akadmin/chatwoot
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: withold pubsub token for readonly token

Browse Source
This commit is contained in:
Shivam Mishra
2026-06-02 17:38:43 +05:30
parent 134eb157cc
commit eedffccf6d
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/views/api/v1/models/_user.json.jbuilder
+4 -1
View File
@@ -17,7 +17,10 @@ json.id resource.id
json.inviter_id resource.active_account_user&.inviter_id
json.name resource.name
json.provider resource.provider
json.pubsub_token resource.pubsub_token
# Withhold the pubsub token from read-only token holders — it authenticates
# RoomChannel without any API-token scope check, letting a caller write presence
# and stream live account events (a write the read-only scope must not grant).
json.pubsub_token resource.pubsub_token unless @access_token&.scope == 'read_only'
json.custom_attributes resource.custom_attributes if resource.custom_attributes.present?
json.role resource.active_account_user&.role
json.ui_settings resource.ui_settings