Merge branch 'release/2.0.2'

- fixes issues with conversation assignment notifications not working in certain cases

.bundler-audit.yml

@@ -0,0 +1,3 @@
+---
+ignore:
+  - CVE-2021-41098 # https://github.com/chatwoot/chatwoot/issues/3097 (update once azure blob storage is updated)

.circleci/config.yml

@@ -7,7 +7,7 @@ defaults: &defaults
   working_directory: ~/build
   docker:
     # specify the version you desire here
-    - image: circleci/ruby:2.7.1-node-browsers
+    - image: cimg/ruby:3.0.2-browsers
 
     # Specify service dependencies here if necessary
     # CircleCI maintains a library of pre-built images
@@ -40,20 +40,20 @@ jobs:
 
       - restore_cache:
           keys:
-            - chatwoot-bundle-{{ checksum "Gemfile.lock" }}
+            - chatwoot-bundle-{{ .Environment.CACHE_VERSION }}-{{ checksum "Gemfile.lock" }}
             - chatwoot-bundle
 
       - run: bundle install --frozen --path ~/.bundle
       - save_cache:
           paths:
             - ~/.bundle
-          key: chatwoot-bundle-{{ checksum "Gemfile.lock" }}
+          key: chatwoot-bundle-{{ .Environment.CACHE_VERSION }}-{{ checksum "Gemfile.lock" }}
 
 
       # Only necessary if app uses webpacker or yarn in some other way
       - restore_cache:
           keys:
-            - chatwoot-yarn-{{ checksum "yarn.lock" }}
+            - chatwoot-yarn-{{ .Environment.CACHE_VERSION }}-{{ checksum "yarn.lock" }}
             - chatwoot-yarn-
 
       - run:
@@ -62,7 +62,7 @@ jobs:
 
       # Store yarn / webpacker cache
       - save_cache:
-          key: chatwoot-yarn-{{ checksum "yarn.lock" }}
+          key: chatwoot-yarn-{{ .Environment.CACHE_VERSION }}-{{ checksum "yarn.lock" }}
           paths:
             - ~/.cache/yarn
 
@@ -77,6 +77,18 @@ jobs:
           paths:
             - cc-test-reporter
 
+      # verify swagger specification
+      - run:
+          name: Verify swagger API specification
+          command: |
+            bundle exec rake swagger:build
+            if [[ `git status swagger/swagger.json --porcelain` ]]
+            then
+              echo "ERROR: The swagger.json file is not in sync with the yaml specification. Run 'rake swagger:build' and commit 'swagger/swagger.json'."
+              exit 1
+            fi
+            curl -L https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/5.3.0/openapi-generator-cli-5.3.0.jar > ~/tmp/openapi-generator-cli-5.3.0.jar
+            java -jar ~/tmp/openapi-generator-cli-5.3.0.jar validate -i swagger/swagger.json
       # Database setup
       - run: yarn install --check-files
       - run: bundle exec rake db:create

.codeclimate.yml

@@ -1,4 +1,4 @@
-version: "2"
+version: '2'
 plugins:
   rubocop:
     enabled: false
@@ -14,19 +14,33 @@ plugins:
 checks:
   similar-code:
     enabled: false
+  method-count:
+    enabled: true
+    config:
+      threshold: 32
+  file-lines:
+    enabled: true
+    config:
+      threshold: 300
 exclude_patterns:
-  - "spec/"
-  - "**/specs/"
-  - "db/*"
-  - "bin/**/*"
-  - "db/**/*"
-  - "config/**/*"
-  - "public/**/*"
-  - "vendor/**/*"
-  - "node_modules/**/*"
-  - "lib/tasks/auto_annotate_models.rake"
-  - "app/test-matchers.js"
-  - "docs/*"
-  - "**/*.md"
-  - "**/*.yml"
-  - "app/javascript/dashboard/i18n/locale"
+  - 'spec/'
+  - '**/specs/'
+  - 'db/*'
+  - 'bin/**/*'
+  - 'db/**/*'
+  - 'config/**/*'
+  - 'public/**/*'
+  - 'vendor/**/*'
+  - 'node_modules/**/*'
+  - 'lib/tasks/auto_annotate_models.rake'
+  - 'app/test-matchers.js'
+  - 'docs/*'
+  - '**/*.md'
+  - '**/*.yml'
+  - 'app/javascript/dashboard/i18n/locale'
+  - '**/*.stories.js'
+  - 'stories/'
+  - 'app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/index.js'
+  - 'app/javascript/shared/constants/countries.js'
+  - 'app/javascript/dashboard/components/widgets/conversation/advancedFilterItems/languages.js'
+  - 'app/javascript/dashboard/routes/dashboard/contacts/contactFilterItems/index.js'

