From ae676077ed80afb156d7514a4b857c0091e3ce6b Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Wed, 27 May 2026 14:53:03 +0530 Subject: [PATCH] test: readonly token can access context inbox filter --- .../v1/accounts/contact_inboxes_controller_spec.rb | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/spec/controllers/api/v1/accounts/contact_inboxes_controller_spec.rb b/spec/controllers/api/v1/accounts/contact_inboxes_controller_spec.rb index 86deab707..66c847ec6 100644 --- a/spec/controllers/api/v1/accounts/contact_inboxes_controller_spec.rb +++ b/spec/controllers/api/v1/accounts/contact_inboxes_controller_spec.rb @@ -67,5 +67,17 @@ RSpec.describe 'Contact Inboxes API', type: :request do expect(response).to have_http_status(:success) end end + + context 'when authenticated via a read-only api_access_token' do + it 'returns the contact since the filter lookup is read-only' do + post "/api/v1/accounts/#{account.id}/contact_inboxes/filter", + headers: { api_access_token: admin.read_only_access_token.token }, + params: { inbox_id: inbox.id, source_id: contact_inbox.source_id }, + as: :json + + expect(response).to have_http_status(:success) + expect(response.parsed_body['id']).to eq(contact.id) + end + end end end