) }
-        .not_to have_enqueued_job(ActionCableBroadcastJob)
-        .with(anything, 'help_center.article_generated', anything)
-    end
-
-    it 'broadcasts generation_completed on late retries past total' do
-      described_class.perform_now(*job_args)
-      described_class.perform_now(*job_args)
-      clear_enqueued_jobs
-
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', hash_including(generation_id: generation_id))
-    end
-
-    it 'skips progress broadcasts when state is missing' do
+    it 'does not raise when state is missing' do
       Redis::Alfred.delete(state_key)
 
-      expect { described_class.perform_now(*job_args) }
-        .not_to have_enqueued_job(ActionCableBroadcastJob)
+      expect { described_class.perform_now(*job_args) }.not_to raise_error
     end
   end
 end
diff --git a/spec/jobs/mutex_application_job_spec.rb b/spec/jobs/mutex_application_job_spec.rb
index 4c8fa3394..e2c03c55a 100644
--- a/spec/jobs/mutex_application_job_spec.rb
+++ b/spec/jobs/mutex_application_job_spec.rb
@@ -58,7 +58,7 @@ RSpec.describe MutexApplicationJob do
 
   describe '.retry_on_lock_conflict' do
     let(:job_class) do
-      Class.new(described_class) do
+      Class.new(MutexApplicationJob) do
         retry_on_lock_conflict wait: 1.second, attempts: 1, on_exhaustion: :process_without_lock
 
         attr_reader :fallback_args
@@ -90,7 +90,7 @@ RSpec.describe MutexApplicationJob do
 
     context 'without an exhaustion handler' do
       let(:job_class) do
-        Class.new(described_class) do
+        Class.new(MutexApplicationJob) do
           retry_on_lock_conflict wait: 1.second, attempts: 1
 
           def perform(lock_key)

From e6dfb91fcc40ea0df3f36cb50883859db4f7b4bc Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Wed, 10 Jun 2026 16:26:24 +0530
Subject: [PATCH 21/34] refactor: use SafeFetch for website branding page fetch
 (#14693)

---
 app/services/website_branding_service.rb | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/app/services/website_branding_service.rb b/app/services/website_branding_service.rb
index 026b51e0e..178994d1e 100644
--- a/app/services/website_branding_service.rb
+++ b/app/services/website_branding_service.rb
@@ -37,12 +37,18 @@ class WebsiteBrandingService
   private
 
   def fetch_page
-    response = HTTParty.get(@url, follow_redirects: true, timeout: 15)
-    @http_status = response.code
-    return nil unless response.success?
+    body = nil
+    SafeFetch.fetch(@url, validate_content_type: false) do |result|
+      body = result.tempfile.read
+    end
+    @http_status = 200
+    return nil if body.blank?
 
-    Nokogiri::HTML(response.body)
-  rescue StandardError => e
+    Nokogiri::HTML(body)
+  rescue SafeFetch::HttpError => e
+    @http_status = e.message.to_i
+    nil
+  rescue SafeFetch::Error => e
     Rails.logger.error "[WebsiteBranding] Failed to fetch #{@url}: #{e.message}"
     nil
   end

From bec795f764d805d2a49d4a27553ad819aabc84f3 Mon Sep 17 00:00:00 2001
From: Sony Mathew <2040199+sony-mathew@users.noreply.github.com>
Date: Wed, 10 Jun 2026 22:43:22 +0530
Subject: [PATCH 22/34] Bump version to 4.14.2

---
 VERSION_CW     | 2 +-
 config/app.yml | 2 +-
 package.json   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/VERSION_CW b/VERSION_CW
index d2b9909a9..0fb7a35b6 100644
--- a/VERSION_CW
+++ b/VERSION_CW
@@ -1 +1 @@
-4.14.1
+4.14.2
diff --git a/config/app.yml b/config/app.yml
index fec34cd07..c2494befa 100644
--- a/config/app.yml
+++ b/config/app.yml
@@ -1,5 +1,5 @@
 shared: &shared
-  version: '4.14.1'
+  version: '4.14.2'
 
 development:
   <<: *shared
diff --git a/package.json b/package.json
index 41313c8b3..bc51bbd85 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@chatwoot/chatwoot",
-  "version": "4.14.1",
+  "version": "4.14.2",
   "license": "MIT",
   "scripts": {
     "eslint": "eslint app/**/*.{js,vue}",

From c6e5657ee52192112c9913d1de797bcd86b5be8a Mon Sep 17 00:00:00 2001
From: Tanmay Deep Sharma <32020192+tds-1@users.noreply.github.com>
Date: Thu, 11 Jun 2026 11:16:41 +0530
Subject: [PATCH 23/34] fix(call): emit assignee activity message when agent
 answers a call (#14700)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Linear Ticket
- https://linear.app/chatwoot/issue/CW-7249/debug-assignment-log

## Description

When an agent answers an inbound WhatsApp call on an unassigned
conversation, the conversation is claimed for that agent — but no
"assigned" activity message or assignee-changed event was emitted, so
the assignment was invisible in the timeline (and notifications/live
assignee panel didn't update).

The claim ran before `update_conversation_call_status`, so that later
`update!` on the same conversation clobbered
`saved_change_to_assignee_id?` before `after_commit` fired. Moving the
claim to be the conversation's final write in the transaction restores
the activity message, the `ASSIGNEE_CHANGED` event, and the live
assignee update.

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)

## How Has This Been Tested?

1. Open an unassigned WhatsApp-call conversation.
2. As an agent, answer an inbound call.
3. Before: the conversation is assigned to you, but no "self-assigned"
activity message appears. After: the activity message is created and the
assignee updates live.

## Checklist:

- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my code
- [ ] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules
---
 enterprise/app/services/whatsapp/call_service.rb | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/enterprise/app/services/whatsapp/call_service.rb b/enterprise/app/services/whatsapp/call_service.rb
index 93eba957c..743409839 100644
--- a/enterprise/app/services/whatsapp/call_service.rb
+++ b/enterprise/app/services/whatsapp/call_service.rb
@@ -9,7 +9,7 @@ class Whatsapp::CallService
     call.with_lock do
       transition_to_in_progress!
       update_message_status('in_progress')
-      update_conversation_call_status(call.display_status)
+      claim_conversation_and_set_call_status
       broadcast(:accepted, accepted_by_agent_id: agent.id)
     end
     call
@@ -56,7 +56,6 @@ class Whatsapp::CallService
     forward_answer_to_meta!
     call.update!(status: 'in_progress', accepted_by_agent_id: agent.id, started_at: Time.current,
                  meta: (call.meta || {}).merge('sdp_answer' => sdp_answer))
-    claim_conversation_for_agent
   end
 
   def forward_answer_to_meta!
@@ -64,9 +63,13 @@ class Whatsapp::CallService
     invoke_provider!(:accept_call, sdp_answer)
   end
 
-  # Take ownership of the conversation if no one holds it; leave assignee alone otherwise (transfer via UI).
-  def claim_conversation_for_agent
-    call.conversation.update!(assignee: agent) if call.conversation.assignee_id.blank?
+  # Claim an unheld conversation and set call_status in one save so previous_changes carries both the
+  # assignee change (activity message + ASSIGNEE_CHANGED) and the call_status change (conversation.updated webhook).
+  def claim_conversation_and_set_call_status
+    conversation = call.conversation
+    attrs = { additional_attributes: (conversation.additional_attributes || {}).merge('call_status' => call.display_status) }
+    attrs[:assignee] = agent if conversation.assignee_id.blank?
+    conversation.update!(attrs)
   end
 
   # Raise on Meta failure (bool false or transport error) so callers bail before

From 4d3196b02fd7b1046ff22a71ea1d1059f69e3193 Mon Sep 17 00:00:00 2001
From: Sony Mathew <sony@chatwoot.com>
Date: Thu, 11 Jun 2026 13:05:52 +0530
Subject: [PATCH 24/34] feat: Show unread count for all conversations (#14627)

## Description

Adds the unread count for All Conversations to the left sidebar. The
unread counts API now returns an `all_count` aggregate based on the same
permission-scoped inbox counts already used for sidebar badges, and the
sidebar renders that backend-provided value on the All Conversations
item.

Fixes
[CW-7240](https://linear.app/chatwoot/issue/CW-7240/unread-count-for-all-conversations)

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality not to work as expected)
- [ ] This change requires a documentation update

## How Has This Been Tested?

- `bundle exec rspec
spec/services/conversations/unread_counts/counter_spec.rb
spec/enterprise/services/conversations/unread_counts/counter_spec.rb
spec/controllers/api/v1/accounts/conversations_controller_spec.rb`
- `pnpm test
app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/actions.spec.js
app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/getters.spec.js
app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/mutations.spec.js`
- `pnpm exec eslint
app/javascript/dashboard/components-next/sidebar/Sidebar.vue
app/javascript/dashboard/store/modules/conversationUnreadCounts.js
app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/actions.spec.js
app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/getters.spec.js
app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/mutations.spec.js`
- `bundle exec rubocop
app/services/conversations/unread_counts/counter.rb
spec/services/conversations/unread_counts/counter_spec.rb
spec/enterprise/services/conversations/unread_counts/counter_spec.rb
spec/controllers/api/v1/accounts/conversations_controller_spec.rb`

## Checklist:

- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my code
- [x] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules

Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
---
 .../components-next/sidebar/Sidebar.vue          |  4 ++++
 .../store/modules/conversationUnreadCounts.js    | 14 ++++++++++++--
 .../conversationUnreadCounts/actions.spec.js     |  1 +
 .../conversationUnreadCounts/getters.spec.js     | 15 +++++++++++++++
 .../conversationUnreadCounts/mutations.spec.js   | 16 +++++++++++++++-
 .../conversations/unread_counts/counter.rb       |  7 +++++--
 .../v1/accounts/conversations_controller_spec.rb |  1 +
 .../conversations/unread_counts/counter_spec.rb  |  5 ++++-
 .../conversations/unread_counts/counter_spec.rb  |  3 +++
 9 files changed, 60 insertions(+), 6 deletions(-)

diff --git a/app/javascript/dashboard/components-next/sidebar/Sidebar.vue b/app/javascript/dashboard/components-next/sidebar/Sidebar.vue
index d9f523dfc..f71652ca0 100644
--- a/app/javascript/dashboard/components-next/sidebar/Sidebar.vue
+++ b/app/javascript/dashboard/components-next/sidebar/Sidebar.vue
@@ -175,6 +175,9 @@ useEventListener(document, 'touchend', onResizeEnd);
 
 const inboxes = useMapGetter('inboxes/getInboxes');
 const labels = useMapGetter('labels/getLabelsOnSidebar');
+const allUnreadCount = useMapGetter(
+  'conversationUnreadCounts/getAllUnreadCount'
+);
 const getInboxUnreadCount = useMapGetter(
   'conversationUnreadCounts/getInboxUnreadCount'
 );
@@ -297,6 +300,7 @@ const menuItems = computed(() => {
         {
           name: 'All',
           label: t('SIDEBAR.ALL_CONVERSATIONS'),
+          badgeCount: allUnreadCount.value,
           activeOn: ['inbox_conversation'],
           to: accountScopedRoute('home'),
         },
diff --git a/app/javascript/dashboard/store/modules/conversationUnreadCounts.js b/app/javascript/dashboard/store/modules/conversationUnreadCounts.js
index 0503c0806..c03249311 100644
--- a/app/javascript/dashboard/store/modules/conversationUnreadCounts.js
+++ b/app/javascript/dashboard/store/modules/conversationUnreadCounts.js
@@ -2,15 +2,21 @@ import ConversationAPI from '../../api/conversations';
 import types from '../mutation-types';
 
 export const state = {
+  allCount: 0,
   inboxes: {},
   labels: {},
   teams: {},
 };
 
