Allow agents to export contacts

This change modifies the ContactPolicy to allow users with the agent role to export contacts. Previously, only administrators could perform this action. Includes tests to verify that both agents and administrators can export contacts.
2025-06-09 16:47:58 +00:00 · 2025-06-09 16:40:30 +00:00
3066 changed files with 24199 additions and 174910 deletions
@@ -1,7 +1,6 @@
 version: 2.1
 orbs:
  node: circleci/node@6.1.0
-  qlty-orb: qltysh/qlty-orb@0.0

 defaults: &defaults
  working_directory: ~/build
@@ -90,6 +89,14 @@ jobs:
          command: |
            source ~/.rvm/scripts/rvm
            bundle install
+            # pnpm install
+
+      - run:
+          name: Download cc-test-reporter
+          command: |
+            mkdir -p ~/tmp
+            curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ~/tmp/cc-test-reporter
+            chmod +x ~/tmp/cc-test-reporter

      # Swagger verification
      - run:
@@ -101,11 +108,10 @@ jobs:
              echo "ERROR: The swagger.json file is not in sync with the yaml specification. Run 'rake swagger:build' and commit 'swagger/swagger.json'."
              exit 1
            fi
-            mkdir -p ~/tmp
            curl -L https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/6.3.0/openapi-generator-cli-6.3.0.jar > ~/tmp/openapi-generator-cli-6.3.0.jar
            java -jar ~/tmp/openapi-generator-cli-6.3.0.jar validate -i swagger/swagger.json

-      # Configure environment and database
+      # we remove the FRONTED_URL from the .env before running the tests
      - run:
          name: Database Setup and Configure Environment Variables
          command: |
@@ -143,11 +149,17 @@ jobs:
          command: pnpm run eslint

      - run:
-          name: Run frontend tests (with coverage)
+          name: Run frontend tests
          command: |
            mkdir -p ~/build/coverage/frontend
+            ~/tmp/cc-test-reporter before-build
            pnpm run test:coverage

+      - run:
+          name: Code Climate Test Coverage (Frontend)
+          command: |
+            ~/tmp/cc-test-reporter format-coverage -t lcov -o "~/build/coverage/frontend/codeclimate.frontend_$CIRCLE_NODE_INDEX.json"
+
      # Run backend tests
      - run:
          name: Run backend tests
@@ -155,18 +167,18 @@ jobs:
            mkdir -p ~/tmp/test-results/rspec
            mkdir -p ~/tmp/test-artifacts
            mkdir -p ~/build/coverage/backend
+            ~/tmp/cc-test-reporter before-build
            TESTFILES=$(circleci tests glob "spec/**/*_spec.rb" | circleci tests split --split-by=timings)
-            bundle exec rspec -I ./spec --require coverage_helper --require spec_helper --format progress \
+            bundle exec rspec --format progress \
                              --format RspecJunitFormatter \
                              --out ~/tmp/test-results/rspec.xml \
                              -- ${TESTFILES}
          no_output_timeout: 30m

-      # Qlty coverage publish
-      - qlty-orb/coverage_publish:
-          files: |
-            coverage/coverage.json
-            coverage/lcov.info
+      - run:
+          name: Code Climate Test Coverage (Backend)
+          command: |
+            ~/tmp/cc-test-reporter format-coverage -t simplecov -o "~/build/coverage/backend/codeclimate.$CIRCLE_NODE_INDEX.json"

      - run:
          name: List coverage directory contents
@@ -177,7 +189,3 @@ jobs:
          root: ~/build
          paths:
            - coverage
-
-      - store_artifacts:
-          path: coverage
-          destination: coverage
@@ -0,0 +1,62 @@
+version: '2'
+plugins:
+  rubocop:
+    enabled: false
+    channel: rubocop-0-73
+  eslint:
+    enabled: false
+  csslint:
+    enabled: true
+  scss-lint:
+    enabled: true
+  brakeman:
+    enabled: false
+checks:
+  similar-code:
+    enabled: false
+  method-count:
+    enabled: true
+    config:
+      threshold: 32
+  file-lines:
+    enabled: true
+    config:
+      threshold: 300
+  method-lines:
+    config:
+      threshold: 50
+exclude_patterns:
+  - 'spec/'
+  - '**/specs/**/**'
+  - '**/spec/**/**'
+  - 'db/*'
+  - 'bin/**/*'
+  - 'db/**/*'
+  - 'config/**/*'
+  - 'public/**/*'
+  - 'vendor/**/*'
+  - 'node_modules/**/*'
+  - 'lib/tasks/auto_annotate_models.rake'
+  - 'app/test-matchers.js'
+  - 'docs/*'
+  - '**/*.md'
+  - '**/*.yml'
+  - 'app/javascript/dashboard/i18n/locale'
+  - '**/*.stories.js'
+  - 'stories/'
+  - 'app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/index.js'
+  - 'app/javascript/shared/constants/countries.js'
+  - 'app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/languages.js'
+  - 'app/javascript/dashboard/routes/dashboard/contacts/contactFilterItems/index.js'
+  - 'app/javascript/dashboard/routes/dashboard/settings/automation/constants.js'
+  - 'app/javascript/dashboard/components/widgets/FilterInput/FilterOperatorTypes.js'
+  - 'app/javascript/dashboard/routes/dashboard/settings/reports/constants.js'
+  - 'app/javascript/dashboard/store/captain/storeFactory.js'
+  - 'app/javascript/dashboard/i18n/index.js'
+  - 'app/javascript/widget/i18n/index.js'
+  - 'app/javascript/survey/i18n/index.js'
+  - 'app/javascript/shared/constants/locales.js'
+  - 'app/javascript/dashboard/helper/specs/macrosFixtures.js'
+  - 'app/javascript/dashboard/routes/dashboard/settings/macros/constants.js'
+  - '**/fixtures/**'
+  - '**/*/fixtures.js'
@@ -6,13 +6,6 @@
 # Use `rake secret` to generate this variable
 SECRET_KEY_BASE=replace_with_lengthy_secure_hex

-# Active Record Encryption keys (required for MFA/2FA functionality)
-# Generate these keys by running: rails db:encryption:init
-# IMPORTANT: Use different keys for each environment (development, staging, production)
-# ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=
-# ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=
-# ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=
-
 # Replace with the URL you are planning to use for your app
 FRONTEND_URL=http://0.0.0.0:3000
 # To use a dedicated URL for help center pages
@@ -103,7 +103,6 @@ module.exports = {
          '⌘',
          '📄',
          '🎉',
-          '🚀',
          '💬',
          '👥',
          '📥',
@@ -1,28 +0,0 @@
-name: Auto-assign PR to Author
-
-on:
-  pull_request:
-    types: [opened]
-
-jobs:
-  auto-assign:
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Auto-assign PR to author
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const pull_number = context.payload.pull_request.number;
-            const author = context.payload.pull_request.user.login;
-            
-            await github.rest.issues.addAssignees({
-              owner,
-              repo,
-              issue_number: pull_number,
-              assignees: [author]
-            });
-            
-            console.log(`Assigned PR #${pull_number} to ${author}`);
@@ -6,11 +6,6 @@ name: Deploy Check
 on:
  pull_request:

-# If two pushes happen within a short time in the same PR, cancel the run of the oldest push
-concurrency:
-  group: pr-${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
 jobs:
  deployment_check:
    name: Check Deployment
@@ -5,11 +5,6 @@ on:
    branches:
      - develop

-# If two pushes happen within a short time in the same PR, cancel the run of the oldest push
-concurrency:
-  group: pr-${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
 jobs:
  log_lines_check:
    runs-on: ubuntu-latest
@@ -1,100 +0,0 @@
-name: Run MFA Tests
-permissions:
-  contents: read
-
-on:
-  pull_request:
-
-# If two pushes happen within a short time in the same PR, cancel the run of the oldest push
-concurrency:
-  group: pr-${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    runs-on: ubuntu-22.04
-    # Only run if MFA test keys are available
-    if: github.event_name == 'workflow_dispatch' || (github.repository == 'chatwoot/chatwoot' && github.actor != 'dependabot[bot]')
-
-    services:
-      postgres:
-        image: pgvector/pgvector:pg15
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: ''
-          POSTGRES_DB: postgres
-          POSTGRES_HOST_AUTH_METHOD: trust
-        ports:
-          - 5432:5432
-        options: >-
-          --mount type=tmpfs,destination=/var/lib/postgresql/data
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis
-        ports:
-          - 6379:6379
-        options: --entrypoint redis-server
-
-    env:
-      RAILS_ENV: test
-      POSTGRES_HOST: localhost
-      # Active Record encryption keys required for MFA - test keys only, not for production use
-      ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY: 'test_key_a6cde8f7b9c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7'
-      ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY: 'test_key_b7def9a8c0d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d8'
-      ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT: 'test_salt_c8efa0b9d1e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d9'
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: ruby/setup-ruby@v1
-        with:
-          bundler-cache: true
-
-      - name: Create database
-        run: bundle exec rake db:create
-
-      - name: Install pgvector extension
-        run: |
-          PGPASSWORD="" psql -h localhost -U postgres -d chatwoot_test -c "CREATE EXTENSION IF NOT EXISTS vector;"
-
-      - name: Seed database
-        run: bundle exec rake db:schema:load
-
-      - name: Run MFA-related backend tests
-        run: |
-          bundle exec rspec \
-            spec/services/mfa/token_service_spec.rb \
-            spec/services/mfa/authentication_service_spec.rb \
-            spec/requests/api/v1/profile/mfa_controller_spec.rb \
-            spec/controllers/devise_overrides/sessions_controller_spec.rb \
-            spec/models/application_record_external_credentials_encryption_spec.rb \
-            --profile=10 \
-            --format documentation
-        env:
-          NODE_OPTIONS: --openssl-legacy-provider
-
-      - name: Run MFA-related tests in user_spec
-        run: |
-          # Run specific MFA-related tests from user_spec
-          bundle exec rspec spec/models/user_spec.rb \
-            -e "two factor" \
-            -e "2FA" \
-            -e "MFA" \
-            -e "otp" \
-            -e "backup code" \
-            --profile=10 \
-            --format documentation
-        env:
-          NODE_OPTIONS: --openssl-legacy-provider
-
-      - name: Upload test logs
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: mfa-test-logs
-          path: |
-            log/test.log
-            tmp/screenshots/
@@ -5,11 +5,6 @@ on:
    branches:
      - develop

-# If two pushes happen within a short time in the same PR, cancel the run of the oldest push
-concurrency:
-  group: pr-${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
 jobs:
  test:
    runs-on: ubuntu-22.04
@@ -94,8 +94,3 @@ yarn-debug.log*
 .vscode
 .claude/settings.local.json
 .cursor
-CLAUDE.local.md
-
-# Histoire deployment
-.netlify
-.histoire
@@ -1,7 +0,0 @@
-*
-!configs
-!configs/**
-!hooks
-!hooks/**
-!qlty.toml
-!.gitignore
@@ -1,2 +0,0 @@
-ignored:
-  - DL3008
@@ -1 +0,0 @@
-source-path=SCRIPTDIR
@@ -1,8 +0,0 @@
-rules:
-  document-start: disable
-  quoted-strings:
-    required: only-when-needed
-    extra-allowed: ["{|}"]
-  key-duplicates: {}
-  octal-values:
-    forbid-implicit-octal: true
@@ -1,84 +0,0 @@
-# This file was automatically generated by `qlty init`.
-# You can modify it to suit your needs.
-# We recommend you to commit this file to your repository.
-#
-# This configuration is used by both Qlty CLI and Qlty Cloud.
-#
-#     Qlty CLI -- Code quality toolkit for developers
-#     Qlty Cloud -- Fully automated Code Health Platform
-#
-# Try Qlty Cloud: https://qlty.sh
-#
-# For a guide to configuration, visit https://qlty.sh/d/config
-# Or for a full reference, visit https://qlty.sh/d/qlty-toml
-config_version = "0"
-
-exclude_patterns = [
-  "*_min.*",
-  "*-min.*",
-  "*.min.*",
-  "**/.yarn/**",
-  "**/*.d.ts",
-  "**/assets/**",
-  "**/bower_components/**",
-  "**/build/**",
-  "**/cache/**",
-  "**/config/**",
-  "**/db/**",
-  "**/deps/**",
-  "**/dist/**",
-  "**/extern/**",
-  "**/external/**",
-  "**/generated/**",
-  "**/Godeps/**",
-  "**/gradlew/**",
-  "**/mvnw/**",
-  "**/node_modules/**",
-  "**/protos/**",
-  "**/seed/**",
-  "**/target/**",
-  "**/templates/**",
-  "**/testdata/**",
-  "**/vendor/**", "spec/", "**/specs/**/**", "**/spec/**/**", "db/*", "bin/**/*", "db/**/*", "config/**/*", "public/**/*", "vendor/**/*", "node_modules/**/*", "lib/tasks/auto_annotate_models.rake", "app/test-matchers.js", "docs/*", "**/*.md", "**/*.yml", "app/javascript/dashboard/i18n/locale", "**/*.stories.js", "stories/", "app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/index.js", "app/javascript/shared/constants/countries.js", "app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/languages.js", "app/javascript/dashboard/routes/dashboard/contacts/contactFilterItems/index.js", "app/javascript/dashboard/routes/dashboard/settings/automation/constants.js", "app/javascript/dashboard/components/widgets/FilterInput/FilterOperatorTypes.js", "app/javascript/dashboard/routes/dashboard/settings/reports/constants.js", "app/javascript/dashboard/store/captain/storeFactory.js", "app/javascript/dashboard/i18n/index.js", "app/javascript/widget/i18n/index.js", "app/javascript/survey/i18n/index.js", "app/javascript/shared/constants/locales.js", "app/javascript/dashboard/helper/specs/macrosFixtures.js", "app/javascript/dashboard/routes/dashboard/settings/macros/constants.js", "**/fixtures/**", "**/*/fixtures.js",
-]
-
-test_patterns = [
-  "**/test/**",
-  "**/spec/**",
-  "**/*.test.*",
-  "**/*.spec.*",
-  "**/*_test.*",
-  "**/*_spec.*",
-  "**/test_*.*",
-  "**/spec_*.*",
-]
-
-[smells]
-mode = "comment"
-
-[smells.boolean_logic]
-threshold = 4
-
-[smells.file_complexity]
-threshold = 66
-enabled = true
-
-[smells.return_statements]
-threshold = 4
-
-[smells.nested_control_flow]
-threshold = 4
-
-[smells.function_parameters]
-threshold = 4
-
-[smells.function_complexity]
-threshold = 5
-
-[smells.duplication]
-enabled = true
-threshold = 20
-
-[[source]]
-name = "default"
-default = true
@@ -23,7 +23,7 @@ Metrics/MethodLength:
    - 'enterprise/lib/captain/agent.rb'

 RSpec/ExampleLength:
-  Max: 50
+  Max: 25

 Style/Documentation:
  Enabled: false
@@ -283,7 +283,7 @@ Rails/RedundantActiveRecordAllMethod:
  Enabled: false

 Layout/TrailingEmptyLines:
-  Enabled: true
+  Enabled: false

 Style/SafeNavigationChainLength:
  Enabled: false
@@ -336,4 +336,4 @@ FactoryBot/RedundantFactoryOption:
  Enabled: false

 FactoryBot/FactoryAssociationWithStrategy:
-  Enabled: false
+  Enabled: false
@@ -55,21 +55,4 @@

 ## Ruby Best Practices

- Use compact `module/class` definitions; avoid nested styles
-
-## Enterprise Edition Notes
-
- Chatwoot has an Enterprise overlay under `enterprise/` that extends/overrides OSS code.
- When you add or modify core functionality, always check for corresponding files in `enterprise/` and keep behavior compatible.
- Follow the Enterprise development practices documented here:
-  - https://chatwoot.help/hc/handbook/articles/developing-enterprise-edition-features-38
-
-Practical checklist for any change impacting core logic or public APIs
- Search for related files in both trees before editing (e.g., `rg -n "FooService|ControllerName|ModelName" app enterprise`).
- If adding new endpoints, services, or models, consider whether Enterprise needs:
-  - An override (e.g., `enterprise/app/...`), or
-  - An extension point (e.g., `prepend_mod_with`, hooks, configuration) to avoid hard forks.
- Avoid hardcoding instance- or plan-specific behavior in OSS; prefer configuration, feature flags, or extension points consumed by Enterprise.
- Keep request/response contracts stable across OSS and Enterprise; update both sets of routes/controllers when introducing new APIs.
- When renaming/moving shared code, mirror the change in `enterprise/` to prevent drift.
- Tests: Add Enterprise-specific specs under `spec/enterprise`, mirroring OSS spec layout where applicable.
+- Use compact `module/class` definitions; avoid nested styles
@@ -21,7 +21,6 @@ gem 'telephone_number'
 gem 'time_diff'
 gem 'tzinfo-data'
 gem 'valid_email2'
-gem 'octokit'
 # compress javascript config.assets.js_compressor
 gem 'uglifier'
 ##-- used for single column multiple binary flags in notification settings/feature flagging --##
@@ -63,10 +62,6 @@ gem 'redis-namespace'
 # super fast record imports in bulk
 gem 'activerecord-import'

