akadmin/chatwoot
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: scope user access token serialization

Browse Source
This commit is contained in:
Shivam Mishra
2026-05-27 13:50:41 +05:30
parent b9e83ec2d4
commit 7333cdd79f
10 changed files with 23 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/views/api/v1/models/_user.json.jbuilder
+7 -5
View File
@@ -1,8 +1,10 @@
# Withhold the full-scope token from callers who authenticated with a
# read-only token — otherwise GET /api/v1/profile would let a read-only
# holder lift the full token and bypass the scope gate entirely.
json.access_token resource.access_token&.token unless @access_token&.scope == 'read_only'
json.read_only_access_token resource.read_only_access_token&.token
if local_assigns[:include_access_tokens]
# Withhold the full-scope token from callers who authenticated with a
# read-only token — otherwise GET /api/v1/profile would let a read-only
# holder lift the full token and bypass the scope gate entirely.
json.access_token resource.access_token&.token unless @access_token&.scope == 'read_only'
json.read_only_access_token resource.read_only_access_token&.token
end
json.account_id resource.active_account_user&.account_id
json.available_name resource.available_name
json.avatar_url resource.avatar_url
app/views/api/v1/profiles/auto_offline.jbuilder
+1 -1
View File
@@ -1 +1 @@
json.partial! 'api/v1/models/user', formats: [:json], resource: @user
json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true
app/views/api/v1/profiles/availability.jbuilder
+1 -1
View File
@@ -1 +1 @@
json.partial! 'api/v1/models/user', formats: [:json], resource: @user
json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true
app/views/api/v1/profiles/avatar.json.jbuilder
+1 -1
View File
@@ -1 +1 @@
json.partial! 'api/v1/models/user', formats: [:json], resource: @user
json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true
app/views/api/v1/profiles/reset_access_token.json.jbuilder
+1 -1
View File
@@ -1 +1 @@
json.partial! 'api/v1/models/user', formats: [:json], resource: @user
json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true
app/views/api/v1/profiles/reset_read_only_access_token.json.jbuilder
+1 -1
View File
@@ -1 +1 @@
json.partial! 'api/v1/models/user', formats: [:json], resource: @user
json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true
app/views/api/v1/profiles/show.json.jbuilder
+1 -1
View File
@@ -1 +1 @@
json.partial! 'api/v1/models/user', formats: [:json], resource: @user
json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true
app/views/api/v1/profiles/update.json.jbuilder
+1 -1
View File
@@ -1 +1 @@
json.partial! 'api/v1/models/user', formats: [:json], resource: @user
json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true
app/views/devise/_auth.json.jbuilder
+1 -1
View File
@@ -1,3 +1,3 @@
json.data do
json.partial! 'api/v1/models/user', formats: [:json], resource: resource
json.partial! 'api/v1/models/user', formats: [:json], resource: resource, include_access_tokens: true
end