+const normalizeCount = count => {
+  const parsedCount = Number(count);
+  return Number.isFinite(parsedCount) && parsedCount > 0 ? parsedCount : 0;
+};
+
 const normalizeCounts = counts => {
   return Object.entries(counts || {}).reduce((result, [id, count]) => {
-    const parsedCount = Number(count);
-    if (Number.isFinite(parsedCount) && parsedCount > 0) {
+    const parsedCount = normalizeCount(count);
+    if (parsedCount > 0) {
       result[String(id)] = parsedCount;
     }
 
@@ -19,6 +25,9 @@ const normalizeCounts = counts => {
 };
 
 export const getters = {
+  getAllUnreadCount($state) {
+    return $state.allCount;
+  },
   getInboxUnreadCount: $state => inboxId => {
     return $state.inboxes[String(inboxId)] || 0;
   },
@@ -55,6 +64,7 @@ export const actions = {
 
 export const mutations = {
   [types.SET_CONVERSATION_UNREAD_COUNTS]($state, payload = {}) {
+    $state.allCount = normalizeCount(payload.all_count);
     $state.inboxes = normalizeCounts(payload.inboxes);
     $state.labels = normalizeCounts(payload.labels);
     $state.teams = normalizeCounts(payload.teams);
diff --git a/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/actions.spec.js b/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/actions.spec.js
index 3100cdd10..29fadc897 100644
--- a/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/actions.spec.js
+++ b/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/actions.spec.js
@@ -15,6 +15,7 @@ describe('#actions', () => {
   describe('#get', () => {
     it('commits unread counts when API is successful', async () => {
       const payload = {
+        all_count: 2,
         inboxes: { 1: '2' },
         labels: { 3: 4 },
         teams: { 5: 6 },
diff --git a/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/getters.spec.js b/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/getters.spec.js
index a3e74fc37..9fe19e22d 100644
--- a/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/getters.spec.js
+++ b/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/getters.spec.js
@@ -3,6 +3,7 @@ import { getters } from '../../conversationUnreadCounts';
 describe('#getters', () => {
   it('returns inbox unread count by id', () => {
     const state = {
+      allCount: 0,
       inboxes: { 1: 2 },
       labels: {},
       teams: {},
@@ -15,6 +16,7 @@ describe('#getters', () => {
 
   it('returns label unread count by id', () => {
     const state = {
+      allCount: 0,
       inboxes: {},
       labels: { 3: 4 },
       teams: {},
@@ -27,6 +29,7 @@ describe('#getters', () => {
 
   it('returns team unread count by id', () => {
     const state = {
+      allCount: 0,
       inboxes: {},
       labels: {},
       teams: { 5: 6 },
@@ -37,8 +40,20 @@ describe('#getters', () => {
     expect(getters.getTeamUnreadCount(state)(6)).toBe(0);
   });
 
+  it('returns all unread count', () => {
+    const state = {
+      allCount: 7,
+      inboxes: {},
+      labels: {},
+      teams: {},
+    };
+
+    expect(getters.getAllUnreadCount(state)).toBe(7);
+  });
+
   it('returns unread count maps', () => {
     const state = {
+      allCount: 0,
       inboxes: { 1: 2 },
       labels: { 3: 4 },
       teams: { 5: 6 },
diff --git a/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/mutations.spec.js b/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/mutations.spec.js
index 3f7e2b1ec..8941d7430 100644
--- a/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/mutations.spec.js
+++ b/app/javascript/dashboard/store/modules/specs/conversationUnreadCounts/mutations.spec.js
@@ -4,9 +4,10 @@ import { mutations } from '../../conversationUnreadCounts';
 describe('#mutations', () => {
   describe('#SET_CONVERSATION_UNREAD_COUNTS', () => {
     it('normalizes unread count payload', () => {
-      const state = { inboxes: {}, labels: {}, teams: {} };
+      const state = { allCount: 0, inboxes: {}, labels: {}, teams: {} };
 
       mutations[types.SET_CONVERSATION_UNREAD_COUNTS](state, {
+        all_count: '3',
         inboxes: {
           1: '2',
           2: 0,
@@ -23,6 +24,7 @@ describe('#mutations', () => {
       });
 
       expect(state).toEqual({
+        allCount: 3,
         inboxes: { 1: 2 },
         labels: { 4: 5 },
         teams: { 6: 7 },
@@ -31,6 +33,7 @@ describe('#mutations', () => {
 
     it('clears counts when payload is empty', () => {
       const state = {
+        allCount: 2,
         inboxes: { 1: 2 },
         labels: { 4: 5 },
         teams: { 6: 7 },
@@ -39,10 +42,21 @@ describe('#mutations', () => {
       mutations[types.SET_CONVERSATION_UNREAD_COUNTS](state, {});
 
       expect(state).toEqual({
+        allCount: 0,
         inboxes: {},
         labels: {},
         teams: {},
       });
     });
+
+    it('normalizes invalid aggregate counts to zero', () => {
+      const state = { allCount: 2, inboxes: {}, labels: {}, teams: {} };
+
+      mutations[types.SET_CONVERSATION_UNREAD_COUNTS](state, {
+        all_count: 'invalid',
+      });
+
+      expect(state.allCount).toBe(0);
+    });
   });
 });
diff --git a/app/services/conversations/unread_counts/counter.rb b/app/services/conversations/unread_counts/counter.rb
index f4126b61f..b1ba5ddb0 100644
--- a/app/services/conversations/unread_counts/counter.rb
+++ b/app/services/conversations/unread_counts/counter.rb
@@ -19,8 +19,11 @@ class Conversations::UnreadCounts::Counter
     ensure_base_cache!
     ensure_assignment_cache! if assignment_mode?
 
+    inbox_counts = unread_inbox_counts
+
     {
-      inboxes: unread_inbox_counts,
+      all_count: inbox_counts.values.sum,
+      inboxes: inbox_counts,
       labels: unread_label_counts,
       teams: unread_team_counts
     }
@@ -191,7 +194,7 @@ class Conversations::UnreadCounts::Counter
   end
 
   def empty_counts
-    { inboxes: {}, labels: {}, teams: {} }
+    { all_count: 0, inboxes: {}, labels: {}, teams: {} }
   end
 
   def store
diff --git a/spec/controllers/api/v1/accounts/conversations_controller_spec.rb b/spec/controllers/api/v1/accounts/conversations_controller_spec.rb
index f8fd446d2..bdb8117ac 100644
--- a/spec/controllers/api/v1/accounts/conversations_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/conversations_controller_spec.rb
@@ -141,6 +141,7 @@ RSpec.describe 'Conversations API', type: :request do
 
           expect(response).to have_http_status(:success)
           expect(response.parsed_body['payload']).to eq(
+            'all_count' => 1,
             'inboxes' => { visible_inbox.id.to_s => 1 },
             'labels' => { label.id.to_s => 1 },
             'teams' => {}
diff --git a/spec/enterprise/services/conversations/unread_counts/counter_spec.rb b/spec/enterprise/services/conversations/unread_counts/counter_spec.rb
index cbb2d6c98..e8f850e78 100644
--- a/spec/enterprise/services/conversations/unread_counts/counter_spec.rb
+++ b/spec/enterprise/services/conversations/unread_counts/counter_spec.rb
@@ -26,6 +26,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
 
     result = described_class.new(account: account, user: agent).perform
 
+    expect(result[:all_count]).to eq(2)
     expect(result[:inboxes]).to eq(inbox.id.to_s => 2)
     expect(result[:labels]).to eq(label.id.to_s => 2)
     expect(result[:teams]).to eq(team.id.to_s => 2)
@@ -40,6 +41,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
 
     result = described_class.new(account: account, user: agent).perform
 
+    expect(result[:all_count]).to eq(2)
     expect(result[:inboxes]).to eq(inbox.id.to_s => 2)
     expect(result[:labels]).to eq(label.id.to_s => 2)
     expect(result[:teams]).to eq(team.id.to_s => 2)
@@ -53,6 +55,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
 
     result = described_class.new(account: account, user: agent).perform
 
+    expect(result[:all_count]).to eq(1)
     expect(result[:inboxes]).to eq(inbox.id.to_s => 1)
     expect(result[:labels]).to eq(label.id.to_s => 1)
     expect(result[:teams]).to eq(team.id.to_s => 1)
@@ -65,7 +68,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
 
     result = described_class.new(account: account, user: agent).perform
 
-    expect(result).to eq(inboxes: {}, labels: {}, teams: {})
+    expect(result).to eq(all_count: 0, inboxes: {}, labels: {}, teams: {})
     expect(store.base_ready?(account.id)).to be(false)
     expect(store.assignment_ready?(account.id)).to be(false)
   end
diff --git a/spec/services/conversations/unread_counts/counter_spec.rb b/spec/services/conversations/unread_counts/counter_spec.rb
index bfd10436e..723f2d437 100644
--- a/spec/services/conversations/unread_counts/counter_spec.rb
+++ b/spec/services/conversations/unread_counts/counter_spec.rb
@@ -62,6 +62,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
     result = described_class.new(account: account, user: agent).perform
 
     expect(result).to eq(
+      all_count: 1,
       inboxes: { visible_inbox.id.to_s => 1 },
       labels: { label.id.to_s => 1 },
       teams: { visible_team.id.to_s => 1 }
@@ -75,6 +76,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
     result = described_class.new(account: account, user: admin).perform
 
     expect(result).to eq(
+      all_count: 2,
       inboxes: { visible_inbox.id.to_s => 1, hidden_inbox.id.to_s => 1 },
       labels: { label.id.to_s => 2 },
       teams: { visible_team.id.to_s => 2 }
@@ -87,6 +89,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
     result = described_class.new(account: account, user: agent).perform
 
     expect(result).to eq(
+      all_count: 1,
       inboxes: { visible_inbox.id.to_s => 1 },
       labels: {},
       teams: { visible_team.id.to_s => 1 }

From 940428c10e5dd23e7dfb195038dd540231845bce Mon Sep 17 00:00:00 2001
From: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
Date: Thu, 11 Jun 2026 13:47:08 +0530
Subject: [PATCH 25/34] fix: preserve markdown links with unsafe href
 characters in help center content (#14686)

