Merge branch 'release/1.15.0'

* Chore: Improve button component styles

.circleci/config.yml

@@ -7,7 +7,7 @@ defaults: &defaults
   working_directory: ~/build
   docker:
     # specify the version you desire here
-    - image: circleci/ruby:2.7.1-node-browsers
+    - image: circleci/ruby:2.7.2-node-browsers
 
     # Specify service dependencies here if necessary
     # CircleCI maintains a library of pre-built images

.devcontainer/Dockerfile

@@ -0,0 +1,51 @@
+# pre-build stage
+ARG VARIANT=2.7
+FROM mcr.microsoft.com/vscode/devcontainers/ruby:${VARIANT}
+
+# Update args in docker-compose.yaml to set the UID/GID of the "vscode" user.
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+RUN if [ "$USER_GID" != "1000" ] || [ "$USER_UID" != "1000" ]; then \
+        groupmod --gid $USER_GID vscode \
+        && usermod --uid $USER_UID --gid $USER_GID vscode \
+        && chmod -R $USER_UID:$USER_GID /home/vscode; \
+    fi
+
+# [Option] Install Node.js
+ARG INSTALL_NODE="true"
+ARG NODE_VERSION="lts/*"
+RUN if [ "${INSTALL_NODE}" = "true" ]; then su vscode -c "source /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi
+
+
+# tmux is for overmind 
+# TODO : install foreman in future
+# packages: postgresql-server-dev-all 
+# may be postgres in same machine 
+
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+  && apt-get -y install --no-install-recommends \
+    libssl-dev \
+    tar \
+    tzdata \
+    postgresql-client \
+    yarn \
+    git \
+    imagemagick \
+    tmux \
+    zsh
+
+# [Optional] Uncomment this line to install global node packages.
+# RUN su vscode -c "source /usr/local/share/nvm/nvm.sh && npm install -g <your-package-here>" 2>&1
+
+
+# Do the set up required for chatwoot app 
+WORKDIR /workspace
+COPY . /workspace
+
+# TODO: figure out installing rvm
+# RUN rvm install
+COPY Gemfile Gemfile.lock ./
+RUN gem install bundler
+RUN bundle install
+COPY package.json yarn.lock ./
+RUN yarn install

.devcontainer/devcontainer.json

@@ -0,0 +1,33 @@
+{
+  "name": "Chatwoot Development Codespace",
+  "service": "app",
+  "dockerComposeFile": "docker-compose.yml",
+
+  "settings": {
+    "terminal.integrated.shell.linux": "/bin/zsh"
+  },
+
+
+  // Add the IDs of extensions you want installed when the container is created.
+  "extensions": [
+    "rebornix.Ruby",
+    "misogi.ruby-rubocop",
+    "wingrunr21.vscode-ruby"
+  ],
+
+
+  // TODO: figure whether we can get all this ports work properly
+
+  // 3000 rails
+  // 3035 webpacker
+  // 5432 postgres
+  // 6379 redis
+  // 1025,8025 mailhog
+  "forwardPorts": [5432, 6379, 1025, 8025],
+  //your application may need to listen on all interfaces (0.0.0.0) not just localhost for it to be available externally. Defaults to []
+  "appPort": [3000, 3035],
+
+  // Use 'postCreateCommand' to run commands after the container is created.
+  // #TODO: can we move logic of copy env file into dockerfile ?
+  "postCreateCommand": "cp .env.example .env",
+}

.devcontainer/docker-compose.yml

@@ -0,0 +1,56 @@
+# https://github.com/microsoft/vscode-dev-containers/blob/master/containers/python-3-postgres/.devcontainer/docker-compose.yml
+# https://github.com/microsoft/vscode-dev-containers/blob/master/containers/ruby-rails/.devcontainer/devcontainer.json
+# 
+
+version: '3'
+
+services:
+  app: 
+    build:
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
+      args:
+        # Update 'VARIANT' to pick a Ruby version: 2, 2.7, 2.6, 2.5
+        VARIANT: 2.7
+        # [Choice] Install Node.js
+        INSTALL_NODE: "true"
+        NODE_VERSION: "lts/*"
+        # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000.
+        USER_UID: 1000
+        USER_GID: 1000
+
+    volumes:
+      - ..:/workspace:cached
+  
+    # Overrides default command so things don't shut down after the process ends.
+    command: sleep infinity
+    
+    # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function.
+    network_mode: service:db
+
+  db:
+    image: postgres:latest
+    restart: unless-stopped
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD: postgres
+
+  redis:
+    image: redis:latest
+    restart: unless-stopped
+    network_mode: service:db
+    volumes:
+      - redis-data:/data
+
+  mailhog:
+    restart: unless-stopped
+    image: mailhog/mailhog
+    network_mode: service:db
+  
+volumes:
+  postgres-data:
+  redis-data:
+  

.env.example

@@ -4,6 +4,13 @@ SECRET_KEY_BASE=replace_with_lengthy_secure_hex
 # Replace with the URL you are planning to use for your app
 FRONTEND_URL=http://0.0.0.0:3000
 
+# If the variable is set, all non-authenticated pages would fallback to the default locale.
+# Whenever a new account is created, the default language will be DEFAULT_LOCALE instead of en
+# DEFAULT_LOCALE=en
+
+# If you plan to use CDN for your assets, set Asset CDN Host
+ASSET_CDN_HOST=
+
 # Force all access to the app over SSL, default is set to false
 FORCE_SSL=false
 
@@ -11,7 +18,7 @@ FORCE_SSL=false
 # true : default option, allows sign ups
 # false : disables all the end points related to sign ups
 # api_only: disables the UI for signup, but you can create sign ups via the account apis
-ENABLE_ACCOUNT_SIGNUP=true
+ENABLE_ACCOUNT_SIGNUP=false
 
 # Redis config
 REDIS_URL=redis://redis:6379
@@ -19,6 +26,11 @@ REDIS_URL=redis://redis:6379
 # which will be the password for the redis service running inside the docker-compose
 # to make it secure
 REDIS_PASSWORD=
+# Redis Sentinel can be used by passing list of sentinel host and ports e,g. sentinel_host1:port1,sentinel_host2:port2
+REDIS_SENTINELS=
+# Redis sentinel master name is required when using sentinel, default value is "mymaster".
+# You can find list of master using "SENTINEL masters" command
+REDIS_SENTINEL_MASTER_NAME=
 
 # Postgres Database config variables
 POSTGRES_HOST=postgres
@@ -27,27 +39,35 @@ POSTGRES_PASSWORD=
 RAILS_ENV=development
 RAILS_MAX_THREADS=5
 
-# Mail outgoing
-MAILER_SENDER_EMAIL=accounts@chatwoot.com
-SMTP_PORT=1025
+# The email from which all outgoing emails are sent
+# could user either  `email@yourdomain.com` or `BrandName <email@yourdomain.com>`
+MAILER_SENDER_EMAIL=Chatwoot <accounts@chatwoot.com>
+
+
+#SMTP domain key is set up for HELO checking
 SMTP_DOMAIN=chatwoot.com
-# if you are running docker-compose, set SMTP_ADDRESS value as "mailhog",
-# else set the value as "localhost"
+# the default value is set "mailhog" and is used by docker-compose for development environments,
+# Set the value as "localhost" or your SMTP address in other environments
 SMTP_ADDRESS=mailhog
+SMTP_PORT=1025
 SMTP_USERNAME=
 SMTP_PASSWORD=
+# plain,login,cram_md5
 SMTP_AUTHENTICATION=
-SMTP_ENABLE_STARTTLS_AUTO=
+SMTP_ENABLE_STARTTLS_AUTO=true
+# Can be: 'none', 'peer', 'client_once', 'fail_if_no_peer_cert', see http://api.rubyonrails.org/classes/ActionMailer/Base.html
+SMTP_OPENSSL_VERIFY_MODE=peer
 
 # Mail Incoming
-
+# This is the domain set for the reply emails when conversation continuity is enabled
+MAILER_INBOUND_EMAIL_DOMAIN=
 # Set this to appropriate ingress channel with regards to incoming emails
 # Possible values are :
-# :relay for Exim, Postfix, Qmail
-# :mailgun for Mailgun
-# :mandrill for Mandrill
-# :postmark for Postmark
-# :sendgrid for Sendgrid
+# relay for Exim, Postfix, Qmail
+# mailgun for Mailgun
+# mandrill for Mandrill
+# postmark for Postmark
+# sendgrid for Sendgrid
 RAILS_INBOUND_EMAIL_SERVICE=
 # Use one of the following based on the email ingress service
 # Ref: https://edgeguides.rubyonrails.org/action_mailbox_basics.html
@@ -97,17 +117,32 @@ SLACK_CLIENT_SECRET=
 ## Mobile app env variables
 IOS_APP_ID=6C953F3RX2.com.chatwoot.app
 
+
+### Smart App Banner
+# https://developer.apple.com/library/archive/documentation/AppleApplications/Reference/SafariWebContent/PromotingAppswithAppBanners/PromotingAppswithAppBanners.html
+# You can find your app-id in https://itunesconnect.apple.com
+#IOS_APP_IDENTIFIER=1495796682
+
 ## Push Notification
 ## generate a new key value here : https://d3v.one/vapid-key-generator/
 # VAPID_PUBLIC_KEY=
 # VAPID_PRIVATE_KEY=
 #
-# for mobile apps 
+# for mobile apps
 # FCM_SERVER_KEY=
 
 ## Bot Customizations
 USE_INBOX_AVATAR_FOR_BOT=true
 
+
+
+## IP look up configuration
+## ref https://github.com/alexreisner/geocoder/blob/master/README_API_GUIDE.md
+## works only on accounts with ip look up feature enabled
+# IP_LOOKUP_SERVICE=geoip2
+# maxmindb api key to use geoip2 service
+# IP_LOOKUP_API_KEY=
+
 ## Development Only Config
 # if you want to use letter_opener for local emails
 # LETTER_OPENER=true

.eslintrc.js

@@ -46,5 +46,6 @@ module.exports = {
   },
   globals: {
     __WEBPACK_ENV__: true,
+    bus: true,
   },
 };

.github/ISSUE_TEMPLATE/bug_report.md

@@ -2,15 +2,16 @@
 name: Bug report
 about: Create a report to help us improve
 title: ''
-labels: ''
+labels: 'Bug'
 assignees: ''
 
 ---
-
 **Describe the bug**
+
 A clear and concise description of what the bug is.
 
 **To Reproduce**
+
 Steps to reproduce the behavior:
 1. Go to '...'
 2. Click on '....'
@@ -18,11 +19,25 @@ Steps to reproduce the behavior:
 4. See error
 
 **Expected behavior**
+
 A clear and concise description of what you expected to happen.
 
 **Screenshots**
+
 If applicable, add screenshots to help explain your problem.
 
+**Browser logs**
+
+Share the browser logs to debug the issue further
+
+**Server logs**
+
+Share the server logs to debug the issue further
+
+**Environment**
+
+Describe whether you are using Chatwoot Cloud (app.chatwoot.com) or a self hosted installation of Chatwoot. If you are using a self hosted installation of Chatwoot describe the type of deployment (Docker/Linux VM installation/Heroku)
+
 **Desktop (please complete the following information):**
  - OS: [e.g. iOS]
  - Browser [e.g. chrome, safari]
@@ -35,4 +50,5 @@ If applicable, add screenshots to help explain your problem.
  - Version [e.g. 22]
 
 **Additional context**
+
 Add any other context about the problem here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,9 +24,9 @@ Please describe the tests that you ran to verify your changes. Provide instructi
 
 - [ ] My code follows the style guidelines of this project
 - [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have commented on my code, particularly in hard-to-understand areas
 - [ ] I have made corresponding changes to the documentation
 - [ ] My changes generate no new warnings
 - [ ] I have added tests that prove my fix is effective or that my feature works
 - [ ] New and existing unit tests pass locally with my changes
-- [ ] Any dependent changes have been merged and published in downstream modules
+- [ ] Any dependent changes have been merged and published in downstream modules

.gitignore

@@ -16,6 +16,7 @@
 /tmp/*
 !/log/.keep
 !/tmp/.keep
+*.mmdb
 
 # Ignore Byebug command history file.
 .byebug_history
@@ -23,7 +24,7 @@
 *.log
 # Ignore application configuration
 node_modules
-
+master.key
 *.rdb
 
 # Ignore env files
@@ -55,3 +56,10 @@ node_modules
 package-lock.json
 
 *.dump
+
+
+# cypress
+test/cypress/videos/*
+
+/config/master.key
+/config/*.enc

.rubocop.yml

@@ -4,25 +4,15 @@ require:
   - rubocop-rspec
 inherit_from: .rubocop_todo.yml
 
-Lint/RaiseException:
-  Enabled: true
-Lint/StructNewOverride:
-  Enabled: true
-Lint/DeprecatedOpenSSLConstant:
-  Enabled: true
-Lint/MixedRegexpCaptureTypes:
-  Enabled: true
 Layout/LineLength:
   Max: 150
-Layout/EmptyLinesAroundAttributeAccessor:
-  Enabled: true
-Layout/SpaceAroundMethodCallOperator:
-  Enabled: true
 
 Metrics/ClassLength:
   Max: 125
   Exclude:
     - 'app/models/conversation.rb'
+    - 'app/mailers/conversation_reply_mailer.rb'
+    - 'app/models/message.rb'
 RSpec/ExampleLength:
   Max: 25
 Style/Documentation:
@@ -33,25 +23,21 @@ Style/FrozenStringLiteralComment:
   Enabled: false
 Style/SymbolArray:
   Enabled: false
-Style/HashEachMethods:
-  Enabled: true
-Style/HashTransformKeys:
-  Enabled: true
-Style/HashTransformValues:
-  Enabled: true
-Style/RedundantFetchBlock:
-  Enabled: true
-Style/RedundantRegexpCharacterClass:
-  Enabled: true
-Style/RedundantRegexpEscape:
-  Enabled: true
-Style/SlicingWithRange:
-  Enabled: true
+Style/OptionalBooleanParameter:
+  Exclude: 
+    - 'app/services/email_templates/db_resolver_service.rb'
+    - 'app/dispatchers/dispatcher.rb'
 Style/GlobalVars:
   Exclude:
     - 'config/initializers/redis.rb'
     - 'lib/redis/alfred.rb'
     - 'lib/global_config.rb'
+Style/ClassVars:
+  Exclude:
+    - 'app/services/email_templates/db_resolver_service.rb'
+Lint/MissingSuper:
+  Exclude:
+    - 'app/drops/base_drop.rb'
 Metrics/BlockLength:
   Exclude:
     - spec/**/*
@@ -64,6 +50,7 @@ Rails/ApplicationController:
     - 'app/controllers/dashboard_controller.rb'
     - 'app/controllers/widget_tests_controller.rb'
     - 'app/controllers/widgets_controller.rb'
+    - 'app/controllers/platform_controller.rb'
 Style/ClassAndModuleChildren:
   EnforcedStyle: compact
   Exclude:
@@ -87,8 +74,11 @@ Style/GuardClause:
     - 'db/migrate/20190819005836_add_missing_indexes_on_taggings.acts_as_taggable_on_engine.rb'
 Metrics/AbcSize:
   Exclude: 
+    - 'app/controllers/concerns/auth_helper.rb'
     - 'db/migrate/20190819005836_add_missing_indexes_on_taggings.acts_as_taggable_on_engine.rb'
+    - 'db/migrate/20161123131628_devise_token_auth_create_users.rb'
 Metrics/CyclomaticComplexity:
+  Max: 7
   Exclude:
     - 'db/migrate/20190819005836_add_missing_indexes_on_taggings.acts_as_taggable_on_engine.rb'
 Rails/ReversibleMigration:
@@ -115,9 +105,17 @@ Rails/UniqueValidationWithoutIndex:
   Exclude:
     - 'app/models/channel/twitter_profile.rb'
     - 'app/models/webhook.rb'
+    - 'app/models/contact.rb'
+Rails/RenderInline:
+  Exclude:
+    - 'app/controllers/swagger_controller.rb'
 RSpec/NamedSubject:
   Enabled: false
+# we should bring this down
+RSpec/MultipleMemoizedHelpers:
+  Max: 12
 AllCops:
+  NewCops: enable
   Exclude:
     - 'bin/**/*'
     - 'db/schema.rb'
@@ -129,3 +127,5 @@ AllCops:
     - 'config/environments/**/*'
     - 'tmp/**/*'
     - 'storage/**/*'
+    - 'db/migrate/20200225162150_init_schema.rb'
+    - 'config/initializers/azure_storage_service_patch.rb'

.rubocop_todo.yml

@@ -6,13 +6,6 @@
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 1
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: native, lf, crlf
-Layout/EndOfLine:
-  Exclude:
-    - 'deploy/after_restart.rb'
-
 # Offense count: 1
 Lint/DuplicateMethods:
   Exclude:

.ruby-version

@@ -1 +1 @@
-2.7.1
+2.7.2

.scss-lint.yml

@@ -282,3 +282,4 @@ exclude:
   - 'app/javascript/widget/assets/scss/_reset.scss'
   - 'app/javascript/widget/assets/scss/sdk.css'
   - 'app/assets/stylesheets/administrate/reset/_normalize.scss'
+  - 'app/javascript/shared/assets/stylesheets/*.scss'

Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-ruby '2.7.1'
+ruby '2.7.2'
 
 ##-- base gems for rails --##
 gem 'rack-cors', require: 'rack/cors'
@@ -8,7 +8,7 @@ gem 'rails'
 # Reduces boot times through caching; required in config/boot.rb
 gem 'bootsnap', require: false
 
