From c361a21d6898f7c83578fb30071f9a3cc7ea4cd6 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Fri, 29 May 2026 14:10:23 +0530 Subject: [PATCH] debug: add regression test for breaking case --- .../public/api/v1/inbox/contacts_controller_spec.rb | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb b/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb index 83e99a829..b9ab7ecac 100644 --- a/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb +++ b/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb @@ -86,14 +86,16 @@ RSpec.describe 'Public Inbox Contacts API', type: :request do expect(owner_inbox.reload.hmac_verified).to be(true) end - it 'does not verify an anonymous contact inbox when a valid pair is replayed against its source_id' do - anonymous_contact = create(:contact, account: api_channel.account) - anonymous_inbox = create(:contact_inbox, contact: anonymous_contact, inbox: api_channel.inbox) + it 'verifies an API contact created without an identifier when a valid pair is supplied later' do + post "/public/api/v1/inboxes/#{api_channel.identifier}/contacts" - get "/public/api/v1/inboxes/#{api_channel.identifier}/contacts/#{anonymous_inbox.source_id}", + anonymous_source_id = response.parsed_body['source_id'] + anonymous_inbox = api_channel.inbox.contact_inboxes.find_by!(source_id: anonymous_source_id) + + get "/public/api/v1/inboxes/#{api_channel.identifier}/contacts/#{anonymous_source_id}", params: { identifier: 'owner-identifier', identifier_hash: valid_owner_hash } - expect(anonymous_inbox.reload.hmac_verified).to be(false) + expect(anonymous_inbox.reload.hmac_verified).to be(true) end end end