Ensure conversation access honors permissions

2025-10-03 14:27:22 +05:30
2 changed files with 11 additions and 0 deletions
@@ -160,6 +160,7 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro

  def conversation
    @conversation ||= Current.account.conversations.find_by!(display_id: params[:id])
+    authorize @conversation
    authorize @conversation.inbox, :show?
  end

@@ -1,4 +1,14 @@
 class ConversationPolicy < ApplicationPolicy
+  class Scope < ApplicationPolicy::Scope
+    def resolve
+      return scope if user.is_a?(AgentBot)
+      return scope.none if account.blank?
+
+      conversations = scope.where(account_id: account.id)
+      Conversations::PermissionFilterService.new(conversations, user, account).perform
+    end
+  end
+
  def index?
    true
  end