-gem 'searchkick'
-gem 'opensearch-ruby'
-gem 'faraday_middleware-aws-sigv4'
-
 ##--- gems for server & infra configuration ---##
 gem 'dotenv-rails', '>= 3.0.0'
 gem 'foreman'
@@ -79,12 +74,9 @@ gem 'barnes'
 gem 'devise', '>= 4.9.4'
 gem 'devise-secure_password', git: 'https://github.com/chatwoot/devise-secure_password', branch: 'chatwoot'
 gem 'devise_token_auth', '>= 1.2.3'
-# two-factor authentication
-gem 'devise-two-factor', '>= 5.0.0'
 # authorization
 gem 'jwt'
 gem 'pundit'
-
 # super admin
 gem 'administrate', '>= 0.20.1'
 gem 'administrate-field-active_storage', '>= 1.0.3'
@@ -97,14 +89,14 @@ gem 'wisper', '2.0.0'
 ##--- gems for channels ---##
 gem 'facebook-messenger'
 gem 'line-bot-api'
-gem 'twilio-ruby'
+gem 'twilio-ruby', '~> 5.66'
 # twitty will handle subscription of twitter account events
 # gem 'twitty', git: 'https://github.com/chatwoot/twitty'
 gem 'twitty', '~> 0.1.5'
 # facebook client
 gem 'koala'
 # slack client
-gem 'slack-ruby-client', '~> 2.7.0'
+gem 'slack-ruby-client', '~> 2.5.2'
 # for dialogflow integrations
 gem 'google-cloud-dialogflow-v2', '>= 0.24.0'
 gem 'grpc'
@@ -116,7 +108,7 @@ gem 'google-cloud-translate-v3', '>= 0.7.0'
 ##-- apm and error monitoring ---#
 # loaded only when environment variables are set.
 # ref application.rb
-gem 'datadog', '~> 2.0', require: false
+gem 'ddtrace', require: false
 gem 'elastic-apm', require: false
 gem 'newrelic_rpm', require: false
 gem 'newrelic-sidekiq-metrics', '>= 1.6.2', require: false
@@ -129,8 +121,6 @@ gem 'sentry-sidekiq', '>= 5.19.0', require: false
 gem 'sidekiq', '>= 7.3.1'
 # We want cron jobs
 gem 'sidekiq-cron', '>= 1.12.0'
-# for sidekiq healthcheck
-gem 'sidekiq_alive'

 ##-- Push notification service --##
 gem 'fcm'
@@ -175,7 +165,6 @@ gem 'audited', '~> 5.4', '>= 5.4.1'

 # need for google auth
 gem 'omniauth', '>= 2.1.2'
-gem 'omniauth-saml'
 gem 'omniauth-google-oauth2', '>= 1.1.3'
 gem 'omniauth-rails_csrf_protection', '~> 1.0', '>= 1.0.2'

@@ -188,10 +177,6 @@ gem 'reverse_markdown'

 gem 'iso-639'
 gem 'ruby-openai'
-gem 'ai-agents', '>= 0.4.3'
-
-# TODO: Move this gem as a dependency of ai-agents
-gem 'ruby_llm-schema'

 gem 'shopify_api'

@@ -221,8 +206,6 @@ group :development do
  gem 'stackprof'
  # Should install the associated chrome extension to view query logs
  gem 'meta_request', '>= 0.8.3'
-
-  gem 'tidewave'
 end

 group :test do
@@ -232,7 +215,6 @@ group :test do
  gem 'webmock'
  # test profiling
  gem 'test-prof'
-  gem 'simplecov_json_formatter', require: false
 end

 group :development, :test do
@@ -257,7 +239,7 @@ group :development, :test do
  gem 'rubocop-factory_bot', require: false
  gem 'seed_dump'
  gem 'shoulda-matchers'
-  gem 'simplecov', '>= 0.21', require: false
+  gem 'simplecov', '0.17.1', require: false
  gem 'spring'
  gem 'spring-watcher-listen'
 end
@@ -25,35 +25,35 @@ GIT
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actioncable (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activestorage (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionmailbox (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      mail (>= 2.7.1)
      net-imap
      net-pop
      net-smtp
-    actionmailer (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      actionview (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionmailer (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      actionview (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      mail (~> 2.5, >= 2.5.4)
      net-imap
      net-pop
      net-smtp
      rails-dom-testing (~> 2.2)
-    actionpack (7.1.5.2)
-      actionview (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionpack (7.1.5.1)
+      actionview (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      nokogiri (>= 1.8.5)
      racc
      rack (>= 2.2.4)
@@ -61,38 +61,38 @@ GEM
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    actiontext (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activestorage (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actiontext (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionview (7.1.5.1)
+      activesupport (= 7.1.5.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
    active_record_query_trace (1.8)
-    activejob (7.1.5.2)
-      activesupport (= 7.1.5.2)
+    activejob (7.1.5.1)
+      activesupport (= 7.1.5.1)
      globalid (>= 0.3.6)
-    activemodel (7.1.5.2)
-      activesupport (= 7.1.5.2)
-    activerecord (7.1.5.2)
-      activemodel (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    activemodel (7.1.5.1)
+      activesupport (= 7.1.5.1)
+    activerecord (7.1.5.1)
+      activemodel (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      timeout (>= 0.4.0)
    activerecord-import (2.1.0)
      activerecord (>= 4.2)
-    activestorage (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    activestorage (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      marcel (~> 1.0)
-    activesupport (7.1.5.2)
+    activesupport (7.1.5.1)
      base64
      benchmark (>= 0.3)
      bigdecimal
@@ -126,8 +126,6 @@ GEM
      jbuilder (~> 2)
      rails (>= 4.2, < 7.2)
      selectize-rails (~> 0.6)
-    ai-agents (0.4.3)
-      ruby_llm (~> 1.3)
    annotate (3.2.0)
      activerecord (>= 3.2, < 8.0)
      rake (>= 10.4, < 14.0)
@@ -155,10 +153,10 @@ GEM
    barnes (0.0.9)
      multi_json (~> 1)
      statsd-ruby (~> 1.1)
-    base64 (0.3.0)
+    base64 (0.2.0)
    bcrypt (3.1.20)
-    benchmark (0.4.1)
-    bigdecimal (3.2.2)
+    benchmark (0.4.0)
+    bigdecimal (3.1.9)
    bindex (0.8.1)
    bootsnap (1.16.0)
      msgpack (~> 1.2)
@@ -174,8 +172,6 @@ GEM
      bundler (>= 1.2.0, < 3)
      thor (~> 1.0)
    byebug (11.1.3)
-    childprocess (5.1.0)
-      logger (~> 1.5)
    climate_control (1.2.0)
    coderay (1.1.3)
    commonmarker (0.23.10)
@@ -194,14 +190,10 @@ GEM
      activerecord (>= 5.a)
      database_cleaner-core (~> 2.0.0)
    database_cleaner-core (2.0.1)
-    datadog (2.19.0)
-      datadog-ruby_core_source (~> 3.4, >= 3.4.1)
-      libdatadog (~> 18.1.0.1.0)
-      libddwaf (~> 1.24.1.0.3)
-      logger
-      msgpack
-    datadog-ruby_core_source (3.4.1)
    date (3.4.1)
+    ddtrace (0.48.0)
+      ffi (~> 1.0)
+      msgpack
    debug (1.8.0)
      irb (>= 1.5.0)
      reline (>= 0.3.1)
@@ -212,11 +204,6 @@ GEM
      railties (>= 4.1.0)
      responders
      warden (~> 1.2.3)
-    devise-two-factor (6.1.0)
-      activesupport (>= 7.0, < 8.1)
-      devise (~> 4.0)
-      railties (>= 7.0, < 8.1)
-      rotp (~> 6.0)
    devise_token_auth (1.2.5)
      bcrypt (~> 3.0)
      devise (> 3.5.2, < 5)
@@ -224,7 +211,7 @@ GEM
    diff-lcs (1.5.1)
    digest-crc (0.6.5)
      rake (>= 12.0.0, < 14.0.0)
-    docile (1.4.1)
+    docile (1.4.0)
    domain_name (0.5.20190701)
      unf (>= 0.0.5, < 1.0.0)
    dotenv (3.1.2)
@@ -235,35 +222,6 @@ GEM
      addressable (~> 2.8)
    drb (2.2.3)
    dry-cli (1.1.0)
-    dry-configurable (1.3.0)
-      dry-core (~> 1.1)
-      zeitwerk (~> 2.6)
-    dry-core (1.1.0)
-      concurrent-ruby (~> 1.0)
-      logger
-      zeitwerk (~> 2.6)
-    dry-inflector (1.2.0)
-    dry-initializer (3.2.0)
-    dry-logic (1.6.0)
-      bigdecimal
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 1.1)
-      zeitwerk (~> 2.6)
-    dry-schema (1.14.1)
-      concurrent-ruby (~> 1.0)
-      dry-configurable (~> 1.0, >= 1.0.1)
-      dry-core (~> 1.1)
-      dry-initializer (~> 3.2)
-      dry-logic (~> 1.5)
-      dry-types (~> 1.8)
-      zeitwerk (~> 2.6)
-    dry-types (1.8.3)
-      bigdecimal (~> 3.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 1.0)
-      dry-inflector (~> 1.0)
-      dry-logic (~> 1.4)
-      zeitwerk (~> 2.6)
    ecma-re-validator (0.4.0)
      regexp_parser (~> 2.2)
    elastic-apm (4.6.2)
@@ -286,34 +244,22 @@ GEM
      railties (>= 5.0.0)
    faker (3.2.0)
      i18n (>= 1.8.11, < 2)
-    faraday (2.13.1)
-      faraday-net_http (>= 2.0, < 3.5)
-      json
-      logger
+    faraday (2.9.0)
+      faraday-net_http (>= 2.0, < 3.2)
    faraday-follow_redirects (0.3.0)
      faraday (>= 1, < 3)
-    faraday-mashify (1.0.0)
+    faraday-mashify (0.1.1)
      faraday (~> 2.0)
      hashie
    faraday-multipart (1.0.4)
      multipart-post (~> 2)
-    faraday-net_http (3.4.0)
-      net-http (>= 0.5.0)
+    faraday-net_http (3.1.0)
+      net-http
    faraday-net_http_persistent (2.1.0)
      faraday (~> 2.5)
      net-http-persistent (~> 4.0)
    faraday-retry (2.2.1)
      faraday (~> 2.0)
-    faraday_middleware-aws-sigv4 (1.0.1)
-      aws-sigv4 (~> 1.0)
-      faraday (>= 2.0, < 3)
-    fast-mcp (1.5.0)
-      addressable (~> 2.8)
-      base64
-      dry-schema (~> 1.14)
-      json (~> 2.0)
-      mime-types (~> 3.4)
-      rack (~> 3.1)
    fcm (1.0.8)
      faraday (>= 1.0.0, < 3.0)
      googleauth (~> 1)
@@ -409,7 +355,6 @@ GEM
    grpc (1.72.0-x86_64-linux)
      google-protobuf (>= 3.25, < 5.0)
      googleapis-common-protos-types (~> 1.0)
-    gserver (0.0.1)
    haikunator (1.1.1)
    hairtrigger (1.0.0)
      activerecord (>= 6.0, < 8)
@@ -452,7 +397,7 @@ GEM
      rails-dom-testing (>= 1, < 3)
      railties (>= 4.2.0)
      thor (>= 0.14, < 2.0)
-    json (2.13.2)
+    json (2.12.0)
    json_refs (0.1.8)
      hana
    json_schemer (0.2.24)
@@ -467,7 +412,7 @@ GEM
    judoscale-sidekiq (1.8.2)
      judoscale-ruby (= 1.8.2)
      sidekiq (>= 5.0)
-    jwt (2.10.1)
+    jwt (2.8.1)
      base64
    kaminari (1.2.2)
      activesupport (>= 4.1.0)
@@ -488,22 +433,10 @@ GEM
      json (>= 1.8)
      rexml
    language_server-protocol (3.17.0.5)
-    launchy (3.1.1)
+    launchy (2.5.2)
      addressable (~> 2.8)
-      childprocess (~> 5.0)
-      logger (~> 1.6)
-    letter_opener (1.10.0)
-      launchy (>= 2.2, < 4)
-    libdatadog (18.1.0.1.0)
-    libdatadog (18.1.0.1.0-x86_64-linux)
-    libddwaf (1.24.1.0.3)
-      ffi (~> 1.0)
-    libddwaf (1.24.1.0.3-arm64-darwin)
-      ffi (~> 1.0)
-    libddwaf (1.24.1.0.3-x86_64-darwin)
-      ffi (~> 1.0)
-    libddwaf (1.24.1.0.3-x86_64-linux)
-      ffi (~> 1.0)
+    letter_opener (1.8.1)
+      launchy (>= 2.2, < 3)
    line-bot-api (1.28.0)
    lint_roller (1.1.0)
    liquid (5.4.0)
@@ -538,7 +471,7 @@ GEM
    mime-types-data (3.2023.0218.1)
    mini_magick (4.12.0)
    mini_mime (1.1.5)
-    mini_portile2 (2.8.9)
+    mini_portile2 (2.8.8)
    minitest (5.25.5)
    mock_redis (0.36.0)
      ruby2_keywords
@@ -549,7 +482,7 @@ GEM
    mutex_m (0.3.0)
    neighbor (0.2.3)
      activerecord (>= 5.2)
-    net-http (0.6.0)
+    net-http (0.4.1)
      uri
    net-http-persistent (4.0.2)
      connection_pool (~> 2.2)
@@ -569,14 +502,14 @@ GEM
    newrelic_rpm (9.6.0)
      base64
    nio4r (2.7.3)
-    nokogiri (1.18.9)
+    nokogiri (1.18.8)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
-    nokogiri (1.18.9-arm64-darwin)
+    nokogiri (1.18.8-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.18.9-x86_64-darwin)
+    nokogiri (1.18.8-x86_64-darwin)
      racc (~> 1.4)
-    nokogiri (1.18.9-x86_64-linux-gnu)
+    nokogiri (1.18.8-x86_64-linux-gnu)
      racc (~> 1.4)
    oauth (1.1.0)
      oauth-tty (~> 1.0, >= 1.0.1)
@@ -591,15 +524,11 @@ GEM
      rack (>= 1.2, < 4)
      snaky_hash (~> 2.0)
      version_gem (~> 1.1)
-    octokit (10.0.0)
-      faraday (>= 1, < 3)
-      sawyer (~> 0.9)
    oj (3.16.10)
      bigdecimal (>= 3.0)
      ostruct (>= 0.2)
-    omniauth (2.1.3)
+    omniauth (2.1.2)
      hashie (>= 3.4.6)
-      logger
      rack (>= 2.2.3)
      rack-protection
    omniauth-google-oauth2 (1.1.3)
@@ -613,12 +542,6 @@ GEM
    omniauth-rails_csrf_protection (1.0.2)
      actionpack (>= 4.2)
      omniauth (~> 2.0)
-    omniauth-saml (2.2.4)
-      omniauth (~> 2.1)
-      ruby-saml (~> 1.18)
-    opensearch-ruby (3.4.0)
-      faraday (>= 1.0, < 3)
-      multi_json (>= 1.0)
    openssl (3.2.0)
    orm_adapter (0.5.0)
    os (1.1.4)
@@ -640,14 +563,14 @@ GEM
      method_source (~> 1.0)
    pry-rails (0.3.9)
      pry (>= 0.10.4)
-    public_suffix (6.0.2)
+    public_suffix (6.0.0)
    puma (6.4.3)
      nio4r (~> 2.0)
    pundit (2.3.0)
      activesupport (>= 3.0.0)
    raabro (1.4.0)
    racc (1.8.1)
-    rack (3.2.3)
+    rack (2.2.15)
    rack-attack (6.7.0)
      rack (>= 1.0, < 4)
    rack-contrib (2.5.0)
@@ -656,34 +579,33 @@ GEM
      rack (>= 2.0.0)
    rack-mini-profiler (3.2.0)
      rack (>= 1.2.0)
-    rack-protection (4.1.1)
+    rack-protection (3.2.0)
      base64 (>= 0.1.0)
-      logger (>= 1.6.0)
-      rack (>= 3.0.0, < 4)
+      rack (~> 2.2, >= 2.2.4)
    rack-proxy (0.7.7)
      rack
-    rack-session (2.1.1)
-      base64 (>= 0.1.0)
-      rack (>= 3.0.0)
+    rack-session (1.0.2)
+      rack (< 3)
    rack-test (2.1.0)
      rack (>= 1.3)
    rack-timeout (0.6.3)
-    rackup (2.2.1)
-      rack (>= 3)
-    rails (7.1.5.2)
-      actioncable (= 7.1.5.2)
-      actionmailbox (= 7.1.5.2)
-      actionmailer (= 7.1.5.2)
-      actionpack (= 7.1.5.2)
-      actiontext (= 7.1.5.2)
-      actionview (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activemodel (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activestorage (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    rackup (1.0.1)
+      rack (< 3)
+      webrick
+    rails (7.1.5.1)
+      actioncable (= 7.1.5.1)
+      actionmailbox (= 7.1.5.1)
+      actionmailer (= 7.1.5.1)
+      actionpack (= 7.1.5.1)
+      actiontext (= 7.1.5.1)
+      actionview (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activemodel (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      bundler (>= 1.15.0)
-      railties (= 7.1.5.2)
+      railties (= 7.1.5.1)
    rails-dom-testing (2.2.0)
      activesupport (>= 5.0.0)
      minitest
@@ -691,9 +613,9 @@ GEM
    rails-html-sanitizer (1.6.1)
      loofah (~> 2.21)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    railties (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      irb
      rackup (>= 1.0.0)
      rake (>= 12.2)
@@ -730,8 +652,7 @@ GEM
    retriable (3.1.2)
    reverse_markdown (2.1.1)
      nokogiri
-    rexml (3.4.4)
-    rotp (6.3.0)
+    rexml (3.4.1)
    rspec-core (3.13.0)
      rspec-support (~> 3.13.0)
    rspec-expectations (3.13.2)
@@ -786,25 +707,12 @@ GEM
      faraday (>= 1)
      faraday-multipart (>= 1)
    ruby-progressbar (1.13.0)
-    ruby-saml (1.18.1)
-      nokogiri (>= 1.13.10)
-      rexml
    ruby-vips (2.1.4)
      ffi (~> 1.12)
    ruby2_keywords (0.0.5)
    ruby2ruby (2.5.0)
      ruby_parser (~> 3.1)
      sexp_processor (~> 4.6)
-    ruby_llm (1.5.1)
-      base64
-      event_stream_parser (~> 1)
-      faraday (>= 1.10.0)
-      faraday-multipart (>= 1)
-      faraday-net_http (>= 1)
-      faraday-retry (>= 1)
-      marcel (~> 1.0)
-      zeitwerk (~> 2)
-    ruby_llm-schema (0.1.0)
    ruby_parser (3.20.0)
      sexp_processor (~> 4.16)
    sass (3.7.4)
@@ -820,16 +728,10 @@ GEM
      sprockets (> 3.0)
      sprockets-rails
      tilt
-    sawyer (0.9.2)
-      addressable (>= 2.3.5)
-      faraday (>= 0.17.3, < 3)
    scout_apm (5.3.3)
      parser
    scss_lint (0.60.0)
      sass (~> 3.5, >= 3.5.5)
-    searchkick (5.5.2)
-      activemodel (>= 7.1)
-      hashie
    securerandom (0.4.1)
    seed_dump (3.3.1)
      activerecord (>= 4)
@@ -868,22 +770,18 @@ GEM
      fugit (~> 1.8)
      globalid (>= 1.0.1)
      sidekiq (>= 6)
-    sidekiq_alive (2.5.0)
-      gserver (~> 0.0.1)
-      sidekiq (>= 5, < 9)
    signet (0.17.0)
      addressable (~> 2.8)
      faraday (>= 0.17.5, < 3.a)
      jwt (>= 1.5, < 3.0)
      multi_json (~> 1.10)
-    simplecov (0.22.0)
+    simplecov (0.17.1)
      docile (~> 1.1)
-      simplecov-html (~> 0.11)
-      simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.13.2)
-    simplecov_json_formatter (0.1.4)
-    slack-ruby-client (2.7.0)
-      faraday (>= 2.0.1)
+      json (>= 1.8, < 3)
+      simplecov-html (~> 0.10.0)
+    simplecov-html (0.10.2)
+    slack-ruby-client (2.5.2)
+      faraday (>= 2.0)
      faraday-mashify
      faraday-multipart
      gli
@@ -910,18 +808,14 @@ GEM
    stripe (8.5.0)
    telephone_number (1.4.20)
    test-prof (1.2.1)
-    thor (1.4.0)
-    tidewave (0.2.0)
-      fast-mcp (~> 1.5.0)
-      rack (>= 2.0)
-      rails (>= 7.1.0)
+    thor (1.3.1)
    tilt (2.3.0)
    time_diff (0.3.0)
      activesupport
      i18n
    timeout (0.4.3)
    trailblazer-option (0.1.2)
-    twilio-ruby (7.6.0)
+    twilio-ruby (5.77.0)
      faraday (>= 0.9, < 3.0)
      jwt (>= 1.5, < 3.0)
      nokogiri (>= 1.6, < 2.0)
@@ -941,7 +835,7 @@ GEM
      unicode-emoji (~> 4.0, >= 4.0.4)
    unicode-emoji (4.0.4)
    uniform_notifier (1.17.0)
-    uri (1.0.4)
+    uri (1.0.3)
    uri_template (0.7.0)
    valid_email2 (5.2.6)
      activemodel (>= 3.2)
@@ -968,6 +862,7 @@ GEM
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
+    webrick (1.9.1)
    websocket-driver (0.7.7)
      base64
      websocket-extensions (>= 0.1.0)
@@ -996,7 +891,6 @@ DEPENDENCIES
  administrate (>= 0.20.1)
  administrate-field-active_storage (>= 1.0.3)
  administrate-field-belongs_to_search (>= 0.9.0)
-  ai-agents (>= 0.4.3)
  annotate
  attr_extras
  audited (~> 5.4, >= 5.4.1)
@@ -1013,11 +907,10 @@ DEPENDENCIES
  commonmarker
  csv-safe
  database_cleaner
-  datadog (~> 2.0)
+  ddtrace
  debug (~> 1.8)
  devise (>= 4.9.4)
  devise-secure_password!
-  devise-two-factor (>= 5.0.0)
  devise_token_auth (>= 1.2.3)
  dotenv-rails (>= 3.0.0)
  down
@@ -1026,7 +919,6 @@ DEPENDENCIES
  facebook-messenger
  factory_bot_rails (>= 6.4.3)
  faker
-  faraday_middleware-aws-sigv4
  fcm
  flag_shih_tzu
  foreman
@@ -1063,13 +955,10 @@ DEPENDENCIES
  net-smtp (~> 0.3.4)
  newrelic-sidekiq-metrics (>= 1.6.2)
  newrelic_rpm
-  octokit
  omniauth (>= 2.1.2)
  omniauth-google-oauth2 (>= 1.1.3)
  omniauth-oauth2
  omniauth-rails_csrf_protection (~> 1.0, >= 1.0.2)
-  omniauth-saml
-  opensearch-ruby
  pg
  pg_search
  pgvector
@@ -1095,10 +984,8 @@ DEPENDENCIES
  rubocop-rails
  rubocop-rspec
  ruby-openai
-  ruby_llm-schema
  scout_apm
  scss_lint
-  searchkick
  seed_dump
  sentry-rails (>= 5.19.0)
  sentry-ruby
@@ -1107,10 +994,8 @@ DEPENDENCIES
  shoulda-matchers
  sidekiq (>= 7.3.1)
  sidekiq-cron (>= 1.12.0)
-  sidekiq_alive
-  simplecov (>= 0.21)
-  simplecov_json_formatter
-  slack-ruby-client (~> 2.7.0)
+  simplecov (= 0.17.1)
+  slack-ruby-client (~> 2.5.2)
  spring
  spring-watcher-listen
  squasher
@@ -1118,9 +1003,8 @@ DEPENDENCIES
  stripe
  telephone_number
  test-prof
-  tidewave
  time_diff
-  twilio-ruby
+  twilio-ruby (~> 5.66)
  twitty (~> 0.1.5)
  tzinfo-data
  uglifier
@@ -2,8 +2,5 @@
 # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.