.devcontainer/Dockerfile

@@ -0,0 +1,8 @@
+# The below image is created out of the Dockerfile.base
+# It has the dependencies already installed so that codespace will boot up fast
+FROM ghcr.io/chatwoot/chatwoot_codespace:latest
+
+# Do the set up required for chatwoot app 
+WORKDIR /workspace
+COPY . /workspace
+RUN yarn && gem install bundler && bundle install 

.devcontainer/Dockerfile.base

@@ -0,0 +1,45 @@
+# pre-build stage
+ARG VARIANT=3
+FROM mcr.microsoft.com/vscode/devcontainers/ruby:${VARIANT}
+
+# Update args in docker-compose.yaml to set the UID/GID of the "vscode" user.
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+RUN if [ "$USER_GID" != "1000" ] || [ "$USER_UID" != "1000" ]; then \
+        groupmod --gid $USER_GID vscode \
+        && usermod --uid $USER_UID --gid $USER_GID vscode \
+        && chmod -R $USER_UID:$USER_GID /home/vscode; \
+    fi
+
+# [Option] Install Node.js
+ARG INSTALL_NODE="true"
+ARG NODE_VERSION="lts/*"
+RUN if [ "${INSTALL_NODE}" = "true" ]; then su vscode -c "source /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi
+
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+  && apt-get -y install --no-install-recommends \
+    libssl-dev \
+    tar \
+    tzdata \
+    postgresql-client \
+    yarn \
+    git \
+    imagemagick \
+    tmux \
+    zsh
+
+
+# Install overmind
+RUN curl -L https://github.com/DarthSim/overmind/releases/download/v2.1.0/overmind-v2.1.0-linux-amd64.gz > overmind.gz \
+  && gunzip overmind.gz \
+  && sudo mv overmind /usr/local/bin \
+  && chmod +x /usr/local/bin/overmind 
+
+# Do the set up required for chatwoot app 
+WORKDIR /workspace
+COPY . /workspace
+RUN yarn
+
+COPY Gemfile Gemfile.lock ./
+RUN gem install bundler && bundle install
+

.devcontainer/devcontainer.json

@@ -0,0 +1,39 @@
+{
+  "name": "Chatwoot Development Codespace",
+  "service": "app",
+  "dockerComposeFile": "docker-compose.yml",
+
+  "settings": {
+    "terminal.integrated.shell.linux": "/bin/zsh"
+  },
+
+
+  // Add the IDs of extensions you want installed when the container is created.
+  "extensions": [
+    "rebornix.Ruby",
+    "misogi.ruby-rubocop",
+    "wingrunr21.vscode-ruby",
+    "davidpallinder.rails-test-runner",
+    "eamodio.gitlens",
+    "github.copilot",
+    "mrmlnc.vscode-duplicate"
+  ],
+
+
+  // 5432 postgres
+  // 6379 redis
+  // 1025,8025 mailhog
+  "forwardPorts": [8025],
+  //your application may need to listen on all interfaces (0.0.0.0) not just localhost for it to be available externally. Defaults to []
+  "appPort": [3000, 3035],
+
+  "postCreateCommand": ".devcontainer/scripts/setup.sh && bundle exec rake db:chatwoot_prepare && yarn",
+  "portsAttributes": {
+    "3000": {
+      "label": "Rails Server"
+    },
+    "8025": {
+      "label": "Mailhog UI"
+    }
+  },
+}

