From eedffccf6d7e87a1fe2e8d6e4dbe1750c1b80796 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Tue, 2 Jun 2026 17:38:32 +0530 Subject: [PATCH] feat: withold pubsub token for readonly token --- app/views/api/v1/models/_user.json.jbuilder | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/app/views/api/v1/models/_user.json.jbuilder b/app/views/api/v1/models/_user.json.jbuilder index 058ec62ab..90c95914c 100644 --- a/app/views/api/v1/models/_user.json.jbuilder +++ b/app/views/api/v1/models/_user.json.jbuilder @@ -17,7 +17,10 @@ json.id resource.id json.inviter_id resource.active_account_user&.inviter_id json.name resource.name json.provider resource.provider -json.pubsub_token resource.pubsub_token +# Withhold the pubsub token from read-only token holders — it authenticates +# RoomChannel without any API-token scope check, letting a caller write presence +# and stream live account events (a write the read-only scope must not grant). +json.pubsub_token resource.pubsub_token unless @access_token&.scope == 'read_only' json.custom_attributes resource.custom_attributes if resource.custom_attributes.present? json.role resource.active_account_user&.role json.ui_settings resource.ui_settings