 require_relative 'config/application'
-# Load Enterprise Edition rake tasks if they exist
-enterprise_tasks_path = Rails.root.join('enterprise/tasks_railtie.rb').to_s
-require enterprise_tasks_path if File.exist?(enterprise_tasks_path)

 Rails.application.load_tasks
@@ -1 +1 @@
-4.4.0
+3.13.0
@@ -1 +1 @@
-3.4.3
+3.2.0
@@ -6,7 +6,6 @@
 # We don't want to update the name of the identified original contact.

 class ContactIdentifyAction
-  include UrlHelper
  pattr_initialize [:contact!, :params!, { retain_original_contact_name: false, discard_invalid_attrs: false }]

  def perform
@@ -105,14 +104,7 @@ class ContactIdentifyAction
    # TODO: replace reject { |_k, v| v.blank? } with compact_blank when rails is upgraded
    @contact.discard_invalid_attrs if discard_invalid_attrs
    @contact.save!
-    enqueue_avatar_job
-  end
-
-  def enqueue_avatar_job
-    return unless params[:avatar_url].present? && !@contact.avatar.attached?
-    return unless url_valid?(params[:avatar_url])
-
-    Avatar::AvatarFromUrlJob.perform_later(@contact, params[:avatar_url])
+    Avatar::AvatarFromUrlJob.perform_later(@contact, params[:avatar_url]) if params[:avatar_url].present? && !@contact.avatar.attached?
  end

  def merge_contact(base_contact, merge_contact)
@@ -10,8 +10,7 @@ function toggleSecretField(e) {
  if (!textElement) return;

  if (textElement.dataset.secretMasked === 'false') {
-    const maskedLength = secretField.dataset.secretText?.length || 10;
-    textElement.textContent = '•'.repeat(maskedLength);
+    textElement.textContent = '•'.repeat(10);
    textElement.dataset.secretMasked = 'true';
    toggler.querySelector('svg use').setAttribute('xlink:href', '#eye-show');

@@ -33,13 +32,3 @@ function copySecretField(e) {

  navigator.clipboard.writeText(secretField.dataset.secretText);
 }
-
-document.addEventListener('DOMContentLoaded', () => {
-  document.querySelectorAll('.cell-data__secret-field').forEach(field => {
-    const span = field.querySelector('[data-secret-masked]');
-    if (span && span.dataset.secretMasked === 'true') {
-      const len = field.dataset.secretText?.length || 10;
-      span.textContent = '•'.repeat(len);
-    }
-  });
-});
@@ -46,25 +46,17 @@

 .cell-data__secret-field {
  align-items: center;
-  color: $hint-grey;
  display: flex;

  span {
-    flex: 0 0 auto;
+    flex: 1;
  }

-  [data-secret-toggler],
-  [data-secret-copier] {
-    background: transparent;
-    border: 0;
-    color: inherit;
-    margin-left: 0.5rem;
-    padding: 0;
+  button {
+    margin-left: 5px;

    svg {
      fill: currentColor;
-      height: 1.25rem;
-      width: 1.25rem;
    }
  }
 }
@@ -52,5 +52,3 @@ class AgentBuilder
    }.compact))
  end
 end
-
-AgentBuilder.prepend_mod_with('AgentBuilder')
@@ -1,54 +0,0 @@
-class Email::BaseBuilder
-  pattr_initialize [:inbox!]
-
-  private
-
-  def channel
-    @channel ||= inbox.channel
-  end
-
-  def account
-    @account ||= inbox.account
-  end
-
-  def conversation
-    @conversation ||= message.conversation
-  end
-
-  def custom_sender_name
-    message&.sender&.available_name || I18n.t('conversations.reply.email.header.notifications')
-  end
-
-  def sender_name(sender_email)
-    # Friendly: <agent_name> from <business_name>
-    # Professional: <business_name>
-    if inbox.friendly?
-      I18n.t(
-        'conversations.reply.email.header.friendly_name',
-        sender_name: custom_sender_name,
-        business_name: business_name,
-        from_email: sender_email
-      )
-    else
-      I18n.t(
-        'conversations.reply.email.header.professional_name',
-        business_name: business_name,
-        from_email: sender_email
-      )
-    end
-  end
-
-  def business_name
-    inbox.business_name || inbox.sanitized_name
-  end
-
-  def account_support_email
-    # Parse the email to ensure it's in the correct format, the user
-    # can save it in the format "Name <email@domain.com>"
-    parse_email(account.support_email)
-  end
-
-  def parse_email(email_string)
-    Mail::Address.new(email_string).address
-  end
-end
@@ -1,51 +0,0 @@
-class Email::FromBuilder < Email::BaseBuilder
-  pattr_initialize [:inbox!, :message!]
-
-  def build
-    return sender_name(account_support_email) unless inbox.email?
-
-    from_email = case email_channel_type
-                 when :standard_imap_smtp,
-                      :google_oauth,
-                      :microsoft_oauth,
-                      :forwarding_own_smtp
-                   channel.email
-                 when :imap_chatwoot_smtp,
-                      :forwarding_chatwoot_smtp
-                   channel.verified_for_sending ? channel.email : account_support_email
-                 else
-                   account_support_email
-                 end
-
-    sender_name(from_email)
-  end
-
-  private
-
-  def email_channel_type
-    return :google_oauth if channel.google?
-    return :microsoft_oauth if channel.microsoft?
-    return :standard_imap_smtp if imap_and_smtp_enabled?
-    return :imap_chatwoot_smtp if imap_enabled_without_smtp?
-    return :forwarding_own_smtp if forwarding_with_own_smtp?
-    return :forwarding_chatwoot_smtp if forwarding_without_smtp?
-
-    :unknown
-  end
-
-  def imap_and_smtp_enabled?
-    channel.imap_enabled && channel.smtp_enabled
-  end
-
-  def imap_enabled_without_smtp?
-    channel.imap_enabled && !channel.smtp_enabled
-  end
-
-  def forwarding_with_own_smtp?
-    !channel.imap_enabled && channel.smtp_enabled
-  end
-
-  def forwarding_without_smtp?
-    !channel.imap_enabled && !channel.smtp_enabled
-  end
-end
@@ -1,21 +0,0 @@
-class Email::ReplyToBuilder < Email::BaseBuilder
-  pattr_initialize [:inbox!, :message!]
-
-  def build
-    reply_to = if inbox.email?
-                 channel.email
-               elsif inbound_email_enabled?
-                 "reply+#{conversation.uuid}@#{account.inbound_email_domain}"
-               else
-                 account_support_email
-               end
-
-    sender_name(reply_to)
-  end
-
-  private
-
-  def inbound_email_enabled?
-    account.feature_enabled?('inbound_emails') && account.inbound_email_domain.present?
-  end
-end
@@ -7,7 +7,6 @@ class Messages::MessageBuilder
    @private = params[:private] || false
    @conversation = conversation
    @user = user
-    @account = conversation.account
    @message_type = params[:message_type] || 'outgoing'
    @attachments = params[:attachments]
    @automation_rule = content_attributes&.dig(:automation_rule_id)
@@ -21,9 +20,6 @@ class Messages::MessageBuilder
    @message = @conversation.messages.build(message_params)
    process_attachments
    process_emails
-    # When the message has no quoted content, it will just be rendered as a regular message
-    # The frontend is equipped to handle this case
-    process_email_content if @account.feature_enabled?(:quoted_email_reply)
    @message.save!
    @message
  end
@@ -96,14 +92,6 @@ class Messages::MessageBuilder
    @message.content_attributes[:to_emails] = to_emails
  end

-  def process_email_content
-    return unless should_process_email_content?
-
-    @message.content_attributes ||= {}
-    email_attributes = build_email_attributes
-    @message.content_attributes[:email] = email_attributes
-  end
-
  def process_email_string(email_string)
    return [] if email_string.blank?