-##-- rails helper gems --##
+##-- rails application helper gems --##
 gem 'acts-as-taggable-on'
 gem 'attr_extras'
 gem 'browser'
@@ -23,6 +23,14 @@ gem 'tzinfo-data'
 gem 'valid_email2'
 # compress javascript config.assets.js_compressor
 gem 'uglifier'
+##-- used for single column multiple binary flags in notification settings/feature flagging --##
+gem 'flag_shih_tzu'
+# Random name generator for user names
+gem 'haikunator'
+# Template parsing safely
+gem 'liquid'
+# Parse Markdown to HTML
+gem 'commonmarker'
 
 ##-- for active storage --##
 gem 'aws-sdk-s3', require: false
@@ -36,12 +44,16 @@ gem 'pg'
 gem 'redis'
 gem 'redis-namespace'
 gem 'redis-rack-cache'
+# super fast record imports in bulk
+gem 'activerecord-import'
 
 ##--- gems for server & infra configuration ---##
 gem 'dotenv-rails'
 gem 'foreman'
 gem 'puma'
-gem 'webpacker'
+gem 'webpacker', '~> 5.x'
+# metrics on heroku
+gem 'barnes'
 
 ##--- gems for authentication & authorization ---##
 gem 'devise'
@@ -57,7 +69,8 @@ gem 'administrate'
 gem 'wisper', '2.0.0'
 
 ##--- gems for channels ---##
-gem 'facebook-messenger'
+# TODO: bump up gem to 2.0
+gem 'facebook-messenger', '1.5.0'
 gem 'telegram-bot-ruby'
 gem 'twilio-ruby', '~> 5.32.0'
 # twitty will handle subscription of twitter account events
@@ -67,8 +80,6 @@ gem 'twitty'
 gem 'koala'
 # slack client
 gem 'slack-ruby-client'
-# Random name generator
-gem 'haikunator'
 
 ##--- gems for debugging and error reporting ---##
 # static analysis
@@ -78,14 +89,22 @@ gem 'sentry-raven'
 
 ##-- background job processing --##
 gem 'sidekiq'
-
-##-- used for single column multiple binary flags in notification settings/feature flagging --##
-gem 'flag_shih_tzu'
+# We want cron jobs
+gem 'sidekiq-cron'
 
 ##-- Push notification service --##
 gem 'fcm'
 gem 'webpush'
 
+##-- geocoding / parse location from ip --##
+# http://www.rubygeocoder.com/
+gem 'geocoder'
+# to parse maxmind db
+gem 'maxminddb'
+
+# to create db triggers
+gem 'hairtrigger'
+
 group :development do
   gem 'annotate'
   gem 'bullet'
@@ -94,6 +113,16 @@ group :development do
 
   # used in swagger build
   gem 'json_refs', git: 'https://github.com/tzmfreedom/json_refs', ref: 'e32deb0'
+
+  # When we want to squash migrations
+  gem 'squasher'
+end
+
+group :test do
+  # Cypress in rails.
+  gem 'cypress-on-rails', '~> 1.0'
+  # fast cleaning of database
+  gem 'database_cleaner'
 end
 
 group :development, :test do

Gemfile.lock

@@ -18,56 +18,58 @@ GEM
   specs:
     action-cable-testing (0.6.1)
       actioncable (>= 5.0)
-    actioncable (6.0.3.2)
-      actionpack (= 6.0.3.2)
+    actioncable (6.0.3.6)
+      actionpack (= 6.0.3.6)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.3.2)
-      actionpack (= 6.0.3.2)
-      activejob (= 6.0.3.2)
-      activerecord (= 6.0.3.2)
-      activestorage (= 6.0.3.2)
-      activesupport (= 6.0.3.2)
+    actionmailbox (6.0.3.6)
+      actionpack (= 6.0.3.6)
+      activejob (= 6.0.3.6)
+      activerecord (= 6.0.3.6)
+      activestorage (= 6.0.3.6)
+      activesupport (= 6.0.3.6)
       mail (>= 2.7.1)
-    actionmailer (6.0.3.2)
-      actionpack (= 6.0.3.2)
-      actionview (= 6.0.3.2)
-      activejob (= 6.0.3.2)
+    actionmailer (6.0.3.6)
+      actionpack (= 6.0.3.6)
+      actionview (= 6.0.3.6)
+      activejob (= 6.0.3.6)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.0.3.2)
-      actionview (= 6.0.3.2)
-      activesupport (= 6.0.3.2)
+    actionpack (6.0.3.6)
+      actionview (= 6.0.3.6)
+      activesupport (= 6.0.3.6)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.3.2)
-      actionpack (= 6.0.3.2)
-      activerecord (= 6.0.3.2)
-      activestorage (= 6.0.3.2)
-      activesupport (= 6.0.3.2)
+    actiontext (6.0.3.6)
+      actionpack (= 6.0.3.6)
+      activerecord (= 6.0.3.6)
+      activestorage (= 6.0.3.6)
+      activesupport (= 6.0.3.6)
       nokogiri (>= 1.8.5)
-    actionview (6.0.3.2)
-      activesupport (= 6.0.3.2)
+    actionview (6.0.3.6)
+      activesupport (= 6.0.3.6)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.3.2)
-      activesupport (= 6.0.3.2)
+    activejob (6.0.3.6)
+      activesupport (= 6.0.3.6)
       globalid (>= 0.3.6)
-    activemodel (6.0.3.2)
-      activesupport (= 6.0.3.2)
-    activerecord (6.0.3.2)
-      activemodel (= 6.0.3.2)
-      activesupport (= 6.0.3.2)
-    activestorage (6.0.3.2)
-      actionpack (= 6.0.3.2)
-      activejob (= 6.0.3.2)
-      activerecord (= 6.0.3.2)
-      marcel (~> 0.3.1)
-    activesupport (6.0.3.2)
+    activemodel (6.0.3.6)
+      activesupport (= 6.0.3.6)
+    activerecord (6.0.3.6)
+      activemodel (= 6.0.3.6)
+      activesupport (= 6.0.3.6)
+    activerecord-import (1.0.7)
+      activerecord (>= 3.2)
+    activestorage (6.0.3.6)
+      actionpack (= 6.0.3.6)
+      activejob (= 6.0.3.6)
+      activerecord (= 6.0.3.6)
+      marcel (~> 1.0.0)
+    activesupport (6.0.3.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -77,7 +79,7 @@ GEM
       activerecord (>= 5.0, < 6.1)
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
-    administrate (0.13.0)
+    administrate (0.14.0)
       actionpack (>= 4.2)
       actionview (>= 4.2)
       activerecord (>= 4.2)
@@ -93,41 +95,45 @@ GEM
       rake (>= 10.4, < 14.0)
     ast (2.4.1)
     attr_extras (6.2.4)
-    autoprefixer-rails (9.8.2)
+    autoprefixer-rails (9.8.6.3)
       execjs
     aws-eventstream (1.1.0)
-    aws-partitions (1.332.0)
-    aws-sdk-core (3.100.0)
+    aws-partitions (1.360.0)
+    aws-sdk-core (3.105.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.239.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-kms (1.34.1)
+    aws-sdk-kms (1.37.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.69.1)
-      aws-sdk-core (~> 3, >= 3.99.0)
+    aws-sdk-s3 (1.79.1)
+      aws-sdk-core (~> 3, >= 3.104.3)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.2.0)
+    aws-sigv4 (1.2.2)
       aws-eventstream (~> 1, >= 1.0.2)
     axiom-types (0.1.1)
       descendants_tracker (~> 0.0.4)
       ice_nine (~> 0.11.0)
       thread_safe (~> 0.3, >= 0.3.1)
-    azure-storage-blob (2.0.0)
+    azure-storage-blob (2.0.1)
       azure-storage-common (~> 2.0)
-      nokogiri (~> 1.10.4)
-    azure-storage-common (2.0.1)
+      nokogiri (~> 1.11.0.rc2)
+    azure-storage-common (2.0.2)
       faraday (~> 1.0)
       faraday_middleware (~> 1.0.0.rc1)
-      nokogiri (~> 1.10.4)
-    bcrypt (3.1.13)
+      net-http-persistent (~> 4.0)
+      nokogiri (~> 1.11.0.rc2)
+    barnes (0.0.8)
+      multi_json (~> 1)
+      statsd-ruby (~> 1.1)
+    bcrypt (3.1.15)
     bindex (0.8.1)
-    bootsnap (1.4.6)
+    bootsnap (1.4.8)
       msgpack (~> 1.0)
-    brakeman (4.8.2)
-    browser (4.2.0)
+    brakeman (4.9.0)
+    browser (5.3.1)
     builder (3.2.4)
     bullet (6.1.0)
       activesupport (>= 3.0.0)
@@ -141,14 +147,19 @@ GEM
     coderay (1.1.3)
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
-    concurrent-ruby (1.1.6)
+    commonmarker (0.21.1)
+      ruby-enum (~> 0.5)
+    concurrent-ruby (1.1.8)
     connection_pool (2.2.3)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
     crass (1.0.6)
+    cypress-on-rails (1.8.0)
+      rack
+    database_cleaner (1.8.5)
     datetime_picker_rails (0.0.7)
       momentjs-rails (>= 2.8.1)
-    declarative (0.0.10)
+    declarative (0.0.20)
     declarative-option (0.1.0)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
@@ -163,41 +174,48 @@ GEM
       devise (> 3.5.2, < 5)
       rails (>= 4.2.0, < 6.1)
       sprockets (= 3.7.2)
-    diff-lcs (1.4)
-    digest-crc (0.5.1)
+    diff-lcs (1.4.4)
+    digest-crc (0.6.1)
+      rake (~> 13.0)
     docile (1.3.2)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
-    dotenv (2.7.5)
-    dotenv-rails (2.7.5)
-      dotenv (= 2.7.5)
-      railties (>= 3.2, < 6.1)
+    dotenv (2.7.6)
+    dotenv-rails (2.7.6)
+      dotenv (= 2.7.6)
+      railties (>= 3.2)
     equalizer (0.0.11)
-    erubi (1.9.0)
+    erubi (1.10.0)
+    et-orbi (1.2.4)
+      tzinfo
     execjs (2.7.0)
     facebook-messenger (1.5.0)
       httparty (~> 0.13, >= 0.13.7)
       rack (>= 1.4.5)
-    factory_bot (6.0.2)
+    factory_bot (6.1.0)
       activesupport (>= 5.0.0)
-    factory_bot_rails (6.0.0)
-      factory_bot (~> 6.0.0)
+    factory_bot_rails (6.1.0)
+      factory_bot (~> 6.1.0)
       railties (>= 5.0.0)
-    faker (2.12.0)
+    faker (2.13.0)
       i18n (>= 1.6, < 2)
     faraday (1.0.1)
       multipart-post (>= 1.2, < 3)
     faraday_middleware (1.0.0)
       faraday (~> 1.0)
-    fcm (1.0.1)
+    fcm (1.0.2)
       faraday (~> 1.0.0)
-    ffi (1.13.1)
+    ffi (1.14.2)
     flag_shih_tzu (0.3.23)
-    foreman (0.87.1)
-    gli (2.19.1)
+    foreman (0.87.2)
+    fugit (1.4.1)
+      et-orbi (~> 1.1, >= 1.1.8)
+      raabro (~> 1.4)
+    geocoder (1.6.3)
+    gli (2.19.2)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
-    google-api-client (0.41.0)
+    google-api-client (0.43.0)
       addressable (~> 2.5, >= 2.5.1)
       googleauth (~> 0.9)
       httpclient (>= 2.8.1, < 3.0)
@@ -208,26 +226,30 @@ GEM
     google-cloud-core (1.5.0)
       google-cloud-env (~> 1.0)
       google-cloud-errors (~> 1.0)
-    google-cloud-env (1.3.2)
+    google-cloud-env (1.3.3)
       faraday (>= 0.17.3, < 2.0)
     google-cloud-errors (1.0.1)
-    google-cloud-storage (1.26.2)
+    google-cloud-storage (1.28.0)
       addressable (~> 2.5)
       digest-crc (~> 0.4)
       google-api-client (~> 0.33)
       google-cloud-core (~> 1.2)
       googleauth (~> 0.9)
       mini_mime (~> 1.0)
-    googleauth (0.13.0)
+    googleauth (0.13.1)
       faraday (>= 0.17.3, < 2.0)
       jwt (>= 1.4, < 3.0)
       memoist (~> 0.16)
       multi_json (~> 1.11)
       os (>= 0.9, < 2.0)
       signet (~> 0.14)
-    groupdate (5.0.0)
+    groupdate (5.1.0)
       activesupport (>= 5)
     haikunator (1.1.0)
+    hairtrigger (0.2.23)
+      activerecord (>= 5.0, < 7)
+      ruby2ruby (~> 2.4)
+      ruby_parser (~> 3.10)
     hana (1.3.6)
     hashdiff (1.0.1)
     hashie (4.1.0)
@@ -239,7 +261,7 @@ GEM
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.8.3)
+    i18n (1.8.9)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     inflecto (0.0.2)
@@ -250,8 +272,8 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    json (2.3.0)
-    jwt (2.2.1)
+    json (2.3.1)
+    jwt (2.2.2)
     kaminari (1.2.1)
       activesupport (>= 4.1.0)
       kaminari-actionview (= 1.2.1)
@@ -272,39 +294,42 @@ GEM
       addressable (~> 2.7)
     letter_opener (1.7.0)
       launchy (~> 2.2)
-    listen (3.2.1)
+    liquid (4.0.3)
+    listen (3.3.3)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    loofah (2.6.0)
+    loofah (2.9.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
-    marcel (0.3.3)
-      mimemagic (~> 0.3.2)
+    marcel (1.0.0)
+    maxminddb (0.1.22)
     memoist (0.16.2)
     method_source (1.0.0)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2020.0512)
-    mimemagic (0.3.5)
     mini_magick (4.10.1)
-    mini_mime (1.0.2)
-    mini_portile2 (2.4.0)
-    minitest (5.14.1)
+    mini_mime (1.0.3)
+    mini_portile2 (2.5.0)
+    minitest (5.14.4)
     momentjs-rails (2.20.1)
       railties (>= 3.1)
     msgpack (1.3.3)
-    multi_json (1.14.1)
+    multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
+    net-http-persistent (4.0.0)
+      connection_pool (~> 2.2)
     netrc (0.11.0)
-    nio4r (2.5.2)
-    nokogiri (1.10.9)
-      mini_portile2 (~> 2.4.0)
+    nio4r (2.5.7)
+    nokogiri (1.11.2)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
     oauth (0.5.4)
     orm_adapter (0.5.0)
-    os (1.1.0)
+    os (1.1.1)
     parallel (1.19.2)
     parser (2.7.1.4)
       ast (~> 2.4.1)
@@ -315,54 +340,54 @@ GEM
     pry-rails (0.3.9)
       pry (>= 0.10.4)
     public_suffix (4.0.5)
-    puma (4.3.5)
+    puma (4.3.6)
       nio4r (~> 2.0)
     pundit (2.1.0)
       activesupport (>= 3.0.0)
+    raabro (1.4.0)
+    racc (1.5.2)
     rack (2.2.3)
     rack-cache (1.12.0)
       rack (>= 0.4)
     rack-cors (1.1.1)
       rack (>= 2.0.0)
-    rack-protection (2.0.8.1)
-      rack
     rack-proxy (0.6.5)
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (6.0.3.2)
-      actioncable (= 6.0.3.2)
-      actionmailbox (= 6.0.3.2)
-      actionmailer (= 6.0.3.2)
-      actionpack (= 6.0.3.2)
-      actiontext (= 6.0.3.2)
-      actionview (= 6.0.3.2)
-      activejob (= 6.0.3.2)
-      activemodel (= 6.0.3.2)
-      activerecord (= 6.0.3.2)
-      activestorage (= 6.0.3.2)
-      activesupport (= 6.0.3.2)
+    rails (6.0.3.6)
+      actioncable (= 6.0.3.6)
+      actionmailbox (= 6.0.3.6)
+      actionmailer (= 6.0.3.6)
+      actionpack (= 6.0.3.6)
+      actiontext (= 6.0.3.6)
+      actionview (= 6.0.3.6)
+      activejob (= 6.0.3.6)
+      activemodel (= 6.0.3.6)
+      activerecord (= 6.0.3.6)
+      activestorage (= 6.0.3.6)
+      activesupport (= 6.0.3.6)
       bundler (>= 1.3.0)
-      railties (= 6.0.3.2)
+      railties (= 6.0.3.6)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    railties (6.0.3.2)
-      actionpack (= 6.0.3.2)
-      activesupport (= 6.0.3.2)
+    railties (6.0.3.6)
+      actionpack (= 6.0.3.6)
+      activesupport (= 6.0.3.6)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.20.3, < 2.0)
     rainbow (3.0.0)
-    rake (13.0.1)
+    rake (13.0.3)
     rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
     redis (4.2.1)
-    redis-namespace (1.7.0)
+    redis-namespace (1.8.0)
       redis (>= 3.0.4)
     redis-rack-cache (2.2.1)
       rack-cache (>= 1.10, < 2)
@@ -401,26 +426,34 @@ GEM
       rspec-mocks (~> 3.9)
       rspec-support (~> 3.9)
     rspec-support (3.9.3)
-    rubocop (0.86.0)
+    rubocop (0.89.1)
       parallel (~> 1.10)
-      parser (>= 2.7.0.1)
+      parser (>= 2.7.1.1)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.7)
       rexml
-      rubocop-ast (>= 0.0.3, < 1.0)
+      rubocop-ast (>= 0.3.0, < 1.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-ast (0.0.3)
-      parser (>= 2.7.0.1)
-    rubocop-performance (1.6.1)
-      rubocop (>= 0.71.0)
-    rubocop-rails (2.6.0)
+    rubocop-ast (0.3.0)
+      parser (>= 2.7.1.4)
+    rubocop-performance (1.7.1)
+      rubocop (>= 0.82.0)
+    rubocop-rails (2.8.1)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
-      rubocop (>= 0.82.0)
-    rubocop-rspec (1.40.0)
-      rubocop (>= 0.68.1)
+      rubocop (>= 0.87.0)
+    rubocop-rspec (1.43.2)
+      rubocop (~> 0.87)
+    ruby-enum (0.9.0)
+      i18n
     ruby-progressbar (1.10.1)
+    ruby2ruby (2.4.4)
+      ruby_parser (~> 3.1)
+      sexp_processor (~> 4.6)
+    ruby_parser (3.15.0)
+      rubocop (>= 0.87.0)
+      sexp_processor (~> 4.9)
     safe_yaml (1.0.5)
     sass (3.7.4)
       sass-listen (~> 4.0.0)
@@ -435,7 +468,7 @@ GEM
       sprockets (> 3.0)
       sprockets-rails
       tilt
-    scout_apm (2.6.7)
+    scout_apm (2.6.9)
       parser
     scss_lint (0.59.0)
       sass (~> 3.5, >= 3.5.5)
@@ -444,15 +477,18 @@ GEM
       activesupport (>= 4)
     selectize-rails (0.12.6)
     semantic_range (2.3.0)
-    sentry-raven (3.0.0)
+    sentry-raven (3.0.3)
       faraday (>= 1.0)
-    shoulda-matchers (4.3.0)
+    sexp_processor (4.15.1)
+    shoulda-matchers (4.4.1)
       activesupport (>= 4.2.0)
-    sidekiq (6.0.7)
+    sidekiq (6.1.1)
       connection_pool (>= 2.2.2)
       rack (~> 2.0)
-      rack-protection (>= 2.0.0)
-      redis (>= 4.1.0)
+      redis (>= 4.2.0)
+    sidekiq-cron (1.2.0)
+      fugit (~> 1.1)
+      sidekiq (>= 4.2.1)
     signet (0.14.0)
       addressable (~> 2.3)
       faraday (>= 0.17.3, < 2.0)
@@ -463,30 +499,31 @@ GEM
       json (>= 1.8, < 3)
       simplecov-html (~> 0.10.0)
     simplecov-html (0.10.2)
-    slack-ruby-client (0.14.6)
-      activesupport
-      faraday (>= 0.9)
+    slack-ruby-client (0.15.0)
+      faraday (>= 1.0)
       faraday_middleware
       gli
       hashie
       websocket-driver
-    spring (2.1.0)
+    spring (2.1.1)
     spring-watcher-listen (2.0.1)
       listen (>= 2.7, < 4.0)
       spring (>= 1.2, < 3.0)
     sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.2.1)
+    sprockets-rails (3.2.2)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
+    squasher (0.6.2)
+    statsd-ruby (1.4.0)
     telegram-bot-ruby (0.12.0)
       faraday
       inflecto
       virtus
-    telephone_number (1.4.7)
-    thor (1.0.1)
+    telephone_number (1.4.9)
+    thor (1.1.0)
     thread_safe (0.3.6)
     tilt (2.0.10)
     time_diff (0.3.0)
@@ -498,7 +535,7 @@ GEM
       nokogiri (>= 1.6, < 2.0)
     twitty (0.1.1)
       oauth
-    tzinfo (1.2.7)
+    tzinfo (1.2.9)
       thread_safe (~> 0.1)
     tzinfo-data (1.2020.1)
       tzinfo (>= 1.0.0)
@@ -510,7 +547,7 @@ GEM
     unf_ext (0.0.7.7)
     unicode-display_width (1.7.0)
     uniform_notifier (1.13.0)
-    valid_email2 (3.2.2)
+    valid_email2 (3.3.1)
       activemodel (>= 3.2)
       mail (~> 2.5)
     virtus (1.0.5)
@@ -520,7 +557,7 @@ GEM
       equalizer (~> 0.0, >= 0.0.9)
     warden (1.2.8)
       rack (>= 2.0.6)
-    web-console (4.0.3)
+    web-console (4.0.4)
       actionview (>= 6.0.0)
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
@@ -529,7 +566,7 @@ GEM
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webpacker (5.1.1)
+    webpacker (5.2.1)
       activesupport (>= 5.2)
       rack-proxy (>= 0.6.1)
       railties (>= 5.2)
@@ -537,41 +574,48 @@ GEM
     webpush (1.0.0)
       hkdf (~> 0.2)
       jwt (~> 2.0)
-    websocket-driver (0.7.2)
+    websocket-driver (0.7.3)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     wisper (2.0.0)
-    zeitwerk (2.3.0)
+    zeitwerk (2.4.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   action-cable-testing
+  activerecord-import
   acts-as-taggable-on
   administrate
   annotate
   attr_extras
   aws-sdk-s3
   azure-storage-blob
+  barnes
   bootsnap
   brakeman
   browser
   bullet
   bundle-audit
   byebug
+  commonmarker
+  cypress-on-rails (~> 1.0)
+  database_cleaner
   devise
   devise_token_auth
   dotenv-rails
-  facebook-messenger
+  facebook-messenger (= 1.5.0)
   factory_bot_rails
   faker
   fcm
   flag_shih_tzu
   foreman
+  geocoder
   google-cloud-storage
   groupdate
   haikunator
+  hairtrigger
   hashie
   jbuilder
   json_refs!
@@ -579,7 +623,9 @@ DEPENDENCIES
   kaminari
   koala
   letter_opener
+  liquid
   listen
+  maxminddb
   mini_magick
   mock_redis!
   pg
@@ -604,10 +650,12 @@ DEPENDENCIES
   sentry-raven
   shoulda-matchers
   sidekiq
+  sidekiq-cron
   simplecov (= 0.17.1)
   slack-ruby-client
   spring
   spring-watcher-listen
+  squasher
   telegram-bot-ruby
   telephone_number
   time_diff
@@ -618,12 +666,12 @@ DEPENDENCIES
   valid_email2
   web-console
   webmock
-  webpacker
+  webpacker (~> 5.x)
   webpush
   wisper (= 2.0.0)
 