---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index bc51bbd85..09eb084f5 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "@amplitude/analytics-browser": "^2.11.10",
     "@breezystack/lamejs": "^1.2.7",
     "@chatwoot/ninja-keys": "1.2.3",
-    "@chatwoot/prosemirror-schema": "1.3.19",
+    "@chatwoot/prosemirror-schema": "1.3.21",
     "@chatwoot/utils": "^0.0.55",
     "@formkit/core": "^1.7.2",
     "@formkit/vue": "^1.7.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 68e667953..e843f8b09 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25,8 +25,8 @@ importers:
         specifier: 1.2.3
         version: 1.2.3
       '@chatwoot/prosemirror-schema':
-        specifier: 1.3.19
-        version: 1.3.19
+        specifier: 1.3.21
+        version: 1.3.21
       '@chatwoot/utils':
         specifier: ^0.0.55
         version: 0.0.55
@@ -458,8 +458,8 @@ packages:
   '@chatwoot/ninja-keys@1.2.3':
     resolution: {integrity: sha512-xM8d9P5ikDMZm2WbaCTk/TW5HFauylrU3cJ75fq5je6ixKwyhl/0kZbVN/vbbZN4+AUX/OaSIn6IJbtCgIF67g==}
 
-  '@chatwoot/prosemirror-schema@1.3.19':
-    resolution: {integrity: sha512-LbATIAeTzclvbIK6WjtrGUO37AtMWkzCJi+s/KpUIp81TORhc0fHnclGT3353AbxeH6dF51/4hFTTsmF+ziqGA==}
+  '@chatwoot/prosemirror-schema@1.3.21':
+    resolution: {integrity: sha512-Y/OfXH1orK14foRcMrUees8lDjnDS9qZylVMyrstbfNyP5hbkBofsGAi6SP+5oIbPZ8iSG0sJyXtscoXpu/OFw==}
 
   '@chatwoot/utils@0.0.55':
     resolution: {integrity: sha512-8G6HYQe1ZEYfJEsSYfDVvE+uhf98JDRjtGlpB+bzMko+yltbrk4yACSo/ImC3jSaJ6K8yPTSjJToSRmsQbL2iQ==}
@@ -5128,7 +5128,7 @@ snapshots:
       hotkeys-js: 3.8.7
       lit: 2.2.6
 
-  '@chatwoot/prosemirror-schema@1.3.19':
+  '@chatwoot/prosemirror-schema@1.3.21':
     dependencies:
       markdown-it-sup: 2.0.0
       prosemirror-commands: 1.7.1

From ce93ddec7876b1d291b8b2185e63ab0083376793 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Thu, 11 Jun 2026 14:09:13 +0530
Subject: [PATCH 26/34] fix: re-fetch widget conversation status on reconnect
 (#14683)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When an inbox has **"Allow messages after conversation is resolved"**
disabled, the live-chat widget should hide the reply box once a
conversation is resolved — but users could still send a reply, silently
reopening it. This syncs the widget's conversation status on reconnect
so the reply box hides correctly.

## Closes
- CW-7272

## How to reproduce
1. Disable **Allow messages after conversation is resolved** on an
inbox.
2. Open the widget, then let its websocket drop (background tab / lose
network).
3. While disconnected, get the conversation resolved (e.g. auto-resolve
on inactivity).
4. Reconnect → reply box is still visible and a sent message reopens the
resolved conversation.

## Why
Reply-box hiding is gated on the widget's local status, updated via the
`conversation.status_changed` socket event. If the resolve happens while
disconnected, the event is missed — and on reconnect the widget only
re-synced messages, never the status, so it stayed stale at `open`.

## What changed
- `onReconnect` now also dispatches
`conversationAttributes/getAttributes` to refresh status after a missed
event.
- Added a spec covering the reconnect behavior.

Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
---
 app/javascript/widget/helpers/actionCable.js  |  3 ++
 .../widget/helpers/specs/actionCable.spec.js  | 53 +++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 app/javascript/widget/helpers/specs/actionCable.spec.js

diff --git a/app/javascript/widget/helpers/actionCable.js b/app/javascript/widget/helpers/actionCable.js
index 60c379ed8..546317018 100644
--- a/app/javascript/widget/helpers/actionCable.js
+++ b/app/javascript/widget/helpers/actionCable.js
@@ -36,6 +36,9 @@ class ActionCableConnector extends BaseActionCableConnector {
 
   onReconnect = () => {
     this.syncLatestMessages();
+    // Re-fetch conversation attributes so a status change (e.g. auto-resolve)
+    // that happened while disconnected is reflected, keeping the reply box state correct.
+    this.app.$store.dispatch('conversationAttributes/getAttributes');
   };
 
   setLastMessageId = () => {
diff --git a/app/javascript/widget/helpers/specs/actionCable.spec.js b/app/javascript/widget/helpers/specs/actionCable.spec.js
new file mode 100644
index 000000000..6aa3872bf
--- /dev/null
+++ b/app/javascript/widget/helpers/specs/actionCable.spec.js
@@ -0,0 +1,53 @@
+import { describe, it, beforeEach, afterEach, expect, vi } from 'vitest';
+import ActionCableConnector from '../actionCable';
+
+vi.mock('@rails/actioncable', () => ({
+  createConsumer: () => ({
+    subscriptions: { create: () => ({}) },
+    disconnect: vi.fn(),
+  }),
+}));
+
+describe('Widget ActionCableConnector', () => {
+  let app;
+  let mockDispatch;
+  let connector;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    mockDispatch = vi.fn();
+    app = {
+      $store: {
+        dispatch: mockDispatch,
+        getters: {
+          getCurrentAccountId: 1,
+          getCurrentUserID: 1,
+        },
+      },
+    };
+    connector = new ActionCableConnector(app, 'test-token');
+    mockDispatch.mockClear();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+    vi.useRealTimers();
+  });
+
+  it('registers the conversation.status_changed event handler', () => {
+    expect(connector.events['conversation.status_changed']).toBe(
+      connector.onStatusChange
+    );
+  });
+
+  it('re-fetches conversation attributes on reconnect so a status change missed while disconnected is reflected', () => {
+    connector.onReconnect();
+
+    expect(mockDispatch).toHaveBeenCalledWith(
+      'conversation/syncLatestMessages'
+    );
+    expect(mockDispatch).toHaveBeenCalledWith(
+      'conversationAttributes/getAttributes'
+    );
+  });
+});

From 8d5d02ea972bbaa6d2e7bc445a8b902f94953e8c Mon Sep 17 00:00:00 2001
From: Tanmay Deep Sharma <32020192+tds-1@users.noreply.github.com>
Date: Thu, 11 Jun 2026 14:22:44 +0530
Subject: [PATCH 27/34] feat: add per-inbox toggle to disable incoming calls
 (#14645)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

Adds a per-inbox "Allow incoming calls" toggle for voice-enabled
WhatsApp and Twilio inboxes. When turned off, the setting is persisted
on the channel; actually rejecting inbound calls is handled in a
follow-up PR.

## Type of change

- [ ] New feature (non-breaking change which adds functionality)

## Screenshot
<img width="804" height="384" alt="Screenshot 2026-06-04 at 11 44 07 AM"
src="https://github.com/user-attachments/assets/df8bb026-0387-4031-bcba-6d9a56872eb7"
/>


## Checklist:

- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my code
- [ ] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules
---
 app/javascript/dashboard/api/inboxes.js       |  6 +++
 .../dashboard/i18n/locale/en/inboxMgmt.json   |  4 ++
 .../settingsPage/VoiceConfigurationPage.vue   | 42 +++++++++++++++
 .../settingsPage/WhatsappCallingPage.vue      | 41 ++++++++++++++
 app/models/channel/twilio_sms.rb              |  6 +++
 app/models/channel/whatsapp.rb                |  5 ++
 app/policies/inbox_policy.rb                  |  4 ++
 app/views/api/v1/models/_inbox.json.jbuilder  |  6 ++-
 config/routes.rb                              |  1 +
 ...d_provider_config_to_channel_twilio_sms.rb |  5 ++
 db/schema.rb                                  |  3 +-
 .../api/v1/accounts/inboxes_controller.rb     | 28 ++++++++++
 .../controllers/twilio/voice_controller.rb    | 12 +++++
 .../whatsapp/incoming_call_service.rb         |  6 +++
 .../v1/accounts/inboxes_controller_spec.rb    | 53 +++++++++++++++++++
 .../twilio/voice_controller_spec.rb           | 17 ++++++
 .../models/channel/twilio_sms_voice_spec.rb   | 13 +++++
 .../whatsapp/incoming_call_service_spec.rb    | 14 +++++
 spec/models/channel/whatsapp_spec.rb          | 18 +++++++
 19 files changed, 282 insertions(+), 2 deletions(-)
 create mode 100644 db/migrate/20260604000000_add_provider_config_to_channel_twilio_sms.rb

diff --git a/app/javascript/dashboard/api/inboxes.js b/app/javascript/dashboard/api/inboxes.js
index 114dbb6f4..3c1d17fc8 100644
--- a/app/javascript/dashboard/api/inboxes.js
+++ b/app/javascript/dashboard/api/inboxes.js
@@ -60,6 +60,12 @@ class Inboxes extends CacheEnabledApiClient {
   disableWhatsappCalling(inboxId) {
     return axios.post(`${this.url}/${inboxId}/disable_whatsapp_calling`);
   }
+
+  setInboundCalls(inboxId, enabled) {
+    return axios.post(`${this.url}/${inboxId}/set_inbound_calls`, {
+      inbound_calls_enabled: enabled,
+    });
+  }
 }
 
 export default new Inboxes();
diff --git a/app/javascript/dashboard/i18n/locale/en/inboxMgmt.json b/app/javascript/dashboard/i18n/locale/en/inboxMgmt.json
index cd7e46330..574cf5b9b 100644
--- a/app/javascript/dashboard/i18n/locale/en/inboxMgmt.json
+++ b/app/javascript/dashboard/i18n/locale/en/inboxMgmt.json
@@ -653,6 +653,10 @@
       },
       "CREDENTIALS": {
         "DESCRIPTION": "Voice calling requires Twilio API Key credentials. These are used to generate tokens for agent voice connections."
+      },
+      "INBOUND": {
+        "LABEL": "Allow incoming calls",
+        "DESCRIPTION": "Let customers call this number. When turned off, incoming calls are declined automatically — agents aren't notified and no conversation is created. Agents can still place outgoing calls."
       }
     },
     "WHATSAPP_CALLING": {
diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/VoiceConfigurationPage.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/VoiceConfigurationPage.vue
index b0fe858e5..b5f3183f1 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/VoiceConfigurationPage.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/VoiceConfigurationPage.vue
@@ -1,9 +1,11 @@
 <script>
 import { useAlert } from 'dashboard/composables';
+import InboxesAPI from 'dashboard/api/inboxes';
 import SettingsFieldSection from 'dashboard/components-next/Settings/SettingsFieldSection.vue';
 import SettingsToggleSection from 'dashboard/components-next/Settings/SettingsToggleSection.vue';
 import NextInput from 'dashboard/components-next/input/Input.vue';
 import NextButton from 'dashboard/components-next/button/Button.vue';
+import Spinner from 'dashboard/components-next/spinner/Spinner.vue';
 
 export default {
   components: {
@@ -11,6 +13,7 @@ export default {
     SettingsToggleSection,
     NextInput,
     NextButton,
+    Spinner,
   },
   props: {
     inbox: {
@@ -21,9 +24,11 @@ export default {
   data() {
     return {
       voiceEnabled: this.inbox.voice_enabled || false,
+      inboundCallsEnabled: this.inbox.inbound_calls_enabled !== false,
       apiKeySid: this.inbox.api_key_sid || '',
       apiKeySecret: '',
       isUpdating: false,
+      isTogglingInbound: false,
     };
   },
   computed: {
@@ -62,8 +67,27 @@ export default {
     'inbox.api_key_sid'(val) {
       this.apiKeySid = val || '';
     },
+    'inbox.inbound_calls_enabled'(val) {
+      this.inboundCallsEnabled = val !== false;
+    },
   },
   methods: {
+    async handleInboundToggle(newValue) {
+      if (this.isTogglingInbound) return;
+      const previousValue = this.inboundCallsEnabled;
+      this.inboundCallsEnabled = newValue;
+      this.isTogglingInbound = true;
+      try {
+        await InboxesAPI.setInboundCalls(this.inbox.id, newValue);
+        await this.$store.dispatch('inboxes/get', this.inbox.id);
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.SUCCESS_MESSAGE'));
+      } catch (_) {
+        this.inboundCallsEnabled = previousValue;
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.ERROR_MESSAGE'));
+      } finally {
+        this.isTogglingInbound = false;
+      }
+    },
     async updateVoiceSettings() {
       this.isUpdating = true;
       try {
@@ -123,6 +147,24 @@ export default {
       />
     </div>
 
