From eae9841eb438bd0611729a8a545b04ac138abcb6 Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Mon, 20 Jul 2026 15:28:33 -0700 Subject: [PATCH] fix: restore token access to account APIs (#15088) Token-authenticated requests to Agent Bots, Labels, and affected Captain endpoints return normal responses again. The regression was caused by duplicate `current_account` callbacks in subclasses moving account resolution behind the API entitlement check, leaving `Current.account` unset. ## Closes - https://linear.app/chatwoot/issue/CW-7641/5xx-errors-in-agent-bot-apis ## How to reproduce 1. Send `GET /api/v1/accounts/:account_id/agent_bots` with a valid administrator API access token. 2. Observe a `500` from `validate_token_api_access` because `Current.account` is `nil`. 3. With this change, account resolution runs in the base-controller order and the request succeeds. ## What changed - Removed redundant `current_account` callbacks from account-scoped controllers that already inherit the callback from `Api::V1::Accounts::BaseController`. - Kept the standalone direct-upload controller callback unchanged. - Added regression coverage for administrator API-token access to Agent Bots. --- app/controllers/api/v1/accounts/agent_bots_controller.rb | 1 - .../api/v1/accounts/captain/preferences_controller.rb | 1 - app/controllers/api/v1/accounts/labels_controller.rb | 1 - .../v1/accounts/captain/assistant_responses_controller.rb | 1 - .../api/v1/accounts/captain/assistants_controller.rb | 1 - .../api/v1/accounts/captain/bulk_actions_controller.rb | 1 - .../api/v1/accounts/captain/custom_tools_controller.rb | 1 - .../api/v1/accounts/captain/documents_controller.rb | 1 - .../api/v1/accounts/captain/inboxes_controller.rb | 1 - .../api/v1/accounts/captain/scenarios_controller.rb | 1 - .../api/v1/accounts/agent_bots_controller_spec.rb | 8 ++++++++ 11 files changed, 8 insertions(+), 10 deletions(-) diff --git a/app/controllers/api/v1/accounts/agent_bots_controller.rb b/app/controllers/api/v1/accounts/agent_bots_controller.rb index de3d10081..3f0309024 100644 --- a/app/controllers/api/v1/accounts/agent_bots_controller.rb +++ b/app/controllers/api/v1/accounts/agent_bots_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::AgentBotsController < Api::V1::Accounts::BaseController - before_action :current_account before_action :check_authorization before_action :agent_bot, except: [:index, :create] diff --git a/app/controllers/api/v1/accounts/captain/preferences_controller.rb b/app/controllers/api/v1/accounts/captain/preferences_controller.rb index 482b001d6..3b7fafad5 100644 --- a/app/controllers/api/v1/accounts/captain/preferences_controller.rb +++ b/app/controllers/api/v1/accounts/captain/preferences_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::PreferencesController < Api::V1::Accounts::BaseController - before_action :current_account before_action :authorize_account_update, only: [:update] def show diff --git a/app/controllers/api/v1/accounts/labels_controller.rb b/app/controllers/api/v1/accounts/labels_controller.rb index 6889d30a4..f678fee42 100644 --- a/app/controllers/api/v1/accounts/labels_controller.rb +++ b/app/controllers/api/v1/accounts/labels_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::LabelsController < Api::V1::Accounts::BaseController - before_action :current_account before_action :fetch_label, except: [:index, :create] before_action :check_authorization diff --git a/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb index 151cf279c..80e05e912 100644 --- a/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb +++ b/enterprise/app/controllers/api/v1/accounts/captain/assistant_responses_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::AssistantResponsesController < Api::V1::Accounts::BaseController - before_action :current_account before_action -> { check_authorization(Captain::Assistant) } before_action :set_current_page, only: [:index] diff --git a/enterprise/app/controllers/api/v1/accounts/captain/assistants_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/assistants_controller.rb index 4fbb93d20..8a6f158cf 100644 --- a/enterprise/app/controllers/api/v1/accounts/captain/assistants_controller.rb +++ b/enterprise/app/controllers/api/v1/accounts/captain/assistants_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::AssistantsController < Api::V1::Accounts::BaseController - before_action :current_account before_action -> { check_authorization(Captain::Assistant) } before_action :set_assistant, only: [:show, :update, :destroy, :playground, :stats, :summary, :drilldown] diff --git a/enterprise/app/controllers/api/v1/accounts/captain/bulk_actions_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/bulk_actions_controller.rb index 7e2817f69..2bd7c8eed 100644 --- a/enterprise/app/controllers/api/v1/accounts/captain/bulk_actions_controller.rb +++ b/enterprise/app/controllers/api/v1/accounts/captain/bulk_actions_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::BulkActionsController < Api::V1::Accounts::BaseController - before_action :current_account before_action -> { check_authorization(Captain::Assistant) } before_action :validate_params before_action :type_matches? diff --git a/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb index 874197870..f0222434c 100644 --- a/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb +++ b/enterprise/app/controllers/api/v1/accounts/captain/custom_tools_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::CustomToolsController < Api::V1::Accounts::BaseController - before_action :current_account before_action :ensure_custom_tools_enabled before_action -> { check_authorization(Captain::CustomTool) } before_action :set_custom_tool, only: [:show, :update, :destroy] diff --git a/enterprise/app/controllers/api/v1/accounts/captain/documents_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/documents_controller.rb index d88cc6b48..cb6fb782d 100644 --- a/enterprise/app/controllers/api/v1/accounts/captain/documents_controller.rb +++ b/enterprise/app/controllers/api/v1/accounts/captain/documents_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::DocumentsController < Api::V1::Accounts::BaseController - before_action :current_account before_action -> { check_authorization(Captain::Assistant) } before_action :set_current_page, only: [:index] diff --git a/enterprise/app/controllers/api/v1/accounts/captain/inboxes_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/inboxes_controller.rb index f4ec303b6..88b8f2fb3 100644 --- a/enterprise/app/controllers/api/v1/accounts/captain/inboxes_controller.rb +++ b/enterprise/app/controllers/api/v1/accounts/captain/inboxes_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::InboxesController < Api::V1::Accounts::BaseController - before_action :current_account before_action -> { check_authorization(Captain::Assistant) } before_action :set_assistant diff --git a/enterprise/app/controllers/api/v1/accounts/captain/scenarios_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/scenarios_controller.rb index 376cee0b3..fa7157dae 100644 --- a/enterprise/app/controllers/api/v1/accounts/captain/scenarios_controller.rb +++ b/enterprise/app/controllers/api/v1/accounts/captain/scenarios_controller.rb @@ -1,5 +1,4 @@ class Api::V1::Accounts::Captain::ScenariosController < Api::V1::Accounts::BaseController - before_action :current_account before_action -> { check_authorization(Captain::Scenario) } before_action :set_assistant before_action :set_scenario, only: [:show, :update, :destroy] diff --git a/spec/controllers/api/v1/accounts/agent_bots_controller_spec.rb b/spec/controllers/api/v1/accounts/agent_bots_controller_spec.rb index a98f787e0..6e1b03bac 100644 --- a/spec/controllers/api/v1/accounts/agent_bots_controller_spec.rb +++ b/spec/controllers/api/v1/accounts/agent_bots_controller_spec.rb @@ -64,6 +64,14 @@ RSpec.describe 'Agent Bot API', type: :request do expect(response).to have_http_status(:success) expect(response.body).to include(agent_bot.access_token.token) end + + it 'supports API token authentication' do + get "/api/v1/accounts/#{account.id}/agent_bots", + headers: { api_access_token: admin.access_token.token }, + as: :json + + expect(response).to have_http_status(:success) + end end end