@@ -165,71 +153,4 @@ class Messages::MessageBuilder
      source_id: @params[:source_id]
    }.merge(external_created_at).merge(automation_rule_id).merge(campaign_id).merge(template_params)
  end
-
-  def email_inbox?
-    @conversation.inbox&.inbox_type == 'Email'
-  end
-
-  def should_process_email_content?
-    email_inbox? && !@private && @message.content.present?
-  end
-
-  def build_email_attributes
-    email_attributes = ensure_indifferent_access(@message.content_attributes[:email] || {})
-    normalized_content = normalize_email_body(@message.content)
-
-    # Use custom HTML content if provided, otherwise generate from message content
-    email_attributes[:html_content] = if custom_email_content_provided?
-                                        build_custom_html_content
-                                      else
-                                        build_html_content(normalized_content)
-                                      end
-
-    email_attributes[:text_content] = build_text_content(normalized_content)
-    email_attributes
-  end
-
-  def build_html_content(normalized_content)
-    html_content = ensure_indifferent_access(@message.content_attributes.dig(:email, :html_content) || {})
-    rendered_html = render_email_html(normalized_content)
-    html_content[:full] = rendered_html
-    html_content[:reply] = rendered_html
-    html_content
-  end
-
-  def build_text_content(normalized_content)
-    text_content = ensure_indifferent_access(@message.content_attributes.dig(:email, :text_content) || {})
-    text_content[:full] = normalized_content
-    text_content[:reply] = normalized_content
-    text_content
-  end
-
-  def ensure_indifferent_access(hash)
-    return {} if hash.blank?
-
-    hash.respond_to?(:with_indifferent_access) ? hash.with_indifferent_access : hash
-  end
-
-  def normalize_email_body(content)
-    content.to_s.gsub("\r\n", "\n")
-  end
-
-  def render_email_html(content)
-    return '' if content.blank?
-
-    ChatwootMarkdownRenderer.new(content).render_message.to_s
-  end
-
-  def custom_email_content_provided?
-    @params[:email_html_content].present?
-  end
-
-  def build_custom_html_content
-    html_content = ensure_indifferent_access(@message.content_attributes.dig(:email, :html_content) || {})
-
-    html_content[:full] = @params[:email_html_content]
-    html_content[:reply] = @params[:email_html_content]
-
-    html_content
-  end
 end
@@ -10,28 +10,10 @@ class V2::Reports::BaseSummaryBuilder

  def load_data
    @conversations_count = fetch_conversations_count
-    load_reporting_events_data
-  end
-
-  def load_reporting_events_data
-    # Extract the column name for indexing (e.g., 'conversations.team_id' -> 'team_id')
-    index_key = group_by_key.to_s.split('.').last
-
-    results = reporting_events
-              .select(
-                "#{group_by_key} as #{index_key}",
-                "COUNT(CASE WHEN name = 'conversation_resolved' THEN 1 END) as resolved_count",
-                "AVG(CASE WHEN name = 'conversation_resolved' THEN #{average_value_key} END) as avg_resolution_time",
-                "AVG(CASE WHEN name = 'first_response' THEN #{average_value_key} END) as avg_first_response_time",
-                "AVG(CASE WHEN name = 'reply_time' THEN #{average_value_key} END) as avg_reply_time"
-              )
-              .group(group_by_key)
-              .index_by { |record| record.public_send(index_key) }
-
-    @resolved_count = results.transform_values(&:resolved_count)
-    @avg_resolution_time = results.transform_values(&:avg_resolution_time)
-    @avg_first_response_time = results.transform_values(&:avg_first_response_time)
-    @avg_reply_time = results.transform_values(&:avg_reply_time)
+    @resolved_count = fetch_resolved_count
+    @avg_resolution_time = fetch_average_time('conversation_resolved')
+    @avg_first_response_time = fetch_average_time('first_response')
+    @avg_reply_time = fetch_average_time('reply_time')
  end

  def reporting_events
@@ -42,6 +24,14 @@ class V2::Reports::BaseSummaryBuilder
    # Override this method
  end

+  def fetch_average_time(event_name)
+    get_grouped_average(reporting_events.where(name: event_name))
+  end
+
+  def fetch_resolved_count
+    reporting_events.where(name: 'conversation_resolved').group(group_by_key).count
+  end
+
  def group_by_key
    # Override this method
  end
@@ -50,6 +40,10 @@ class V2::Reports::BaseSummaryBuilder
    # Override this method
  end

+  def get_grouped_average(events)
+    events.group(group_by_key).average(average_value_key)
+  end
+
  def average_value_key
    ActiveModel::Type::Boolean.new.cast(params[:business_hours]).present? ? :value_in_business_hours : :value
  end
@@ -13,7 +13,10 @@ class V2::Reports::InboxSummaryBuilder < V2::Reports::BaseSummaryBuilder

  def load_data
    @conversations_count = fetch_conversations_count
-    load_reporting_events_data
+    @resolved_count = fetch_resolved_count
+    @avg_resolution_time = fetch_average_time('conversation_resolved')
+    @avg_first_response_time = fetch_average_time('first_response')
+    @avg_reply_time = fetch_average_time('reply_time')
  end

  def fetch_conversations_count
@@ -1,112 +0,0 @@
-class V2::Reports::LabelSummaryBuilder < V2::Reports::BaseSummaryBuilder
-  attr_reader :account, :params
-
-  # rubocop:disable Lint/MissingSuper
-  # the parent class has no initialize
-  def initialize(account:, params:)
-    @account = account
-    @params = params
-
-    timezone_offset = (params[:timezone_offset] || 0).to_f
-    @timezone = ActiveSupport::TimeZone[timezone_offset]&.name
-  end
-  # rubocop:enable Lint/MissingSuper
-
-  def build
-    labels = account.labels.to_a
-    return [] if labels.empty?
-
-    report_data = collect_report_data
-    labels.map { |label| build_label_report(label, report_data) }
-  end
-
-  private
-
-  def collect_report_data
-    conversation_filter = build_conversation_filter
-    use_business_hours = use_business_hours?
-
-    {
-      conversation_counts: fetch_conversation_counts(conversation_filter),
-      resolved_counts: fetch_resolved_counts,
-      resolution_metrics: fetch_metrics(conversation_filter, 'conversation_resolved', use_business_hours),
-      first_response_metrics: fetch_metrics(conversation_filter, 'first_response', use_business_hours),
-      reply_metrics: fetch_metrics(conversation_filter, 'reply_time', use_business_hours)
-    }
-  end
-
-  def build_label_report(label, report_data)
-    {
-      id: label.id,
-      name: label.title,
-      conversations_count: report_data[:conversation_counts][label.title] || 0,
-      avg_resolution_time: report_data[:resolution_metrics][label.title] || 0,
-      avg_first_response_time: report_data[:first_response_metrics][label.title] || 0,
-      avg_reply_time: report_data[:reply_metrics][label.title] || 0,
-      resolved_conversations_count: report_data[:resolved_counts][label.title] || 0
-    }
-  end
-
-  def use_business_hours?
-    ActiveModel::Type::Boolean.new.cast(params[:business_hours])
-  end
-
-  def build_conversation_filter
-    conversation_filter = { account_id: account.id }
-    conversation_filter[:created_at] = range if range.present?
-
-    conversation_filter
-  end
-
-  def fetch_conversation_counts(conversation_filter)
-    fetch_counts(conversation_filter)
-  end
-
-  def fetch_resolved_counts
-    # Count resolution events, not conversations currently in resolved status
-    # Filter by reporting_event.created_at, not conversation.created_at
-    reporting_event_filter = { name: 'conversation_resolved', account_id: account.id }
-    reporting_event_filter[:created_at] = range if range.present?
-
-    ReportingEvent
-      .joins(conversation: { taggings: :tag })
-      .where(
-        reporting_event_filter.merge(
-          taggings: { taggable_type: 'Conversation', context: 'labels' }
-        )
-      )
-      .group('tags.name')
-      .count
-  end
-
-  def fetch_counts(conversation_filter)
-    ActsAsTaggableOn::Tagging
-      .joins('INNER JOIN conversations ON taggings.taggable_id = conversations.id')
-      .joins('INNER JOIN tags ON taggings.tag_id = tags.id')
-      .where(
-        taggable_type: 'Conversation',
-        context: 'labels',
-        conversations: conversation_filter
-      )
-      .select('tags.name, COUNT(taggings.*) AS count')
-      .group('tags.name')
-      .each_with_object({}) { |record, hash| hash[record.name] = record.count }
-  end
-
-  def fetch_metrics(conversation_filter, event_name, use_business_hours)
-    ReportingEvent
-      .joins(conversation: { taggings: :tag })
-      .where(
-        conversations: conversation_filter,
-        name: event_name,
-        taggings: { taggable_type: 'Conversation', context: 'labels' }
-      )
-      .group('tags.name')
-      .order('tags.name')
-      .select(
-        'tags.name',
-        use_business_hours ? 'AVG(reporting_events.value_in_business_hours) as avg_value' : 'AVG(reporting_events.value) as avg_value'
-      )
-      .each_with_object({}) { |record, hash| hash[record.name] = record.avg_value.to_f }
-  end
-end
@@ -38,34 +38,27 @@ class V2::Reports::Timeseries::CountReportBuilder < V2::Reports::Timeseries::Bas
  end

  def scope_for_resolutions_count
-    scope.reporting_events.where(
+    scope.reporting_events.joins(:conversation).select(:conversation_id).where(
      name: :conversation_resolved,
-      account_id: account.id,
-      created_at: range
-    )
+      conversations: { status: :resolved }, created_at: range
+    ).distinct
  end

  def scope_for_bot_resolutions_count
-    scope.reporting_events.where(
+    scope.reporting_events.joins(:conversation).select(:conversation_id).where(
      name: :conversation_bot_resolved,
-      account_id: account.id,
-      created_at: range
-    )
+      conversations: { status: :resolved }, created_at: range
+    ).distinct
  end

  def scope_for_bot_handoffs_count
    scope.reporting_events.joins(:conversation).select(:conversation_id).where(
      name: :conversation_bot_handoff,
-      account_id: account.id,
      created_at: range
    ).distinct
  end

  def grouped_count
-    # IMPORTANT: time_zone parameter affects both data grouping AND output timestamps
-    # It converts timestamps to the target timezone before grouping, which means
-    # the same event can fall into different day buckets depending on timezone
-    # Example: 2024-01-15 00:00 UTC becomes 2024-01-14 16:00 PST (falls on different day)
    @grouped_values = object_scope.group_by_period(
      group_by,
      :created_at,
@@ -1,20 +0,0 @@
-class Api::V1::Accounts::AssignmentPolicies::InboxesController < Api::V1::Accounts::BaseController
-  before_action :fetch_assignment_policy
-  before_action -> { check_authorization(AssignmentPolicy) }
-
-  def index
-    @inboxes = @assignment_policy.inboxes
-  end
-
-  private
-
-  def fetch_assignment_policy
-    @assignment_policy = Current.account.assignment_policies.find(
-      params[:assignment_policy_id]
-    )
-  end
-
-  def permitted_params
-    params.permit(:assignment_policy_id)
-  end
-end
@@ -1,36 +0,0 @@
-class Api::V1::Accounts::AssignmentPoliciesController < Api::V1::Accounts::BaseController
-  before_action :fetch_assignment_policy, only: [:show, :update, :destroy]
-  before_action :check_authorization
-
-  def index
-    @assignment_policies = Current.account.assignment_policies
-  end
-
-  def show; end
-
-  def create
-    @assignment_policy = Current.account.assignment_policies.create!(assignment_policy_params)
-  end
-
-  def update
-    @assignment_policy.update!(assignment_policy_params)
-  end
-
-  def destroy
-    @assignment_policy.destroy!
-    head :ok
-  end
-
-  private
-
-  def fetch_assignment_policy
-    @assignment_policy = Current.account.assignment_policies.find(params[:id])
-  end
-
-  def assignment_policy_params
-    params.require(:assignment_policy).permit(
-      :name, :description, :assignment_order, :conversation_priority,
-      :fair_distribution_limit, :fair_distribution_window, :enabled
-    )
-  end
-end
@@ -30,14 +30,7 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
  end

  def facebook_pages
-    pages = []
-    fb_pages = fb_object.get_connections('me', 'accounts')
-    pages.concat(fb_pages)
-    while fb_pages.respond_to?(:next_page) && (next_page = fb_pages.next_page)
-      fb_pages = next_page
-      pages.concat(fb_pages)
-    end
-    @page_details = mark_already_existing_facebook_pages(pages)
+    @page_details = mark_already_existing_facebook_pages(fb_object.get_connections('me', 'accounts'))
  end

  def set_instagram_id(page_access_token, facebook_channel)
@@ -29,6 +29,6 @@ class Api::V1::Accounts::CampaignsController < Api::V1::Accounts::BaseController

  def campaign_params
    params.require(:campaign).permit(:title, :description, :message, :enabled, :trigger_only_during_business_hours, :inbox_id, :sender_id,
-                                     :scheduled_at, audience: [:type, :id], trigger_rules: {}, template_params: {})
+                                     :scheduled_at, audience: [:type, :id], trigger_rules: {})
  end
 end
@@ -17,8 +17,8 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
  before_action :set_include_contact_inboxes, only: [:index, :active, :search, :filter, :show, :update]

  def index
+    @contacts_count = resolved_contacts.count
    @contacts = fetch_contacts(resolved_contacts)
-    @contacts_count = @contacts.total_count
  end

  def search
@@ -29,8 +29,8 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
        OR contacts.additional_attributes->>\'company_name\' ILIKE :search',
      search: "%#{params[:q].strip}%"
    )
+    @contacts_count = contacts.count
    @contacts = fetch_contacts(contacts)
-    @contacts_count = @contacts.total_count
  end

  def import
@@ -55,8 +55,8 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
  def active
    contacts = Current.account.contacts.where(id: ::OnlineStatusTracker
                  .get_available_contact_ids(Current.account.id))
+    @contacts_count = contacts.count
    @contacts = fetch_contacts(contacts)
-    @contacts_count = @contacts.total_count
  end

  def show; end
@@ -122,7 +122,7 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
  def resolved_contacts
    return @resolved_contacts if @resolved_contacts

-    @resolved_contacts = Current.account.contacts.resolved_contacts(use_crm_v2: Current.account.feature_enabled?('crm_v2'))
+    @resolved_contacts = Current.account.contacts.resolved_contacts

    @resolved_contacts = @resolved_contacts.tagged_with(params[:labels], any: true) if params[:labels].present?
    @resolved_contacts
@@ -133,14 +133,13 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
  end

  def fetch_contacts(contacts)
-    # Build includes hash to avoid separate query when contact_inboxes are needed
-    includes_hash = { avatar_attachment: [:blob] }
-    includes_hash[:contact_inboxes] = { inbox: :channel } if @include_contact_inboxes
+    contacts_with_avatar = filtrate(contacts)
+                           .includes([{ avatar_attachment: [:blob] }])
+                           .page(@current_page).per(RESULTS_PER_PAGE)