+    <div
+      v-if="inbox.voice_enabled"
+      class="relative"
+      :class="{ 'pointer-events-none opacity-60': isTogglingInbound }"
+    >
+      <SettingsToggleSection
+        :model-value="inboundCallsEnabled"
+        :header="$t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.LABEL')"
+        :description="$t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.DESCRIPTION')"
+        :hide-toggle="isTogglingInbound"
+        @update:model-value="handleInboundToggle"
+      >
+        <template v-if="isTogglingInbound" #hiddenToggle>
+          <Spinner class="size-4 text-n-slate-11" />
+        </template>
+      </SettingsToggleSection>
+    </div>
+
     <div v-if="inbox.voice_enabled && inbox.voice_call_webhook_url">
       <SettingsFieldSection
         :label="$t('INBOX_MGMT.ADD.VOICE.CONFIGURATION.TWILIO_VOICE_URL_TITLE')"
diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/WhatsappCallingPage.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/WhatsappCallingPage.vue
index 1fe082d09..b52cc6923 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/WhatsappCallingPage.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/settingsPage/WhatsappCallingPage.vue
@@ -24,10 +24,13 @@ export default {
   data() {
     return {
       callingEnabled: this.inbox.provider_config?.calling_enabled || false,
+      inboundCallsEnabled:
+        this.inbox.provider_config?.inbound_calls_enabled !== false,
       permissionRequestBody:
         this.inbox.provider_config?.call_permission_request_body || '',
       isUpdating: false,
       isTogglingCalling: false,
+      isTogglingInbound: false,
     };
   },
   computed: {
@@ -44,8 +47,27 @@ export default {
     'inbox.provider_config.call_permission_request_body'(val) {
       this.permissionRequestBody = val || '';
     },
+    'inbox.provider_config.inbound_calls_enabled'(val) {
+      this.inboundCallsEnabled = val !== false;
+    },
   },
   methods: {
+    async handleInboundToggle(newValue) {
+      if (this.isTogglingInbound) return;
+      const previousValue = this.inboundCallsEnabled;
+      this.inboundCallsEnabled = newValue;
+      this.isTogglingInbound = true;
+      try {
+        await InboxesAPI.setInboundCalls(this.inbox.id, newValue);
+        await this.$store.dispatch('inboxes/get', this.inbox.id);
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.SUCCESS_MESSAGE'));
+      } catch (_) {
+        this.inboundCallsEnabled = previousValue;
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.ERROR_MESSAGE'));
+      } finally {
+        this.isTogglingInbound = false;
+      }
+    },
     async handleCallingToggle(newValue) {
       if (this.isTogglingCalling) return;
       const previousValue = this.callingEnabled;
@@ -117,6 +139,25 @@ export default {
     </div>
 
     <template v-if="callingEnabled">
+      <div
+        class="relative"
+        :class="{ 'pointer-events-none opacity-60': isTogglingInbound }"
+      >
+        <SettingsToggleSection
+          :model-value="inboundCallsEnabled"
+          :header="$t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.LABEL')"
+          :description="
+            $t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.DESCRIPTION')
+          "
+          :hide-toggle="isTogglingInbound"
+          @update:model-value="handleInboundToggle"
+        >
+          <template v-if="isTogglingInbound" #hiddenToggle>
+            <Spinner class="size-4 text-n-slate-11" />
+          </template>
+        </SettingsToggleSection>
+      </div>
+
       <SettingsFieldSection
         v-if="phoneNumber"
         :label="$t('INBOX_MGMT.WHATSAPP_CALLING.PHONE_NUMBER.LABEL')"
diff --git a/app/models/channel/twilio_sms.rb b/app/models/channel/twilio_sms.rb
index e288361ea..072857b5a 100644
--- a/app/models/channel/twilio_sms.rb
+++ b/app/models/channel/twilio_sms.rb
@@ -12,6 +12,7 @@
 #  medium                         :integer          default("sms")
 #  messaging_service_sid          :string
 #  phone_number                   :string
+#  provider_config                :jsonb
 #  twiml_app_sid                  :string
 #  voice_enabled                  :boolean          default(FALSE), not null
 #  created_at                     :datetime         not null
@@ -54,6 +55,11 @@ class Channel::TwilioSms < ApplicationRecord
     medium == 'sms' ? 'Twilio SMS' : 'Whatsapp'
   end
 
+  # Mutes only the incoming side of calling; default on, so only an explicit false disables inbound.
+  def inbound_calls_enabled?
+    provider_config['inbound_calls_enabled'] != false
+  end
+
   def send_message(to:, body:, media_url: nil)
     params = send_message_from.merge(to: to, body: body)
     params[:media_url] = media_url if media_url.present?
diff --git a/app/models/channel/whatsapp.rb b/app/models/channel/whatsapp.rb
index 00d3277c9..46cf65f3b 100644
--- a/app/models/channel/whatsapp.rb
+++ b/app/models/channel/whatsapp.rb
@@ -49,6 +49,11 @@ class Channel::Whatsapp < ApplicationRecord
       account.feature_enabled?('channel_voice')
   end
 
+  # Mutes only the incoming side of calling; default on, so only an explicit false disables inbound.
+  def inbound_calls_enabled?
+    provider_config['inbound_calls_enabled'] != false
+  end
+
   # Whether this inbox can do WhatsApp calling at all. Meta's Calling API is
   # reachable by any whatsapp_cloud inbox, so 360dialog inboxes can't be toggled
   # on even though calling_enabled would persist.
diff --git a/app/policies/inbox_policy.rb b/app/policies/inbox_policy.rb
index e516a498e..9c74c35e7 100644
--- a/app/policies/inbox_policy.rb
+++ b/app/policies/inbox_policy.rb
@@ -77,4 +77,8 @@ class InboxPolicy < ApplicationPolicy
   def disable_whatsapp_calling?
     @account_user.administrator?
   end
+
+  def set_inbound_calls?
+    @account_user.administrator?
+  end
 end
diff --git a/app/views/api/v1/models/_inbox.json.jbuilder b/app/views/api/v1/models/_inbox.json.jbuilder
index b34bbe95b..677e4fe9e 100644
--- a/app/views/api/v1/models/_inbox.json.jbuilder
+++ b/app/views/api/v1/models/_inbox.json.jbuilder
@@ -140,6 +140,7 @@ end
 ## Voice attributes for TwilioSms
 if resource.twilio? && resource.channel.respond_to?(:voice_enabled?)
   json.voice_enabled resource.channel.voice_enabled?
+  json.inbound_calls_enabled resource.channel.inbound_calls_enabled?
   json.voice_configured resource.channel.try(:twiml_app_sid).present?
   json.has_api_key_secret resource.channel.try(:api_key_secret).present?
   if resource.channel.try(:twiml_app_sid).present?
@@ -149,4 +150,7 @@ if resource.twilio? && resource.channel.respond_to?(:voice_enabled?)
 end
 
 ## Voice attribute for WhatsApp Cloud (only embedded-signup channels surface true)
-json.voice_enabled resource.channel.voice_enabled? if resource.channel_type == 'Channel::Whatsapp' && resource.channel.respond_to?(:voice_enabled?)
+if resource.channel_type == 'Channel::Whatsapp' && resource.channel.respond_to?(:voice_enabled?)
+  json.voice_enabled resource.channel.voice_enabled?
+  json.inbound_calls_enabled resource.channel.inbound_calls_enabled?
+end
diff --git a/config/routes.rb b/config/routes.rb
index d78831343..885b69062 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -267,6 +267,7 @@ Rails.application.routes.draw do
               end
               post :enable_whatsapp_calling, on: :member
               post :disable_whatsapp_calling, on: :member
+              post :set_inbound_calls, on: :member
             end
 
             resource :csat_template, only: [:show, :create], controller: 'inbox_csat_templates' do
diff --git a/db/migrate/20260604000000_add_provider_config_to_channel_twilio_sms.rb b/db/migrate/20260604000000_add_provider_config_to_channel_twilio_sms.rb
new file mode 100644
index 000000000..6d28aa5dd
--- /dev/null
+++ b/db/migrate/20260604000000_add_provider_config_to_channel_twilio_sms.rb
@@ -0,0 +1,5 @@
+class AddProviderConfigToChannelTwilioSms < ActiveRecord::Migration[7.1]
+  def change
+    add_column :channel_twilio_sms, :provider_config, :jsonb, default: {}
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index f2c479571..eb6b82508 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2026_05_25_093000) do
+ActiveRecord::Schema[7.1].define(version: 2026_06_04_000000) do
   # These extensions should be enabled to support this database
   enable_extension "pg_stat_statements"
   enable_extension "pg_trgm"
@@ -557,6 +557,7 @@ ActiveRecord::Schema[7.1].define(version: 2026_05_25_093000) do
     t.boolean "voice_enabled", default: false, null: false
     t.string "twiml_app_sid"
     t.string "api_key_secret"
+    t.jsonb "provider_config", default: {}
     t.index ["account_sid", "phone_number"], name: "index_channel_twilio_sms_on_account_sid_and_phone_number", unique: true
     t.index ["messaging_service_sid"], name: "index_channel_twilio_sms_on_messaging_service_sid", unique: true
     t.index ["phone_number"], name: "index_channel_twilio_sms_on_phone_number", unique: true
diff --git a/enterprise/app/controllers/enterprise/api/v1/accounts/inboxes_controller.rb b/enterprise/app/controllers/enterprise/api/v1/accounts/inboxes_controller.rb
index 76f578bf1..cdeeda74e 100644
--- a/enterprise/app/controllers/enterprise/api/v1/accounts/inboxes_controller.rb
+++ b/enterprise/app/controllers/enterprise/api/v1/accounts/inboxes_controller.rb
@@ -1,4 +1,6 @@
 module Enterprise::Api::V1::Accounts::InboxesController
+  extend ActiveSupport::Concern
+
   def inbox_attributes
     super + ee_inbox_attributes
   end
@@ -21,6 +23,24 @@ module Enterprise::Api::V1::Accounts::InboxesController
     render_could_not_create_error(e.message)
   end
 