 RUBY VERSION
-   ruby 2.7.1p83
+   ruby 2.7.2p137
 
 BUNDLED WITH
    2.1.4

LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2017-2020 ThoughtWoot Inc.
+Copyright (c) 2017-2021 Chatwoot Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Procfile

@@ -1,3 +1,3 @@
-release: bundle exec rails db:prepare
+release: bundle exec rails db:chatwoot_prepare
 web: bin/rails server -p $PORT -e $RAILS_ENV
 worker: bundle exec sidekiq -C config/sidekiq.yml

Procfile.test

@@ -0,0 +1,3 @@
+backend: RAILS_ENV=test bin/rails s -p 5050
+frontend: bin/webpack-dev-server
+worker: RAILS_ENV=test bundle exec sidekiq -C config/sidekiq.yml

README.md

@@ -1,8 +1,7 @@
 <p align="center">
-  <img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/brand.svg" alt="Woot-logo" width="240">
+  <img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/brand.svg" alt="Woot-logo" width="240" />
 
-  <div align="center">A simple and elegant live chat software</div>
-  <div align="center">An opensource alternative to Intercom, Zendesk, Drift, Crisp etc.</div>
+  <p align="center">Customer engagement suite, an open-source alternative to Intercom, Zendesk, Salesforce Service Cloud etc.</p>
 </p>
 
 <p align="center">
@@ -16,51 +15,88 @@ ___
 <p align="center">
   <a href="https://codeclimate.com/github/chatwoot/chatwoot/maintainability"><img src="https://api.codeclimate.com/v1/badges/80f9e1a7c72d186289ad/maintainability" alt="Maintainability"></a>
   <img src="https://img.shields.io/circleci/build/github/chatwoot/chatwoot" alt="CircleCI Badge">
+    <a href="https://hub.docker.com/r/chatwoot/chatwoot/"><img src="https://img.shields.io/docker/pulls/chatwoot/chatwoot" alt="Docker Pull Badge"></a>
   <a href="https://hub.docker.com/r/chatwoot/chatwoot/"><img src="https://img.shields.io/docker/cloud/build/chatwoot/chatwoot" alt="Docker Build Badge"></a>
   <img src="https://img.shields.io/github/license/chatwoot/chatwoot" alt="License">
   <img src="https://img.shields.io/github/commit-activity/m/chatwoot/chatwoot" alt="Commits-per-month">
   <a title="Crowdin" target="_self" href="https://chatwoot.crowdin.com/chatwoot"><img src="https://badges.crowdin.net/e/37ced7eba411064bd792feb3b7a28b16/localized.svg"></a>
   <a href="https://discord.gg/cJXdrwS"><img src="https://img.shields.io/discord/647412545203994635" alt="Discord"></a>
+  <a href="https://huntr.dev/bounties/disclose"><img src="https://cdn.huntr.dev/huntr_security_badge_mono.svg" alt="Huntr"></a>
 </p>
 
-![ChatUI progess](https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/chatwoot-dashboard-assets.png)
+<img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/chatwoot-dashboard-assets.png" width="100%" alt="Chat dashboard"/>
 
-## Background
+Chatwoot is an open-source omnichannel customer support software. The development of Chatwoot started in 2016. It failed to succeed as a business and eventually shut up shop in 2017. During 2019 #Hacktoberfest, the maintainers decided to make it open-source, instead of letting the code rust in a private repo. With a pleasant surprise, Chatwoot became a trending project on Hacker News and best of all, got lots of love from the community.
+Now, a failed project is back on track and the prospects are looking great. The team is back to working on the project and this time, we are building it in the open. Thanks to the ideas and contributions from the community.
 
-Chatwoot is a customer support tool for instant messaging channels which can help businesses to provide exceptional customer support. The development of Chatwoot started in 2016 and it failed to succeed as a business and eventually shut the shop in 2017. During 2019 #Hacktoberfest, the maintainers decided to make it opensource instead of letting the code rust in a private repo. With a pleasant surprise, Chatwoot became a trending project on Hacker News and best of all, got lots of love from the community.
+---
 
-Now, a failed project is back on track and the prospects are looking great. The team is back to working on the project and we are building it in the open. Thanks to the ideas and contributions from the community.
+### Features
 
-## Documentation
+Chatwoot gives an integrated view of conversations happening in different communication channels.
 
-Detailed documentation is available at [www.chatwoot.com/docs](https://www.chatwoot.com/docs).
+It supports the following conversation channels:
 
-You can find the quick setup docs [here](https://www.chatwoot.com/docs/quick-setup).
+ - **Website**: Talk to your customers using our live chat widget and make use of our SDK to identify a user and provide contextual support.
+ - **Facebook**: Connect your Facebook pages and start replying to the direct messages to your page.
+ - **Twitter**: Connect your Twitter profiles and reply to direct messages or the tweets where you are mentioned.
+ - **Whatsapp**: Connect your Whatsapp business account and manage the conversation in Chatwoot
+ - **SMS**: Connect your Twilio SMS account and reply to the SMS queries in Chatwoot
+ - **API Channel**: Build custom communication channels using our API channel.
+ - **Email (beta)**: Forward all your email queries to Chatwoot and view it in our integrated dashboard.
 
-## Branching model
+Other features include:
 
-We use [git-flow](https://nvie.com/posts/a-successful-git-branching-model/) branching model. The base branch is `develop`.
-If you are looking for a stable version, please use the `master` or tags labelled as `v1.x.x`. 
+- **Multi-brand inboxes**: Manage multiple brands or pages using a single dashboard.
+- **Private notes**: Inter team communication is possible using private notes in a conversation.
+- **Canned responses (Saved replies)**: Improve the response rate by adding saved replies for frequently asked questions.
+- **Conversation Labels**: Use conversation labelling to create custom workflows.
+- **Auto assignment**: Chatwoot intelligently assigns a ticket to the agents who have access to the inbox depending on their availability and load.
+- **Conversation continuity**: If the user has provided an email address through the chat widget, Chatwoot would send an email to the customer under the agent name so that the user can continue the conversation over the email.
+- **Multi-lingual support**: Chatwoot supports 10+ languages.
+- **Powerful API & Webhooks**: Extend the capability of the software using Chatwoot’s webhooks and APIs.
+- **Integrations**: Chatwoot natively integrates with Slack right now. Manage your conversations in Slack without logging into the dashboard.
 
-## Heroku one-click deploy
+---
 
-Deploying chatwoot to heroku, it's a breeze. It's as simple as clicking this button.
+### Documentation
+
+Detailed documentation is available at [www.chatwoot.com/help-center](https://www.chatwoot.com/help-center).
+
+### Translation process
+
+The translation process for Chatwoot web and mobile app is managed at [https://translate.chatwoot.com](https://translate.chatwoot.com) using Crowdin. Please read the [translation guide](https://www.chatwoot.com/docs/contributing/translating-chatwoot-to-your-language) for contributing to Chatwoot.
+
+---
+
+### Branching model
+
+We use the [git-flow](https://nvie.com/posts/a-successful-git-branching-model/) branching model. The base branch is `develop`.
+If you are looking for a stable version, please use the `master` or tags labelled as `v1.x.x`.
+
+---
+
+### Deployment
+
+#### Heroku one-click deploy
+
+Deploying Chatwoot to Heroku is a breeze. It's as simple as clicking this button:
 
 [![Deploy](https://www.herokucdn.com/deploy/button.svg)](https://heroku.com/deploy?template=https://github.com/chatwoot/chatwoot/tree/master)
 
-Follow this [link](https://www.chatwoot.com/docs/environment-variables) to understand setting the correct environment variables for the app to work with all the features. There might be breakages if you do not set the relevant environment variables. This applies to deploying the docker image as well.
+Follow this [link](https://www.chatwoot.com/docs/environment-variables) to understand setting the correct environment variables for the app to work with all the features. There might be breakages if you do not set the relevant environment variables.
 
-## Docker
+#### Other deployment options
 
-Follow our [docker development guide](https://www.chatwoot.com/docs/installation-guide-docker) to develop and debug the application using `docker-compose`.
+Please follow [deployment architecture guide](https://www.chatwoot.com/docs/deployment/architecture) to deploy with Docker or Caprover.
 
-Follow our [environment variables](https://www.chatwoot.com/docs/environment-variables/) guide to setup environment for Docker.
+---
 
-## Contributors ✨
+### Contributors ✨
 
 Thanks goes to all these [wonderful people](https://www.chatwoot.com/docs/contributors):
 
 <a href="https://github.com/chatwoot/chatwoot/graphs/contributors"><img src="https://opencollective.com/chatwoot/contributors.svg?width=890&button=false" /></a>
 
 
-*Chatwoot* &copy; 2017-2020, ThoughtWoot Inc - Released under the MIT License.
+*Chatwoot* &copy; 2017-2021, Chatwoot Inc - Released under the MIT License.

app.json

@@ -11,7 +11,7 @@
     "rails",
     "vue"
   ],
-  "success_url": "/app/login",
+  "success_url": "/",
   "env": {
     "SECRET_TOKEN": {
       "description": "A secret key for verifying the integrity of signed cookies.",
@@ -34,6 +34,10 @@
     "web": {
       "quantity": 1,
       "size": "FREE"
+    },
+    "worker": {
+      "quantity": 1,
+      "size": "FREE"
     }
   },
   "image": "heroku/ruby",

app/actions/contact_identify_action.rb

@@ -33,7 +33,10 @@ class ContactIdentifyAction
   end
 
   def update_contact
-    @contact.update!(params.slice(:name, :email, :identifier))
+    custom_attributes = params[:custom_attributes] ? @contact.custom_attributes.merge(params[:custom_attributes]) : @contact.custom_attributes
+    # blank identifier or email will throw unique index error
+    # TODO: replace reject { |_k, v| v.blank? } with compact_blank when rails is upgraded
+    @contact.update!(params.slice(:name, :email, :identifier).reject { |_k, v| v.blank? }.merge({ custom_attributes: custom_attributes }))
     ContactAvatarJob.perform_later(@contact, params[:avatar_url]) if params[:avatar_url].present?
   end
 

app/assets/stylesheets/administrate/components/_navigation.scss

@@ -1,6 +1,6 @@
 .logo-brand {
   margin-bottom: $space-normal;
-  padding: $space-normal $space-smaller;
+  padding: $space-normal $space-smaller $space-small;
   text-align: center;
 }
 
@@ -70,3 +70,9 @@
   left: $space-normal;
   position: fixed;
 }
+
+.app-version {
+  color: $color-gray;
+  font-size: $font-size-small;
+  padding-top: $space-smaller;
+}

app/assets/stylesheets/administrate/reset/_normalize.scss

@@ -13,6 +13,7 @@ html {
   line-height: 1.15; /* 1 */
   -ms-text-size-adjust: 100%; /* 2 */
   -webkit-text-size-adjust: 100%; /* 2 */
+  -moz-osx-font-smoothing: grayscale;
 }
 
 /* Sections

app/assets/stylesheets/administrate/utilities/_variables.scss

@@ -55,7 +55,7 @@ $color-heading: #1f2d3d;
 $color-extra-light-blue: #f5f7f9;
 