-    filtrate(contacts)
-      .includes(includes_hash)
-      .page(@current_page)
-      .per(RESULTS_PER_PAGE)
+    return contacts_with_avatar.includes([{ contact_inboxes: [:inbox] }]) if @include_contact_inboxes
+
+    contacts_with_avatar
  end

  def build_contact_inbox
@@ -5,6 +5,6 @@ class Api::V1::Accounts::Conversations::BaseController < Api::V1::Accounts::Base

  def conversation
    @conversation ||= Current.account.conversations.find_by!(display_id: params[:conversation_id])
-    authorize @conversation, :show?
+    authorize @conversation.inbox, :show?
  end
 end
@@ -160,7 +160,7 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro

  def conversation
    @conversation ||= Current.account.conversations.find_by!(display_id: params[:id])
-    authorize @conversation, :show?
+    authorize @conversation.inbox, :show?
  end

  def inbox
@@ -1,23 +1,32 @@
-class Api::V1::Accounts::Google::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+class Api::V1::Accounts::Google::AuthorizationsController < Api::V1::Accounts::BaseController
  include GoogleConcern
+  before_action :check_authorization

  def create
+    email = params[:authorization][:email]
    redirect_url = google_client.auth_code.authorize_url(
      {
        redirect_uri: "#{base_url}/google/callback",
-        scope: scope,
+        scope: 'email profile https://mail.google.com/',
        response_type: 'code',
        prompt: 'consent', # the oauth flow does not return a refresh token, this is supposed to fix it
        access_type: 'offline', # the default is 'online'
-        state: state,
        client_id: GlobalConfigService.load('GOOGLE_OAUTH_CLIENT_ID', nil)
      }
    )

    if redirect_url
+      cache_key = "google::#{email.downcase}"
+      ::Redis::Alfred.setex(cache_key, Current.account.id, 5.minutes)
      render json: { success: true, url: redirect_url }
    else
      render json: { success: false }, status: :unprocessable_entity
    end
  end
+
+  private
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
 end
@@ -1,46 +0,0 @@
-class Api::V1::Accounts::Inboxes::AssignmentPoliciesController < Api::V1::Accounts::BaseController
-  before_action :fetch_inbox
-  before_action :fetch_assignment_policy, only: [:create]
-  before_action -> { check_authorization(AssignmentPolicy) }
-  before_action :validate_assignment_policy, only: [:show, :destroy]
-
-  def show
-    @assignment_policy = @inbox.assignment_policy
-  end
-
-  def create
-    # There should be only one assignment policy for an inbox.
-    # If there is a new request to add an assignment policy, we will
-    # delete the old one and attach the new policy
-    remove_inbox_assignment_policy
-    @inbox_assignment_policy = @inbox.create_inbox_assignment_policy!(assignment_policy: @assignment_policy)
-    @assignment_policy = @inbox.assignment_policy
-  end
-
-  def destroy
-    remove_inbox_assignment_policy
-    head :ok
-  end
-
-  private
-
-  def remove_inbox_assignment_policy
-    @inbox.inbox_assignment_policy&.destroy
-  end
-
-  def fetch_inbox
-    @inbox = Current.account.inboxes.find(permitted_params[:inbox_id])
-  end
-
-  def fetch_assignment_policy
-    @assignment_policy = Current.account.assignment_policies.find(permitted_params[:assignment_policy_id])
-  end
-
-  def permitted_params
-    params.permit(:assignment_policy_id, :inbox_id)
-  end
-
-  def validate_assignment_policy
-    return render_not_found_error(I18n.t('errors.assignment_policy.not_found')) unless @inbox.assignment_policy
-  end
-end
@@ -4,8 +4,7 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
  before_action :fetch_agent_bot, only: [:set_agent_bot]
  before_action :validate_limit, only: [:create]
  # we are already handling the authorization in fetch inbox
-  before_action :check_authorization, except: [:show, :health]
-  before_action :validate_whatsapp_cloud_channel, only: [:health]
+  before_action :check_authorization, except: [:show]

  def index
    @inboxes = policy_scope(Current.account.inboxes.order_by_name.includes(:channel, { avatar_attachment: [:blob] }))
@@ -70,23 +69,6 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
    render status: :ok, json: { message: I18n.t('messages.inbox_deletetion_response') }
  end

-  def sync_templates
-    return render status: :unprocessable_entity, json: { error: 'Template sync is only available for WhatsApp channels' } unless whatsapp_channel?
-
-    trigger_template_sync
-    render status: :ok, json: { message: 'Template sync initiated successfully' }
-  rescue StandardError => e
-    render status: :internal_server_error, json: { error: e.message }
-  end
-
-  def health
-    health_data = Whatsapp::HealthService.new(@inbox.channel).fetch_health_status
-    render json: health_data
-  rescue StandardError => e
-    Rails.logger.error "[INBOX HEALTH] Error fetching health data: #{e.message}"
-    render json: { error: e.message }, status: :unprocessable_entity
-  end
-
  private

  def fetch_inbox
@@ -98,22 +80,12 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
    @agent_bot = AgentBot.find(params[:agent_bot]) if params[:agent_bot]
  end

-  def validate_whatsapp_cloud_channel
-    return if @inbox.channel.is_a?(Channel::Whatsapp) && @inbox.channel.provider == 'whatsapp_cloud'
-
-    render json: { error: 'Health data only available for WhatsApp Cloud API channels' }, status: :bad_request
-  end
-
  def create_channel
-    return unless allowed_channel_types.include?(permitted_params[:channel][:type])
+    return unless %w[web_widget api email line telegram whatsapp sms].include?(permitted_params[:channel][:type])

    account_channels_method.create!(permitted_params(channel_type_from_params::EDITABLE_ATTRS)[:channel].except(:type))
  end

-  def allowed_channel_types
-    %w[web_widget api email line telegram whatsapp sms]
-  end
-
  def update_inbox_working_hours
    @inbox.update_working_hours(params.permit(working_hours: Inbox::OFFISABLE_ATTRS)[:working_hours]) if params[:working_hours]
  end
@@ -198,18 +170,6 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
      []
    end
  end
-
-  def whatsapp_channel?
-    @inbox.whatsapp? || (@inbox.twilio? && @inbox.channel.whatsapp?)
-  end
-
-  def trigger_template_sync
-    if @inbox.whatsapp?
-      Channels::Whatsapp::TemplatesSyncJob.perform_later(@inbox.channel)
-    elsif @inbox.twilio? && @inbox.channel.whatsapp?
-      Channels::Twilio::TemplatesSyncJob.perform_later(@inbox.channel)
-    end
-  end
 end

 Api::V1::Accounts::InboxesController.prepend_mod_with('Api::V1::Accounts::InboxesController')
@@ -1,6 +1,7 @@
-class Api::V1::Accounts::Instagram::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+class Api::V1::Accounts::Instagram::AuthorizationsController < Api::V1::Accounts::BaseController
  include InstagramConcern
  include Instagram::IntegrationHelper
+  before_action :check_authorization

  def create
    # https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/business-login#step-1--get-authorization
@@ -20,4 +21,10 @@ class Api::V1::Accounts::Instagram::AuthorizationsController < Api::V1::Accounts
      render json: { success: false }, status: :unprocessable_entity
    end
  end
+
+  private
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
 end
@@ -22,7 +22,7 @@ class Api::V1::Accounts::Integrations::DyteController < Api::V1::Accounts::BaseC
  private

  def authorize_request
-    authorize @conversation, :show?
+    authorize @conversation.inbox, :show?
  end

  def render_response(response)
@@ -1,155 +0,0 @@
-class Api::V1::Accounts::Integrations::GithubController < Api::V1::Accounts::BaseController
-  before_action :fetch_hook
-  before_action :ensure_hook_exists, except: [:destroy]
-
-  def destroy
-    @hook.destroy!
-    head :ok
-  end
-
-  def repositories
-    repositories = github_service.repositories
-    filtered_repos = repositories.map do |repo|
-      {
-        full_name: repo[:full_name] || repo.full_name,
-        private: repo[:private] || repo.private
-      }
-    end
-    render json: filtered_repos
-  end
-
-  def search_repositories
-    repositories = github_service.search_repositories(params[:q])
-    filtered_repos = repositories.map do |repo|
-      {
-        full_name: repo[:full_name] || repo.full_name,
-        private: repo[:private] || repo.private
-      }
-    end
-    render json: filtered_repos
-  end
-
-  def assignees
-    assignees = github_service.assignees(repo_full_name)
-    filtered_assignees = assignees.map do |assignee|
-      {
-        login: assignee.login,
-        avatar_url: assignee.avatar_url
-      }
-    end
-    render json: filtered_assignees
-  end
-
-  def labels
-    labels = github_service.labels(repo_full_name)
-    filtered_labels = labels.map do |label|
-      {
-        name: label.name,
-        color: label.color
-      }
-    end
-    render json: filtered_labels
-  end
-
-  def search_issues
-    issues = github_service.search_issues(repo_full_name, params[:q])
-    filtered_issues = issues.map do |issue|
-      {
-        number: issue.number,
-        title: issue.title,
-        html_url: issue.html_url
-      }
-    end
-    render json: filtered_issues
-  end
-
-  def create_issue
-    issue_data = github_service.create_issue(
-      repo_full_name,
-      params[:title],
-      params[:body],
-      issue_options
-    )
-
-    github_issue = create_linked_issue(issue_data)
-    render json: issue_response(github_issue), status: :created
-  end
-
-  def link_issue
-    issue_data = github_service.issue(repo_full_name, params[:issue_number])
-    github_issue = create_linked_issue(issue_data)
-    render json: issue_response(github_issue), status: :created
-  end
-
-  def linked_issues
-    issues = GithubIssue.where(conversation_id: params[:conversation_id])
-
-    render json: issues.map do |issue|
-      {
-        id: issue.id,
-        issue_number: issue.issue_number,
-        title: issue.issue_title,
-        html_url: issue.html_url,
-        repo_full_name: issue.repo_full_name,
-        linked_by: {
-          id: issue.linked_by.id,
-          name: issue.linked_by.name
-        },
-        created_at: issue.created_at
-      }
-    end
-  end
-
-  def unlink_issue
-    github_issue = GithubIssue.find(params[:id])
-    github_issue.destroy!
-    head :ok
-  end
-
-  private
-
-  def fetch_hook
-    @hook = Integrations::Hook.where(account: Current.account).find_by(app_id: 'github')
-  end
-
-  def ensure_hook_exists
-    render json: { error: 'GitHub integration not configured' }, status: :unauthorized unless @hook
-  end
-
-  def github_service
-    @github_service ||= Github::GithubService.new(hook: @hook)
-  end
-
-  def repo_full_name
-    params[:repo_full_name] || "#{params[:owner]}/#{params[:repo]}"
-  end
-
-  def issue_options
-    options = {}
-    options[:assignees] = params[:assignees] if params[:assignees].present?
-    options[:labels] = params[:labels] if params[:labels].present?
-    options
-  end
-
-  def create_linked_issue(issue_data)
-    GithubIssue.create!(
-      conversation_id: params[:conversation_id],
-      account: Current.account,
-      repo_full_name: repo_full_name,
-      issue_number: issue_data.number,
-      issue_title: issue_data.title,
-      html_url: issue_data.html_url,
-      linked_by: Current.user
-    )
-  end
-
-  def issue_response(github_issue)
-    {
-      id: github_issue.id,
-      issue_number: github_issue.issue_number,
-      title: github_issue.issue_title,
-      html_url: github_issue.html_url,
-      repo_full_name: github_issue.repo_full_name
-    }
-  end
-end
@@ -1,9 +1,8 @@
 class Api::V1::Accounts::Integrations::LinearController < Api::V1::Accounts::BaseController
-  before_action :fetch_conversation, only: [:create_issue, :link_issue, :unlink_issue, :linked_issues]
+  before_action :fetch_conversation, only: [:link_issue, :linked_issues]
  before_action :fetch_hook, only: [:destroy]

  def destroy
-    revoke_linear_token
    @hook.destroy!
    head :ok
  end
@@ -28,16 +27,10 @@ class Api::V1::Accounts::Integrations::LinearController < Api::V1::Accounts::Bas
  end

  def create_issue
-    issue = linear_processor_service.create_issue(permitted_params, Current.user)
+    issue = linear_processor_service.create_issue(permitted_params)
    if issue[:error]
      render json: { error: issue[:error] }, status: :unprocessable_entity
    else
-      Linear::ActivityMessageService.new(
-        conversation: @conversation,
-        action_type: :issue_created,
-        issue_data: { id: issue[:data][:identifier] },
-        user: Current.user
-      ).perform
      render json: issue[:data], status: :ok
    end
  end
@@ -45,34 +38,21 @@ class Api::V1::Accounts::Integrations::LinearController < Api::V1::Accounts::Bas
  def link_issue
    issue_id = permitted_params[:issue_id]
    title = permitted_params[:title]
-    issue = linear_processor_service.link_issue(conversation_link, issue_id, title, Current.user)
+    issue = linear_processor_service.link_issue(conversation_link, issue_id, title)
    if issue[:error]
      render json: { error: issue[:error] }, status: :unprocessable_entity
    else
-      Linear::ActivityMessageService.new(
-        conversation: @conversation,
-        action_type: :issue_linked,
-        issue_data: { id: issue_id },
-        user: Current.user
-      ).perform
      render json: issue[:data], status: :ok
    end
  end

  def unlink_issue
    link_id = permitted_params[:link_id]
-    issue_id = permitted_params[:issue_id]
    issue = linear_processor_service.unlink_issue(link_id)

    if issue[:error]
      render json: { error: issue[:error] }, status: :unprocessable_entity
    else
-      Linear::ActivityMessageService.new(
-        conversation: @conversation,
-        action_type: :issue_unlinked,
-        issue_data: { id: issue_id },
-        user: Current.user
-      ).perform
      render json: issue[:data], status: :ok
    end
  end
@@ -121,15 +101,4 @@ class Api::V1::Accounts::Integrations::LinearController < Api::V1::Accounts::Bas
  def fetch_hook
    @hook = Integrations::Hook.where(account: Current.account).find_by(app_id: 'linear')
  end
-
-  def revoke_linear_token
-    return unless @hook&.access_token
-
-    begin
-      linear_client = Linear.new(@hook.access_token)
-      linear_client.revoke_token
-    rescue StandardError => e
-      Rails.logger.error "Failed to revoke Linear token: #{e.message}"
-    end
-  end
 end
@@ -1,14 +0,0 @@
-class Api::V1::Accounts::Integrations::NotionController < Api::V1::Accounts::BaseController
-  before_action :fetch_hook, only: [:destroy]
-
-  def destroy
-    @hook.destroy!
-    head :ok
-  end
-
-  private
-
-  def fetch_hook
-    @hook = Integrations::Hook.where(account: Current.account).find_by(app_id: 'notion')
-  end
-end
@@ -1,19 +1,28 @@
-class Api::V1::Accounts::Microsoft::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+class Api::V1::Accounts::Microsoft::AuthorizationsController < Api::V1::Accounts::BaseController
  include MicrosoftConcern
+  before_action :check_authorization

  def create
+    email = params[:authorization][:email]
    redirect_url = microsoft_client.auth_code.authorize_url(
      {
        redirect_uri: "#{base_url}/microsoft/callback",
-        scope: scope,
-        state: state,
+        scope: 'offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send openid profile',
        prompt: 'consent'
      }
    )
    if redirect_url
+      cache_key = "microsoft::#{email.downcase}"
+      ::Redis::Alfred.setex(cache_key, Current.account.id, 5.minutes)
      render json: { success: true, url: redirect_url }
    else
      render json: { success: false }, status: :unprocessable_entity
    end
  end
+
+  private
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
 end
@@ -1,21 +0,0 @@
-class Api::V1::Accounts::Notion::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
-  include NotionConcern
-
-  def create
-    redirect_url = notion_client.auth_code.authorize_url(
-      {
-        redirect_uri: "#{base_url}/notion/callback",
-        response_type: 'code',
-        owner: 'user',
-        state: state,
-        client_id: GlobalConfigService.load('NOTION_CLIENT_ID', nil)
-      }
-    )
-
-    if redirect_url
-      render json: { success: true, url: redirect_url }
-    else
-      render json: { success: false }, status: :unprocessable_entity
-    end
-  end
-end
@@ -1,23 +0,0 @@
-class Api::V1::Accounts::OauthAuthorizationController < Api::V1::Accounts::BaseController
-  before_action :check_authorization
-
-  protected
-
-  def scope
-    ''
-  end
-
-  def state
-    Current.account.to_sgid(expires_in: 15.minutes).to_s
-  end
-
-  def base_url
-    ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
-  end
-
-  private
-
-  def check_authorization
-    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
-  end
-end
@@ -26,8 +26,9 @@ class Api::V1::Accounts::PortalsController < Api::V1::Accounts::BaseController
      @portal.update!(portal_params.merge(live_chat_widget_params)) if params[:portal].present?
      # @portal.custom_domain = parsed_custom_domain
      process_attached_logo if params[:blob_id].present?
-    rescue ActiveRecord::RecordInvalid => e
-      render_record_invalid(e)
+    rescue StandardError => e
+      Rails.logger.error e
+      render json: { error: @portal.errors.messages }.to_json, status: :unprocessable_entity
    end
  end

@@ -46,20 +47,6 @@ class Api::V1::Accounts::PortalsController < Api::V1::Accounts::BaseController
    head :ok
  end