+  # Toggles only the inbound-calls flag in provider_config. Saved with validate: false
+  # so WhatsApp's remote credential re-check (validate_provider_config) can't reject a
+  # simple toggle, mirroring enable_voice_calling!. Voice support (WhatsApp calling or
+  # Twilio voice) is guarded inline by ensure_inbound_calls_supported.
+  def set_inbound_calls
+    return unless ensure_inbound_calls_supported
+
+    channel = @inbox.channel
+    channel.provider_config = (channel.provider_config || {}).merge(
+      'inbound_calls_enabled' => ActiveModel::Type::Boolean.new.cast(params[:inbound_calls_enabled])
+    )
+    channel.save!(validate: false)
+    @inbox.update_account_cache # bump inbox cache key so the cached inbox list refetches the new flag
+    head :ok
+  rescue StandardError => e
+    render_could_not_create_error(e.message)
+  end
+
   def ee_inbox_attributes
     [auto_assignment_config: [:max_assignment_limit]]
   end
@@ -35,6 +55,14 @@ module Enterprise::Api::V1::Accounts::InboxesController
     false
   end
 
+  # Inbound calls can be toggled on any voice-enabled inbox (WhatsApp calling or Twilio voice).
+  def ensure_inbound_calls_supported
+    return true if @inbox.channel.try(:voice_enabled?)
+
+    render_could_not_create_error('Inbox does not support calling')
+    false
+  end
+
   def allowed_channel_types
     super + ['voice']
   end
diff --git a/enterprise/app/controllers/twilio/voice_controller.rb b/enterprise/app/controllers/twilio/voice_controller.rb
index eb29c00bd..66fef9583 100644
--- a/enterprise/app/controllers/twilio/voice_controller.rb
+++ b/enterprise/app/controllers/twilio/voice_controller.rb
@@ -24,6 +24,8 @@ class Twilio::VoiceController < ApplicationController
       "TWILIO_VOICE_TWIML account=#{current_account.id} call_sid=#{twilio_call_sid} from=#{twilio_from} direction=#{twilio_direction}"
     )
 
+    return render xml: reject_twiml if reject_inbound?
+
     call = resolve_call
     render xml: conference_twiml(call)
   end
@@ -88,6 +90,16 @@ class Twilio::VoiceController < ApplicationController
     from_number.start_with?('client:')
   end
 
+  # A fresh contact-initiated leg on an inbox with inbound calls turned off.
+  # Reject it so no conference, conversation, or Call row is created.
+  def reject_inbound?
+    twilio_direction == 'inbound' && !agent_leg?(twilio_from) && !inbox.channel.inbound_calls_enabled?
+  end
+
+  def reject_twiml
+    Twilio::TwiML::VoiceResponse.new(&:reject).to_s
+  end
+
   def resolve_call
     return find_call_for_agent if agent_leg?(twilio_from)
 
diff --git a/enterprise/app/services/whatsapp/incoming_call_service.rb b/enterprise/app/services/whatsapp/incoming_call_service.rb
index afca508a8..f6185050d 100644
--- a/enterprise/app/services/whatsapp/incoming_call_service.rb
+++ b/enterprise/app/services/whatsapp/incoming_call_service.rb
@@ -72,6 +72,12 @@ class Whatsapp::IncomingCallService
   end
 
   def create_inbound_call(payload)
+    unless inbox.channel.inbound_calls_enabled?
+      Rails.logger.info "[WHATSAPP CALL] Inbound calls disabled for inbox #{inbox.id}; rejecting call #{payload[:id]}"
+      inbox.channel.provider_service.reject_call(payload[:id])
+      return
+    end
+
     sdp_offer = payload.dig(:session, :sdp)
     extra_meta = { 'sdp_offer' => sdp_offer, 'ice_servers' => Call.default_ice_servers }
     name = caller_profile_name(payload)
diff --git a/spec/enterprise/controllers/enterprise/api/v1/accounts/inboxes_controller_spec.rb b/spec/enterprise/controllers/enterprise/api/v1/accounts/inboxes_controller_spec.rb
index 709a8da22..ead387995 100644
--- a/spec/enterprise/controllers/enterprise/api/v1/accounts/inboxes_controller_spec.rb
+++ b/spec/enterprise/controllers/enterprise/api/v1/accounts/inboxes_controller_spec.rb
@@ -49,6 +49,59 @@ RSpec.describe 'Enterprise Inboxes API', type: :request do
     end
   end
 
+  describe 'POST /api/v1/accounts/{account.id}/inboxes/:id/set_inbound_calls' do
+    before do
+      allow(Twilio::VoiceWebhookSetupService).to receive(:new)
+        .and_return(instance_double(Twilio::VoiceWebhookSetupService, perform: "AP#{SecureRandom.hex(16)}"))
+    end
+
+    context 'when administrator' do
+      it 'disables inbound calls on a Twilio voice inbox' do
+        channel = create(:channel_twilio_sms, :with_voice, account: account)
+
+        post "/api/v1/accounts/#{account.id}/inboxes/#{channel.inbox.id}/set_inbound_calls",
+             headers: admin.create_new_auth_token,
+             params: { inbound_calls_enabled: false },
+             as: :json
+
+        expect(response).to have_http_status(:ok)
+        expect(channel.reload.inbound_calls_enabled?).to be false
+      end
+
+      it 'enables inbound calls on a WhatsApp inbox without re-validating provider config' do
+        account.enable_features('channel_voice')
+        account.save!
+        channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud',
+                                            validate_provider_config: false, sync_templates: false)
+        channel.update!(provider_config: channel.provider_config.merge('calling_enabled' => true, 'inbound_calls_enabled' => false))
+
+        post "/api/v1/accounts/#{account.id}/inboxes/#{channel.inbox.id}/set_inbound_calls",
+             headers: admin.create_new_auth_token,
+             params: { inbound_calls_enabled: true },
+             as: :json
+
+        expect(response).to have_http_status(:ok)
+        expect(channel.reload.inbound_calls_enabled?).to be true
+      end
+    end
+
+    context 'when agent' do
+      let(:agent) { create(:user, account: account, role: :agent) }
+
+      it 'is forbidden' do
+        channel = create(:channel_twilio_sms, :with_voice, account: account)
+
+        post "/api/v1/accounts/#{account.id}/inboxes/#{channel.inbox.id}/set_inbound_calls",
+             headers: agent.create_new_auth_token,
+             params: { inbound_calls_enabled: false },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(channel.reload.inbound_calls_enabled?).to be true
+      end
+    end
+  end
+
   describe 'PATCH /api/v1/accounts/{account.id}/inboxes/:id' do
     let(:inbox) { create(:inbox, account: account, auto_assignment_config: { max_assignment_limit: 5 }) }
 
diff --git a/spec/enterprise/controllers/twilio/voice_controller_spec.rb b/spec/enterprise/controllers/twilio/voice_controller_spec.rb
index cde513c86..79fdd67a8 100644
--- a/spec/enterprise/controllers/twilio/voice_controller_spec.rb
+++ b/spec/enterprise/controllers/twilio/voice_controller_spec.rb
@@ -112,6 +112,23 @@ RSpec.describe 'Twilio::VoiceController', type: :request do
       }
       expect(response).to have_http_status(:not_found)
     end
+
+    it 'rejects the inbound contact leg without building a call when inbound calls are disabled' do
+      channel.update!(provider_config: { 'inbound_calls_enabled' => false })
+      expect(Voice::InboundCallBuilder).not_to receive(:perform!)
+
+      expect do
+        post "/twilio/voice/call/#{digits}", params: {
+          'CallSid' => call_sid,
+          'From' => from_number,
+          'To' => to_number,
+          'Direction' => 'inbound'
+        }
+      end.not_to change(Call, :count)
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('<Reject')
+    end
   end
 
   describe 'POST /twilio/voice/status/:phone' do
diff --git a/spec/enterprise/models/channel/twilio_sms_voice_spec.rb b/spec/enterprise/models/channel/twilio_sms_voice_spec.rb
index b2d5dba48..fb768f01b 100644
--- a/spec/enterprise/models/channel/twilio_sms_voice_spec.rb
+++ b/spec/enterprise/models/channel/twilio_sms_voice_spec.rb
@@ -38,6 +38,19 @@ RSpec.describe Channel::TwilioSms do
     end
   end
 
+  describe '#inbound_calls_enabled?' do
+    it 'returns true by default when nothing has been toggled' do
+      channel = create(:channel_twilio_sms, :with_voice, account: account)
+      expect(channel.inbound_calls_enabled?).to be true
+    end
+
+    it 'returns false only when explicitly disabled in provider_config' do
+      channel = create(:channel_twilio_sms, :with_voice, account: account,
+                                                         provider_config: { 'inbound_calls_enabled' => false })
+      expect(channel.inbound_calls_enabled?).to be false
+    end
+  end
+
   describe '#voice_call_webhook_url' do
     it 'returns the webhook URL based on phone number' do
       channel = create(:channel_twilio_sms, :with_voice)
diff --git a/spec/enterprise/services/whatsapp/incoming_call_service_spec.rb b/spec/enterprise/services/whatsapp/incoming_call_service_spec.rb
index 53b8ec52f..4651b5f13 100644
--- a/spec/enterprise/services/whatsapp/incoming_call_service_spec.rb
+++ b/spec/enterprise/services/whatsapp/incoming_call_service_spec.rb
@@ -30,6 +30,20 @@ describe Whatsapp::IncomingCallService do
     end
   end
 
+  context 'when inbound calls are disabled on the channel' do
+    it 'rejects the call with Meta without creating a Call or Conversation' do
+      channel.provider_config = channel.provider_config.merge('inbound_calls_enabled' => false)
+      channel.save!
+      provider_service = instance_double(Whatsapp::Providers::WhatsappCloudService, reject_call: true)
+      allow(inbox.channel).to receive(:provider_service).and_return(provider_service)
+
+      params = call_payload(event: 'connect', session: { sdp: "v=0\r\n...sdp...", sdp_type: 'offer' })
+      expect { described_class.new(inbox: inbox, params: params).perform }
+        .to not_change(Call, :count).and not_change(Conversation, :count)
+      expect(provider_service).to have_received(:reject_call).with(provider_call_id)
+    end
+  end
+
   describe 'inbound connect' do
     let(:sdp_offer) { "v=0\r\n...sdp..." }
     let!(:agent) { create(:user, account: account) }
diff --git a/spec/models/channel/whatsapp_spec.rb b/spec/models/channel/whatsapp_spec.rb
index 95bc83932..cd4fa3a21 100644
--- a/spec/models/channel/whatsapp_spec.rb
+++ b/spec/models/channel/whatsapp_spec.rb
@@ -248,4 +248,22 @@ RSpec.describe Channel::Whatsapp do
       expect(channel.voice_enabled?).to be false
     end
   end
+
+  describe '#inbound_calls_enabled?' do
+    let(:account) { create(:account) }
+
+    it 'returns true by default when nothing has been toggled' do
+      channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud',
+                                          validate_provider_config: false, sync_templates: false)
+      expect(channel.inbound_calls_enabled?).to be true
+    end
+
+    it 'returns false only when explicitly disabled in provider_config' do
+      channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud',
+                                          validate_provider_config: false, sync_templates: false)
+      channel.update!(provider_config: channel.provider_config.merge('inbound_calls_enabled' => false))
+
+      expect(channel.inbound_calls_enabled?).to be false
+    end
+  end
 end

