From 906b14d8250952143f8ca4b0d0c0661575b98c2b Mon Sep 17 00:00:00 2001
From: Sojan Jose <sojan.official@gmail.com>
Date: Fri, 3 Oct 2025 14:27:22 +0530
Subject: [PATCH] Ensure conversation access honors permissions

---
 .../api/v1/accounts/conversations_controller.rb        |  1 +
 app/policies/conversation_policy.rb                    | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/app/controllers/api/v1/accounts/conversations_controller.rb b/app/controllers/api/v1/accounts/conversations_controller.rb
index e27869d82..e3ebe0450 100644
--- a/app/controllers/api/v1/accounts/conversations_controller.rb
+++ b/app/controllers/api/v1/accounts/conversations_controller.rb
@@ -160,6 +160,7 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
 
   def conversation
     @conversation ||= Current.account.conversations.find_by!(display_id: params[:id])
+    authorize @conversation
     authorize @conversation.inbox, :show?
   end
 
diff --git a/app/policies/conversation_policy.rb b/app/policies/conversation_policy.rb
index 931e17435..ea4d1a15b 100644
--- a/app/policies/conversation_policy.rb
+++ b/app/policies/conversation_policy.rb
@@ -1,4 +1,14 @@
 class ConversationPolicy < ApplicationPolicy
+  class Scope < ApplicationPolicy::Scope
+    def resolve
+      return scope if user.is_a?(AgentBot)
+      return scope.none if account.blank?
+
+      conversations = scope.where(account_id: account.id)
+      Conversations::PermissionFilterService.new(conversations, user, account).perform
+    end
+  end
+
   def index?
     true
   end