-  def send_instructions
-    email = permitted_params[:email]
-    return render_could_not_create_error(I18n.t('portals.send_instructions.email_required')) if email.blank?
-    return render_could_not_create_error(I18n.t('portals.send_instructions.invalid_email_format')) unless valid_email?(email)
-    return render_could_not_create_error(I18n.t('portals.send_instructions.custom_domain_not_configured')) if @portal.custom_domain.blank?
-
-    PortalInstructionsMailer.send_cname_instructions(
-      portal: @portal,
-      recipient_email: email
-    ).deliver_later
-
-    render json: { message: I18n.t('portals.send_instructions.instructions_sent_successfully') }, status: :ok
-  end
-
  def process_attached_logo
    blob_id = params[:blob_id]
    blob = ActiveStorage::Blob.find_by(id: blob_id)
@@ -73,20 +60,19 @@ class Api::V1::Accounts::PortalsController < Api::V1::Accounts::BaseController
  end

  def permitted_params
-    params.permit(:id, :email)
+    params.permit(:id)
  end

  def portal_params
    params.require(:portal).permit(
-      :id, :account_id, :color, :custom_domain, :header_text, :homepage_link,
+      :account_id, :color, :custom_domain, :header_text, :homepage_link,
      :name, :page_title, :slug, :archived, { config: [:default_locale, { allowed_locales: [] }] }
    )
  end

  def live_chat_widget_params
    permitted_params = params.permit(:inbox_id)
-    return {} unless permitted_params.key?(:inbox_id)
-    return { channel_web_widget_id: nil } if permitted_params[:inbox_id].blank?
+    return {} if permitted_params[:inbox_id].blank?

    inbox = Inbox.find(permitted_params[:inbox_id])
    return {} unless inbox.web_widget?
@@ -102,10 +88,4 @@ class Api::V1::Accounts::PortalsController < Api::V1::Accounts::BaseController
    domain = URI.parse(@portal.custom_domain)
    domain.is_a?(URI::HTTP) ? domain.host : @portal.custom_domain
  end
-
-  def valid_email?(email)
-    ValidEmail2::Address.new(email).valid?
-  end
 end
-
-Api::V1::Accounts::PortalsController.prepend_mod_with('Api::V1::Accounts::PortalsController')
@@ -1,77 +0,0 @@
-class Api::V1::Accounts::Whatsapp::AuthorizationsController < Api::V1::Accounts::BaseController
-  before_action :fetch_and_validate_inbox, if: -> { params[:inbox_id].present? }
-
-  # POST /api/v1/accounts/:account_id/whatsapp/authorization
-  # Handles both initial authorization and reauthorization
-  # If inbox_id is present in params, it performs reauthorization
-  def create
-    validate_embedded_signup_params!
-    channel = process_embedded_signup
-    render_success_response(channel.inbox)
-  rescue StandardError => e
-    render_error_response(e)
-  end
-
-  private
-
-  def process_embedded_signup
-    service = Whatsapp::EmbeddedSignupService.new(
-      account: Current.account,
-      params: params.permit(:code, :business_id, :waba_id, :phone_number_id).to_h.symbolize_keys,
-      inbox_id: params[:inbox_id]
-    )
-    service.perform
-  end
-
-  def fetch_and_validate_inbox
-    @inbox = Current.account.inboxes.find(params[:inbox_id])
-    validate_reauthorization_required
-  end
-
-  def validate_reauthorization_required
-    return if @inbox.channel.reauthorization_required? || can_upgrade_to_embedded_signup?
-
-    render json: {
-      success: false,
-      message: I18n.t('inbox.reauthorization.not_required')
-    }, status: :unprocessable_entity
-  end
-
-  def can_upgrade_to_embedded_signup?
-    channel = @inbox.channel
-    return false unless channel.provider == 'whatsapp_cloud'
-
-    true
-  end
-
-  def render_success_response(inbox)
-    response = {
-      success: true,
-      id: inbox.id,
-      name: inbox.name,
-      channel_type: 'whatsapp'
-    }
-    response[:message] = I18n.t('inbox.reauthorization.success') if params[:inbox_id].present?
-    render json: response
-  end
-
-  def render_error_response(error)
-    Rails.logger.error "[WHATSAPP AUTHORIZATION] Embedded signup error: #{error.message}"
-    Rails.logger.error error.backtrace.join("\n")
-    render json: {
-      success: false,
-      error: error.message
-    }, status: :unprocessable_entity
-  end
-
-  def validate_embedded_signup_params!
-    missing_params = []
-    missing_params << 'code' if params[:code].blank?
-    missing_params << 'business_id' if params[:business_id].blank?
-    missing_params << 'waba_id' if params[:waba_id].blank?
-
-    return if missing_params.empty?
-
-    raise ArgumentError, "Required parameters are missing: #{missing_params.join(', ')}"
-  end
-end
@@ -1,68 +0,0 @@
-class Api::V1::Profile::MfaController < Api::BaseController
-  before_action :check_mfa_feature_available
-  before_action :check_mfa_enabled, only: [:destroy, :backup_codes]
-  before_action :check_mfa_disabled, only: [:create, :verify]
-  before_action :validate_otp, only: [:verify, :backup_codes, :destroy]
-  before_action :validate_password, only: [:destroy]
-
-  def show; end
-
-  def create
-    mfa_service.enable_two_factor!
-  end
-
-  def verify
-    @backup_codes = mfa_service.verify_and_activate!
-  end
-
-  def destroy
-    mfa_service.disable_two_factor!
-  end
-
-  def backup_codes
-    @backup_codes = mfa_service.generate_backup_codes!
-  end
-
-  private
-
-  def mfa_service
-    @mfa_service ||= Mfa::ManagementService.new(user: current_user)
-  end
-
-  def check_mfa_enabled
-    render_could_not_create_error(I18n.t('errors.mfa.not_enabled')) unless current_user.mfa_enabled?
-  end
-
-  def check_mfa_feature_available
-    return if Chatwoot.mfa_enabled?
-
-    render json: {
-      error: I18n.t('errors.mfa.feature_unavailable')
-    }, status: :forbidden
-  end
-
-  def check_mfa_disabled
-    render_could_not_create_error(I18n.t('errors.mfa.already_enabled')) if current_user.mfa_enabled?
-  end
-
-  def validate_otp
-    authenticated = Mfa::AuthenticationService.new(
-      user: current_user,
-      otp_code: mfa_params[:otp_code]
-    ).authenticate
-
-    return if authenticated
-
-    render_could_not_create_error(I18n.t('errors.mfa.invalid_code'))
-  end
-
-  def validate_password
-    return if current_user.valid_password?(mfa_params[:password])
-
-    render_could_not_create_error(I18n.t('errors.mfa.invalid_credentials'))
-  end
-
-  def mfa_params
-    params.permit(:otp_code, :password)
-  end
-end
@@ -9,7 +9,7 @@ class Api::V1::Widget::ConfigsController < Api::V1::Widget::BaseController
  private

  def set_global_config
-    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL', 'INSTALLATION_NAME')
+    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL')
  end

  def set_contact
@@ -1,6 +1,6 @@
 class Api::V2::Accounts::SummaryReportsController < Api::V1::Accounts::BaseController
  before_action :check_authorization
-  before_action :prepare_builder_params, only: [:agent, :team, :inbox, :label]
+  before_action :prepare_builder_params, only: [:agent, :team, :inbox]

  def agent
    render_report_with(V2::Reports::AgentSummaryBuilder)
@@ -14,10 +14,6 @@ class Api::V2::Accounts::SummaryReportsController < Api::V1::Accounts::BaseContr
    render_report_with(V2::Reports::InboxSummaryBuilder)
  end

-  def label
-    render_report_with(V2::Reports::LabelSummaryBuilder)
-  end
-
  private

  def check_authorization
@@ -14,7 +14,6 @@ module AccessTokenAuthHelper
    ensure_access_token
    render_unauthorized('Invalid Access Token') && return if @access_token.blank?

-    # NOTE: This ensures that current_user is set and available for the rest of the controller actions
    @resource = @access_token.owner
    Current.user = @resource if allowed_current_user_type?(@resource)
  end
@@ -14,7 +14,7 @@ module GoogleConcern

  private

-  def scope
-    'email profile https://mail.google.com/'
+  def base_url
+    ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
  end
 end
@@ -15,7 +15,7 @@ module MicrosoftConcern

  private

-  def scope
-    'offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send openid profile email'
+  def base_url
+    ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
  end
 end
@@ -1,21 +0,0 @@
-module NotionConcern
-  extend ActiveSupport::Concern
-
-  def notion_client
-    app_id = GlobalConfigService.load('NOTION_CLIENT_ID', nil)
-    app_secret = GlobalConfigService.load('NOTION_CLIENT_SECRET', nil)
-
-    ::OAuth2::Client.new(app_id, app_secret, {
-                           site: 'https://api.notion.com',
-                           authorize_url: 'https://api.notion.com/v1/oauth/authorize',
-                           token_url: 'https://api.notion.com/v1/oauth/token',
-                           auth_scheme: :basic_auth
-                         })
-  end
-
-  private
-
-  def scope
-    ''
-  end
-end
@@ -4,28 +4,17 @@ module SwitchLocale
  private

  def switch_locale(&)
-    # Priority is for locale set in query string (mostly for widget/from js sdk)
+    # priority is for locale set in query string (mostly for widget/from js sdk)
    locale ||= params[:locale]

-    # Use the user's locale if available
-    locale ||= locale_from_user
-
-    # Use the locale from a custom domain if applicable
    locale ||= locale_from_custom_domain
-
    # if locale is not set in account, let's use DEFAULT_LOCALE env variable
    locale ||= ENV.fetch('DEFAULT_LOCALE', nil)
-
    set_locale(locale, &)
  end

  def switch_locale_using_account_locale(&)
-    # Get the locale from the user first
-    locale = locale_from_user
-
-    # Fallback to the account's locale if the user's locale is not set
-    locale ||= locale_from_account(@current_account)
-
+    locale = locale_from_account(@current_account)
    set_locale(locale, &)
  end

@@ -43,12 +32,6 @@ module SwitchLocale
    @portal.default_locale
  end

-  def locale_from_user
-    return unless @user
-
-    @user.ui_settings&.dig('locale')
-  end
-
  def set_locale(locale, &)
    safe_locale = validate_and_get_locale(locale)
    # Ensure locale won't bleed into other requests
@@ -15,7 +15,7 @@ class DashboardController < ActionController::Base
  private

  def ensure_html_format
-    render json: { error: 'Please use API routes instead of dashboard routes for JSON requests' }, status: :not_acceptable if request.format.json?
+    head :not_acceptable unless request.format.html?
  end

  def set_global_config
@@ -66,9 +66,7 @@ class DashboardController < ActionController::Base
      ENABLE_ACCOUNT_SIGNUP: GlobalConfigService.load('ENABLE_ACCOUNT_SIGNUP', 'false'),
      FB_APP_ID: GlobalConfigService.load('FB_APP_ID', ''),
      INSTAGRAM_APP_ID: GlobalConfigService.load('INSTAGRAM_APP_ID', ''),
-      FACEBOOK_API_VERSION: GlobalConfigService.load('FACEBOOK_API_VERSION', 'v18.0'),
-      WHATSAPP_APP_ID: GlobalConfigService.load('WHATSAPP_APP_ID', ''),
-      WHATSAPP_CONFIGURATION_ID: GlobalConfigService.load('WHATSAPP_CONFIGURATION_ID', ''),
+      FACEBOOK_API_VERSION: GlobalConfigService.load('FACEBOOK_API_VERSION', 'v17.0'),
      IS_ENTERPRISE: ChatwootApp.enterprise?,
      AZURE_APP_ID: GlobalConfigService.load('AZURE_APP_ID', ''),
      GIT_SHA: GIT_HASH
@@ -19,19 +19,6 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa
    redirect_to login_page_url(email: encoded_email, sso_auth_token: @resource.generate_sso_auth_token)
  end

-  def sign_in_user_on_mobile
-    @resource.skip_confirmation! if confirmable_enabled?
-
-    # once the resource is found and verified
-    # we can just send them to the login page again with the SSO params
-    # that will log them in
-    encoded_email = ERB::Util.url_encode(@resource.email)
-    params = { email: encoded_email, sso_auth_token: @resource.generate_sso_auth_token }.to_query
-
-    mobile_deep_link_base = GlobalConfigService.load('MOBILE_DEEP_LINK_BASE', 'chatwootapp')
-    redirect_to "#{mobile_deep_link_base}://auth/saml?#{params}", allow_other_host: true
-  end
-
  def sign_up_user
    return redirect_to login_page_url(error: 'no-account-found') unless account_signup_allowed?
    return redirect_to login_page_url(error: 'business-account-only') unless validate_signup_email_is_business_domain?
@@ -60,8 +47,10 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa
  end

  def get_resource_from_auth_hash # rubocop:disable Naming/AccessorMethodName
-    email = auth_hash.dig('info', 'email')
-    @resource = resource_class.from_email(email)
+    # find the user with their email instead of UID and token
+    @resource = resource_class.where(
+      email: auth_hash['info']['email']
+    ).first
  end

  def validate_signup_email_is_business_domain?
@@ -86,5 +75,3 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa
    'user'
  end
 end
-
-DeviseOverrides::OmniauthCallbacksController.prepend_mod_with('DeviseOverrides::OmniauthCallbacksController')
@@ -44,5 +44,3 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController
    }, status: status
  end
 end
-
-DeviseOverrides::PasswordsController.prepend_mod_with('DeviseOverrides::PasswordsController')
@@ -9,14 +9,14 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController
  end

  def create
-    return handle_mfa_verification if mfa_verification_request?
-    return handle_sso_authentication if sso_authentication_request?
-
-    user = find_user_for_authentication
-    return handle_mfa_required(user) if user&.mfa_enabled?
-
-    # Only proceed with standard authentication if no MFA is required
-    super
+    # Authenticate user via the temporary sso auth token
+    if params[:sso_auth_token].present? && @resource.present?
+      authenticate_resource_with_sso_token
+      yield @resource if block_given?
+      render_create_success
+    else
+      super
+    end
  end

  def render_create_success
@@ -25,31 +25,6 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController

  private

-  def find_user_for_authentication
-    return nil unless params[:email].present? && params[:password].present?
-
-    normalized_email = params[:email].strip.downcase
-    user = User.from_email(normalized_email)
-    return nil unless user&.valid_password?(params[:password])
-    return nil unless user.active_for_authentication?
-
-    user
-  end
-
-  def mfa_verification_request?
-    params[:mfa_token].present?
-  end
-
-  def sso_authentication_request?
-    params[:sso_auth_token].present? && @resource.present?
-  end
-
-  def handle_sso_authentication
-    authenticate_resource_with_sso_token
-    yield @resource if block_given?
-    render_create_success
-  end
-
  def login_page_url(error: nil)
    frontend_url = ENV.fetch('FRONTEND_URL', nil)

@@ -71,41 +46,6 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController
    user = User.from_email(params[:email])
    @resource = user if user&.valid_sso_auth_token?(params[:sso_auth_token])
  end
-
-  def handle_mfa_required(user)
-    render json: {
-      mfa_required: true,
-      mfa_token: Mfa::TokenService.new(user: user).generate_token
-    }, status: :partial_content
-  end
-
-  def handle_mfa_verification
-    user = Mfa::TokenService.new(token: params[:mfa_token]).verify_token
-    return render_mfa_error('errors.mfa.invalid_token', :unauthorized) unless user
-
-    authenticated = Mfa::AuthenticationService.new(
-      user: user,
-      otp_code: params[:otp_code],
-      backup_code: params[:backup_code]
-    ).authenticate
-
-    return render_mfa_error('errors.mfa.invalid_code') unless authenticated
-
-    sign_in_mfa_user(user)
-  end
-
-  def sign_in_mfa_user(user)
-    @resource = user
-    @token = @resource.create_token
-    @resource.save!
-
-    sign_in(:user, @resource, store: false, bypass: false)
-    render_create_success
-  end
-
-  def render_mfa_error(message_key, status = :bad_request)
-    render json: { error: I18n.t(message_key) }, status: status
-  end
 end