From 6d26e7930ae14e4abe72821e863dc8b28e3ab070 Mon Sep 17 00:00:00 2001
From: Sony Mathew <sony@chatwoot.com>
Date: Thu, 11 Jun 2026 15:15:14 +0530
Subject: [PATCH 28/34] fix(contacts): truncate inbound contact names (IMAP
 sender display names) (#14631)

## Description

Truncates long contact names in `ContactInboxWithContactBuilder` before
persisting them, so inbound IMAP sender display names over the
`contacts.name` 255-character limit no longer raise
`ActiveRecord::RecordInvalid` from `Inboxes::FetchImapEmailsJob`. This
keeps email ingestion moving while preserving the existing contact name
length constraint.

Linear ticket:
[https://linear.app/chatwoot/issue/CW-7263/sentry-active-record-invalid-contact-create-from-imap-fetch-job](https://linear.app/chatwoot/issue/CW-7263/sentry-active-record-invalid-contact-create-from-imap-fetch-job)

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)

## How Has This Been Tested?

- [x] `bundle exec rspec
spec/builders/contact_inbox_with_contact_builder_spec.rb`
- [x] `bundle exec rspec spec/mailboxes/imap/imap_mailbox_spec.rb`
- [x] `bundle exec rubocop
app/builders/contact_inbox_with_contact_builder.rb
spec/builders/contact_inbox_with_contact_builder_spec.rb`

## Checklist:

- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my code
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
---
 .../contact_inbox_with_contact_builder.rb         |  7 ++++++-
 app/models/application_record.rb                  |  5 ++++-
 .../contact_inbox_with_contact_builder_spec.rb    | 15 +++++++++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/app/builders/contact_inbox_with_contact_builder.rb b/app/builders/contact_inbox_with_contact_builder.rb
index 2c0e6087e..2ba9179ed 100644
--- a/app/builders/contact_inbox_with_contact_builder.rb
+++ b/app/builders/contact_inbox_with_contact_builder.rb
@@ -50,7 +50,7 @@ class ContactInboxWithContactBuilder
 
   def create_contact
     account.contacts.create!(
-      name: contact_attributes[:name] || ::Haikunator.haikunate(1000),
+      name: contact_name,
       phone_number: contact_attributes[:phone_number],
       email: contact_attributes[:email],
       identifier: contact_attributes[:identifier],
@@ -59,6 +59,11 @@ class ContactInboxWithContactBuilder
     )
   end
 
+  def contact_name
+    name = contact_attributes[:name] || ::Haikunator.haikunate(1000)
+    name.truncate(ApplicationRecord::MAX_STRING_COLUMN_LENGTH, omission: '')
+  end
+
   def find_contact
     contact = find_contact_by_identifier(contact_attributes[:identifier])
     contact ||= find_contact_by_email(contact_attributes[:email])
diff --git a/app/models/application_record.rb b/app/models/application_record.rb
index c6877c883..0cb3f7de2 100644
--- a/app/models/application_record.rb
+++ b/app/models/application_record.rb
@@ -1,4 +1,7 @@
 class ApplicationRecord < ActiveRecord::Base
+  MAX_STRING_COLUMN_LENGTH = 255
+  MAX_TEXT_COLUMN_LENGTH = 20_000
+
   include Events::Types
   self.abstract_class = true
 
@@ -37,7 +40,7 @@ class ApplicationRecord < ActiveRecord::Base
   end
 
   def validate_content_length(column)
-    max_length = column.type == :text ? 20_000 : 255
+    max_length = column.type == :text ? MAX_TEXT_COLUMN_LENGTH : MAX_STRING_COLUMN_LENGTH
     return if self[column.name].nil? || self[column.name].length <= max_length
 
     errors.add(column.name.to_sym, "is too long (maximum is #{max_length} characters)")
diff --git a/spec/builders/contact_inbox_with_contact_builder_spec.rb b/spec/builders/contact_inbox_with_contact_builder_spec.rb
index 60f0834af..58502539f 100644
--- a/spec/builders/contact_inbox_with_contact_builder_spec.rb
+++ b/spec/builders/contact_inbox_with_contact_builder_spec.rb
@@ -39,6 +39,21 @@ describe ContactInboxWithContactBuilder do
       expect(contact_inbox.inbox_id).to eq(inbox.id)
     end
 
+    it 'truncates long contact names before creating the contact' do
+      long_name = 'a' * 300
+
+      contact_inbox = described_class.new(
+        source_id: '123456',
+        inbox: inbox,
+        contact_attributes: {
+          name: long_name,
+          email: 'testemail@example.com'
+        }
+      ).perform
+
+      expect(contact_inbox.contact.name).to eq(long_name.first(ApplicationRecord::MAX_STRING_COLUMN_LENGTH))
+    end
+
     it 'doesnot create contact if it already exist with identifier' do
       contact_inbox = described_class.new(
         source_id: '123456',

From a901c87ab4f2d2efad60016f7d39ce729c5597df Mon Sep 17 00:00:00 2001
From: Vishnu Narayanan <iamwishnu@gmail.com>
Date: Thu, 11 Jun 2026 16:10:48 +0530
Subject: [PATCH 29/34] perf: merge 3 conversation COUNT queries in /meta into
 single query (#13536)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Pull Request Template

## Description


- Merges 3 separate COUNT queries in
`ConversationFinder#set_count_for_all_conversations` into a single query
using PostgreSQL `COUNT(*) FILTER (WHERE ...)`
- Every call to `/meta` and conversation index fires 3 COUNT queries
against the conversations table — one for "mine", one for "unassigned",
one for "all". These share the same base query and scan the same rows,
but execute as 3 independent round-trips.

from pg_stats

| Query | Calls | Total DB Time | Avg Latency |
|-------|-------|--------------|-------------|
| COUNT unassigned | 4.1M | 141,081 sec | 34ms |
| COUNT all | 4.1M | 132,302 sec | 32ms |
| COUNT mine | 3.7M | 37,637 sec | 10ms |
| **Total** | **~12M** | **311,020 sec** | |

`/meta` alone runs at 2.3K RPM (NewRelic), triggered on every WebSocket
event (conversation created/updated/status changed/assignee changed).



Fixes
https://linear.app/chatwoot/issue/INF-43/make-single-query-to-count-the-assigned-unassigned-and-all-instead-of

## Type of change

- [x] Performance fix

## How Has This Been Tested?

- [x] Verify conversation list shows correct
mine/unassigned/assigned/all counts
- [x] Verify /meta endpoint returns correct counts
- [x] Verify counts update correctly when assigning/unassigning
conversations
- [x] Verify counts with team filter applied
- [x] Monitor DB query count reduction in NewRelic after deploy

## Checklist:

- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my code
- [ ] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream
modules

---------

Co-authored-by: Sony Mathew <ynos1234@gmail.com>
---
 app/finders/conversation_finder.rb | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/app/finders/conversation_finder.rb b/app/finders/conversation_finder.rb
index fa437327d..1c27d8260 100644
--- a/app/finders/conversation_finder.rb
+++ b/app/finders/conversation_finder.rb
@@ -40,7 +40,7 @@ class ConversationFinder
   def perform
     set_up
 
-    mine_count, unassigned_count, all_count, = set_count_for_all_conversations
+    mine_count, unassigned_count, all_count = set_count_for_all_conversations
     assigned_count = all_count - unassigned_count
 
     filter_by_assignee_type
@@ -184,6 +184,17 @@ class ConversationFinder
   end
 
   def set_count_for_all_conversations
+    return legacy_count_for_all_conversations if @conversations.limit_value || @conversations.offset_value || @conversations.eager_loading?
+
+    counts = @conversations.unscope(:order).pick(
+      Arel.sql("COUNT(*) FILTER (WHERE assignee_id = #{current_user.id})"),
+      Arel.sql('COUNT(*) FILTER (WHERE assignee_id IS NULL)'),
+      Arel.sql('COUNT(*)')
+    )
+    counts || [0, 0, 0]
+  end
+
+  def legacy_count_for_all_conversations
     [
       @conversations.assigned_to(current_user).count,
       @conversations.unassigned.count,

From 95d6aecb519b9330b251eb59bb1da4306d3ec9d2 Mon Sep 17 00:00:00 2001
From: Adam Berger <132088347+Sneaky-Goat-Dev@users.noreply.github.com>
Date: Thu, 11 Jun 2026 12:43:57 +0200
Subject: [PATCH 30/34] chore: Add security flags to session cookie
 configuration (#14248)

## Summary
- Adds `httponly` and `secure` flags to session cookie configuration
- Adds RSpec tests for session configuration

## Changes
- `config/initializers/session_store.rb`: add `httponly: true`, `secure:
FORCE_SSL`
- `spec/config/session_store_spec.rb`: tests for all session store
options

Ref #2683 (hardens the session cookie but does not remove it, sessions
are still needed for super_admin dashboard)

---------

Co-authored-by: Adam-Relay <adam@userelay.ai>
Co-authored-by: Adam Berger <adam@adam-berger.com>
Co-authored-by: Vishnu Narayanan <iamwishnu@gmail.com>
---
 config/initializers/session_store.rb |  9 ++++++++-
 spec/config/session_store_spec.rb    | 29 ++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 spec/config/session_store_spec.rb

diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index 9d0d1f35b..6e6ce8134 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1,3 +1,10 @@
 # Be sure to restart your server when you modify this file.
+# Sessions are used only for the super_admin dashboard (flash/CSRF), not for API auth.
 