 $primary-color: $color-woot;
-$secondary-color: #35c5ff;
+$secondary-color: #5d7592;
 $success-color: #44ce4b;
 $warning-color: #ffc532;
 $alert-color: #ff382d;

app/bot/facebook_bot.rb

@@ -19,4 +19,10 @@ class FacebookBot
     updater.perform
     Rails.logger.info "Human was online at #{delivery.at}"
   end
+
+  Bot.on :message_echo do |message|
+    Rails.logger.info "MESSAGE_ECHO #{message}"
+    response = ::Integrations::Facebook::MessageParser.new(message)
+    ::Integrations::Facebook::MessageCreator.new(response).perform
+  end
 end

app/builders/account_builder.rb

@@ -2,17 +2,19 @@
 
 class AccountBuilder
   include CustomExceptions::Account
-  pattr_initialize [:account_name!, :email!, :confirmed!]
+  pattr_initialize [:account_name!, :email!, :confirmed!, :user, :user_full_name, :user_password]
 
   def perform
-    validate_email
-    validate_user
+    if @user.nil?
+      validate_email
+      validate_user
+    end
     ActiveRecord::Base.transaction do
       @account = create_account
       @user = create_and_link_user
     end
+    [@user, @account]
   rescue StandardError => e
-    @account&.destroy
     puts e.inspect
     raise e
   end
@@ -24,7 +26,7 @@ class AccountBuilder
     if address.valid? # && !address.disposable?
       true
     else
-      raise InvalidEmail.new(valid: address.valid?) # , disposable: address.disposable?})
+      raise InvalidEmail.new(valid: address.valid?)
     end
   end
 
@@ -37,18 +39,12 @@ class AccountBuilder
   end
 
   def create_account
-    @account = Account.create!(name: @account_name)
+    @account = Account.create!(name: @account_name, locale: I18n.locale)
     Current.account = @account
   end
 
   def create_and_link_user
-    password = Time.now.to_i
-    @user = User.new(email: @email,
-                     password: password,
-                     password_confirmation: password,
-                     name: email_to_name(@email))
-    @user.confirm if @confirmed
-    if @user.save!
+    if @user.present? || create_user
       link_user_to_account(@user, @account)
       @user
     else
@@ -64,8 +60,14 @@ class AccountBuilder
     )
   end
 
-  def email_to_name(email)
-    name = email[/[^@]+/]
-    name.split('.').map(&:capitalize).join(' ')
+  def create_user
+    password = user_password || SecureRandom.alphanumeric(12)
+
+    @user = User.new(email: @email,
+                     password: password,
+                     password_confirmation: password,
+                     name: @user_full_name)
+    @user.confirm if @confirmed
+    @user.save!
   end
 end

app/builders/contact_builder.rb

@@ -5,7 +5,7 @@ class ContactBuilder
     contact_inbox = inbox.contact_inboxes.find_by(source_id: source_id)
     return contact_inbox if contact_inbox
 
-    build_contact
+    build_contact_inbox
   end
 
   private
@@ -26,16 +26,29 @@ class ContactBuilder
     ::ContactAvatarJob.perform_later(contact, contact_attributes[:avatar_url]) if contact_attributes[:avatar_url]
   end
 
-  def build_contact
-    ActiveRecord::Base.transaction do
-      contact = account.contacts.create!(
-        name: contact_attributes[:name],
-        phone_number: contact_attributes[:phone_number],
-        email: contact_attributes[:email],
-        identifier: contact_attributes[:identifier],
-        additional_attributes: contact_attributes[:additional_attributes]
-      )
+  def create_contact
+    account.contacts.create!(
+      name: contact_attributes[:name],
+      phone_number: contact_attributes[:phone_number],
+      email: contact_attributes[:email],
+      identifier: contact_attributes[:identifier],
+      additional_attributes: contact_attributes[:additional_attributes]
+    )
+  end
 
+  def find_contact
+    contact = nil
+
+    contact = account.contacts.find_by(identifier: contact_attributes[:identifier]) if contact_attributes[:identifier].present?
+
+    contact ||= account.contacts.find_by(email: contact_attributes[:email]) if contact_attributes[:email].present?
+
+    contact
+  end
+
+  def build_contact_inbox
+    ActiveRecord::Base.transaction do
+      contact = find_contact || create_contact
       contact_inbox = create_contact_inbox(contact)
       update_contact_avatar(contact)
       contact_inbox

app/builders/contact_inbox_builder.rb

@@ -0,0 +1,41 @@
+class ContactInboxBuilder
+  pattr_initialize [:contact_id!, :inbox_id!, :source_id]
+
+  def perform
+    @contact = Contact.find(contact_id)
+    @inbox = @contact.account.inboxes.find(inbox_id)
+    return unless ['Channel::TwilioSms', 'Channel::Email', 'Channel::Api'].include? @inbox.channel_type
+
+    source_id = @source_id || generate_source_id
+    create_contact_inbox(source_id) if source_id.present?
+  end
+
+  private
+
+  def generate_source_id
+    return twilio_source_id if @inbox.channel_type == 'Channel::TwilioSms'
+    return @contact.email if @inbox.channel_type == 'Channel::Email'
+    return SecureRandom.uuid if @inbox.channel_type == 'Channel::Api'
+
+    nil
+  end
+
+  def twilio_source_id
+    return unless @contact.phone_number
+
+    case @inbox.channel.medium
+    when 'sms'
+      @contact.phone_number
+    when 'whatsapp'
+      "whatsapp:#{@contact.phone_number}"
+    end
+  end
+
+  def create_contact_inbox(source_id)
+    ::ContactInbox.find_or_create_by!(
+      contact_id: @contact.id,
+      inbox_id: @inbox.id,
+      source_id: source_id
+    )
+  end
+end

app/builders/messages/facebook/message_builder.rb

@@ -0,0 +1,142 @@
+# This class creates both outgoing messages from chatwoot and echo outgoing messages based on the flag `outgoing_echo`
+# Assumptions
+# 1. Incase of an outgoing message which is echo, source_id will NOT be nil,
+#    based on this we are showing "not sent from chatwoot" message in frontend
+#    Hence there is no need to set user_id in message for outgoing echo messages.
+
+class Messages::Facebook::MessageBuilder
+  attr_reader :response
+
+  def initialize(response, inbox, outgoing_echo: false)
+    @response = response
+    @inbox = inbox
+    @outgoing_echo = outgoing_echo
+    @sender_id = (@outgoing_echo ? @response.recipient_id : @response.sender_id)
+    @message_type = (@outgoing_echo ? :outgoing : :incoming)
+  end
+
+  def perform
+    ActiveRecord::Base.transaction do
+      build_contact
+      build_message
+    end
+  rescue StandardError => e
+    Raven.capture_exception(e)
+    true
+  end
+
+  private
+
+  def contact
+    @contact ||= @inbox.contact_inboxes.find_by(source_id: @sender_id)&.contact
+  end
+
+  def build_contact
+    return if contact.present?
+
+    @contact = Contact.create!(contact_params.except(:remote_avatar_url))
+    ContactAvatarJob.perform_later(@contact, contact_params[:remote_avatar_url]) if contact_params[:remote_avatar_url]
+    @contact_inbox = ContactInbox.create(contact: contact, inbox: @inbox, source_id: @sender_id)
+  end
+
+  def build_message
+    @message = conversation.messages.create!(message_params)
+    (response.attachments || []).each do |attachment|
+      attachment_obj = @message.attachments.new(attachment_params(attachment).except(:remote_file_url))
+      attachment_obj.save!
+      attach_file(attachment_obj, attachment_params(attachment)[:remote_file_url]) if attachment_params(attachment)[:remote_file_url]
+    end
+  end
+
+  def attach_file(attachment, file_url)
+    file_resource = LocalResource.new(file_url)
+    attachment.file.attach(io: file_resource.file, filename: file_resource.filename, content_type: file_resource.encoding)
+  rescue *ExceptionList::URI_EXCEPTIONS => e
+    Rails.logger.info "invalid url #{file_url} : #{e.message}"
+  end
+
+  def conversation
+    @conversation ||= Conversation.find_by(conversation_params) || build_conversation
+  end
+
+  def build_conversation
+    @contact_inbox ||= contact.contact_inboxes.find_by!(source_id: @sender_id)
+    Conversation.create!(conversation_params.merge(
+                           contact_inbox_id: @contact_inbox.id
+                         ))
+  end
+
+  def attachment_params(attachment)
+    file_type = attachment['type'].to_sym
+    params = { file_type: file_type, account_id: @message.account_id }
+
+    if [:image, :file, :audio, :video].include? file_type
+      params.merge!(file_type_params(attachment))
+    elsif file_type == :location
+      params.merge!(location_params(attachment))
+    elsif file_type == :fallback
+      params.merge!(fallback_params(attachment))
+    end
+
+    params
+  end
+
+  def file_type_params(attachment)
+    {
+      external_url: attachment['payload']['url'],
+      remote_file_url: attachment['payload']['url']
+    }
+  end
+
+  def location_params(attachment)
+    lat = attachment['payload']['coordinates']['lat']
+    long = attachment['payload']['coordinates']['long']
+    {
+      external_url: attachment['url'],
+      coordinates_lat: lat,
+      coordinates_long: long,
+      fallback_title: attachment['title']
+    }
+  end
+
+  def fallback_params(attachment)
+    {
+      fallback_title: attachment['title'],
+      external_url: attachment['url']
+    }
+  end
+
+  def conversation_params
+    {
+      account_id: @inbox.account_id,
+      inbox_id: @inbox.id,
+      contact_id: contact.id
+    }
+  end
+
+  def message_params
+    {
+      account_id: conversation.account_id,
+      inbox_id: conversation.inbox_id,
+      message_type: @message_type,
+      content: response.content,
+      source_id: response.identifier,
+      sender: @outgoing_echo ? nil : contact
+    }
+  end
+
+  def contact_params
+    begin
+      k = Koala::Facebook::API.new(@inbox.channel.page_access_token) if @inbox.facebook?
+      result = k.get_object(@sender_id) || {}
+    rescue StandardError => e
+      result = {}
+      Raven.capture_exception(e)
+    end
+    {
+      name: "#{result['first_name'] || 'John'} #{result['last_name'] || 'Doe'}",
+      account_id: @inbox.account_id,
+      remote_avatar_url: result['profile_pic'] || ''
+    }
+  end
+end

app/builders/messages/incoming_message_builder.rb

@@ -1,2 +0,0 @@
-class Messages::IncomingMessageBuilder < Messages::MessageBuilder
-end

app/builders/messages/message_builder.rb

@@ -1,139 +1,59 @@
-# This class creates both outgoing messages from chatwoot and echo outgoing messages based on the flag `outgoing_echo`
-# Assumptions
-# 1. Incase of an outgoing message which is echo, source_id will NOT be nil,
-#    based on this we are showing "not sent from chatwoot" message in frontend
-#    Hence there is no need to set user_id in message for outgoing echo messages.
-
 class Messages::MessageBuilder
-  attr_reader :response
+  include ::FileTypeHelper
+  attr_reader :message
 
-  def initialize(response, inbox, outgoing_echo = false)
-    @response = response
-    @inbox = inbox
-    @sender_id = (outgoing_echo ? @response.recipient_id : @response.sender_id)
-    @message_type = (outgoing_echo ? :outgoing : :incoming)
+  def initialize(user, conversation, params)
+    @params = params
+    @private = params[:private] || false
+    @conversation = conversation
+    @user = user
+    @message_type = params[:message_type] || 'outgoing'
+    @items = params.to_unsafe_h&.dig(:content_attributes, :items)
+    @attachments = params[:attachments]
+    @in_reply_to = params.to_unsafe_h&.dig(:content_attributes, :in_reply_to)
   end
 
   def perform
-    ActiveRecord::Base.transaction do
-      build_contact
-      build_message
+    @message = @conversation.messages.build(message_params)
+    if @attachments.present?
+      @attachments.each do |uploaded_attachment|
+        attachment = @message.attachments.new(
+          account_id: @message.account_id,
+          file_type: file_type(uploaded_attachment&.content_type)
+        )
+        attachment.file.attach(uploaded_attachment)
+      end
     end
-  rescue StandardError => e
-    Raven.capture_exception(e)
-    true
+    @message.save
+    @message
   end
 
   private
 
-  def contact
-    @contact ||= @inbox.contact_inboxes.find_by(source_id: @sender_id)&.contact
-  end
-
-  def build_contact
-    return if contact.present?
-
-    @contact = Contact.create!(contact_params.except(:remote_avatar_url))
-    ContactAvatarJob.perform_later(@contact, contact_params[:remote_avatar_url]) if contact_params[:remote_avatar_url]
-    @contact_inbox = ContactInbox.create(contact: contact, inbox: @inbox, source_id: @sender_id)
-  end
-
-  def build_message
-    @message = conversation.messages.create!(message_params)
-    (response.attachments || []).each do |attachment|
-      attachment_obj = @message.attachments.new(attachment_params(attachment).except(:remote_file_url))
-      attachment_obj.save!
-      attach_file(attachment_obj, attachment_params(attachment)[:remote_file_url]) if attachment_params(attachment)[:remote_file_url]
-    end
-  end
-
-  def attach_file(attachment, file_url)
-    file_resource = LocalResource.new(file_url)
-    attachment.file.attach(io: file_resource.file, filename: file_resource.tmp_filename, content_type: file_resource.encoding)
-  end
-
-  def conversation
-    @conversation ||= Conversation.find_by(conversation_params) || build_conversation
-  end
-
-  def build_conversation
-    @contact_inbox ||= contact.contact_inboxes.find_by!(source_id: @sender_id)
-    Conversation.create!(conversation_params.merge(
-                           contact_inbox_id: @contact_inbox.id
-                         ))
-  end
-
-  def attachment_params(attachment)
-    file_type = attachment['type'].to_sym
-    params = { file_type: file_type, account_id: @message.account_id }
-
-    if [:image, :file, :audio, :video].include? file_type
-      params.merge!(file_type_params(attachment))
-    elsif file_type == :location
-      params.merge!(location_params(attachment))
-    elsif file_type == :fallback
-      params.merge!(fallback_params(attachment))
+  def message_type
+    if @conversation.inbox.channel_type != 'Channel::Api' && @message_type == 'incoming'
+      raise StandardError, 'Incoming messages are only allowed in Api inboxes'
     end
 
-    params
+    @message_type
   end
 
-  def file_type_params(attachment)
-    {
-      external_url: attachment['payload']['url'],
-      remote_file_url: attachment['payload']['url']
-    }
-  end
-
-  def location_params(attachment)
-    lat = attachment['payload']['coordinates']['lat']
-    long = attachment['payload']['coordinates']['long']
-    {
-      external_url: attachment['url'],
-      coordinates_lat: lat,
-      coordinates_long: long,
-      fallback_title: attachment['title']
-    }
-  end
-
-  def fallback_params(attachment)
-    {
-      fallback_title: attachment['title'],
-      external_url: attachment['url']
-    }
-  end
-
-  def conversation_params
-    {
-      account_id: @inbox.account_id,
-      inbox_id: @inbox.id,
-      contact_id: contact.id
-    }
+  def sender
+    message_type == 'outgoing' ? @user : @conversation.contact
   end
 
   def message_params
     {
-      account_id: conversation.account_id,
-      inbox_id: conversation.inbox_id,
-      message_type: @message_type,
-      content: response.content,
-      source_id: response.identifier,
-      sender: contact
-    }
-  end
-
-  def contact_params
-    begin
-      k = Koala::Facebook::API.new(@inbox.channel.page_access_token) if @inbox.facebook?
-      result = k.get_object(@sender_id) || {}
-    rescue Exception => e
-      result = {}
-      Raven.capture_exception(e)
-    end
-    {
-      name: "#{result['first_name'] || 'John'} #{result['last_name'] || 'Doe'}",
-      account_id: @inbox.account_id,
-      remote_avatar_url: result['profile_pic'] || ''
+      account_id: @conversation.account_id,
+      inbox_id: @conversation.inbox_id,
+      message_type: message_type,
+      content: @params[:content],
+      private: @private,
+      sender: sender,
+      content_type: @params[:content_type],
+      items: @items,
+      in_reply_to: @in_reply_to,
+      echo_id: @params[:echo_id]
     }
   end
 end

app/builders/messages/outgoing/echo_builder.rb

@@ -1,2 +0,0 @@
-class Messages::Outgoing::EchoBuilder < ::Messages::MessageBuilder
-end

app/builders/messages/outgoing/normal_builder.rb

@@ -1,46 +0,0 @@
-class Messages::Outgoing::NormalBuilder
-  include ::FileTypeHelper
-  attr_reader :message
-
-  def initialize(user, conversation, params)
-    @content = params[:content]
-    @private = params[:private] || false
-    @conversation = conversation
-    @user = user
-    @fb_id = params[:fb_id]
-    @content_type = params[:content_type]
-    @items = params.to_unsafe_h&.dig(:content_attributes, :items)
-    @attachments = params[:attachments]
-  end
-
-  def perform
-    @message = @conversation.messages.build(message_params)
-    if @attachments.present?
-      @attachments.each do |uploaded_attachment|
-        attachment = @message.attachments.new(
-          account_id: @message.account_id,
-          file_type: file_type(uploaded_attachment&.content_type)
-        )
-        attachment.file.attach(uploaded_attachment)
-      end
-    end
-    @message.save
-    @message
-  end
-
-  private
-
-  def message_params
-    {
-      account_id: @conversation.account_id,
-      inbox_id: @conversation.inbox_id,
-      message_type: :outgoing,
-      content: @content,
-      private: @private,
-      sender: @user,
-      source_id: @fb_id,
-      content_type: @content_type,
-      items: @items
-    }
-  end
-end

app/controllers/api/base_controller.rb

@@ -10,4 +10,10 @@ class Api::BaseController < ApplicationController
   def authenticate_by_access_token?
     request.headers[:api_access_token].present? || request.headers[:HTTP_API_ACCESS_TOKEN].present?
   end
+
+  def check_authorization(model = nil)
+    model ||= controller_name.classify.constantize
+
+    authorize(model)
+  end
 end

app/controllers/api/v1/accounts/agents_controller.rb

@@ -27,7 +27,7 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
   private
 
   def check_authorization
-    authorize(User)
+    super(User)
   end
 
   def fetch_agent
@@ -64,6 +64,6 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
   end
 
   def agents
-    @agents ||= Current.account.users
+    @agents ||= Current.account.users.order_by_full_name.includes({ avatar_attachment: [:blob] })
   end
 end

app/controllers/api/v1/accounts/base_controller.rb

@@ -1,5 +1,7 @@
 class Api::V1::Accounts::BaseController < Api::BaseController
+  include SwitchLocale
   before_action :current_account
+  around_action :switch_locale_using_account_locale
 
   private
 
@@ -15,7 +17,6 @@ class Api::V1::Accounts::BaseController < Api::BaseController
     elsif @resource&.is_a?(AgentBot)
       account_accessible_for_bot?(account)
     end
-    switch_locale account
     account
   end
 

app/controllers/api/v1/accounts/callbacks_controller.rb

@@ -30,7 +30,7 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
 
       if (page_detail = (page_details || []).detect { |page| fb_page_id == page['id'] })
         update_fb_page(fb_page_id, page_detail['access_token'])
-        return head :ok
+        render and return
       end
     end
 
