feat: migrate dyte integration to cloudflare realtimekit (#14752)

Dyte is sunsetting its existing infrastructure after the Cloudflare
acquisition, so this migrates Chatwoot’s video call integration to
Cloudflare RealtimeKit.

The integration now uses Cloudflare Account ID, RealtimeKit App ID, and
a Cloudflare API token with Realtime Admin permissions. Meeting creation
and participant token generation now call Cloudflare’s RealtimeKit APIs,
while the existing Chatwoot call experience remains unchanged for agents
and customers.

This also adds setup-time credential validation, so admins get clearer
errors when the API token is invalid, the Cloudflare account or
permissions are incorrect, or the RealtimeKit App ID does not belong to
the selected account.

Fixes
https://linear.app/chatwoot/issue/PLA-176/migrate-dyte-integration-to-cloudflare-realtimekit

**How to test**

1. Go to Settings → Integrations → Cloudflare RealtimeKit.
2. Add a Cloudflare Account ID, RealtimeKit App ID, and API token with
Realtime Admin permissions.
3. Confirm the integration saves successfully with valid credentials.
4. Try invalid credentials and confirm the error identifies whether the
token, account/permissions, or app ID is wrong.
5. Start a video call from a conversation and confirm the RealtimeKit
meeting opens.

---------

Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>
Co-authored-by: Sony Mathew <sony@chatwoot.com>

spec/models/integrations/hook_spec.rb

@@ -177,4 +177,132 @@ RSpec.describe Integrations::Hook do
       expect(hook).to be_valid
     end
   end
+
+  describe 'cloudflare realtimekit credential validation' do
+    let(:account) { create(:account) }
+    let(:settings) { { 'account_id' => 'account_id', 'app_id' => 'app_id', 'api_token' => 'api_token' } }
+
+    it 'prevents saving a RealtimeKit hook with an invalid API token' do
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(false, :invalid_api_token))
+
+      hook = build(:integrations_hook, :dyte, account: account, settings: settings)
+
+      expect(hook).not_to be_valid
+      expect(hook.errors[:base]).to include(I18n.t('errors.cloudflare.realtimekit.invalid_api_token'))
+    end
+
+    it 'prevents saving a RealtimeKit hook with an invalid account or missing token permissions' do
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(false, :invalid_account_or_permissions))
+
+      hook = build(:integrations_hook, :dyte, account: account, settings: settings)
+
+      expect(hook).not_to be_valid
+      expect(hook.errors[:base]).to include(I18n.t('errors.cloudflare.realtimekit.invalid_account_or_permissions'))
+    end
+
+    it 'prevents saving a RealtimeKit hook when the app is not found' do
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(false, :app_not_found))
+
+      hook = build(:integrations_hook, :dyte, account: account, settings: settings)
+
+      expect(hook).not_to be_valid
+      expect(hook.errors[:base]).to include(I18n.t('errors.cloudflare.realtimekit.app_not_found'))
+    end
+
+    it 'allows saving a RealtimeKit hook with valid credentials' do
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(true))
+
+      hook = build(:integrations_hook, :dyte, account: account, settings: settings)
+
+      expect(hook).to be_valid
+    end
+
+    it 'skips validation when an enabled RealtimeKit hook is saved without changing credentials' do
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(true))
+      hook = create(:integrations_hook, :dyte, account: account, settings: settings)
+
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(false, :invalid_api_token))
+      hook.settings['account_id'] = 'account_id'
+
+      expect(hook.save).to be true
+    end
+
+    it 'validates when a disabled RealtimeKit hook is re-enabled' do
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(true))
+      hook = create(:integrations_hook, :dyte, account: account, settings: settings)
+      hook.update!(status: :disabled)
+
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .with('account_id', 'app_id', 'api_token')
+        .and_return(cloudflare_validator_result(false, :invalid_api_token))
+
+      expect(hook.update(status: :enabled)).to be false
+      expect(hook.errors[:base]).to include(I18n.t('errors.cloudflare.realtimekit.invalid_api_token'))
+    end
+
+    it 'skips validation for disabled RealtimeKit hooks' do
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(true))
+      hook = create(:integrations_hook, :dyte, account: account, settings: settings)
+
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(false, :invalid_api_token))
+      hook.disable
+
+      expect(hook.reload).to be_disabled
+    end
+
+    it 'allows disabling a persisted legacy Dyte hook without RealtimeKit credentials' do
+      hook = build(:integrations_hook, :dyte, account: account, settings: { 'organization_id' => 'org_id', 'api_key' => 'dyte_api_key' })
+      hook.save!(validate: false)
+
+      allow(Integrations::Cloudflare::RealtimeKitCredentialsValidator).to receive(:validate)
+        .and_return(cloudflare_validator_result(false, :invalid_api_token))
+
+      expect(hook.disable).to be true
+      expect(hook.reload).to be_disabled
+    end
+
+    it 'allows re-enabling a persisted legacy Dyte hook without RealtimeKit credential validation' do
+      hook = build(:integrations_hook, :dyte, account: account, settings: { 'organization_id' => 'org_id', 'api_key' => 'dyte_api_key' })
+      hook.save!(validate: false)
+      hook.disable
+
+      expect(Integrations::Cloudflare::RealtimeKitCredentialsValidator).not_to receive(:validate)
+
+      expect(hook.update(status: :enabled)).to be true
+      expect(hook.reload).to be_enabled
+    end
+
+    it 'validates settings when a legacy Dyte hook settings payload is changed' do
+      hook = build(:integrations_hook, :dyte, account: account, settings: { 'organization_id' => 'org_id', 'api_key' => 'dyte_api_key' })
+      hook.save!(validate: false)
+
+      hook.settings = { 'account_id' => 'account_id' }
+
+      expect(hook).not_to be_valid
+      expect(hook.errors[:settings]).to include(': Invalid settings data')
+    end
+
+    it 'rejects new legacy Dyte hooks' do
+      hook = build(:integrations_hook, :dyte,
+                   account: account,
+                   status: :disabled,
+                   settings: { 'organization_id' => 'org_id', 'api_key' => 'dyte_api_key' })
+
+      expect(hook).not_to be_valid
+      expect(hook.errors[:settings]).to include(': Invalid settings data')
+    end
+  end
+
+  def cloudflare_validator_result(success, error = nil)
+    Integrations::Cloudflare::RealtimeKitCredentialsValidator::Result.new(success, error)
+  end
 end