-Rails.application.config.session_store :cookie_store, key: '_chatwoot_session', same_site: :lax
+secure_cookies = ActiveModel::Type::Boolean.new.cast(ENV.fetch('FORCE_SSL', false))
+
+Rails.application.config.session_store :cookie_store,
+                                       key: '_chatwoot_session',
+                                       same_site: :lax,
+                                       secure: secure_cookies,
+                                       httponly: true
diff --git a/spec/config/session_store_spec.rb b/spec/config/session_store_spec.rb
new file mode 100644
index 000000000..a4f74af52
--- /dev/null
+++ b/spec/config/session_store_spec.rb
@@ -0,0 +1,29 @@
+require 'rails_helper'
+
+# rubocop:disable RSpec/DescribeClass
+describe 'Session Store Configuration' do
+  # rubocop:enable RSpec/DescribeClass
+
+  let(:session_options) { Rails.application.config.session_options }
+
+  it 'uses cookie_store as the session store' do
+    expect(Rails.application.config.session_store).to eq(ActionDispatch::Session::CookieStore)
+  end
+
+  it 'sets the session key' do
+    expect(session_options[:key]).to eq('_chatwoot_session')
+  end
+
+  it 'sets same_site to lax' do
+    expect(session_options[:same_site]).to eq(:lax)
+  end
+
+  it 'sets httponly to true' do
+    expect(session_options[:httponly]).to be(true)
+  end
+
+  it 'sets secure flag based on FORCE_SSL' do
+    expected_secure = ActiveModel::Type::Boolean.new.cast(ENV.fetch('FORCE_SSL', false))
+    expect(session_options[:secure]).to eq(expected_secure)
+  end
+end

From d0d275d962e9dc49f90638cb4ba357454d9cca53 Mon Sep 17 00:00:00 2001
From: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
Date: Thu, 11 Jun 2026 16:47:11 +0530
Subject: [PATCH 31/34] fix: cannot resize pasted images (#14709)

---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 09eb084f5..fc4598bc4 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "@amplitude/analytics-browser": "^2.11.10",
     "@breezystack/lamejs": "^1.2.7",
     "@chatwoot/ninja-keys": "1.2.3",
-    "@chatwoot/prosemirror-schema": "1.3.21",
+    "@chatwoot/prosemirror-schema": "1.3.22",
     "@chatwoot/utils": "^0.0.55",
     "@formkit/core": "^1.7.2",
     "@formkit/vue": "^1.7.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e843f8b09..6c7bebb79 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25,8 +25,8 @@ importers:
         specifier: 1.2.3
         version: 1.2.3
       '@chatwoot/prosemirror-schema':
-        specifier: 1.3.21
-        version: 1.3.21
+        specifier: 1.3.22
+        version: 1.3.22
       '@chatwoot/utils':
         specifier: ^0.0.55
         version: 0.0.55
@@ -458,8 +458,8 @@ packages:
   '@chatwoot/ninja-keys@1.2.3':
     resolution: {integrity: sha512-xM8d9P5ikDMZm2WbaCTk/TW5HFauylrU3cJ75fq5je6ixKwyhl/0kZbVN/vbbZN4+AUX/OaSIn6IJbtCgIF67g==}
 
-  '@chatwoot/prosemirror-schema@1.3.21':
-    resolution: {integrity: sha512-Y/OfXH1orK14foRcMrUees8lDjnDS9qZylVMyrstbfNyP5hbkBofsGAi6SP+5oIbPZ8iSG0sJyXtscoXpu/OFw==}
+  '@chatwoot/prosemirror-schema@1.3.22':
+    resolution: {integrity: sha512-0r+PT8xhQLCKCpoV9k9XVTTRECs/0Nr37wbcLsRS7yvc7WkF9FY05z2hGCRJReWmTOcmmshHtb042LVP+MyB/w==}
 
   '@chatwoot/utils@0.0.55':
     resolution: {integrity: sha512-8G6HYQe1ZEYfJEsSYfDVvE+uhf98JDRjtGlpB+bzMko+yltbrk4yACSo/ImC3jSaJ6K8yPTSjJToSRmsQbL2iQ==}
@@ -5128,7 +5128,7 @@ snapshots:
       hotkeys-js: 3.8.7
       lit: 2.2.6
 
-  '@chatwoot/prosemirror-schema@1.3.21':
+  '@chatwoot/prosemirror-schema@1.3.22':
     dependencies:
       markdown-it-sup: 2.0.0
       prosemirror-commands: 1.7.1

From 2663a8495d02622c108ed438a0dc0254966515c6 Mon Sep 17 00:00:00 2001
From: Sugar Ray Ledesma <sugarrayledesma@outlook.com>
Date: Thu, 11 Jun 2026 22:06:34 +0900
Subject: [PATCH 32/34] refactor(security): rename path_without_extensions in
 Rack::Attack (#14216)

Fix misspelling 'extentions' and clarify comments. Behavior unchanged:
same path-stripping logic for throttle matching (e.g. /auth and
/auth.json). Also correct 'You may' in remote_ip comment.
---
 config/initializers/rack_attack.rb | 40 +++++++++++++++---------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
index 15e78af9b..0158e3284 100644
--- a/config/initializers/rack_attack.rb
+++ b/config/initializers/rack_attack.rb
@@ -19,7 +19,7 @@ class Rack::Attack
   Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(redis: $velma, pool: false)
 
   class Request < ::Rack::Request
-    # You many need to specify a method to fetch the correct remote IP address
+    # You may need to specify a method to fetch the correct remote IP address
     # if the web server is behind a load balancer.
     def remote_ip
       @remote_ip ||= (env['action_dispatch.remote_ip'] || ip).to_s
@@ -31,9 +31,9 @@ class Rack::Attack
       (default_allowed_ips + env_allowed_ips).include?(remote_ip)
     end
 
-    # Rails would allow requests to paths with extentions, so lets compare against the path with extention stripped
+    # Rails would allow requests to paths with extensions, so lets compare against the path with extension stripped
     # example /auth & /auth.json would both work
-    def path_without_extentions
+    def path_without_extensions
       path[/^[^.]+/]
     end
   end
@@ -75,11 +75,11 @@ class Rack::Attack
 
   ### Prevent Brute-Force Super Admin Login Attacks ###
   throttle('super_admin_login/ip', limit: 5, period: 5.minutes) do |req|
-    req.ip if req.path_without_extentions == '/super_admin/sign_in' && req.post?
+    req.ip if req.path_without_extensions == '/super_admin/sign_in' && req.post?
   end
 
   throttle('super_admin_login/email', limit: 5, period: 15.minutes) do |req|
-    if req.path_without_extentions == '/super_admin/sign_in' && req.post?
+    if req.path_without_extensions == '/super_admin/sign_in' && req.post?
       # NOTE: This line used to throw ArgumentError /rails/action_mailbox/sendgrid/inbound_emails : invalid byte sequence in UTF-8
       # Hence placed in the if block
       # ref: https://github.com/rack/rack-attack/issues/399
@@ -91,7 +91,7 @@ class Rack::Attack
   # ### Prevent Brute-Force Login Attacks ###
   # Exclude MFA verification attempts from regular login throttling
   throttle('login/ip', limit: 5, period: 5.minutes) do |req|
-    if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
+    if req.path_without_extensions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
       # Skip if this is an MFA verification request
       req.ip
     end
@@ -99,7 +99,7 @@ class Rack::Attack
 
   throttle('login/email', limit: 10, period: 15.minutes) do |req|
     # Skip if this is an MFA verification request
-    if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
+    if req.path_without_extensions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
       # ref: https://github.com/rack/rack-attack/issues/399
       # NOTE: This line used to throw ArgumentError /rails/action_mailbox/sendgrid/inbound_emails : invalid byte sequence in UTF-8
       # Hence placed in the if block
@@ -110,11 +110,11 @@ class Rack::Attack
 
   ## Reset password throttling
   throttle('reset_password/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/auth/password' && req.post?
+    req.ip if req.path_without_extensions == '/auth/password' && req.post?
   end
 
   throttle('reset_password/email', limit: 5, period: 1.hour) do |req|
-    if req.path_without_extentions == '/auth/password' && req.post?
+    if req.path_without_extensions == '/auth/password' && req.post?
       email = req.params['email'].presence || ActionDispatch::Request.new(req.env).params['email'].presence
       email.to_s.downcase.gsub(/\s+/, '')
     end
@@ -122,11 +122,11 @@ class Rack::Attack
 
   ## Resend confirmation throttling (unauthenticated)
   throttle('resend_confirmation/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/resend_confirmation' && req.post?
+    req.ip if req.path_without_extensions == '/resend_confirmation' && req.post?
   end
 
   throttle('resend_confirmation/email', limit: 5, period: 1.hour) do |req|
-    if req.path_without_extentions == '/resend_confirmation' && req.post?
+    if req.path_without_extensions == '/resend_confirmation' && req.post?
       email = req.params['email'].presence || ActionDispatch::Request.new(req.env).params['email'].presence
       email.to_s.downcase.gsub(/\s+/, '')
     end
@@ -134,25 +134,25 @@ class Rack::Attack
 
   ## Resend confirmation throttling (authenticated)
   throttle('resend_confirmation_auth/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/api/v1/profile/resend_confirmation' && req.post?
+    req.ip if req.path_without_extensions == '/api/v1/profile/resend_confirmation' && req.post?
   end
 
   ## MFA throttling - prevent brute force attacks
   throttle('mfa_verification/ip', limit: 5, period: 1.minute) do |req|
-    if req.path_without_extentions == '/api/v1/profile/mfa'
+    if req.path_without_extensions == '/api/v1/profile/mfa'
       req.ip if req.delete? # Throttle disable attempts
-    elsif req.path_without_extentions.match?(%r{/api/v1/profile/mfa/(verify|backup_codes)})
+    elsif req.path_without_extensions.match?(%r{/api/v1/profile/mfa/(verify|backup_codes)})
       req.ip if req.post? # Throttle verify and backup_codes attempts
     end
   end
 
   # Separate rate limiting for MFA verification attempts
   throttle('mfa_login/ip', limit: 10, period: 1.minute) do |req|
-    req.ip if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].present?
+    req.ip if req.path_without_extensions == '/auth/sign_in' && req.post? && req.params['mfa_token'].present?
   end
 
   throttle('mfa_login/token', limit: 10, period: 1.minute) do |req|
-    if req.path_without_extentions == '/auth/sign_in' && req.post?
+    if req.path_without_extensions == '/auth/sign_in' && req.post?
       # Track by MFA token to prevent brute force on a specific token
       mfa_token = req.params['mfa_token'].presence
       (mfa_token.presence)
@@ -161,7 +161,7 @@ class Rack::Attack
 
   ## Prevent Brute-Force Signup Attacks ###
   throttle('accounts/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/api/v1/accounts' && req.post?
+    req.ip if req.path_without_extensions == '/api/v1/accounts' && req.post?
   end
 
   ##-----------------------------------------------##
@@ -176,17 +176,17 @@ class Rack::Attack
   if ActiveModel::Type::Boolean.new.cast(ENV.fetch('ENABLE_RACK_ATTACK_WIDGET_API', true))
     ## Prevent Conversation Bombing on Widget APIs ###
     throttle('api/v1/widget/conversations', limit: 6, period: 12.hours) do |req|
-      req.ip if req.path_without_extentions == '/api/v1/widget/conversations' && req.post?
+      req.ip if req.path_without_extensions == '/api/v1/widget/conversations' && req.post?
     end
 
     ## Prevent Contact update Bombing in Widget API ###
     throttle('api/v1/widget/contacts', limit: 60, period: 1.hour) do |req|
-      req.ip if req.path_without_extentions == '/api/v1/widget/contacts' && (req.patch? || req.put?)
+      req.ip if req.path_without_extensions == '/api/v1/widget/contacts' && (req.patch? || req.put?)
     end
 
     ## Prevent Conversation Bombing through multiple sessions
     throttle('widget?website_token={website_token}&cw_conversation={x-auth-token}', limit: 5, period: 1.hour) do |req|
-      req.ip if req.path_without_extentions == '/widget' && ActionDispatch::Request.new(req.env).params['cw_conversation'].blank?
+      req.ip if req.path_without_extensions == '/widget' && ActionDispatch::Request.new(req.env).params['cw_conversation'].blank?
     end
   end
 

From c6a38e2fc61a05af85cc966fd35fcbcd12883295 Mon Sep 17 00:00:00 2001
From: Muhsin Keloth <muhsinkeramam@gmail.com>
Date: Fri, 12 Jun 2026 09:39:26 +0400
Subject: [PATCH 33/34] fix: Keep Instagram scopes out of new Messenger OAuth
 flows (#14695)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removes Instagram permissions from the Facebook Messenger inbox setup
flow to avoid blocking Meta App Review for Messenger-only apps.