.devcontainer/docker-compose.yml

@@ -0,0 +1,56 @@
+# https://github.com/microsoft/vscode-dev-containers/blob/master/containers/python-3-postgres/.devcontainer/docker-compose.yml
+# https://github.com/microsoft/vscode-dev-containers/blob/master/containers/ruby-rails/.devcontainer/devcontainer.json
+# 
+
+version: '3'
+
+services:
+  app: 
+    build:
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
+      args:
+        # Update 'VARIANT' to pick a Ruby version: https://github.com/microsoft/vscode-dev-containers/tree/main/containers/ruby
+        VARIANT: 3
+        # [Choice] Install Node.js
+        INSTALL_NODE: "true"
+        NODE_VERSION: "lts/*"
+        # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000.
+        USER_UID: 1000
+        USER_GID: 1000
+
+    volumes:
+      - ..:/workspace:cached
+  
+    # Overrides default command so things don't shut down after the process ends.
+    command: sleep infinity
+    
+    # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function.
+    network_mode: service:db
+
+  db:
+    image: postgres:latest
+    restart: unless-stopped
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD: postgres
+
+  redis:
+    image: redis:latest
+    restart: unless-stopped
+    network_mode: service:db
+    volumes:
+      - redis-data:/data
+
+  mailhog:
+    restart: unless-stopped
+    image: mailhog/mailhog
+    network_mode: service:db
+  
+volumes:
+  postgres-data:
+  redis-data:
+  

.devcontainer/scripts/setup.sh

@@ -0,0 +1,8 @@
+cp .env.example .env
+sed -i -e '/REDIS_URL/ s/=.*/=redis:\/\/localhost:6379/' .env
+sed -i -e '/POSTGRES_HOST/ s/=.*/=localhost/' .env
+sed -i -e '/SMTP_ADDRESS/ s/=.*/=localhost/' .env
+sed -i -e "/FRONTEND_URL/ s/=.*/=https:\/\/$CODESPACE_NAME-3000.githubpreview.dev/" .env
+sed -i -e "/WEBPACKER_DEV_SERVER_PUBLIC/ s/=.*/=https:\/\/$CODESPACE_NAME-3035.githubpreview.dev/" .env
+# uncomment the webpacker env variable
+sed -i -e '/WEBPACKER_DEV_SERVER_PUBLIC/s/^# //' .env

.env.example

@@ -4,6 +4,10 @@ SECRET_KEY_BASE=replace_with_lengthy_secure_hex
 # Replace with the URL you are planning to use for your app
 FRONTEND_URL=http://0.0.0.0:3000
 
+# If the variable is set, all non-authenticated pages would fallback to the default locale.
+# Whenever a new account is created, the default language will be DEFAULT_LOCALE instead of en
+# DEFAULT_LOCALE=en
+
 # If you plan to use CDN for your assets, set Asset CDN Host
 ASSET_CDN_HOST=
 
@@ -14,7 +18,7 @@ FORCE_SSL=false
 # true : default option, allows sign ups
 # false : disables all the end points related to sign ups
 # api_only: disables the UI for signup, but you can create sign ups via the account apis
-ENABLE_ACCOUNT_SIGNUP=true
+ENABLE_ACCOUNT_SIGNUP=false
 
 # Redis config
 REDIS_URL=redis://redis:6379
@@ -22,6 +26,11 @@ REDIS_URL=redis://redis:6379
 # which will be the password for the redis service running inside the docker-compose
 # to make it secure
 REDIS_PASSWORD=
+# Redis Sentinel can be used by passing list of sentinel host and ports e,g. sentinel_host1:port1,sentinel_host2:port2
+REDIS_SENTINELS=
+# Redis sentinel master name is required when using sentinel, default value is "mymaster".
+# You can find list of master using "SENTINEL masters" command
+REDIS_SENTINEL_MASTER_NAME=
 
 # Postgres Database config variables
 POSTGRES_HOST=postgres
@@ -30,28 +39,38 @@ POSTGRES_PASSWORD=
 RAILS_ENV=development
 RAILS_MAX_THREADS=5
 
-# Mail outgoing
-MAILER_SENDER_EMAIL=accounts@chatwoot.com
-SMTP_PORT=1025
+# The email from which all outgoing emails are sent
+# could user either  `email@yourdomain.com` or `BrandName <email@yourdomain.com>`
+MAILER_SENDER_EMAIL="Chatwoot <accounts@chatwoot.com>"
+
+
+#SMTP domain key is set up for HELO checking
 SMTP_DOMAIN=chatwoot.com
-# if you are running docker-compose, set SMTP_ADDRESS value as "mailhog",
-# else set the value as "localhost"
+# the default value is set "mailhog" and is used by docker-compose for development environments,
+# Set the value as "localhost" or your SMTP address in other environments
 SMTP_ADDRESS=mailhog
+SMTP_PORT=1025
 SMTP_USERNAME=
 SMTP_PASSWORD=
+# plain,login,cram_md5
 SMTP_AUTHENTICATION=
-SMTP_ENABLE_STARTTLS_AUTO=
+SMTP_ENABLE_STARTTLS_AUTO=true
+# Can be: 'none', 'peer', 'client_once', 'fail_if_no_peer_cert', see http://api.rubyonrails.org/classes/ActionMailer/Base.html
+SMTP_OPENSSL_VERIFY_MODE=peer
+# Comment out the following environment variables if required by your SMTP server
+# SMTP_TLS=
+# SMTP_SSL=
 