 DeviseOverrides::SessionsController.prepend_mod_with('DeviseOverrides::SessionsController')
@@ -1,160 +0,0 @@
-class Github::CallbacksController < ApplicationController
-  include Github::IntegrationHelper
-
-  def show
-    # Validate account context early for all flows that require it
-    account if params[:code].present?
-
-    if params[:installation_id].present? && params[:code].present?
-      # Both installation and OAuth code present - handle both
-      handle_installation_with_oauth
-    elsif params[:installation_id].present?
-      # Only installation_id present - redirect to OAuth
-      handle_installation
-    else
-      # Only OAuth code present - handle authorization
-      handle_authorization
-    end
-  rescue StandardError => e
-    Rails.logger.error("Github callback error: #{e.message}")
-    redirect_to fallback_redirect_uri
-  end
-
-  private
-
-  def handle_installation_with_oauth
-    # Handle both installation and OAuth in one go
-    installation_id = params[:installation_id]
-
-    @response = oauth_client.auth_code.get_token(
-      params[:code],
-      redirect_uri: "#{base_url}/github/callback"
-    )
-
-    handle_response(installation_id)
-  end
-
-  def handle_installation
-    if params[:setup_action] == 'install'
-      installation_id = params[:installation_id]
-
-      redirect_to build_oauth_url(installation_id)
-    else
-      Rails.logger.error("Unknown setup_action: #{params[:setup_action]}")
-      redirect_to github_integration_settings_url
-    end
-  end
-
-  def handle_authorization
-    @response = oauth_client.auth_code.get_token(
-      params[:code],
-      redirect_uri: "#{base_url}/github/callback"
-    )
-
-    handle_response
-  end
-
-  def build_oauth_url(installation_id)
-    GlobalConfigService.load('GITHUB_CLIENT_ID', nil)
-
-    # Store installation_id in session for later use
-    session[:github_installation_id] = installation_id
-
-    # For now, redirect to a page that will initiate OAuth with proper account context
-    # This is a temporary solution until we have a proper account-agnostic setup
-    "#{ENV.fetch('FRONTEND_URL', nil)}/app/accounts/1/settings/integrations/github?setup_action=install&installation_id=#{installation_id}"
-  end
-
-  def oauth_client
-    app_id = GlobalConfigService.load('GITHUB_CLIENT_ID', nil)
-    app_secret = GlobalConfigService.load('GITHUB_CLIENT_SECRET', nil)
-
-    OAuth2::Client.new(
-      app_id,
-      app_secret,
-      {
-        site: 'https://github.com',
-        token_url: '/login/oauth/access_token',
-        authorize_url: '/login/oauth/authorize'
-      }
-    )
-  end
-
-  def handle_response(installation_id = nil)
-    settings = build_hook_settings(installation_id)
-    hook = create_integration_hook(settings)
-    hook.save!
-
-    cleanup_session_data
-    redirect_to github_redirect_uri
-  rescue StandardError => e
-    Rails.logger.error("Github callback error: #{e.message}")
-    redirect_to fallback_redirect_uri
-  end
-
-  def build_hook_settings(installation_id)
-    settings = {
-      token_type: parsed_body['token_type'],
-      scope: parsed_body['scope']
-    }
-
-    settings[:installation_id] = installation_id || session[:github_installation_id]
-    settings.compact
-  end
-
-  def create_integration_hook(settings)
-    account.hooks.new(
-      access_token: parsed_body['access_token'],
-      status: 'enabled',
-      app_id: 'github',
-      settings: settings
-    )
-  end
-
-  def cleanup_session_data
-    session.delete(:github_installation_id)
-  end
-
-  def account
-    @account ||= account_from_state
-  end
-
-  def account_from_state
-    raise ActionController::BadRequest, 'Missing state variable' if params[:state].blank?
-
-    # Try signed GlobalID first (installation flow)
-    account = GlobalID::Locator.locate_signed(params[:state])
-    return account if account
-
-    # Fallback to JWT token (direct OAuth flow)
-    account_id = verify_github_token(params[:state])
-    return Account.find(account_id) if account_id
-
-    raise 'Invalid or expired state'
-  rescue StandardError
-    raise ActionController::BadRequest, 'Invalid account context'
-  end
-
-  def github_redirect_uri
-    "#{ENV.fetch('FRONTEND_URL', nil)}/app/accounts/#{account.id}/settings/integrations/github"
-  end
-
-  def github_integration_settings_url
-    "#{ENV.fetch('FRONTEND_URL', nil)}/app/accounts/1/settings/integrations/github"
-  end
-
-  def fallback_redirect_uri
-    github_redirect_uri
-  rescue StandardError
-    # Fallback if no account context available
-    "#{ENV.fetch('FRONTEND_URL', nil)}/app/settings/integrations"
-  end
-
-  def parsed_body
-    @parsed_body ||= @response.response.parsed
-  end
-
-  def base_url
-    ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
-  end
-end
@@ -2,7 +2,7 @@ class MicrosoftController < ApplicationController
  after_action :set_version_header

  def identity_association
-    microsoft_identity
+    microsoft_indentity
  end

  private
@@ -11,7 +11,7 @@ class MicrosoftController < ApplicationController
    response.headers['Content-Length'] = { associatedApplications: [{ applicationId: @identity_json }] }.to_json.length
  end

-  def microsoft_identity
+  def microsoft_indentity
    @identity_json = GlobalConfigService.load('AZURE_APP_ID', nil)
  end
 end
@@ -1,36 +0,0 @@
-class Notion::CallbacksController < OauthCallbackController
-  include NotionConcern
-
-  private
-
-  def provider_name
-    'notion'
-  end
-
-  def oauth_client
-    notion_client
-  end
-
-  def handle_response
-    hook = account.hooks.new(
-      access_token: parsed_body['access_token'],
-      status: 'enabled',
-      app_id: 'notion',
-      settings: {
-        token_type: parsed_body['token_type'],
-        workspace_name: parsed_body['workspace_name'],
-        workspace_id: parsed_body['workspace_id'],
-        workspace_icon: parsed_body['workspace_icon'],
-        bot_id: parsed_body['bot_id'],
-        owner: parsed_body['owner']
-      }
-    )
-
-    hook.save!
-    redirect_to notion_redirect_uri
-  end
-
-  def notion_redirect_uri
-    "#{ENV.fetch('FRONTEND_URL', nil)}/app/accounts/#{account.id}/settings/integrations/notion"
-  end
-end
@@ -6,6 +6,7 @@ class OauthCallbackController < ApplicationController
    )

    handle_response
+    ::Redis::Alfred.delete(cache_key)
  rescue StandardError => e
    ChatwootExceptionTracker.new(e).capture_exception
    redirect_to '/'
@@ -63,6 +64,10 @@ class OauthCallbackController < ApplicationController
    raise NotImplementedError
  end

+  def cache_key
+    "#{provider_name}::#{users_data['email'].downcase}"
+  end
+
  def create_channel_with_inbox
    ActiveRecord::Base.transaction do
      channel_email = Channel::Email.create!(email: users_data['email'], account: account)
@@ -81,17 +86,12 @@ class OauthCallbackController < ApplicationController
    decoded_token[0]
  end

-  def account_from_signed_id
-    raise ActionController::BadRequest, 'Missing state variable' if params[:state].blank?
-
-    account = GlobalID::Locator.locate_signed(params[:state])
-    raise 'Invalid or expired state' if account.nil?
-
-    account
+  def account_id
+    ::Redis::Alfred.get(cache_key)
  end

  def account
-    @account ||= account_from_signed_id
+    @account ||= Account.find(account_id)
  end

  # Fallback name, for when name field is missing from users_data
@@ -1,11 +1,4 @@
 class Platform::Api::V1::AccountsController < PlatformController
-  def index
-    @resources = @platform_app.platform_app_permissibles
-                              .where(permissible_type: 'Account')
-                              .includes(:permissible)
-                              .map(&:permissible)
-  end
-
  def show; end

  def create
@@ -3,7 +3,7 @@ class Public::Api::V1::Inboxes::ConversationsController < Public::Api::V1::Inbox
  before_action :set_conversation, only: [:toggle_typing, :update_last_seen, :show, :toggle_status]

  def index
-    @conversations = @contact_inbox.hmac_verified? ? @contact_inbox.contact.conversations : @contact_inbox.conversations
+    @conversations = @contact_inbox.hmac_verified? ? @contact.conversations : @contact_inbox.conversations
  end

  def show; end
@@ -7,19 +7,13 @@ class Public::Api::V1::Portals::ArticlesController < Public::Api::V1::Portals::B

  def index
    @articles = @portal.articles.published.includes(:category, :author)
-
-    @articles = @articles.where(locale: permitted_params[:locale]) if permitted_params[:locale].present?
-
    @articles_count = @articles.count
-
    search_articles
    order_by_sort_param
    limit_results
  end

-  def show
-    @og_image_url = helpers.set_og_image_url(@portal.name, @article.title)
-  end
+  def show; end

  def tracking_pixel
    @article = @portal.articles.find_by(slug: permitted_params[:article_slug])
@@ -58,6 +58,6 @@ class Public::Api::V1::Portals::BaseController < PublicController
  end

  def set_global_config
-    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'BRAND_URL', 'INSTALLATION_NAME')
+    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'BRAND_URL')
  end
 end
@@ -8,9 +8,7 @@ class Public::Api::V1::Portals::CategoriesController < Public::Api::V1::Portals:
    @categories = @portal.categories.order(position: :asc)
  end

-  def show
-    @og_image_url = helpers.set_og_image_url(@portal.name, @category.name)
-  end
+  def show; end

  private

@@ -4,9 +4,7 @@ class Public::Api::V1::PortalsController < Public::Api::V1::Portals::BaseControl
  before_action :redirect_to_portal_with_locale, only: [:show]
  layout 'portal'

-  def show
-    @og_image_url = helpers.set_og_image_url('', @portal.header_text)
-  end
+  def show; end

  def sitemap
    @help_center_url = @portal.custom_domain || ChatwootApp.help_center_root
@@ -17,12 +17,7 @@ class SlackUploadsController < ApplicationController
  end

  def blob_url
-    # Only generate representations for images
-    if @blob.content_type.start_with?('image/')
-      url_for(@blob.representation(resize_to_fill: [250, nil]))
-    else
-      url_for(@blob)
-    end
+    url_for(@blob.representation(resize_to_fill: [250, nil]))
  end

  def avatar_url
@@ -39,11 +39,7 @@ class SuperAdmin::AppConfigsController < SuperAdmin::ApplicationController
      'email' => ['MAILER_INBOUND_EMAIL_DOMAIN'],
      'linear' => %w[LINEAR_CLIENT_ID LINEAR_CLIENT_SECRET],
      'slack' => %w[SLACK_CLIENT_ID SLACK_CLIENT_SECRET],
-      'instagram' => %w[INSTAGRAM_APP_ID INSTAGRAM_APP_SECRET INSTAGRAM_VERIFY_TOKEN INSTAGRAM_API_VERSION ENABLE_INSTAGRAM_CHANNEL_HUMAN_AGENT],
-      'whatsapp_embedded' => %w[WHATSAPP_APP_ID WHATSAPP_APP_SECRET WHATSAPP_CONFIGURATION_ID WHATSAPP_API_VERSION],
-      'notion' => %w[NOTION_CLIENT_ID NOTION_CLIENT_SECRET],
-      'google' => %w[GOOGLE_OAUTH_CLIENT_ID GOOGLE_OAUTH_CLIENT_SECRET GOOGLE_OAUTH_REDIRECT_URI],
-      'github' => %w[GITHUB_CLIENT_ID GITHUB_CLIENT_SECRET]
+      'instagram' => %w[INSTAGRAM_APP_ID INSTAGRAM_APP_SECRET INSTAGRAM_VERIFY_TOKEN INSTAGRAM_API_VERSION ENABLE_INSTAGRAM_CHANNEL_HUMAN_AGENT]
    }

    @allowed_configs = mapping.fetch(@config, %w[ENABLE_ACCOUNT_SIGNUP FIREBASE_PROJECT_ID FIREBASE_CREDENTIALS])
@@ -7,9 +7,8 @@
 class SuperAdmin::ApplicationController < Administrate::ApplicationController
  include ActionView::Helpers::TagHelper
  include ActionView::Context
-  include SuperAdmin::NavigationHelper

-  helper_method :render_vue_component, :settings_open?, :settings_pages
+  helper_method :render_vue_component
  # authenticiation done via devise : SuperAdmin Model
  before_action :authenticate_super_admin!

@@ -13,11 +13,11 @@ class SuperAdmin::UsersController < SuperAdmin::ApplicationController
      redirect_to new_super_admin_user_path, notice: notice
    end
  end
-
-  def update
-    requested_resource.skip_reconfirmation! if resource_params[:confirmed_at].present?
-    super
-  end
+  #
+  # def update
+  #   super
+  #   send_foo_updated_email(requested_resource)
+  # end

  # Override this method to specify custom lookup behavior.
  # This will be used to set the resource for the `show`, `edit`, and `update`
@@ -5,6 +5,6 @@ class Survey::ResponsesController < ActionController::Base
  private

  def set_global_config
-    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL', 'INSTALLATION_NAME')
+    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL')
  end
 end
@@ -27,11 +27,7 @@ class Twilio::CallbackController < ApplicationController
      *Array.new(10) { |i| :"MediaUrl#{i}" },
      *Array.new(10) { |i| :"MediaContentType#{i}" },
      :MessagingServiceSid,
-      :NumMedia,
-      :Latitude,
-      :Longitude,
-      :MessageType,
-      :ProfileName
+      :NumMedia
    )
  end
 end
@@ -4,16 +4,7 @@ class Webhooks::InstagramController < ActionController::API
  def events
    Rails.logger.info('Instagram webhook received events')
    if params['object'].casecmp('instagram').zero?
-      entry_params = params.to_unsafe_hash[:entry]
-
-      if contains_echo_event?(entry_params)
-        # Add delay to prevent race condition where echo arrives before send message API completes
-        # This avoids duplicate messages when echo comes early during API processing
-        ::Webhooks::InstagramEventsJob.set(wait: 2.seconds).perform_later(entry_params)
-      else
-        ::Webhooks::InstagramEventsJob.perform_later(entry_params)
-      end
-
+      ::Webhooks::InstagramEventsJob.perform_later(params.to_unsafe_hash[:entry])
      render json: :ok
    else
      Rails.logger.warn("Message is not received from the instagram webhook event: #{params['object']}")
@@ -23,16 +14,6 @@ class Webhooks::InstagramController < ActionController::API

  private

-  def contains_echo_event?(entry_params)
-    return false unless entry_params.is_a?(Array)
-
-    entry_params.any? do |entry|
-      # Check messaging array for echo events
-      messaging_events = entry[:messaging] || []
-      messaging_events.any? { |messaging| messaging.dig(:message, :is_echo).present? }
-    end
-  end
-
  def valid_token?(token)
    # Validates against both IG_VERIFY_TOKEN (Instagram channel via Facebook page) and
    # INSTAGRAM_VERIFY_TOKEN (Instagram channel via direct Instagram login)
@@ -14,7 +14,7 @@ class WidgetsController < ActionController::Base
  private

  def set_global_config
-    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL', 'DIRECT_UPLOADS_ENABLED', 'INSTALLATION_NAME')
+    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL', 'DIRECT_UPLOADS_ENABLED')
  end

  def set_web_widget
@@ -70,12 +70,7 @@ class WidgetsController < ActionController::Base
  end

  def allow_iframe_requests
-    if @web_widget.allowed_domains.blank?
-      response.headers.delete('X-Frame-Options')
-    else
-      domains = @web_widget.allowed_domains.split(',').map(&:strip).join(' ')
-      response.headers['Content-Security-Policy'] = "frame-ancestors #{domains}"
-    end
+    response.headers.delete('X-Frame-Options')
  end
 end

@@ -59,11 +59,11 @@ class UserDashboard < Administrate::BaseDashboard
  SHOW_PAGE_ATTRIBUTES = %i[
    id
    avatar_url
+    unconfirmed_email
    name
    type
    display_name
    email
-    unconfirmed_email
    created_at
    updated_at
    confirmed_at
@@ -6,54 +6,19 @@ class EmailChannelFinder
  end

  def perform
-    channel_from_primary_recipients || channel_from_bcc_recipients
-  end
+    channel = nil

-  private
+    recipient_mails.each do |email|
+      normalized_email = normalize_email_with_plus_addressing(email)
+      channel = Channel::Email.find_by('lower(email) = ? OR lower(forward_to_email) = ?', normalized_email, normalized_email)

-  def channel_from_primary_recipients
-    primary_recipient_emails.each do |email|
-      channel = channel_from_email(email)
-      return channel if channel.present?
+      break if channel.present?
    end
-
-    nil
+    channel
  end