Meta rejects or stalls Messenger-only app reviews when the OAuth flow
requests unrelated Instagram permissions such as `instagram_basic` and
`instagram_manage_messages`. This blocks approval for Messenger
permissions like `human_agent`, even when the user only wants to
configure a Facebook Messenger inbox.

New Facebook Messenger inbox setup now requests only the Page and
Messenger permissions required for Messenger. Existing Facebook
Messenger inboxes that already have Instagram details continue to
request Instagram permissions during reauthorization, preserving support
for the legacy combined Facebook/Instagram inbox flow.

Going forward, new Instagram setups should use the dedicated Instagram
channel inbox instead of being bundled into the Messenger setup flow.

Closes #13860

## How to test

1. Go to Settings → Inboxes → Add Inbox → Facebook Messenger.
2. Click Login with Facebook.
3. Verify the OAuth scope does not include `instagram_basic` or
`instagram_manage_messages`.
4. Reauthorize an existing Facebook Messenger inbox with `instagram_id`
present.
5. Verify the reauth scope still includes `instagram_basic` and
`instagram_manage_messages`.

---------

Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
---
 .../spec/useFacebookPageConnect.spec.js       |  3 ++-
 .../composables/useFacebookPageConnect.js     |  8 ++-----
 .../dashboard/helper/facebookScopes.js        | 22 +++++++++++++++++++
 .../settings/inbox/facebook/Reauthorize.vue   |  9 ++++++--
 4 files changed, 33 insertions(+), 9 deletions(-)
 create mode 100644 app/javascript/dashboard/helper/facebookScopes.js

diff --git a/app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js b/app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js
index 5d9edb993..4ec17e753 100644
--- a/app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js
+++ b/app/javascript/dashboard/composables/spec/useFacebookPageConnect.spec.js
@@ -70,7 +70,8 @@ describe('useFacebookPageConnect', () => {
       ACCOUNT_ID
     );
     expect(window.FB.login).toHaveBeenCalledWith(expect.any(Function), {
-      scope: expect.stringContaining('pages_show_list'),
+      scope:
+        'pages_manage_metadata,business_management,pages_messaging,pages_show_list,pages_read_engagement',
     });
   });
 
diff --git a/app/javascript/dashboard/composables/useFacebookPageConnect.js b/app/javascript/dashboard/composables/useFacebookPageConnect.js
index 46a177d58..dbe06dd0d 100644
--- a/app/javascript/dashboard/composables/useFacebookPageConnect.js
+++ b/app/javascript/dashboard/composables/useFacebookPageConnect.js
@@ -1,13 +1,9 @@
 import { ref } from 'vue';
 import { useMapGetter } from 'dashboard/composables/store';
 import ChannelApi from 'dashboard/api/channels';
+import { buildFacebookLoginScopes } from 'dashboard/helper/facebookScopes';
 import { setupFacebookSdk } from 'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils';
 
-// Page-management + messaging scopes required to list pages and create a
-// Channel::FacebookPage inbox (mirrors the standalone settings flow).
-const FB_PAGE_SCOPES =
-  'pages_manage_metadata,business_management,pages_messaging,instagram_basic,pages_show_list,pages_read_engagement,instagram_manage_messages';
-
 // Headless half of the Facebook Page connect flow: load the Meta SDK, run
 // FB.login for page scopes, and fetch the user's pages. The caller owns the
 // page-picker UI and the channel creation, because choosing a page is an
@@ -51,7 +47,7 @@ export function useFacebookPageConnect() {
               : null
           );
         },
-        { scope: FB_PAGE_SCOPES }
+        { scope: buildFacebookLoginScopes() }
       );
     });
 
diff --git a/app/javascript/dashboard/helper/facebookScopes.js b/app/javascript/dashboard/helper/facebookScopes.js
new file mode 100644
index 000000000..755b3f465
--- /dev/null
+++ b/app/javascript/dashboard/helper/facebookScopes.js
@@ -0,0 +1,22 @@
+export const FACEBOOK_PAGE_SCOPES = [
+  'pages_manage_metadata',
+  'business_management',
+  'pages_messaging',
+  'pages_show_list',
+  'pages_read_engagement',
+];
+
+export const INSTAGRAM_SCOPES = [
+  'instagram_basic',
+  'instagram_manage_messages',
+];
+
+export const buildFacebookLoginScopes = ({
+  includeInstagramScopes = false,
+} = {}) => {
+  const scopes = [...FACEBOOK_PAGE_SCOPES];
+  if (includeInstagramScopes) {
+    scopes.push(...INSTAGRAM_SCOPES);
+  }
+  return scopes.join(',');
+};
diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/facebook/Reauthorize.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/facebook/Reauthorize.vue
index dd566f131..cf25177ea 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/facebook/Reauthorize.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/facebook/Reauthorize.vue
@@ -4,6 +4,7 @@ import InboxReconnectionRequired from '../components/InboxReconnectionRequired.v
 import { useAlert } from 'dashboard/composables';
 
 import { loadScript } from 'dashboard/helper/DOMHelpers';
+import { buildFacebookLoginScopes } from 'dashboard/helper/facebookScopes';
 import * as Sentry from '@sentry/vue';
 
 export default {
@@ -20,6 +21,11 @@ export default {
     inboxId() {
       return this.inbox.id;
     },
+    facebookLoginScopes() {
+      return buildFacebookLoginScopes({
+        includeInstagramScopes: !!this.inbox.instagram_id,
+      });
+    },
   },
   mounted() {
     window.fbAsyncInit = this.runFBInit;
@@ -77,8 +83,7 @@ export default {
           }
         },
         {
-          scope:
-            'pages_manage_metadata,business_management,pages_messaging,instagram_basic,pages_show_list,pages_read_engagement,instagram_manage_messages',
+          scope: this.facebookLoginScopes,
           auth_type: 'reauthorize',
         }
       );

From c041fde3a2d745b9b69d73df8726c687cf351164 Mon Sep 17 00:00:00 2001
From: Rorrick <34399621+Rorrick@users.noreply.github.com>
Date: Fri, 12 Jun 2026 08:21:42 +0200
Subject: [PATCH 34/34] fix: Preserve original filenames for WhatsApp cloud
 attachments (#14168)

## Summary

Preserves the original filename provided in the WhatsApp Cloud
attachment payload when downloading media files.

## Problem

Files containing accented or special characters could be saved with
malformed names or incorrect extensions due to relying on remote
download metadata.

## Changes Made

- Uses attachment_payload[:filename] when present
- Creates a tempfile using the original filename and extension
- Preserves content type metadata
- Falls back to existing behavior when no filename is provided

## Notes

This should improve attachment downloads for filenames containing
accented characters.
Related to #10973

---------

Co-authored-by: Rorrick Smith <rorrick@bulksms.com>
Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 ...incoming_message_whatsapp_cloud_service.rb | 11 +++++-
 ...ing_message_whatsapp_cloud_service_spec.rb | 35 +++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/app/services/whatsapp/incoming_message_whatsapp_cloud_service.rb b/app/services/whatsapp/incoming_message_whatsapp_cloud_service.rb
index 164c3ac12..f836a63c3 100644
--- a/app/services/whatsapp/incoming_message_whatsapp_cloud_service.rb
+++ b/app/services/whatsapp/incoming_message_whatsapp_cloud_service.rb
@@ -13,8 +13,17 @@ class Whatsapp::IncomingMessageWhatsappCloudService < Whatsapp::IncomingMessageB
       inbox.channel.media_url(attachment_payload[:id]),
       headers: inbox.channel.api_headers
     )
+
     # This url response will be failure if the access token has expired.
     inbox.channel.authorization_error! if url_response.unauthorized?
-    Down.download(url_response.parsed_response['url'], headers: inbox.channel.api_headers) if url_response.success?
+
+    return unless url_response.success?
+
+    downloaded_file = Down.download(url_response.parsed_response['url'], headers: inbox.channel.api_headers)
+    # WhatsApp Cloud sends the original filename in the payload; preserve it so accented
+    # names keep their correct extension instead of relying on the mangled remote metadata.
+    filename = attachment_payload[:filename]
+    downloaded_file.define_singleton_method(:original_filename) { filename } if filename.present?
+    downloaded_file
   end
 end
diff --git a/spec/services/whatsapp/incoming_message_whatsapp_cloud_service_spec.rb b/spec/services/whatsapp/incoming_message_whatsapp_cloud_service_spec.rb
index 70c29c092..1bbd6d8f4 100644
--- a/spec/services/whatsapp/incoming_message_whatsapp_cloud_service_spec.rb
+++ b/spec/services/whatsapp/incoming_message_whatsapp_cloud_service_spec.rb
@@ -59,6 +59,41 @@ describe Whatsapp::IncomingMessageWhatsappCloudService do
       end
     end
 
+    context 'when document attachment includes an accented filename' do
+      let(:document_params) do
+        {
+          phone_number: whatsapp_channel.phone_number,
+          object: 'whatsapp_business_account',
+          entry: [{
+            changes: [{
+              value: {
+                contacts: [{ profile: { name: 'Sojan Jose' }, wa_id: '2423423243' }],
+                messages: [{
+                  from: '2423423243',
+                  document: {
+                    id: 'b1c68f38-8734-4ad3-b4a1-ef0c10d683',
+                    mime_type: 'application/pdf',
+                    filename: 'Currículum café.pdf',
+                    caption: 'My résumé'
+                  },
+                  timestamp: '1664799904', type: 'document'
+                }]
+              }
+            }]
+          }]
+        }.with_indifferent_access
+      end
+
+      it 'preserves the original filename from the payload' do
+        stub_media_url_request
+        stub_sample_png_request
+        described_class.new(inbox: whatsapp_channel.inbox, params: document_params).perform
+
+        attachment = whatsapp_channel.inbox.messages.first.attachments.first
+        expect(attachment.file.filename.to_s).to eq('Currículum café.pdf')
+      end
+    end
+
     context 'when invalid attachment message params' do
       let(:error_params) do
         {