 # Mail Incoming
 # This is the domain set for the reply emails when conversation continuity is enabled
 MAILER_INBOUND_EMAIL_DOMAIN=
 # Set this to appropriate ingress channel with regards to incoming emails
 # Possible values are :
-# :relay for Exim, Postfix, Qmail
-# :mailgun for Mailgun
-# :mandrill for Mandrill
-# :postmark for Postmark
-# :sendgrid for Sendgrid
+# relay for Exim, Postfix, Qmail
+# mailgun for Mailgun
+# mandrill for Mandrill
+# postmark for Postmark
+# sendgrid for Sendgrid
 RAILS_INBOUND_EMAIL_SERVICE=
 # Use one of the following based on the email ingress service
 # Ref: https://edgeguides.rubyonrails.org/action_mailbox_basics.html
@@ -69,8 +88,6 @@ AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_REGION=
 
-# Sentry
-SENTRY_DSN=
 
 # Log settings
 # Disable if you want to write logs to a file
@@ -86,6 +103,9 @@ FB_VERIFY_TOKEN=
 FB_APP_SECRET=
 FB_APP_ID=
 
+# https://developers.facebook.com/docs/messenger-platform/instagram/get-started#app-dashboard
+IG_VERIFY_TOKEN=
+
 # Twitter
 # documentation: https://www.chatwoot.com/docs/twitter-app-setup
 TWITTER_APP_ID=
@@ -99,7 +119,17 @@ SLACK_CLIENT_SECRET=
 
 ### Change this env variable only if you are using a custom build mobile app
 ## Mobile app env variables
-IOS_APP_ID=6C953F3RX2.com.chatwoot.app
+IOS_APP_ID=L7YLMN4634.com.chatwoot.app
+ANDROID_BUNDLE_ID=com.chatwoot.app
+
+# https://developers.google.com/android/guides/client-auth (use keytool to print the fingerprint in the first section)
+ANDROID_SHA256_CERT_FINGERPRINT=AC:73:8E:DE:EB:56:EA:CC:10:87:02:A7:65:37:7B:38:D4:5D:D4:53:F8:3B:FB:D3:C6:28:64:1D:AA:08:1E:D8
+
+
+### Smart App Banner
+# https://developer.apple.com/library/archive/documentation/AppleApplications/Reference/SafariWebContent/PromotingAppswithAppBanners/PromotingAppswithAppBanners.html
+# You can find your app-id in https://itunesconnect.apple.com
+#IOS_APP_IDENTIFIER=1495796682
 
 ## Push Notification
 ## generate a new key value here : https://d3v.one/vapid-key-generator/
@@ -112,6 +142,49 @@ IOS_APP_ID=6C953F3RX2.com.chatwoot.app
 ## Bot Customizations
 USE_INBOX_AVATAR_FOR_BOT=true
 
+
+### APM and Error Monitoring configurations
+## Sentry
+# SENTRY_DSN=
+
+## Scout
+## https://scoutapm.com/docs/ruby/configuration
+# SCOUT_KEY=YOURKEY
+# SCOUT_NAME=YOURAPPNAME (Production)
+# SCOUT_MONITOR=true
+
+## NewRelic
+# https://docs.newrelic.com/docs/agents/ruby-agent/configuration/ruby-agent-configuration/
+# NEW_RELIC_LICENSE_KEY=
+
+## Datadog
+## https://github.com/DataDog/dd-trace-rb/blob/master/docs/GettingStarted.md#environment-variables
+# DD_TRACE_AGENT_URL=
+
+
+
+## IP look up configuration
+## ref https://github.com/alexreisner/geocoder/blob/master/README_API_GUIDE.md
+## works only on accounts with ip look up feature enabled
+# IP_LOOKUP_SERVICE=geoip2
+# maxmindb api key to use geoip2 service
+# IP_LOOKUP_API_KEY=
+
+## Rack Attack configuration
+## To prevent and throttle abusive requests
+# ENABLE_RACK_ATTACK=true
+
+
+## Running chatwoot as an API only server
+## setting this value to true will disable the frontend dashboard endpoints
+# CW_API_ONLY_SERVER=false
+
 ## Development Only Config
 # if you want to use letter_opener for local emails
 # LETTER_OPENER=true
+# meant to be used in github codespaces
+# WEBPACKER_DEV_SERVER_PUBLIC=
+
+# If you want to use official mobile app,
+# the notifications would be relayed via a Chatwoot server
+ENABLE_PUSH_RELAY_SERVER=true