@@ -44,9 +44,9 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
   end
 
   def update_fb_page(fb_page_id, access_token)
-    get_fb_page(fb_page_id)&.update!(
-      user_access_token: @user_access_token, page_access_token: access_token
-    )
+    fb_page = get_fb_page(fb_page_id)
+    fb_page&.update!(user_access_token: @user_access_token, page_access_token: access_token)
+    fb_page&.reauthorized!
   end
 
   def get_fb_page(fb_page_id)
@@ -81,6 +81,8 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
 
     avatar_resource = LocalResource.new(uri)
     facebook_inbox.avatar.attach(io: avatar_resource.file, filename: avatar_resource.tmp_filename, content_type: avatar_resource.encoding)
+  rescue *ExceptionList::URI_EXCEPTIONS => e
+    Rails.logger.info "invalid url #{file_url} : #{e.message}"
   end
 
   def get_avatar_url(page_id)

app/controllers/api/v1/accounts/contacts/contact_inboxes_controller.rb

@@ -0,0 +1,19 @@
+class Api::V1::Accounts::Contacts::ContactInboxesController < Api::V1::Accounts::BaseController
+  before_action :ensure_contact
+  before_action :ensure_inbox, only: [:create]
+
+  def create
+    source_id = params[:source_id] || SecureRandom.uuid
+    @contact_inbox = ContactInbox.create!(contact: @contact, inbox: @inbox, source_id: source_id)
+  end
+
+  private
+
+  def ensure_inbox
+    @inbox = Current.account.inboxes.find(params[:inbox_id])
+  end
+
+  def ensure_contact
+    @contact = Current.account.contacts.find(params[:contact_id])
+  end
+end

app/controllers/api/v1/accounts/contacts/conversations_controller.rb

@@ -1,17 +1,17 @@
 class Api::V1::Accounts::Contacts::ConversationsController < Api::V1::Accounts::BaseController
   def index
     @conversations = Current.account.conversations.includes(
-      :assignee, :contact, :inbox
+      :assignee, :contact, :inbox, :taggings
     ).where(inbox_id: inbox_ids, contact_id: permitted_params[:contact_id])
   end
 
   private
 
   def inbox_ids
-    if current_user.administrator?
+    if Current.user.administrator?
       Current.account.inboxes.pluck(:id)
-    elsif current_user.agent?
-      current_user.assigned_inboxes.pluck(:id)
+    elsif Current.user.agent?
+      Current.user.assigned_inboxes.pluck(:id)
     else
       []
     end

app/controllers/api/v1/accounts/contacts/labels_controller.rb

@@ -0,0 +1,13 @@
+class Api::V1::Accounts::Contacts::LabelsController < Api::V1::Accounts::BaseController
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= Current.account.contacts.find(permitted_params[:contact_id])
+  end
+
+  def permitted_params
+    params.permit(:contact_id, labels: [])
+  end
+end

app/controllers/api/v1/accounts/contacts_controller.rb

@@ -1,40 +1,112 @@
 class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
+  RESULTS_PER_PAGE = 15
   protect_from_forgery with: :null_session
 
   before_action :check_authorization
-  before_action :fetch_contact, only: [:show, :update]
+  before_action :set_current_page, only: [:index, :active, :search]
+  before_action :fetch_contact, only: [:show, :update, :contactable_inboxes]
 
   def index
-    @contacts = Current.account.contacts
+    @contacts_count = resolved_contacts.count
+    @contacts = fetch_contact_last_seen_at(resolved_contacts)
+  end
+
+  def search
+    render json: { error: 'Specify search string with parameter q' }, status: :unprocessable_entity if params[:q].blank? && return
+
+    contacts = resolved_contacts.where(
+      'name ILIKE :search OR email ILIKE :search OR phone_number ILIKE :search',
+      search: "%#{params[:q]}%"
+    )
+    @contacts_count = contacts.count
+    @contacts = fetch_contact_last_seen_at(contacts)
+  end
+
+  def import
+    ActiveRecord::Base.transaction do
+      import = Current.account.data_imports.create!(data_type: 'contacts')
+      import.import_file.attach(params[:import_file])
+    end
+    head :ok
+  end
+
+  # returns online contacts
+  def active
+    contacts = Current.account.contacts.where(id: ::OnlineStatusTracker
+                  .get_available_contact_ids(Current.account.id))
+    @contacts_count = contacts.count
+    @contacts = contacts.page(@current_page)
   end
 
   def show; end
 
+  def contactable_inboxes
+    @contactable_inboxes = Contacts::ContactableInboxesService.new(contact: @contact).get
+  end
+
   def create
-    @contact = Current.account.contacts.new(contact_create_params)
-    @contact.save!
-    render json: @contact
+    ActiveRecord::Base.transaction do
+      @contact = Current.account.contacts.new(contact_params)
+      @contact.save!
+      @contact_inbox = build_contact_inbox
+    end
   end
 
   def update
-    @contact.update!(contact_params)
+    @contact.assign_attributes(contact_update_params)
+    @contact.save!
+  rescue ActiveRecord::RecordInvalid => e
+    render json: {
+      message: e.record.errors.full_messages.join(', '),
+      contact: Current.account.contacts.find_by(email: contact_params[:email])
+    }, status: :unprocessable_entity
   end
 
   private
 
-  def check_authorization
-    authorize(Contact)
+  def resolved_contacts
+    @resolved_contacts ||= Current.account.contacts
+                                  .where.not(email: [nil, ''])
+                                  .or(Current.account.contacts.where.not(phone_number: [nil, '']))
+                                  .order('LOWER(name)')
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def fetch_contact_last_seen_at(contacts)
+    contacts.left_outer_joins(:conversations)
+            .select('contacts.*, COUNT(conversations.id) as conversations_count, MAX(conversations.contact_last_seen_at) as last_seen_at')
+            .group('contacts.id')
+            .includes([{ avatar_attachment: [:blob] }, { contact_inboxes: [:inbox] }])
+            .page(@current_page).per(RESULTS_PER_PAGE)
+  end
+
+  def build_contact_inbox
+    return if params[:inbox_id].blank?
+
+    inbox = Current.account.inboxes.find(params[:inbox_id])
+    source_id = params[:source_id] || SecureRandom.uuid
+    ContactInbox.create(contact: @contact, inbox: inbox, source_id: source_id)
   end
 
   def contact_params
-    params.require(:contact).permit(:name, :email, :phone_number)
+    params.require(:contact).permit(:name, :email, :phone_number, additional_attributes: {}, custom_attributes: {})
+  end
+
+  def contact_custom_attributes
+    return @contact.custom_attributes.merge(contact_params[:custom_attributes]) if contact_params[:custom_attributes]
+
+    @contact.custom_attributes
+  end
+
+  def contact_update_params
+    # we want the merged custom attributes not the original one
+    contact_params.except(:custom_attributes).merge({ custom_attributes: contact_custom_attributes })
   end
 
   def fetch_contact
-    @contact = Current.account.contacts.find(params[:id])
-  end
-
-  def contact_create_params
-    params.require(:contact).permit(:name, :email, :phone_number)
+    @contact = Current.account.contacts.includes(contact_inboxes: [:inbox]).find(params[:id])
   end
 end

app/controllers/api/v1/accounts/conversations/assignments_controller.rb

@@ -1,9 +1,20 @@
 class Api::V1::Accounts::Conversations::AssignmentsController < Api::V1::Accounts::Conversations::BaseController
-  # assign agent to a conversation
+  # assigns agent/team to a conversation
   def create
+    set_assignee
+    render json: @assignee
+  end
+
+  private
+
+  def set_assignee
     # if params[:assignee_id] is not a valid id, it will set to nil, hence unassigning the conversation
-    assignee = Current.account.users.find_by(id: params[:assignee_id])
-    @conversation.update_assignee(assignee)
-    render json: assignee
+    if params.key?(:assignee_id)
+      @assignee = Current.account.users.find_by(id: params[:assignee_id])
+      @conversation.update_assignee(@assignee)
+    elsif params.key?(:team_id)
+      @assignee = Current.account.teams.find_by(id: params[:team_id])
+      @conversation.update!(team: @assignee)
+    end
   end
 end

app/controllers/api/v1/accounts/conversations/labels_controller.rb

@@ -1,11 +1,13 @@
 class Api::V1::Accounts::Conversations::LabelsController < Api::V1::Accounts::Conversations::BaseController
-  def create
-    @conversation.update_labels(params[:labels])
-    @labels = @conversation.label_list
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= @conversation
   end
 
-  # all labels of the current conversation
-  def index
-    @labels = @conversation.label_list
+  def permitted_params
+    params.permit(:conversation_id, labels: [])
   end
 end

app/controllers/api/v1/accounts/conversations/messages_controller.rb

@@ -4,14 +4,31 @@ class Api::V1::Accounts::Conversations::MessagesController < Api::V1::Accounts::
   end
 
   def create
-    user = current_user || @resource
-    mb = Messages::Outgoing::NormalBuilder.new(user, @conversation, params)
+    user = Current.user || @resource
+    mb = Messages::MessageBuilder.new(user, @conversation, params)
     @message = mb.perform
+  rescue StandardError => e
+    render_could_not_create_error(e.message)
+  end
+
+  def destroy
+    ActiveRecord::Base.transaction do
+      message.update!(content: I18n.t('conversations.messages.deleted'), deleted: true)
+      message.attachments.destroy_all
+    end
   end
 
   private
 
+  def message
+    @message ||= @conversation.messages.find(permitted_params[:id])
+  end
+
   def message_finder
     @message_finder ||= MessageFinder.new(@conversation, params)
   end
+
+  def permitted_params
+    params.permit(:id)
+  end
 end

app/controllers/api/v1/accounts/conversations_controller.rb

@@ -1,5 +1,6 @@
 class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseController
   include Events::Types
+
   before_action :conversation, except: [:index]
   before_action :contact_inbox, only: [:create]
 
@@ -14,8 +15,17 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
     @conversations_count = result[:count]
   end
 
+  def search
+    result = conversation_finder.perform
+    @conversations = result[:conversations]
+    @conversations_count = result[:count]
+  end
+
   def create
-    @conversation = ::Conversation.create!(conversation_params)
+    ActiveRecord::Base.transaction do
+      @conversation = ::Conversation.create!(conversation_params)
+      Messages::MessageBuilder.new(Current.user, @conversation, params[:message]).perform if params[:message].present?
+    end
   end
 
   def show; end
@@ -25,6 +35,16 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
     head :ok
   end
 
+  def unmute
+    @conversation.unmute!
+    head :ok
+  end
+
+  def transcript
+    ConversationReplyMailer.conversation_transcript(@conversation, params[:email])&.deliver_later if params[:email].present?
+    head :ok
+  end
+
   def toggle_status
     if params[:status]
       @conversation.status = params[:status]
@@ -35,18 +55,18 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
   end
 
   def toggle_typing_status
-    if params[:typing_status] == 'on'
+    case params[:typing_status]
+    when 'on'
       trigger_typing_event(CONVERSATION_TYPING_ON)
-    elsif params[:typing_status] == 'off'
+    when 'off'
       trigger_typing_event(CONVERSATION_TYPING_OFF)
     end
     head :ok
   end
 
   def update_last_seen
-    @conversation.agent_last_seen_at = parsed_last_seen_at
+    @conversation.agent_last_seen_at = DateTime.now.utc
     @conversation.save!
-    head :ok
   end
 
   private
@@ -56,24 +76,34 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
     Rails.configuration.dispatcher.dispatch(event, Time.zone.now, conversation: @conversation, user: user)
   end
 
-  def parsed_last_seen_at
-    DateTime.strptime(params[:agent_last_seen_at].to_s, '%s')
-  end
-
   def conversation
     @conversation ||= Current.account.conversations.find_by(display_id: params[:id])
   end
 
   def contact_inbox
+    @contact_inbox = build_contact_inbox
+
     @contact_inbox ||= ::ContactInbox.find_by!(source_id: params[:source_id])
   end
 
+  def build_contact_inbox
+    return if params[:contact_id].blank? || params[:inbox_id].blank?
+
+    ContactInboxBuilder.new(
+      contact_id: params[:contact_id],
+      inbox_id: params[:inbox_id],
+      source_id: params[:source_id]
+    ).perform
+  end
+
   def conversation_params
+    additional_attributes = params[:additional_attributes]&.permit! || {}
     {
       account_id: Current.account.id,
       inbox_id: @contact_inbox.inbox_id,
       contact_id: @contact_inbox.contact_id,
-      contact_inbox_id: @contact_inbox.id
+      contact_inbox_id: @contact_inbox.id,
+      additional_attributes: additional_attributes
     }
   end
 

app/controllers/api/v1/accounts/inbox_members_controller.rb

@@ -12,7 +12,7 @@ class Api::V1::Accounts::InboxMembersController < Api::V1::Accounts::BaseControl
   end
 
   def show
-    @agents = Current.account.users.where(id: @inbox.members.pluck(:user_id))
+    @agents = Current.account.users.where(id: @inbox.members.select(:user_id))
   end
 
   private
@@ -22,9 +22,10 @@ class Api::V1::Accounts::InboxMembersController < Api::V1::Accounts::BaseControl
     # get the list of  user_ids from params
     # the missing ones are the agents which are to be deleted from the inbox
     # the new ones are the agents which are to be added to the inbox
-
-    agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
-    agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    ActiveRecord::Base.transaction do
+      agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
+      agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    end
   end
 
   def agents_to_be_added_ids

app/controllers/api/v1/accounts/inboxes_controller.rb

@@ -4,12 +4,12 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
   before_action :check_authorization
 
   def index
-    @inboxes = policy_scope(Current.account.inboxes)
+    @inboxes = policy_scope(Current.account.inboxes.order_by_name.includes(:channel, { avatar_attachment: [:blob] }))
   end
 
   def create
     ActiveRecord::Base.transaction do
-      channel = web_widgets.create!(permitted_params[:channel].except(:type)) if permitted_params[:channel][:type] == 'web_widget'
+      channel = create_channel
       @inbox = Current.account.inboxes.build(
         name: permitted_params[:name],
         greeting_message: permitted_params[:greeting_message],
@@ -23,7 +23,11 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
 
   def update
     @inbox.update(inbox_update_params.except(:channel))
-    @inbox.channel.update!(inbox_update_params[:channel]) if @inbox.channel.is_a?(Channel::WebWidget) && inbox_update_params[:channel].present?
+    @inbox.update_working_hours(params.permit(working_hours: Inbox::OFFISABLE_ATTRS)[:working_hours]) if params[:working_hours]
+    return unless @inbox.channel.is_a?(Channel::WebWidget) && inbox_update_params[:channel].present?
+
+    @inbox.channel.update!(inbox_update_params[:channel])
+    update_channel_feature_flags
   end
 
   def set_agent_bot
@@ -52,21 +56,43 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
     @agent_bot = AgentBot.find(params[:agent_bot]) if params[:agent_bot]
   end
 
-  def web_widgets
-    Current.account.web_widgets
+  def create_channel
+    case permitted_params[:channel][:type]
+    when 'web_widget'
+      Current.account.web_widgets.create!(permitted_params[:channel].except(:type))
+    when 'api'
+      Current.account.api_channels.create!(permitted_params[:channel].except(:type))
+    when 'email'
+      Current.account.email_channels.create!(permitted_params[:channel].except(:type))
+    end
   end
 
