From 8e98fd26b5704c9b8e20cc4f318f3b9745f8f385 Mon Sep 17 00:00:00 2001
From: Muhsin Keloth <muhsinkeramam@gmail.com>
Date: Fri, 4 Jul 2025 16:52:02 +0530
Subject: [PATCH] chore: fix account id

---
 .../github/callbacks_controller.rb            | 43 ++++++++-----------
 app/models/integrations/app.rb                |  4 +-
 2 files changed, 21 insertions(+), 26 deletions(-)

diff --git a/app/controllers/github/callbacks_controller.rb b/app/controllers/github/callbacks_controller.rb
index b82a3ff2c..2bb2017a2 100644
--- a/app/controllers/github/callbacks_controller.rb
+++ b/app/controllers/github/callbacks_controller.rb
@@ -2,23 +2,13 @@ class Github::CallbacksController < ApplicationController
   include Github::IntegrationHelper
 
   def show
-    # Log all received parameters for debugging
-    Rails.logger.info("GitHub callback received parameters: #{params.to_unsafe_h}")
-    Rails.logger.info("installation_id present: #{params[:installation_id].present?}")
-    Rails.logger.info("code present: #{params[:code].present?}")
-    Rails.logger.info("setup_action: #{params[:setup_action]}")
-    Rails.logger.info("state present: #{params[:state].present?}")
-
     if params[:installation_id].present? && params[:code].present?
-      Rails.logger.info('Handling installation with OAuth')
       # Both installation and OAuth code present - handle both
       handle_installation_with_oauth
     elsif params[:installation_id].present?
-      Rails.logger.info('Handling installation only')
       # Only installation_id present - redirect to OAuth
       handle_installation
     else
-      Rails.logger.info('Handling authorization only')
       # Only OAuth code present - handle authorization
       handle_authorization
     end
@@ -30,7 +20,6 @@ class Github::CallbacksController < ApplicationController
   private
 
   def handle_installation_with_oauth
-    Rails.logger.info("Processing installation with OAuth - installation_id: #{params[:installation_id]}, code: #{params[:code]}")
     # Handle both installation and OAuth in one go
     installation_id = params[:installation_id]
 
@@ -43,7 +32,6 @@ class Github::CallbacksController < ApplicationController
   end
 
   def handle_installation
-    Rails.logger.info("Processing installation only - setup_action: #{params[:setup_action]}, installation_id: #{params[:installation_id]}")
     if params[:setup_action] == 'install'
       installation_id = params[:installation_id]
 
@@ -55,7 +43,6 @@ class Github::CallbacksController < ApplicationController
   end
 
   def handle_authorization
-    Rails.logger.info("Processing authorization only - code: #{params[:code]}")
     @response = oauth_client.auth_code.get_token(
       params[:code],
       redirect_uri: "#{base_url}/github/callback"
@@ -124,15 +111,23 @@ class Github::CallbacksController < ApplicationController
   end
 
   def account
-    @account ||= Account.find(account_id)
+    @account ||= account_from_state
   end
 
-  def account_id
-    # First try to get from state parameter (OAuth flow)
-    return verify_github_token(params[:state]) if params[:state].present?
+  def account_from_state
+    raise ActionController::BadRequest, 'Missing state variable' if params[:state].blank?
 
-    # Fallback to hardcoded account 1 for installation flow (temporary)
-    1
+    # Try signed GlobalID first (installation flow)
+    account = GlobalID::Locator.locate_signed(params[:state])
+    return account if account
+
+    # Fallback to JWT token (direct OAuth flow)
+    account_id = verify_github_token(params[:state])
+    return Account.find(account_id) if account_id
+
+    raise 'Invalid or expired state'
+  rescue StandardError
+    raise ActionController::BadRequest, 'Invalid account context'
   end
 
   def github_redirect_uri
@@ -144,12 +139,10 @@ class Github::CallbacksController < ApplicationController
   end
 
   def fallback_redirect_uri
-    if account_id
-      github_redirect_uri
-    else
-      # Fallback if no account context available
-      "#{ENV.fetch('FRONTEND_URL', nil)}/app/settings/integrations"
-    end
+    github_redirect_uri
+  rescue StandardError
+    # Fallback if no account context available
+    "#{ENV.fetch('FRONTEND_URL', nil)}/app/settings/integrations"
   end
 
   def parsed_body
diff --git a/app/models/integrations/app.rb b/app/models/integrations/app.rb
index 3e0a73cb5..f5d870836 100644
--- a/app/models/integrations/app.rb
+++ b/app/models/integrations/app.rb
@@ -92,8 +92,10 @@ class Integrations::App
     GlobalConfigService.load('GITHUB_CLIENT_ID', nil)
 
     # For GitHub Apps, we need to redirect to the installation page first
+    # Include state parameter with signed account ID for account context
     github_app_name = GlobalConfigService.load('GITHUB_APP_NAME', 'chatwoot-qa')
-    "https://github.com/apps/#{github_app_name}/installations/new"
+    state = Current.account.to_signed_global_id(expires_in: 1.hour)
+    "https://github.com/apps/#{github_app_name}/installations/new?state=#{state}"
   end
 
   def enabled?(account)