-  def channel_from_bcc_recipients
-    bcc_recipient_emails.each do |email|
-      channel = channel_from_email(email)
-
-      # Skip if BCC processing is disabled for this account
-      next if channel && !allow_bcc_processing?(channel.account_id)
-
-      return channel if channel.present?
-    end
-
-    nil
-  end
-
-  def primary_recipient_emails
-    (@email_object.to.to_a + @email_object.cc.to_a + [@email_object['X-Original-To'].try(:value)]).flatten.compact
-  end
-
-  def bcc_recipient_emails
-    @email_object.bcc.to_a.flatten.compact
-  end
-
-  def channel_from_email(email)
-    normalized_email = normalize_email_with_plus_addressing(email)
-    Channel::Email.find_by('lower(email) = ? OR lower(forward_to_email) = ?', normalized_email, normalized_email)
-  end
-
-  def bcc_processing_skipped_accounts
-    config_value = GlobalConfigService.load('SKIP_INCOMING_BCC_PROCESSING', '')
-    return [] if config_value.blank?
-
-    config_value.split(',').map(&:to_i)
-  end
-
-  def allow_bcc_processing?(account_id)
-    bcc_processing_skipped_accounts.exclude?(account_id)
+  def recipient_mails
+    recipient_addresses = @email_object.to.to_a + @email_object.cc.to_a + @email_object.bcc.to_a + [@email_object['X-Original-To'].try(:value)]
+    recipient_addresses.flatten.compact
  end
 end
@@ -15,13 +15,7 @@ class NotificationFinder
  end

  def unread_count
-    if type_included?('read')
-      # If we're including read notifications, filter to unread
-      @notifications.where(read_at: nil).count
-    else
-      # Already filtered to unread notifications, just count
-      @notifications.count
-    end
+    @notifications.where(read_at: nil).count
  end

  def count
@@ -33,7 +27,7 @@ class NotificationFinder
  def set_up
    find_all_notifications
    filter_snoozed_notifications
-    filter_read_notifications
+    fitler_read_notifications
  end

  def find_all_notifications
@@ -44,7 +38,7 @@ class NotificationFinder
    @notifications = @notifications.where(snoozed_until: nil) unless type_included?('snoozed')
  end

-  def filter_read_notifications
+  def fitler_read_notifications
    @notifications = @notifications.where(read_at: nil) unless type_included?('read')
  end

@@ -36,13 +36,9 @@ module Api::V2::Accounts::ReportsHelper
  end

  def generate_labels_report
-    reports = V2::Reports::LabelSummaryBuilder.new(
-      account: Current.account,
-      params: build_params({})
-    ).build
-
-    reports.map do |report|
-      [report[:name]] + generate_readable_report_metrics(report)
+    Current.account.labels.map do |label|
+      label_report = report_builder({ type: :label, id: label.id }).short_summary
+      [label.title] + generate_readable_report_metrics(label_report)
    end
  end

@@ -1,47 +0,0 @@
-module Github::IntegrationHelper
-  # Generates a signed JWT token for Github integration
-  #
-  # @param account_id [Integer] The account ID to encode in the token
-  # @return [String, nil] The encoded JWT token or nil if client secret is missing
-  def generate_github_token(account_id)
-    return if github_client_secret.blank?
-
-    JWT.encode(github_token_payload(account_id), github_client_secret, 'HS256')
-  rescue StandardError => e
-    Rails.logger.error("Failed to generate Github token: #{e.message}")
-    nil
-  end
-
-  def github_token_payload(account_id)
-    {
-      sub: account_id,
-      iat: Time.current.to_i
-    }
-  end
-
-  # Verifies and decodes a Github JWT token
-  #
-  # @param token [String] The JWT token to verify
-  # @return [Integer, nil] The account ID from the token or nil if invalid
-  def verify_github_token(token)
-    return if token.blank? || github_client_secret.blank?
-
-    github_decode_token(token, github_client_secret)
-  end
-
-  private
-
-  def github_client_secret
-    @github_client_secret ||= GlobalConfigService.load('GITHUB_CLIENT_SECRET', nil)
-  end
-
-  def github_decode_token(token, secret)
-    JWT.decode(token, secret, true, {
-                 algorithm: 'HS256',
-                 verify_expiration: true
-               }).first['sub']
-  rescue StandardError => e
-    Rails.logger.error("Unexpected error verifying Github token: #{e.message}")
-    nil
-  end
-end
@@ -1,13 +1,9 @@
 module MessageFormatHelper
+  include RegexHelper
+
  def transform_user_mention_content(message_content)
    # attachment message without content, message_content is nil
-    return '' unless message_content.presence
-
-    # Use CommonMarker to convert markdown to plain text for notifications
-    # This handles all markdown formatting (links, bold, italic, etc.) not just mentions
-    # Converts: [@👍 customer support](mention://team/1/%F0%9F%91%8D%20customer%20support)
-    # To: @👍 customer support
-    CommonMarker.render_doc(message_content).to_plaintext.strip
+    message_content.presence ? message_content.gsub(MENTION_REGEX, '\1') : ''
  end

  def render_message_content(message_content)
@@ -1,22 +1,4 @@
 module PortalHelper
-  include UrlHelper
-  def set_og_image_url(portal_name, title)
-    cdn_url = GlobalConfig.get('OG_IMAGE_CDN_URL')['OG_IMAGE_CDN_URL']
-    return if cdn_url.blank?
-
-    client_ref = GlobalConfig.get('OG_IMAGE_CLIENT_REF')['OG_IMAGE_CLIENT_REF']
-
-    uri = URI.parse(cdn_url)
-    uri.path = '/og'
-    uri.query = URI.encode_www_form(
-      clientRef: client_ref,
-      title: title,
-      portalName: portal_name
-    )
-
-    uri.to_s
-  end
-
  def generate_portal_bg_color(portal_color, theme)
    base_color = theme == 'dark' ? 'black' : 'white'
    "color-mix(in srgb, #{portal_color} 20%, #{base_color})"
@@ -75,17 +57,6 @@ module PortalHelper
    end
  end

-  def generate_portal_brand_url(brand_url, referer)
-    url = URI.parse(brand_url.to_s)
-    query_params = Rack::Utils.parse_query(url.query)
-    query_params['utm_medium'] = 'helpcenter'
-    query_params['utm_campaign'] = 'branding'
-    query_params['utm_source'] = URI.parse(referer).host if url_valid?(referer)
-
-    url.query = query_params.to_query
-    url.to_s
-  end
-
  def render_category_content(content)
    ChatwootMarkdownRenderer.new(content).render_markdown_to_plain_text
  end
@@ -53,13 +53,13 @@ module ReportHelper
  end

  def resolutions
-    scope.reporting_events.where(account_id: account.id, name: :conversation_resolved,
-                                 created_at: range)
+    scope.reporting_events.joins(:conversation).select(:conversation_id).where(account_id: account.id, name: :conversation_resolved,
+                                                                               conversations: { status: :resolved }, created_at: range).distinct
  end

  def bot_resolutions
-    scope.reporting_events.where(account_id: account.id, name: :conversation_bot_resolved,
-                                 created_at: range)
+    scope.reporting_events.joins(:conversation).select(:conversation_id).where(account_id: account.id, name: :conversation_bot_resolved,
+                                                                               conversations: { status: :resolved }, created_at: range).distinct
  end

  def bot_handoffs
@@ -18,25 +18,12 @@ module ReportingEventHelper
  end

  def last_non_human_activity(conversation)
-    # Try to get either a handoff or reopened event first
-    # These will always take precedence over any other activity
-    # Also, any of these events can happen at any time in the course of a conversation lifecycle.
-    # So we pick the latest event
-    event = ReportingEvent.where(
-      conversation_id: conversation.id,
-      name: %w[conversation_bot_handoff conversation_opened]
-    ).order(event_end_time: :desc).first
+    # check if a handoff event already exists
+    handoff_event = ReportingEvent.where(conversation_id: conversation.id, name: 'conversation_bot_handoff').last

-    return event.event_end_time if event&.event_end_time
-
-    # Fallback to bot resolved event
-    # Because this will be closest to the most accurate activity instead of conversation.created_at
-    bot_event = ReportingEvent.where(conversation_id: conversation.id, name: 'conversation_bot_resolved').last
-
-    return bot_event.event_end_time if bot_event&.event_end_time
-
-    # If no events found, return conversation creation time
-    conversation.created_at
+    # if a handoff exists, last non human activity is when the handoff ended,
+    # otherwise it's when the conversation was created
+    handoff_event&.event_end_time || conversation.created_at
  end

  private
@@ -1,16 +0,0 @@
-module SuperAdmin::NavigationHelper
-  def settings_open?
-    params[:controller].in? %w[super_admin/settings super_admin/app_configs]
-  end
-
-  def settings_pages
-    features = SuperAdmin::FeaturesHelper.available_features.select do |_feature, attrs|
-      attrs['config_key'].present? && attrs['enabled']
-    end
-
-    # Add general at the beginning
-    general_feature = [['general', { 'config_key' => 'general', 'name' => 'General' }]]
-
-    general_feature + features.to_a
-  end
-end
@@ -1,6 +1,6 @@
 <script>
 import { mapGetters } from 'vuex';
-import AddAccountModal from './components/app/AddAccountModal.vue';
+import AddAccountModal from '../dashboard/components/layout/sidebarComponents/AddAccountModal.vue';
 import LoadingState from './components/widgets/LoadingState.vue';
 import NetworkNotification from './components/NetworkNotification.vue';
 import UpdateBanner from './components/app/UpdateBanner.vue';
@@ -19,7 +19,6 @@ import {
  verifyServiceWorkerExistence,
 } from './helper/pushHelper';
 import ReconnectService from 'dashboard/helper/ReconnectService';
-import { useUISettings } from 'dashboard/composables/useUISettings';

 export default {
  name: 'App',
@@ -39,14 +38,12 @@ export default {
    const { accountId } = useAccount();
    // Use the font size composable (it automatically sets up the watcher)
    const { currentFontSize } = useFontSize();
-    const { uiSettings } = useUISettings();

    return {
      router,
      store,
      currentAccountId: accountId,
      currentFontSize,
-      uiSettings,
    };
  },
  data() {
@@ -91,10 +88,7 @@ export default {
  mounted() {
    this.initializeColorTheme();
    this.listenToThemeChanges();
-    // If user locale is set, use it; otherwise use account locale
-    this.setLocale(
-      this.uiSettings?.locale || window.chatwootConfig.selectedLocale
-    );
+    this.setLocale(window.chatwootConfig.selectedLocale);
  },
  unmounted() {
    if (this.reconnectService) {
@@ -120,8 +114,7 @@ export default {
      const { locale, latest_chatwoot_version: latestChatwootVersion } =
        this.getAccount(this.currentAccountId);
      const { pubsub_token: pubsubToken } = this.currentUser || {};
-      // If user locale is set, use it; otherwise use account locale
-      this.setLocale(this.uiSettings?.locale || locale);
+      this.setLocale(locale);
      this.latestChatwootVersion = latestChatwootVersion;
      vueActionCable.init(this.store, pubsubToken);
      this.reconnectService = new ReconnectService(this.store, this.router);
@@ -143,7 +136,8 @@ export default {
  <div
    v-if="!authUIFlags.isFetching && !accountUIFlags.isFetchingItem"
    id="app"
-    class="flex flex-col w-full h-screen min-h-0"
+    class="flex-grow-0 w-full h-full min-h-0 app-wrapper"
+    :class="{ 'app-rtl--wrapper': isRTL }"
    :dir="isRTL ? 'rtl' : 'ltr'"
  >
    <UpdateBanner :latest-chatwoot-version="latestChatwootVersion" />
@@ -1,43 +0,0 @@
-/* global axios */
-
-import ApiClient from './ApiClient';
-
-class AgentCapacityPolicies extends ApiClient {
-  constructor() {
-    super('agent_capacity_policies', { accountScoped: true });
-  }
-
-  getUsers(policyId) {
-    return axios.get(`${this.url}/${policyId}/users`);
-  }
-
-  addUser(policyId, userData) {
-    return axios.post(`${this.url}/${policyId}/users`, {
-      user_id: userData.id,
-      capacity: userData.capacity,
-    });
-  }
-
-  removeUser(policyId, userId) {
-    return axios.delete(`${this.url}/${policyId}/users/${userId}`);
-  }
-
-  createInboxLimit(policyId, limitData) {
-    return axios.post(`${this.url}/${policyId}/inbox_limits`, {
-      inbox_id: limitData.inboxId,
-      conversation_limit: limitData.conversationLimit,
-    });
-  }
-
-  updateInboxLimit(policyId, limitId, limitData) {
-    return axios.put(`${this.url}/${policyId}/inbox_limits/${limitId}`, {
-      conversation_limit: limitData.conversationLimit,
-    });
-  }
-
-  deleteInboxLimit(policyId, limitId) {
-    return axios.delete(`${this.url}/${policyId}/inbox_limits/${limitId}`);
-  }
-}
-
-export default new AgentCapacityPolicies();
@@ -1,36 +0,0 @@
-/* global axios */
-
-import ApiClient from './ApiClient';
-
-class AssignmentPolicies extends ApiClient {
-  constructor() {
-    super('assignment_policies', { accountScoped: true });
-  }
-
-  getInboxes(policyId) {
-    return axios.get(`${this.url}/${policyId}/inboxes`);
-  }
-
-  setInboxPolicy(inboxId, policyId) {
-    return axios.post(
-      `/api/v1/accounts/${this.accountIdFromRoute}/inboxes/${inboxId}/assignment_policy`,
-      {
-        assignment_policy_id: policyId,
-      }
-    );
-  }
-
-  getInboxPolicy(inboxId) {
-    return axios.get(
-      `/api/v1/accounts/${this.accountIdFromRoute}/inboxes/${inboxId}/assignment_policy`
-    );
-  }
-
-  removeInboxPolicy(inboxId) {
-    return axios.delete(
-      `/api/v1/accounts/${this.accountIdFromRoute}/inboxes/${inboxId}/assignment_policy`
-    );
-  }
-}
-
-export default new AssignmentPolicies();
@@ -38,7 +38,13 @@ export default {
    }
    return false;
  },
-  profileUpdate({ displayName, avatar, ...profileAttributes }) {
+  profileUpdate({
+    password,
+    password_confirmation,
+    displayName,
+    avatar,
+    ...profileAttributes
+  }) {
    const formData = new FormData();
    Object.keys(profileAttributes).forEach(key => {
      const hasValue = profileAttributes[key] === undefined;
@@ -47,22 +53,16 @@ export default {
      }
    });
    formData.append('profile[display_name]', displayName || '');
+    if (password && password_confirmation) {
+      formData.append('profile[password]', password);
+      formData.append('profile[password_confirmation]', password_confirmation);
+    }
    if (avatar) {
      formData.append('profile[avatar]', avatar);
    }
    return axios.put(endPoints('profileUpdate').url, formData);
  },

-  profilePasswordUpdate({ currentPassword, password, passwordConfirmation }) {
-    return axios.put(endPoints('profileUpdate').url, {
-      profile: {
-        current_password: currentPassword,
-        password,
-        password_confirmation: passwordConfirmation,
-      },
-    });
-  },
-
  updateUISettings({ uiSettings }) {
    return axios.put(endPoints('profileUpdate').url, {
      profile: { ui_settings: uiSettings },
@@ -1,36 +0,0 @@
-/* global axios */
-import ApiClient from '../ApiClient';
-
-class CaptainCustomTools extends ApiClient {
-  constructor() {
-    super('captain/custom_tools', { accountScoped: true });
-  }
-
-  get({ page = 1, searchKey } = {}) {
-    return axios.get(this.url, {
-      params: { page, searchKey },
-    });
-  }
-
-  show(id) {
-    return axios.get(`${this.url}/${id}`);
-  }
-
-  create(data = {}) {
-    return axios.post(this.url, {
-      custom_tool: data,
-    });
-  }
-
-  update(id, data = {}) {
-    return axios.put(`${this.url}/${id}`, {
-      custom_tool: data,
-    });
-  }
-
-  delete(id) {
-    return axios.delete(`${this.url}/${id}`);
-  }
-}
-
-export default new CaptainCustomTools();
@@ -6,11 +6,11 @@ class CaptainResponses extends ApiClient {
    super('captain/assistant_responses', { accountScoped: true });
  }

-  get({ page = 1, search, assistantId, documentId, status } = {}) {
+  get({ page = 1, searchKey, assistantId, documentId, status } = {}) {
    return axios.get(this.url, {
      params: {
        page,
-        search,
+        searchKey,
        assistant_id: assistantId,
        document_id: documentId,
        status,
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .4.0
 .13.0
@@ -1 +1 @@
 .4.3
 .2.0