From 97b30127a6b7e6800b72ae2a00e4167cec077923 Mon Sep 17 00:00:00 2001
From: Muhsin <12408980+muhsin-k@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:20:41 +0400
Subject: [PATCH] fix(inboxes): block disabled widget config and inbound calls

---
 .../api/v1/widget/configs_controller.rb       |  1 +
 .../controllers/twilio/voice_controller.rb    |  4 ++--
 .../api/v1/widget/configs_controller_spec.rb  | 23 +++++++++++++++++++
 .../twilio/voice_controller_spec.rb           | 17 ++++++++++++++
 4 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/app/controllers/api/v1/widget/configs_controller.rb b/app/controllers/api/v1/widget/configs_controller.rb
index 458d0486c..59fe1a951 100644
--- a/app/controllers/api/v1/widget/configs_controller.rb
+++ b/app/controllers/api/v1/widget/configs_controller.rb
@@ -1,4 +1,5 @@
 class Api::V1::Widget::ConfigsController < Api::V1::Widget::BaseController
+  before_action :ensure_inbox_active
   before_action :set_global_config
 
   def create
diff --git a/enterprise/app/controllers/twilio/voice_controller.rb b/enterprise/app/controllers/twilio/voice_controller.rb
index 52ec2637b..126ba3979 100644
--- a/enterprise/app/controllers/twilio/voice_controller.rb
+++ b/enterprise/app/controllers/twilio/voice_controller.rb
@@ -90,10 +90,10 @@ class Twilio::VoiceController < ApplicationController
     from_number.start_with?('client:')
   end
 
-  # A fresh contact-initiated leg on an inbox with inbound calls turned off.
+  # A fresh contact-initiated leg on an inbox that cannot receive calls.
   # Reject it so no conference, conversation, or Call row is created.
   def reject_inbound?
-    twilio_direction == 'inbound' && !agent_leg?(twilio_from) && !inbox.channel.inbound_calls_enabled?
+    twilio_direction == 'inbound' && !agent_leg?(twilio_from) && (!inbox.active? || !inbox.channel.inbound_calls_enabled?)
   end
 
   def reject_twiml
diff --git a/spec/controllers/api/v1/widget/configs_controller_spec.rb b/spec/controllers/api/v1/widget/configs_controller_spec.rb
index cea2e55fa..04cd62b7d 100644
--- a/spec/controllers/api/v1/widget/configs_controller_spec.rb
+++ b/spec/controllers/api/v1/widget/configs_controller_spec.rb
@@ -31,6 +31,18 @@ RSpec.describe '/api/v1/widget/config', type: :request do
         response_data = response.parsed_body
         expect(response_data.keys).to include(*response_keys)
       end
+
+      it 'does not initialize config or create a contact when the inbox is disabled' do
+        web_widget.inbox.update!(active: false)
+
+        expect do
+          post '/api/v1/widget/config',
+               params: params,
+               as: :json
+        end.not_to change(Contact, :count)
+
+        expect(response).to have_http_status(:forbidden)
+      end
     end
 
     context 'with correct website token and valid X-Auth-Token' do
@@ -48,6 +60,17 @@ RSpec.describe '/api/v1/widget/config', type: :request do
         expect(response_data['contact']['pubsub_token']).to eq(contact_inbox.pubsub_token)
       end
 
+      it 'does not initialize config when the inbox is disabled' do
+        web_widget.inbox.update!(active: false)
+
+        post '/api/v1/widget/config',
+             params: params,
+             headers: { 'X-Auth-Token' => token },
+             as: :json
+
+        expect(response).to have_http_status(:forbidden)
+      end
+
       it 'returns 401 if account is suspended' do
         account.update!(status: :suspended)
 
diff --git a/spec/enterprise/controllers/twilio/voice_controller_spec.rb b/spec/enterprise/controllers/twilio/voice_controller_spec.rb
index 0f537af20..e51d2ce6c 100644
--- a/spec/enterprise/controllers/twilio/voice_controller_spec.rb
+++ b/spec/enterprise/controllers/twilio/voice_controller_spec.rb
@@ -129,6 +129,23 @@ RSpec.describe 'Twilio::VoiceController', type: :request do
       expect(response).to have_http_status(:ok)
       expect(response.body).to include('<Reject')
     end
+
+    it 'rejects the inbound contact leg without building a call when the inbox is disabled' do
+      inbox.update!(active: false)
+      expect(Voice::InboundCallBuilder).not_to receive(:perform!)
+
+      expect do
+        post "/twilio/voice/call/#{digits}", params: {
+          'CallSid' => call_sid,
+          'From' => from_number,
+          'To' => to_number,
+          'Direction' => 'inbound'
+        }
+      end.not_to change(Call, :count)
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('<Reject')
+    end
   end
 
   describe 'POST /twilio/voice/status/:phone' do