.eslintrc.js

@@ -28,6 +28,7 @@ module.exports = {
     }],
     'vue/html-self-closing': 'off',
     "vue/no-v-html": 'off',
+    'vue/singleline-html-element-content-newline': 'off',
     'import/extensions': ['off']
 
   },

.github/ISSUE_TEMPLATE/bug_report.md

@@ -26,6 +26,14 @@ A clear and concise description of what you expected to happen.
 
 If applicable, add screenshots to help explain your problem.
 
+**Browser logs**
+
+Share the browser logs to debug the issue further
+
+**Server logs**
+
+Share the server logs to debug the issue further
+
 **Environment**
 
 Describe whether you are using Chatwoot Cloud (app.chatwoot.com) or a self hosted installation of Chatwoot. If you are using a self hosted installation of Chatwoot describe the type of deployment (Docker/Linux VM installation/Heroku)

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,9 +24,9 @@ Please describe the tests that you ran to verify your changes. Provide instructi
 
 - [ ] My code follows the style guidelines of this project
 - [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have commented on my code, particularly in hard-to-understand areas
 - [ ] I have made corresponding changes to the documentation
 - [ ] My changes generate no new warnings
 - [ ] I have added tests that prove my fix is effective or that my feature works
 - [ ] New and existing unit tests pass locally with my changes
-- [ ] Any dependent changes have been merged and published in downstream modules
+- [ ] Any dependent changes have been merged and published in downstream modules

.github/workflows/publish_codespace_image.yml

@@ -0,0 +1,23 @@
+name: Publish Codespace Base Image
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish-code-space-image:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v1
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Build the Codespace Base Image
+      run: |
+        docker build . -t ghcr.io/chatwoot/chatwoot_codespace:latest -f .devcontainer/Dockerfile.base 
+        docker push ghcr.io/chatwoot/chatwoot_codespace:latest

.gitignore

@@ -16,6 +16,7 @@
 /tmp/*
 !/log/.keep
 !/tmp/.keep
+*.mmdb
 
 # Ignore Byebug command history file.
 .byebug_history
@@ -23,7 +24,7 @@
 *.log
 # Ignore application configuration
 node_modules
-
+master.key
 *.rdb
 
 # Ignore env files
@@ -58,4 +59,7 @@ package-lock.json
 
 
 # cypress
-test/cypress/videos/*
+test/cypress/videos/*
+
+/config/master.key
+/config/*.enc

.husky/pre-commit

@@ -0,0 +1,5 @@
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+npm run eslint
+bundle exec rubocop -a
+git add

.husky/pre-push

@@ -0,0 +1,4 @@
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
+sh bin/validate_push

.nvmrc

@@ -1 +1 @@
-12.16.1
+14.17.4

.prettierrc

@@ -1,5 +1,6 @@
 {
   "printWidth": 80,
   "singleQuote": true,
-  "trailingComma": "es5"
+  "trailingComma": "es5",
+  "arrowParens": "avoid"
 }