-  def check_authorization
-    authorize(Inbox)
+  def update_channel_feature_flags
+    return unless inbox_update_params[:channel].key? :selected_feature_flags
+
+    @inbox.channel.selected_feature_flags = inbox_update_params[:channel][:selected_feature_flags]
+    @inbox.channel.save!
   end
 
   def permitted_params
     params.permit(:id, :avatar, :name, :greeting_message, :greeting_enabled, channel:
-      [:type, :website_url, :widget_color, :welcome_title, :welcome_tagline])
+      [:type, :website_url, :widget_color, :welcome_title, :welcome_tagline, :webhook_url, :email, :reply_time])
   end
 
   def inbox_update_params
     params.permit(:enable_auto_assignment, :name, :avatar, :greeting_message, :greeting_enabled,
-                  channel: [:website_url, :widget_color, :welcome_title, :welcome_tagline])
+                  :working_hours_enabled, :out_of_office_message, :timezone,
+                  channel: [
+                    :website_url,
+                    :widget_color,
+                    :welcome_title,
+                    :welcome_tagline,
+                    :webhook_url,
+                    :email,
+                    :reply_time,
+                    :pre_chat_form_enabled,
+                    { pre_chat_form_options: [:pre_chat_message, :require_email] },
+                    { selected_feature_flags: [] }
+                  ])
   end
 end

app/controllers/api/v1/accounts/integrations/slack_controller.rb

@@ -2,13 +2,15 @@ class Api::V1::Accounts::Integrations::SlackController < Api::V1::Accounts::Base
   before_action :fetch_hook, only: [:update, :destroy]
 
   def create
-    builder = Integrations::Slack::HookBuilder.new(
-      account: current_account,
-      code: params[:code],
-      inbox_id: params[:inbox_id]
-    )
-    @hook = builder.perform
-    create_chatwoot_slack_channel
+    ActiveRecord::Base.transaction do
+      builder = Integrations::Slack::HookBuilder.new(
+        account: Current.account,
+        code: params[:code],
+        inbox_id: params[:inbox_id]
+      )
+      @hook = builder.perform
+      create_chatwoot_slack_channel
+    end
   end
 
   def update
@@ -25,7 +27,7 @@ class Api::V1::Accounts::Integrations::SlackController < Api::V1::Accounts::Base
   private
 
   def fetch_hook
-    @hook = Integrations::Hook.find_by(app_id: 'slack')
+    @hook = Integrations::Hook.where(account: Current.account).find_by(app_id: 'slack')
   end
 
   def create_chatwoot_slack_channel

app/controllers/api/v1/accounts/kbase/base_controller.rb

@@ -0,0 +1,9 @@
+class Api::V1::Accounts::Kbase::BaseController < Api::V1::Accounts::BaseController
+  before_action :portal
+
+  private
+
+  def portal
+    @portal ||= Current.account.kbase_portals.find_by(id: params[:portal_id])
+  end
+end

app/controllers/api/v1/accounts/kbase/categories_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Kbase::CategoriesController < Api::V1::Accounts::Kbase::BaseController
+  before_action :fetch_category, except: [:index, :create]
+
+  def index
+    @categories = @portal.categories
+  end
+
+  def create
+    @category = @portal.categories.create!(category_params)
+  end
+
+  def update
+    @category.update!(category_params)
+  end
+
+  def destroy
+    @category.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_category
+    @category = @portal.categories.find(params[:id])
+  end
+
+  def category_params
+    params.require(:category).permit(
+      :name, :description, :position
+    )
+  end
+end

app/controllers/api/v1/accounts/kbase/portals_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Kbase::PortalsController < Api::V1::Accounts::Kbase::BaseController
+  before_action :fetch_portal, except: [:index, :create]
+
+  def index
+    @portals = Current.account.kbase_portals
+  end
+
+  def create
+    @portal = Current.account.kbase_portals.create!(portal_params)
+  end
+
+  def update
+    @portal.update!(portal_params)
+  end
+
+  def destroy
+    @portal.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_portal
+    @portal = current_account.kbase_portals.find(params[:id])
+  end
+
+  def portal_params
+    params.require(:portal).permit(
+      :account_id, :color, :custom_domain, :header_text, :homepage_link, :name, :page_title, :slug
+    )
+  end
+end

app/controllers/api/v1/accounts/labels_controller.rb

@@ -28,10 +28,6 @@ class Api::V1::Accounts::LabelsController < Api::V1::Accounts::BaseController
     @label = Current.account.labels.find(params[:id])
   end
 
-  def check_authorization
-    authorize(Label)
-  end
-
   def permitted_params
     params.require(:label).permit(:title, :description, :color, :show_on_sidebar)
   end

app/controllers/api/v1/accounts/notifications_controller.rb

@@ -1,22 +1,26 @@
 class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseController
-  protect_from_forgery with: :null_session
+  RESULTS_PER_PAGE = 15
 
+  protect_from_forgery with: :null_session
   before_action :fetch_notification, only: [:update]
   before_action :set_primary_actor, only: [:read_all]
+  before_action :set_current_page, only: [:index]
 
   def index
     @unread_count = current_user.notifications.where(account_id: current_account.id, read_at: nil).count
-    @notifications = current_user.notifications.where(account_id: current_account.id).page params[:page]
+    @count = notifications.count
+    @notifications = notifications.page(@current_page).per(RESULTS_PER_PAGE)
   end
 
   def read_all
+    # rubocop:disable Rails/SkipsModelValidations
     if @primary_actor
       current_user.notifications.where(account_id: current_account.id, primary_actor: @primary_actor, read_at: nil)
-                  .update(read_at: DateTime.now.utc)
+                  .update_all(read_at: DateTime.now.utc)
     else
-      current_user.notifications.where(account_id: current_account.id, read_at: nil).update(read_at: DateTime.now.utc)
+      current_user.notifications.where(account_id: current_account.id, read_at: nil).update_all(read_at: DateTime.now.utc)
     end
-
+    # rubocop:enable Rails/SkipsModelValidations
     head :ok
   end
 
@@ -25,6 +29,11 @@ class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseContro
     render json: @notification
   end
 
+  def unread_count
+    @unread_count = current_user.notifications.where(account_id: current_account.id, read_at: nil).count
+    render json: @unread_count
+  end
+
   private
 
   def set_primary_actor
@@ -37,4 +46,12 @@ class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseContro
   def fetch_notification
     @notification = current_user.notifications.find(params[:id])
   end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def notifications
+    @notifications ||= current_user.notifications.where(account_id: current_account.id)
+  end
 end

app/controllers/api/v1/accounts/team_members_controller.rb

@@ -0,0 +1,48 @@
+class Api::V1::Accounts::TeamMembersController < Api::V1::Accounts::BaseController
+  before_action :fetch_team
+  before_action :check_authorization
+
+  def index
+    @team_members = @team.team_members.map(&:user)
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      @team_members = params[:user_ids].map { |user_id| @team.add_member(user_id) }
+    end
+  end
+
+  def update
+    ActiveRecord::Base.transaction do
+      members_to_be_added_ids.each { |user_id| @team.add_member(user_id) }
+      members_to_be_removed_ids.each { |user_id| @team.remove_member(user_id) }
+    end
+    @team_members = @team.members
+    render action: 'create'
+  end
+
+  def destroy
+    ActiveRecord::Base.transaction do
+      params[:user_ids].map { |user_id| @team.remove_member(user_id) }
+    end
+    head :ok
+  end
+
+  private
+
+  def members_to_be_added_ids
+    params[:user_ids] - current_members_ids
+  end
+
+  def members_to_be_removed_ids
+    current_members_ids - params[:user_ids]
+  end
+
+  def current_members_ids
+    @current_members_ids ||= @team.members.pluck(:id)
+  end
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:team_id])
+  end
+end

app/controllers/api/v1/accounts/teams_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::TeamsController < Api::V1::Accounts::BaseController
+  before_action :fetch_team, only: [:show, :update, :destroy]
+  before_action :check_authorization
+
+  def index
+    @teams = Current.account.teams
+  end
+
+  def show; end
+
+  def create
+    @team = Current.account.teams.new(team_params)
+    @team.save!
+  end
+
+  def update
+    @team.update!(team_params)
+  end
+
+  def destroy
+    @team.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:id])
+  end
+
+  def team_params
+    params.require(:team).permit(:name, :description, :allow_auto_assign)
+  end
+end

app/controllers/api/v1/accounts/twitter/authorizations_controller.rb

@@ -0,0 +1,29 @@
+class Api::V1::Accounts::Twitter::AuthorizationsController < Api::V1::Accounts::BaseController
+  include TwitterConcern
+
+  before_action :check_authorization
+
+  def create
+    @response = twitter_client.request_oauth_token(url: twitter_callback_url)
+    if @response.status == '200'
+      ::Redis::Alfred.setex(oauth_token, Current.account.id)
+      render json: { success: true, url: oauth_authorize_endpoint(oauth_token) }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def oauth_token
+    parsed_body['oauth_token']
+  end
+
+  def oauth_authorize_endpoint(oauth_token)
+    "#{twitter_api_base_url}/oauth/authorize?oauth_token=#{oauth_token}"
+  end
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
+end

app/controllers/api/v1/accounts/webhooks_controller.rb

@@ -29,8 +29,4 @@ class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
   def fetch_webhook
     @webhook = Current.account.webhooks.find(params[:id])
   end
-
-  def check_authorization
-    authorize(Webhook)
-  end
 end

app/controllers/api/v1/accounts/working_hours_controller.rb

@@ -0,0 +1,18 @@
+class Api::V1::Accounts::WorkingHoursController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+  before_action :fetch_webhook, only: [:update]
+
+  def update
+    @working_hour.update!(working_hour_params)
+  end
+
+  private
+
+  def working_hour_params
+    params.require(:working_hour).permit(:inbox_id, :open_hour, :open_minutes, :close_hour, :close_minutes, :closed_all_day)
+  end
+
+  def fetch_working_hour
+    @working_hour = Current.account.working_hours.find(params[:id])
+  end
+end

app/controllers/api/v1/accounts_controller.rb

@@ -14,25 +14,28 @@ class Api::V1::AccountsController < Api::BaseController
               with: :render_error_response
 
   def create
-    @user = AccountBuilder.new(
+    @user, @account = AccountBuilder.new(
       account_name: account_params[:account_name],
+      user_full_name: account_params[:user_full_name],
       email: account_params[:email],
-      confirmed: confirmed?
+      confirmed: confirmed?,
+      user: current_user
     ).perform
     if @user
       send_auth_headers(@user)
-      render partial: 'devise/auth.json', locals: { resource: @user }
+      render 'api/v1/accounts/create.json', locals: { resource: @user }
     else
       render_error_response(CustomExceptions::Account::SignupFailed.new({}))
     end
   end
 
   def show
+    @latest_chatwoot_version = ::Redis::Alfred.get(::Redis::Alfred::LATEST_CHATWOOT_VERSION)
     render 'api/v1/accounts/show.json'
   end
 
   def update
-    @account.update!(account_params.slice(:name, :locale, :domain, :support_email, :domain_emails_enabled))
+    @account.update!(account_params.slice(:name, :locale, :domain, :support_email, :auto_resolve_duration))
   end
 
   def update_active_at
@@ -43,10 +46,6 @@ class Api::V1::AccountsController < Api::BaseController
 
   private
 
-  def check_authorization
-    authorize(Account)
-  end
-
   def confirmed?
     super_admin? && params[:confirmed]
   end
@@ -57,7 +56,7 @@ class Api::V1::AccountsController < Api::BaseController
   end
 
   def account_params
-    params.permit(:account_name, :email, :name, :locale, :domain, :support_email, :domain_emails_enabled)
+    params.permit(:account_name, :email, :name, :locale, :domain, :support_email, :auto_resolve_duration, :user_full_name)
   end
 
   def check_signup_enabled

app/controllers/api/v1/profiles_controller.rb

@@ -16,6 +16,15 @@ class Api::V1::ProfilesController < Api::BaseController
   end
 
   def profile_params
-    params.require(:profile).permit(:email, :name, :password, :password_confirmation, :avatar, :availability)
+    params.require(:profile).permit(
+      :email,
+      :name,
+      :display_name,
+      :password,
+      :password_confirmation,
+      :avatar,
+      :availability,
+      ui_settings: {}
+    )
   end
 end

app/controllers/api/v1/widget/base_controller.rb

@@ -1,33 +1,107 @@
 class Api::V1::Widget::BaseController < ApplicationController
+  include SwitchLocale
+
   before_action :set_web_widget
   before_action :set_contact
 
   private
 
+  def conversations
+    if @contact_inbox.hmac_verified?
+      verified_contact_inbox_ids = @contact.contact_inboxes.where(inbox_id: auth_token_params[:inbox_id], hmac_verified: true).map(&:id)
+      @conversations = @contact.conversations.where(contact_inbox_id: verified_contact_inbox_ids)
+    else
+      @conversations = @contact_inbox.conversations.where(inbox_id: auth_token_params[:inbox_id])
+    end
+  end
+
   def conversation
-    @conversation ||= @contact_inbox.conversations.where(
-      inbox_id: auth_token_params[:inbox_id]
-    ).last
+    @conversation ||= conversations.last
   end
 
   def auth_token_params
-    @auth_token_params ||= ::Widget::TokenService.new(token: request.headers[header_name]).decode_token
-  end
-
-  def header_name
-    'X-Auth-Token'
+    @auth_token_params ||= ::Widget::TokenService.new(token: request.headers['X-Auth-Token']).decode_token
   end
 
   def set_web_widget
     @web_widget = ::Channel::WebWidget.find_by!(website_token: permitted_params[:website_token])
-    @account = @web_widget.account
-    switch_locale @account
+    @current_account = @web_widget.account
   end
 
   def set_contact
     @contact_inbox = @web_widget.inbox.contact_inboxes.find_by(
       source_id: auth_token_params[:source_id]
     )
-    @contact = @contact_inbox.contact
+    @contact = @contact_inbox&.contact
+    raise ActiveRecord::RecordNotFound unless @contact
+  end
+
+  def create_conversation
+    ::Conversation.create!(conversation_params)
+  end
+
+  def inbox
+    @inbox ||= ::Inbox.find_by(id: auth_token_params[:inbox_id])
+  end
+
+  def conversation_params
+    # FIXME: typo referrer in additional attributes, will probably require a migration.
+    {
+      account_id: inbox.account_id,
+      inbox_id: inbox.id,
+      contact_id: @contact.id,
+      contact_inbox_id: @contact_inbox.id,
+      additional_attributes: {
+        browser: browser_params,
+        referer: permitted_params[:message][:referer_url],
+        initiated_at: timestamp_params
+      }
+    }
+  end
+
+  def update_contact(email)
+    contact_with_email = @current_account.contacts.find_by(email: email)
+    if contact_with_email
+      @contact = ::ContactMergeAction.new(
+        account: @current_account,
+        base_contact: contact_with_email,
+        mergee_contact: @contact
+      ).perform
+    else
+      @contact.update!(email: email, name: contact_name)
+    end
+  end
+
+  def contact_email
+    permitted_params[:contact][:email].downcase
+  end
+
+  def contact_name
+    params[:contact][:name] || contact_email.split('@')[0]
+  end
+
+  def browser_params
+    {
+      browser_name: browser.name,
+      browser_version: browser.full_version,
+      device_name: browser.device.name,
+      platform_name: browser.platform.name,
+      platform_version: browser.platform.version
+    }
+  end
+
+  def timestamp_params
+    { timestamp: permitted_params[:message][:timestamp] }
+  end
+
+  def message_params
+    {
+      account_id: conversation.account_id,
+      sender: @contact,
+      content: permitted_params[:message][:content],
+      inbox_id: conversation.inbox_id,
+      echo_id: permitted_params[:message][:echo_id],
+      message_type: :incoming
+    }
   end
 end

app/controllers/api/v1/widget/contacts_controller.rb

@@ -1,4 +1,8 @@
 class Api::V1::Widget::ContactsController < Api::V1::Widget::BaseController
+  before_action :process_hmac
+
+  def show; end
+
   def update
     contact_identify_action = ContactIdentifyAction.new(
       contact: @contact,
@@ -9,7 +13,22 @@ class Api::V1::Widget::ContactsController < Api::V1::Widget::BaseController
 
   private
 
+  def process_hmac
+    return if params[:identifier_hash].blank?
+    raise StandardError, 'HMAC failed: Invalid Identifier Hash Provided' unless valid_hmac?
+
+    @contact_inbox.update(hmac_verified: true)
+  end
+
+  def valid_hmac?
+    params[:identifier_hash] == OpenSSL::HMAC.hexdigest(
+      'sha256',
+      @web_widget.hmac_token,
+      params[:identifier].to_s
+    )
+  end
+
   def permitted_params
-    params.permit(:website_token, :identifier, :email, :name, :avatar_url)
+    params.permit(:website_token, :identifier, :identifier_hash, :email, :name, :avatar_url, custom_attributes: {})
   end
 end

app/controllers/api/v1/widget/conversations_controller.rb

@@ -5,20 +5,39 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
     @conversation = conversation
   end
 
+  def create
+    ActiveRecord::Base.transaction do
+      update_contact(contact_email) if @contact.email.blank? && contact_email.present?
+      @conversation = create_conversation
+      conversation.messages.create(message_params)
+    end
+  end
+
   def update_last_seen
     head :ok && return if conversation.nil?
 
-    conversation.user_last_seen_at = DateTime.now.utc
+    conversation.contact_last_seen_at = DateTime.now.utc
     conversation.save!
     head :ok
   end
 
+  def transcript
+    if permitted_params[:email].present? && conversation.present?
+      ConversationReplyMailer.conversation_transcript(
+        conversation,
+        permitted_params[:email]
+      )&.deliver_later
+    end
+    head :ok
+  end
+
   def toggle_typing
     head :ok && return if conversation.nil?
 