.rubocop.yml

@@ -11,6 +11,10 @@ Metrics/ClassLength:
   Max: 125
   Exclude:
     - 'app/models/conversation.rb'
+    - 'app/mailers/conversation_reply_mailer.rb'
+    - 'app/models/message.rb'
+    - 'app/builders/messages/facebook/message_builder.rb'
+    - 'app/controllers/api/v1/accounts/contacts_controller.rb'
 RSpec/ExampleLength:
   Max: 25
 Style/Documentation:
@@ -22,12 +26,13 @@ Style/FrozenStringLiteralComment:
 Style/SymbolArray:
   Enabled: false
 Style/OptionalBooleanParameter:
-  Exclude: 
+  Exclude:
     - 'app/services/email_templates/db_resolver_service.rb'
     - 'app/dispatchers/dispatcher.rb'
 Style/GlobalVars:
   Exclude:
-    - 'config/initializers/redis.rb'
+    - 'config/initializers/01_redis.rb'
+    - 'config/initializers/rack_attack.rb'
     - 'lib/redis/alfred.rb'
     - 'lib/global_config.rb'
 Style/ClassVars:
@@ -36,18 +41,36 @@ Style/ClassVars:
 Lint/MissingSuper:
   Exclude:
     - 'app/drops/base_drop.rb'
+Lint/SymbolConversion:
+  Enabled: false
+Lint/EmptyBlock:
+  Exclude:
+    - 'app/views/api/v1/accounts/conversations/toggle_status.json.jbuilder'
+Lint/OrAssignmentToConstant:
+  Exclude:
+    - 'lib/redis/config.rb'
 Metrics/BlockLength:
   Exclude:
     - spec/**/*
     - '**/routes.rb'
     - 'config/environments/*'
     - db/schema.rb
+Metrics/ModuleLength:
+  Exclude:
+    - lib/seeders/message_seeder.rb
 Rails/ApplicationController:
   Exclude:
     - 'app/controllers/api/v1/widget/messages_controller.rb'
     - 'app/controllers/dashboard_controller.rb'
     - 'app/controllers/widget_tests_controller.rb'
     - 'app/controllers/widgets_controller.rb'
+    - 'app/controllers/platform_controller.rb'
+    - 'app/controllers/public_controller.rb'
+    - 'app/controllers/survey/responses_controller.rb'
+Rails/EnvironmentVariableAccess:
+  Enabled: false
+Rails/TimeZoneAssignment:
+  Enabled: false
 Style/ClassAndModuleChildren:
   EnforcedStyle: compact
   Exclude:
@@ -57,9 +80,14 @@ RSpec/NestedGroups:
   Max: 4
 RSpec/MessageSpies:
   Enabled: false
+RSpec/StubbedMock:
+  Enabled: false
+Naming/VariableNumber:
+  Enabled: false
 Metrics/MethodLength:
   Exclude:
     - 'db/migrate/20161123131628_devise_token_auth_create_users.rb'
+    - 'db/migrate/20211219031453_update_foreign_keys_on_delete.rb'
 Rails/CreateTableWithTimestamps:
   Exclude:
     - 'db/migrate/20170207092002_acts_as_taggable_on_migration.acts_as_taggable_on_engine.rb'
@@ -70,10 +98,12 @@ Style/GuardClause:
     - 'app/models/message.rb'
     - 'db/migrate/20190819005836_add_missing_indexes_on_taggings.acts_as_taggable_on_engine.rb'
 Metrics/AbcSize:
-  Exclude: 
+  Exclude:
     - 'app/controllers/concerns/auth_helper.rb'
     - 'db/migrate/20190819005836_add_missing_indexes_on_taggings.acts_as_taggable_on_engine.rb'
     - 'db/migrate/20161123131628_devise_token_auth_create_users.rb'
+    - 'app/controllers/api/v1/accounts/inboxes_controller.rb'
+    - 'db/migrate/20211219031453_update_foreign_keys_on_delete.rb'
 Metrics/CyclomaticComplexity:
   Max: 7
   Exclude:
@@ -98,18 +128,25 @@ Rails/BulkChangeTable:
     - 'db/migrate/20170511134418_latlong.rb'
     - 'db/migrate/20191027054756_create_contact_inboxes.rb'
     - 'db/migrate/20191130164019_add_template_type_to_messages.rb'
-Rails/UniqueValidationWithoutIndex: 
+    - 'db/migrate/20210425093724_convert_integration_hook_settings_field.rb'
+Rails/UniqueValidationWithoutIndex:
   Exclude:
     - 'app/models/channel/twitter_profile.rb'
     - 'app/models/webhook.rb'
+    - 'app/models/contact.rb'
+    - 'app/models/integrations/hook.rb'
 Rails/RenderInline:
   Exclude:
     - 'app/controllers/swagger_controller.rb'
+Performance/CollectionLiteralInLoop:
+  Exclude:
+    - 'db/migrate/20210315101919_enable_email_channel.rb'
 RSpec/NamedSubject:
   Enabled: false
 # we should bring this down
 RSpec/MultipleMemoizedHelpers:
   Max: 12
+
 AllCops:
   NewCops: enable
   Exclude:
@@ -124,3 +161,11 @@ AllCops:
     - 'tmp/**/*'
     - 'storage/**/*'
     - 'db/migrate/20200225162150_init_schema.rb'
+    - 'db/migrate/20210611180222_create_active_storage_variant_records.active_storage.rb'
+    - 'db/migrate/20210611180221_add_service_name_to_active_storage_blobs.active_storage.rb'
+    - db/migrate/20200309213132_add_account_id_to_agent_bot_inboxes.rb
+    - db/migrate/20200331095710_add_identifier_to_contact.rb
+    - db/migrate/20200429082655_add_medium_to_twilio_sms.rb
+    - db/migrate/20200503151130_add_account_feature_flag.rb
+    - db/migrate/20200927135222_add_last_activity_at_to_conversation.rb
+    - db/migrate/20210306170117_add_last_activity_at_to_contacts.rb