-    if permitted_params[:typing_status] == 'on'
+    case permitted_params[:typing_status]
+    when 'on'
       trigger_typing_event(CONVERSATION_TYPING_ON)
-    elsif permitted_params[:typing_status] == 'off'
+    when 'off'
       trigger_typing_event(CONVERSATION_TYPING_OFF)
     end
 
@@ -32,6 +51,6 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
   end
 
   def permitted_params
-    params.permit(:id, :typing_status, :website_token)
+    params.permit(:id, :typing_status, :website_token, :email, contact: [:name, :email], message: [:content, :referer_url, :timestamp, :echo_id])
   end
 end

app/controllers/api/v1/widget/events_controller.rb

@@ -11,7 +11,8 @@ class Api::V1::Widget::EventsController < Api::V1::Widget::BaseController
   def event_info
     {
       widget_language: params[:locale],
-      browser_language: browser.accept_language.first&.code
+      browser_language: browser.accept_language.first&.code,
+      browser: browser_params
     }
   end
 

app/controllers/api/v1/widget/labels_controller.rb

@@ -1,20 +1,29 @@
 class Api::V1::Widget::LabelsController < Api::V1::Widget::BaseController
   def create
-    conversation.label_list.add(permitted_params[:label])
-    conversation.save!
+    if conversation.present? && label_defined_in_account?
+      conversation.label_list.add(permitted_params[:label])
+      conversation.save!
+    end
 
     head :no_content
   end
 
   def destroy
-    conversation.label_list.remove(permitted_params[:id])
-    conversation.save!
+    if conversation.present?
+      conversation.label_list.remove(permitted_params[:id])
+      conversation.save!
+    end
 
     head :no_content
   end
 
   private
 
+  def label_defined_in_account?
+    label = @current_account.labels&.find_by(title: permitted_params[:label])
+    label.present?
+  end
+
   def permitted_params
     params.permit(:id, :label, :website_token)
   end

app/controllers/api/v1/widget/messages_controller.rb

@@ -39,51 +39,7 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
   end
 
   def set_conversation
-    @conversation = ::Conversation.create!(conversation_params) if conversation.nil?
-  end
-
-  def message_params
-    {
-      account_id: conversation.account_id,
-      sender: @contact,
-      content: permitted_params[:message][:content],
-      inbox_id: conversation.inbox_id,
-      message_type: :incoming
-    }
-  end
-
-  def conversation_params
-    {
-      account_id: inbox.account_id,
-      inbox_id: inbox.id,
-      contact_id: @contact.id,
-      contact_inbox_id: @contact_inbox.id,
-      additional_attributes: {
-        browser: browser_params,
-        referer: permitted_params[:message][:referer_url],
-        initiated_at: timestamp_params
-      }
-    }
-  end
-
-  def browser_params
-    {
-      browser_name: browser.name,
-      browser_version: browser.full_version,
-      device_name: browser.device.name,
-      platform_name: browser.platform.name,
-      platform_version: browser.platform.version
-    }
-  end
-
-  def timestamp_params
-    {
-      timestamp: permitted_params[:message][:timestamp]
-    }
-  end
-
-  def inbox
-    @inbox ||= ::Inbox.find_by(id: auth_token_params[:inbox_id])
+    @conversation = create_conversation if conversation.nil?
   end
 
   def message_finder_params
@@ -97,36 +53,12 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
     @message_finder ||= MessageFinder.new(conversation, message_finder_params)
   end
 
-  def update_contact(email)
-    contact_with_email = @account.contacts.find_by(email: email)
-    if contact_with_email
-      @contact = ::ContactMergeAction.new(
-        account: @account,
-        base_contact: contact_with_email,
-        mergee_contact: @contact
-      ).perform
-    else
-      @contact.update!(
-        email: email,
-        name: contact_name
-      )
-    end
-  end
-
-  def contact_email
-    permitted_params[:contact][:email].downcase
-  end
-
-  def contact_name
-    contact_email.split('@')[0]
-  end
-
   def message_update_params
-    params.permit(message: [submitted_values: [:name, :title, :value]])
+    params.permit(message: [{ submitted_values: [:name, :title, :value] }])
   end
 
   def permitted_params
-    params.permit(:id, :before, :website_token, contact: [:email], message: [:content, :referer_url, :timestamp])
+    params.permit(:id, :before, :website_token, contact: [:name, :email], message: [:content, :referer_url, :timestamp, :echo_id])
   end
 
   def set_message

app/controllers/api/v2/accounts/reports_controller.rb

@@ -9,6 +9,18 @@ class Api::V2::Accounts::ReportsController < Api::V1::Accounts::BaseController
     render json: account_summary_metrics
   end
 
+  def agents
+    response.headers['Content-Type'] = 'text/csv'
+    response.headers['Content-Disposition'] = 'attachment; filename=agents_report.csv'
+    render layout: false, template: 'api/v2/accounts/reports/agents.csv.erb', format: 'csv'
+  end
+
+  def inboxes
+    response.headers['Content-Type'] = 'text/csv'
+    response.headers['Content-Disposition'] = 'attachment; filename=inboxes_report.csv'
+    render layout: false, template: 'api/v2/accounts/reports/inboxes.csv.erb', format: 'csv'
+  end
+
   private
 
   def account_summary_params

app/controllers/application_controller.rb

@@ -1,10 +1,12 @@
 class ApplicationController < ActionController::Base
   include DeviseTokenAuth::Concerns::SetUserByToken
   include Pundit
+  include SwitchLocale
 
   protect_from_forgery with: :null_session
 
   before_action :set_current_user, unless: :devise_controller?
+  around_action :switch_locale
   around_action :handle_with_exception, unless: :devise_controller?
 
   # after_action :verify_authorized
@@ -21,7 +23,7 @@ class ApplicationController < ActionController::Base
     render_unauthorized('You are not authorized to do this action')
   ensure
     # to address the thread variable leak issues in Puma/Thin webserver
-    Current.user = nil
+    Current.reset
   end
 
   def set_current_user
@@ -59,22 +61,6 @@ class ApplicationController < ActionController::Base
     render json: exception.to_hash, status: exception.http_status
   end
 
-  def locale_from_params
-    I18n.available_locales.map(&:to_s).include?(params[:locale]) ? params[:locale] : nil
-  end
-
-  def locale_from_account(account)
-    I18n.available_locales.map(&:to_s).include?(account.locale) ? account.locale : nil
-  end
-
-  def switch_locale(account)
-    # priority is for locale set in query string (mostly for widget/from js sdk)
-    locale ||= locale_from_params
-    # if local is not set in param, lets try account
-    locale ||= locale_from_account(account)
-    I18n.locale = locale || I18n.default_locale
-  end
-
   def pundit_user
     {
       user: Current.user,

app/controllers/concerns/access_token_auth_helper.rb

@@ -14,6 +14,7 @@ module AccessTokenAuthHelper
     render_unauthorized('Invalid Access Token') && return if @access_token.blank?
 
     @resource = @access_token.owner
+    Current.user = @resource if current_user.is_a?(User)
   end
 
   def super_admin?
@@ -21,7 +22,7 @@ module AccessTokenAuthHelper
   end
 
   def validate_bot_access_token!
-    return if current_user.is_a?(User)
+    return if Current.user.is_a?(User)
     return if super_admin?
     return if agent_bot_accessible?
 

app/controllers/concerns/label_concern.rb

@@ -0,0 +1,10 @@
+module LabelConcern
+  def create
+    model.update_labels(permitted_params[:labels])
+    @labels = model.label_list
+  end
+
+  def index
+    @labels = model.label_list
+  end
+end

app/controllers/concerns/switch_locale.rb

@@ -0,0 +1,42 @@
+module SwitchLocale
+  extend ActiveSupport::Concern
+
+  private
+
+  def switch_locale(&action)
+    # priority is for locale set in query string (mostly for widget/from js sdk)
+    locale ||= locale_from_params
+    # if locale is not set in account, let's use DEFAULT_LOCALE env variable
+    locale ||= locale_from_env_variable
+    set_locale(locale, &action)
+  end
+
+  def switch_locale_using_account_locale(&action)
+    locale = locale_from_account(@current_account)
+    set_locale(locale, &action)
+  end
+
+  def set_locale(locale, &action)
+    # if locale is empty, use default_locale
+    locale ||= I18n.default_locale
+    # Ensure locale won't bleed into other requests
+    # https://guides.rubyonrails.org/i18n.html#managing-the-locale-across-requests
+    I18n.with_locale(locale, &action)
+  end
+
+  def locale_from_params
+    I18n.available_locales.map(&:to_s).include?(params[:locale]) ? params[:locale] : nil
+  end
+
+  def locale_from_account(account)
+    return unless account
+
+    I18n.available_locales.map(&:to_s).include?(account.locale) ? account.locale : nil
+  end
+
+  def locale_from_env_variable
+    return unless ENV.fetch('DEFAULT_LOCALE', nil)
+
+    I18n.available_locales.map(&:to_s).include?(ENV.fetch('DEFAULT_LOCALE')) ? ENV.fetch('DEFAULT_LOCALE') : nil
+  end
+end

app/controllers/concerns/twitter_concern.rb

@@ -0,0 +1,26 @@
+module TwitterConcern
+  extend ActiveSupport::Concern
+
+  private
+
+  def parsed_body
+    @parsed_body ||= Rack::Utils.parse_nested_query(@response.raw_response.body)
+  end
+
+  def host
+    ENV.fetch('FRONTEND_URL', '')
+  end
+
+  def twitter_client
+    Twitty::Facade.new do |config|
+      config.consumer_key = ENV.fetch('TWITTER_CONSUMER_KEY', nil)
+      config.consumer_secret = ENV.fetch('TWITTER_CONSUMER_SECRET', nil)
+      config.base_url = twitter_api_base_url
+      config.environment = ENV.fetch('TWITTER_ENVIRONMENT', '')
+    end
+  end
+
+  def twitter_api_base_url
+    'https://api.twitter.com'
+  end
+end

app/controllers/dashboard_controller.rb

@@ -1,5 +1,9 @@
 class DashboardController < ActionController::Base
+  include SwitchLocale
+
   before_action :set_global_config
+  around_action :switch_locale
+  before_action :ensure_installation_onboarding, only: [:index]
 
   layout 'vueapp'
 
@@ -15,7 +19,15 @@ class DashboardController < ActionController::Base
       'WIDGET_BRAND_URL',
       'TERMS_URL',
       'PRIVACY_URL',
-      'DISPLAY_MANIFEST'
+      'DISPLAY_MANIFEST',
+      'CREATE_NEW_ACCOUNT_FROM_DASHBOARD',
+      'CHATWOOT_INBOX_TOKEN'
+    ).merge(
+      APP_VERSION: Chatwoot.config[:version]
     )
   end
+
+  def ensure_installation_onboarding
+    redirect_to '/installation/onboarding' if ::Redis::Alfred.get(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING)
+  end
 end

app/controllers/devise_overrides/confirmations_controller.rb

@@ -4,27 +4,39 @@ class DeviseOverrides::ConfirmationsController < Devise::ConfirmationsController
 
   def create
     @confirmable = User.find_by(confirmation_token: params[:confirmation_token])
-    if @confirmable
-      if @confirmable.confirm || (@confirmable.confirmed_at && @confirmable.reset_password_token)
-        # confirmed now or already confirmed but quit before setting a password
-        render json: { "message": 'Success', "redirect_url": create_reset_token_link(@confirmable) }, status: :ok
-      elsif @confirmable.confirmed_at
-        render json: { "message": 'Already confirmed', "redirect_url": '/' }, status: 422
-      else
-        render json: { "message": 'Failure', "redirect_url": '/' }, status: 422
-      end
+
+    if confirm
+      render_confirmation_success
     else
-      render json: { "message": 'Invalid token', "redirect_url": '/' }, status: 422
+      render_confirmation_error
     end
   end
 
   protected
 
+  def confirm
+    @confirmable&.confirm || (@confirmable&.confirmed_at && @confirmable&.reset_password_token)
+  end
+
+  def render_confirmation_success
+    render json: { "message": 'Success', "redirect_url": create_reset_token_link(@confirmable) }, status: :ok
+  end
+
+  def render_confirmation_error
+    if @confirmable.blank?
+      render json: { "message": 'Invalid token', "redirect_url": '/' }, status: 422
+    elsif @confirmable.confirmed_at
+      render json: { "message": 'Already confirmed', "redirect_url": '/' }, status: 422
+    else
+      render json: { "message": 'Failure', "redirect_url": '/' }, status: 422
+    end
+  end
+
   def create_reset_token_link(user)
     raw, enc = Devise.token_generator.generate(user.class, :reset_password_token)
     user.reset_password_token   = enc
     user.reset_password_sent_at = Time.now.utc
     user.save(validate: false)
-    '/app/auth/password/edit?config=default&redirect_url=&reset_password_token=' + raw
+    "/app/auth/password/edit?config=default&redirect_url=&reset_password_token=#{raw}"
   end
 end

app/controllers/devise_overrides/sessions_controller.rb

@@ -2,8 +2,38 @@ class DeviseOverrides::SessionsController < ::DeviseTokenAuth::SessionsControlle
   # Prevent session parameter from being passed
   # Unpermitted parameter: session
   wrap_parameters format: []
+  before_action :process_sso_auth_token, only: [:create]
+
+  def create
+    # Authenticate user via the temporary sso auth token
+    if params[:sso_auth_token].present? && @resource.present?
+      authenticate_resource_with_sso_token
+      yield @resource if block_given?
+      render_create_success
+    else
+      super
+    end
+  end
 
   def render_create_success
     render partial: 'devise/auth.json', locals: { resource: @resource }
   end
+
+  private
+
+  def authenticate_resource_with_sso_token
+    @token = @resource.create_token
+    @resource.save
+
+    sign_in(:user, @resource, store: false, bypass: false)
+    # invalidate the token after the user is signed in
+    @resource.invalidate_sso_auth_token(params[:sso_auth_token])
+  end
+
+  def process_sso_auth_token
+    return if params[:email].blank?
+
+    user = User.find_by(email: params[:email])
+    @resource = user if user&.valid_sso_auth_token?(params[:sso_auth_token])
+  end
 end

app/controllers/installation/onboarding_controller.rb

@@ -0,0 +1,36 @@
+class Installation::OnboardingController < ApplicationController
+  before_action :ensure_installation_onboarding
+
+  def index; end
+
+  def create
+    begin
+      AccountBuilder.new(
+        account_name: onboarding_params.dig(:user, :company),
+        user_full_name: onboarding_params.dig(:user, :name),
+        email: onboarding_params.dig(:user, :email),
+        user_password: params.dig(:user, :password),
+        confirmed: true
+      ).perform
+    rescue StandardError => e
+      redirect_to '/', flash: { error: e.message } and return
+    end
+    finish_onboarding
+    redirect_to '/'
+  end
+
+  private
+
+  def onboarding_params
+    params.permit(:subscribe_to_updates, user: [:name, :company, :email])
+  end
+
+  def finish_onboarding
+    ::Redis::Alfred.delete(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING)
+    ChatwootHub.register_instance(onboarding_params) if onboarding_params[:subscribe_to_updates]
+  end
+
+  def ensure_installation_onboarding
+    redirect_to '/' unless ::Redis::Alfred.get(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING)
+  end
+end

app/controllers/platform/api/v1/account_users_controller.rb

@@ -0,0 +1,29 @@
+class Platform::Api::V1::AccountUsersController < PlatformController
+  before_action :set_resource
+  before_action :validate_platform_app_permissible
+
+  def index
+    render json: @resource.account_users
+  end
+
+  def create
+    @account_user = @resource.account_users.find_or_initialize_by(user_id: account_user_params[:user_id])
+    @account_user.update!(account_user_params)
+    render json: @account_user
+  end
+
+  def destroy
+    @resource.account_users.find_by(user_id: account_user_params[:user_id])&.destroy
+    head :ok
+  end
+
+  private
+
+  def set_resource
+    @resource = Account.find(params[:account_id])
+  end
+
+  def account_user_params
+    params.permit(:user_id, :role)
+  end
+end

app/controllers/platform/api/v1/accounts_controller.rb

@@ -0,0 +1,32 @@
+class Platform::Api::V1::AccountsController < PlatformController
+  def create
+    @resource = Account.new(account_params)
+    @resource.save!
+    @platform_app.platform_app_permissibles.find_or_create_by(permissible: @resource)
+    render json: @resource
+  end
+
+  def show
+    render json: @resource
+  end
+
+  def update
+    @resource.update!(account_params)
+    render json: @resource
+  end
+
+  def destroy
+    # TODO: obfusicate account
+    head :ok
+  end
+
+  private
+
+  def set_resource
+    @resource = Account.find(params[:id])
+  end
+
+  def account_params
+    params.permit(:name)
+  end
+end

app/controllers/platform/api/v1/users_controller.rb

@@ -0,0 +1,39 @@
+class Platform::Api::V1::UsersController < PlatformController
+  # ref: https://stackoverflow.com/a/45190318/939299
+  # set resource is called for other actions already in platform controller
+  # we want to add login to that chain as well
+  before_action(only: [:login]) { set_resource }
+  before_action(only: [:login]) { validate_platform_app_permissible }
+
+  def create
+    @resource = (User.find_by(email: user_params[:email]) || User.new(user_params))
+    @resource.confirm
+    @resource.save!
+    @platform_app.platform_app_permissibles.find_or_create_by(permissible: @resource)
+  end
+
+  def login
+    render json: { url: "#{ENV['FRONTEND_URL']}/app/login?email=#{@resource.email}&sso_auth_token=#{@resource.generate_sso_auth_token}" }
+  end
+
+  def show; end
+
+  def update
+    @resource.update!(user_params)
+  end
+
+  def destroy
+    # TODO: obfusicate user
+    head :ok
+  end
+
+  private
+
+  def set_resource
+    @resource = User.find(params[:id])
+  end
+
+  def user_params
+    params.permit(:name, :email, :password)
+  end
+end

app/controllers/platform_controller.rb

@@ -0,0 +1,37 @@
+class PlatformController < ActionController::Base
+  protect_from_forgery with: :null_session
+
+  before_action :ensure_access_token
+  before_action :set_platform_app
+  before_action :set_resource, only: [:update, :show, :destroy]
+  before_action :validate_platform_app_permissible, only: [:update, :show, :destroy]
+
+  def show; end
+
+  def update; end
+
+  def destroy; end
+
+  private
+
+  def ensure_access_token
+    token = request.headers[:api_access_token] || request.headers[:HTTP_API_ACCESS_TOKEN]
+    @access_token = AccessToken.find_by(token: token) if token.present?
+  end
+
+  def set_platform_app
+    @platform_app = @access_token.owner if @access_token && @access_token.owner.is_a?(PlatformApp)
+    render json: { error: 'Invalid access_token' }, status: :unauthorized if @platform_app.blank?
+  end
+
+  def set_resource
+    # set @resource in your controller
+    raise 'Overwrite this method your controller'
+  end
+
+  def validate_platform_app_permissible
+    return if @platform_app.platform_app_permissibles.find_by(permissible: @resource)
+
+    render json: { error: 'Non permissible resource' }, status: :unauthorized
+  end
+end

app/controllers/super_admin/installation_configs_controller.rb

@@ -0,0 +1,46 @@
+class SuperAdmin::InstallationConfigsController < SuperAdmin::ApplicationController
+  # Overwrite any of the RESTful controller actions to implement custom behavior
+  # For example, you may want to send an email after a foo is updated.
+  #
+  # def update
+  #   super
+  #   send_foo_updated_email(requested_resource)
+  # end
+
+  # Override this method to specify custom lookup behavior.
+  # This will be used to set the resource for the `show`, `edit`, and `update`
+  # actions.
+  #
+  # def find_resource(param)
+  #   Foo.find_by!(slug: param)
+  # end
+
+  # The result of this lookup will be available as `requested_resource`
+
+  # Override this if you have certain roles that require a subset
+  # this will be used to set the records shown on the `index` action.
+  #
+  def scoped_resource
+    resource_class.editable
+  end
+
+  # Override `resource_params` if you want to transform the submitted
+  # data before it's persisted. For example, the following would turn all
+  # empty values into nil values. It uses other APIs such as `resource_class`
+  # and `dashboard`:
+  #
+  # def resource_params
+  #   params.require(resource_class.model_name.param_key).
+  #     permit(dashboard.permitted_attributes).
+  #     transform_values { |value| value == "" ? nil : value }
+  # end
+
+  def resource_params
+    params.require(:installation_config)
+          .permit(:name, :value)
+          .transform_values { |value| value == '' ? nil : value }.merge(locked: false)
+  end
+
+  # See https://administrate-prototype.herokuapp.com/customizing_controller_actions
+  # for more information
+end

app/controllers/twitter/authorizations_controller.rb

@@ -1,30 +0,0 @@
-class Twitter::AuthorizationsController < Twitter::BaseController
-  def create
-    @response = twitter_client.request_oauth_token(url: twitter_callback_url)
-
-    if @response.status == '200'
-      ::Redis::Alfred.setex(oauth_token, account.id)
-      redirect_to oauth_authorize_endpoint(oauth_token)
-    else
-      redirect_to app_new_twitter_inbox_url(account_id: account.id)
-    end
-  end
-
-  private
-
-  def oauth_token
-    parsed_body['oauth_token']
-  end
-
-  def user
-    @user ||= User.find_by(id: params[:user_id])
-  end
-
-  def account
-    @account ||= user.account
-  end
-
-  def oauth_authorize_endpoint(oauth_token)
-    "#{twitter_api_base_url}/oauth/authorize?oauth_token=#{oauth_token}"
-  end
-end

app/controllers/twitter/base_controller.rb

@@ -1,24 +1,3 @@
 class Twitter::BaseController < ApplicationController
-  private
-
-  def parsed_body
-    @parsed_body ||= Rack::Utils.parse_nested_query(@response.raw_response.body)
-  end
-
-  def host
-    ENV.fetch('FRONTEND_URL', '')
-  end
-
-  def twitter_client
-    Twitty::Facade.new do |config|
-      config.consumer_key = ENV.fetch('TWITTER_CONSUMER_KEY', nil)
-      config.consumer_secret = ENV.fetch('TWITTER_CONSUMER_SECRET', nil)
-      config.base_url = twitter_api_base_url
-      config.environment = ENV.fetch('TWITTER_ENVIRONMENT', '')
-    end
-  end
-
-  def twitter_api_base_url
-    'https://api.twitter.com'
-  end
+  include TwitterConcern
 end

app/controllers/twitter/callbacks_controller.rb

@@ -1,4 +1,6 @@
 class Twitter::CallbacksController < Twitter::BaseController
+  include TwitterConcern
+
   def show
     return redirect_to twitter_app_redirect_url if permitted_params[:denied]
 
@@ -27,7 +29,7 @@ class Twitter::CallbacksController < Twitter::BaseController
   end
 
   def account
-    @account ||= Account.find_by!(id: account_id)
+    @account ||= Account.find(account_id)
   end
 
   def twitter_app_redirect_url

app/controllers/widgets_controller.rb

@@ -6,12 +6,10 @@ class WidgetsController < ActionController::Base
   before_action :build_contact
   after_action :allow_iframe_requests
 
-  def index; end
-
   private
 
   def set_global_config
-    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'INSTALLATION_NAME', 'WIDGET_BRAND_URL')
+    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL')
   end
 
   def set_web_widget
@@ -41,13 +39,21 @@ class WidgetsController < ActionController::Base
   def build_contact
     return if @contact.present?
 
-    contact_inbox = @web_widget.create_contact_inbox
+    contact_inbox = @web_widget.create_contact_inbox(additional_attributes)
     @contact = contact_inbox.contact
 
     payload = { source_id: contact_inbox.source_id, inbox_id: @web_widget.inbox.id }
     @token = ::Widget::TokenService.new(payload: payload).generate_token
   end
 
+  def additional_attributes
+    if @web_widget.inbox.account.feature_enabled?('ip_lookup')
+      { created_at_ip: request.remote_ip }
+    else
+      {}
+    end
+  end
+
   def permitted_params
     params.permit(:website_token, :cw_conversation)
   end

app/dashboards/installation_config_dashboard.rb

@@ -0,0 +1,66 @@
+require 'administrate/base_dashboard'
+
+class InstallationConfigDashboard < Administrate::BaseDashboard
+  # ATTRIBUTE_TYPES
+  # a hash that describes the type of each of the model's fields.
+  #
+  # Each different type represents an Administrate::Field object,
+  # which determines how the attribute is displayed
+  # on pages throughout the dashboard.
+  ATTRIBUTE_TYPES = {
+    id: Field::Number,
+    name: Field::String,
+    value: SerializedField,
+    created_at: Field::DateTime,
+    updated_at: Field::DateTime
+  }.freeze
+
+  # COLLECTION_ATTRIBUTES
+  # an array of attributes that will be displayed on the model's index page.
+  #
+  # By default, it's limited to four items to reduce clutter on index pages.
+  # Feel free to add, remove, or rearrange items.
+  COLLECTION_ATTRIBUTES = %i[
+    id
+    name
+    value
+    created_at
+  ].freeze
+
+  # SHOW_PAGE_ATTRIBUTES
+  # an array of attributes that will be displayed on the model's show page.
+  SHOW_PAGE_ATTRIBUTES = %i[
+    id
+    name
+    value
+    created_at
+    updated_at
+  ].freeze
+
+  # FORM_ATTRIBUTES
+  # an array of attributes that will be displayed
+  # on the model's form (`new` and `edit`) pages.
+  FORM_ATTRIBUTES = %i[
+    name
+    value
+  ].freeze
+
+  # COLLECTION_FILTERS
+  # a hash that defines filters that can be used while searching via the search
+  # field of the dashboard.
+  #
+  # For example to add an option to search for open resources by typing "open:"
+  # in the search field:
+  #
+  #   COLLECTION_FILTERS = {
+  #     open: ->(resources) { resources.where(open: true) }
+  #   }.freeze
+  COLLECTION_FILTERS = {}.freeze
+
+  # Overwrite this method to customize how installation configs are displayed
+  # across all pages of the admin dashboard.
+  #
+  # def display_resource(installation_config)
+  #   "InstallationConfig ##{installation_config.id}"
+  # end
+end

app/dashboards/user_dashboard.rb

@@ -24,7 +24,7 @@ class UserDashboard < Administrate::BaseDashboard
     confirmation_sent_at: Field::DateTime,
     unconfirmed_email: Field::String,
     name: Field::String,
-    nickname: Field::String,
+    display_name: Field::String,
     email: Field::String,
     tokens: Field::String.with_options(searchable: false),
     created_at: Field::DateTime,
@@ -53,7 +53,7 @@ class UserDashboard < Administrate::BaseDashboard
     avatar_url
     unconfirmed_email
     name
-    nickname
+    display_name
     email
     created_at
     updated_at
@@ -65,7 +65,7 @@ class UserDashboard < Administrate::BaseDashboard
   # on the model's form (`new` and `edit`) pages.
   FORM_ATTRIBUTES = %i[
     name
-    nickname
+    display_name
     email
     password
   ].freeze

app/dispatchers/async_dispatcher.rb

@@ -9,7 +9,10 @@ class AsyncDispatcher < BaseDispatcher
   end
 
   def listeners
-    listeners = [EventListener.instance, WebhookListener.instance, HookListener.instance]
-    listeners
+    [
+      EventListener.instance,
+      WebhookListener.instance,
+      InstallationWebhookListener.instance, HookListener.instance
+    ]
   end
 end

app/drops/account_drop.rb

@@ -0,0 +1,2 @@
+class AccountDrop < BaseDrop
+end

app/drops/base_drop.rb

@@ -0,0 +1,13 @@
+class BaseDrop < Liquid::Drop
+  def initialize(obj)
+    @obj = obj
+  end
+
+  def id
+    @obj.try(:id)
+  end
+
+  def name
+    @obj.try(:name)
+  end
+end

app/drops/conversation_drop.rb

@@ -0,0 +1,5 @@
+class ConversationDrop < BaseDrop
+  def display_id
+    @obj.try(:display_id)
+  end
+end

app/drops/inbox_drop.rb

@@ -0,0 +1,2 @@
+class InboxDrop < BaseDrop
+end

app/drops/user_drop.rb

@@ -0,0 +1,5 @@
+class UserDrop < BaseDrop
+  def available_name
+    @obj.try(:available_name)
+  end
+end

app/fields/serialized_field.rb

@@ -0,0 +1,15 @@
+require 'administrate/field/base'
+
+class SerializedField < Administrate::Field::Base
+  def to_s
+    hash? ? data.as_json : data.to_s
+  end
+
+  def hash?
+    data.is_a? Hash
+  end
+
+  def array?
+    data.is_a? Array
+  end
+end

app/finders/conversation_finder.rb

@@ -22,11 +22,14 @@ class ConversationFinder
 
   def perform
     set_inboxes
+    set_team
     set_assignee_type
 
     find_all_conversations
-    filter_by_status
+    filter_by_status unless params[:q]
+    filter_by_team if @team
     filter_by_labels if params[:labels]
+    filter_by_query if params[:q]
 
     mine_count, unassigned_count, all_count = set_count_for_all_conversations
 
@@ -60,25 +63,40 @@ class ConversationFinder
     @assignee_type = params[:assignee_type]
   end
 
+  def set_team
+    @team = current_account.teams.find(params[:team_id]) if params[:team_id]
+  end
+
   def find_all_conversations
-    @conversations = current_account.conversations.includes(
-      :assignee, :inbox, contact: [:avatar_attachment]
-    ).where(inbox_id: @inbox_ids)
+    @conversations = current_account.conversations.where(inbox_id: @inbox_ids)
   end
 
   def filter_by_assignee_type
-    if @assignee_type == 'me'
+    case @assignee_type
+    when 'me'
       @conversations = @conversations.assigned_to(current_user)
-    elsif @assignee_type == 'unassigned'
+    when 'unassigned'
       @conversations = @conversations.unassigned
     end
     @conversations
   end
 
+  def filter_by_query
+    allowed_message_types = [Message.message_types[:incoming], Message.message_types[:outgoing]]
+    @conversations = conversations.joins(:messages).where('messages.content ILIKE :search', search: "%#{params[:q]}%")
+                                  .where(messages: { message_type: allowed_message_types }).includes(:messages)
+                                  .where('messages.content ILIKE :search', search: "%#{params[:q]}%")
+                                  .where(messages: { message_type: allowed_message_types })
+  end
+
   def filter_by_status
     @conversations = @conversations.where(status: params[:status] || DEFAULT_STATUS)
   end
 
+  def filter_by_team
+    @conversations = @conversations.where(team: @team)
+  end
+
   def filter_by_labels
     @conversations = @conversations.tagged_with(params[:labels], any: true)
   end
@@ -96,6 +114,9 @@ class ConversationFinder
   end
 
   def conversations
+    @conversations = @conversations.includes(
+      :taggings, :inbox, { assignee: { avatar_attachment: [:blob] } }, { contact: { avatar_attachment: [:blob] } }
+    )
     current_page ? @conversations.latest.page(current_page) : @conversations.latest
   end
 end

app/finders/message_finder.rb

@@ -11,7 +11,7 @@ class MessageFinder
   private
 
   def conversation_messages
-    @conversation.messages.includes(:attachments, user: { avatar_attachment: :blob })
+    @conversation.messages.includes(:attachments, :sender, sender: { avatar_attachment: [:blob] })
   end
 
   def messages

app/helpers/file_type_helper.rb

@@ -9,6 +9,8 @@ module FileTypeHelper
       'image/bmp'
     ].include?(content_type)
 
+    return :audio if content_type.include?('audio/')
+
     :file
   end
 end

app/javascript/dashboard/App.vue

@@ -8,7 +8,6 @@
 </template>
 
 <script>
-import Vue from 'vue';
 import { mapGetters } from 'vuex';
 import WootSnackbarBox from './components/SnackbarContainer';
 import { accountIdFromPathname } from './helper/URLHelper';
@@ -28,10 +27,15 @@ export default {
 
   mounted() {
     this.$store.dispatch('setUser');
+    this.setLocale(window.chatwootConfig.selectedLocale);
     this.initializeAccount();
   },
 
   methods: {
+    setLocale(locale) {
+      this.$root.$i18n.locale = locale;
+    },
+
     async initializeAccount() {
       const { pathname } = window.location;
       const accountId = accountIdFromPathname(pathname);
@@ -39,7 +43,7 @@ export default {
       if (accountId) {
         await this.$store.dispatch('accounts/get');
         const { locale } = this.getAccount(accountId);
-        Vue.config.lang = locale;
+        this.setLocale(locale);
       }
     },
   },

app/javascript/dashboard/api/account.js

@@ -1,9 +1,14 @@
+/* global axios */
 import ApiClient from './ApiClient';
 
 class AccountAPI extends ApiClient {
   constructor() {
     super('', { accountScoped: true });
   }
+
+  createAccount(data) {
+    return axios.post(`${this.apiVersion}/accounts`, data);
+  }
 }
 
 export default new AccountAPI();

app/javascript/dashboard/api/auth.js

@@ -26,7 +26,8 @@ export default {
     const fetchPromise = new Promise((resolve, reject) => {
       axios
         .post(urlData.url, {
-          account_name: creds.name,
+          account_name: creds.accountName.trim(),
+          user_full_name: creds.fullName.trim(),
           email: creds.email,
         })
         .then(response => {
@@ -60,7 +61,9 @@ export default {
   },
 
   isLoggedIn() {
-    return !!Cookies.getJSON('auth_data');
+    const hasAuthCookie = !!Cookies.getJSON('auth_data');
+    const hasUserCookie = !!Cookies.getJSON('user');
+    return hasAuthCookie && hasUserCookie;
   },
 
   isAdmin() {
@@ -78,7 +81,9 @@ export default {
   },
   getPubSubToken() {
     if (this.isLoggedIn()) {
-      return Cookies.getJSON('user').pubsub_token;
+      const user = Cookies.getJSON('user') || {};
+      const { pubsub_token: pubsubToken } = user;
+      return pubsubToken;
     }
     return null;
   },
@@ -118,7 +123,12 @@ export default {
     return axios.post(urlData.url, { email });
   },
 
-  profileUpdate({ password, password_confirmation, ...profileAttributes }) {
+  profileUpdate({
+    password,
+    password_confirmation,
+    displayName,
+    ...profileAttributes
+  }) {
     const formData = new FormData();
     Object.keys(profileAttributes).forEach(key => {
       const value = profileAttributes[key];
@@ -126,10 +136,23 @@ export default {
         formData.append(`profile[${key}]`, value);
       }
     });
+    formData.append('profile[display_name]', displayName || '');
     if (password && password_confirmation) {
       formData.append('profile[password]', password);
       formData.append('profile[password_confirmation]', password_confirmation);
     }
     return axios.put(endPoints('profileUpdate').url, formData);
   },
+
+  updateUISettings({ uiSettings }) {
+    return axios.put(endPoints('profileUpdate').url, {
+      profile: { ui_settings: uiSettings },
+    });
+  },
+
+  updateAvailability({ availability }) {
+    return axios.put(endPoints('profileUpdate').url, {
+      profile: { availability },
+    });
+  },
 };