.rubocop_todo.yml

@@ -6,13 +6,6 @@
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 1
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: native, lf, crlf
-Layout/EndOfLine:
-  Exclude:
-    - 'deploy/after_restart.rb'
-
 # Offense count: 1
 Lint/DuplicateMethods:
   Exclude:

.ruby-version

@@ -1 +1 @@
-2.7.1
+3.0.2

.storybook/main.js

@@ -0,0 +1,44 @@
+const path = require('path');
+const resolve = require('../config/webpack/resolve');
+
+// Chatwoot's webpack.config.js
+process.env.NODE_ENV = 'development';
+const custom = require('../config/webpack/environment');
+
+module.exports = {
+  stories: [
+    '../stories/**/*.stories.mdx',
+    '../app/javascript/**/*.stories.@(js|jsx|ts|tsx)',
+  ],
+  addons: [
+    {
+      name: '@storybook/addon-docs',
+      options: {
+        vueDocgenOptions: {
+          alias: {
+            '@': path.resolve(__dirname, '../'),
+          },
+        },
+      },
+    },
+    '@storybook/addon-links',
+    '@storybook/addon-essentials',
+  ],
+  webpackFinal: config => {
+    const newConfig = {
+      ...config,
+      resolve: {
+        ...config.resolve,
+        modules: custom.resolvedModules.map(i => i.value),
+      },
+    };
+
+    newConfig.module.rules.push({
+      test: /\.scss$/,
+      use: ['style-loader', 'css-loader', 'sass-loader'],
+      include: path.resolve(__dirname, '../app/javascript'),
+    });
+
+    return newConfig;
+  },
+};

.storybook/preview.js

@@ -0,0 +1,42 @@
+import { addDecorator } from '@storybook/vue';
+import Vue from 'vue';
+import Vuex from 'vuex';
+import VueI18n from 'vue-i18n';
+import Vuelidate from 'vuelidate';
+import Multiselect from 'vue-multiselect';
+
+import WootUiKit from '../app/javascript/dashboard/components';
+import i18n from '../app/javascript/dashboard/i18n';
+
+import '../app/javascript/dashboard/assets/scss/storybook.scss';
+
+Vue.use(VueI18n);
+Vue.use(Vuelidate);
+Vue.use(WootUiKit);
+Vue.use(Vuex);
+Vue.component('multiselect', Multiselect);
+
+const store = new Vuex.Store({});
+const i18nConfig = new VueI18n({
+  locale: 'en',
+  messages: i18n,
+});
+
+addDecorator(() => ({
+  template: '<story/>',
+  i18n: i18nConfig,
+  store,
+  beforeCreate: function() {
+    this.$root._i18n = this.$i18n;
+  },
+}));
+
+export const parameters = {
+  actions: { argTypesRegex: '^on[A-Z].*' },
+  controls: {
+    matchers: {
+      color: /(background|color)$/i,
+      date: /Date$/,
+    },
+  },
+};

CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+hello@chatwoot.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -0,0 +1,5 @@
+# Contributing to Chatwoot
+
+Thanks for taking the time to contribute! :tada::+1:
+
+Please refer to our [Contributing Guide](https://www.chatwoot.com/docs/contributing-guide) for detailed instructions. 

Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-ruby '2.7.1'
+ruby '3.0.2'
 
 ##-- base gems for rails --##
 gem 'rack-cors', require: 'rack/cors'
@@ -27,21 +27,30 @@ gem 'uglifier'
 gem 'flag_shih_tzu'
 # Random name generator for user names
 gem 'haikunator'
-# Template parsing safetly
+# Template parsing safely
 gem 'liquid'
+# Parse Markdown to HTML
+gem 'commonmarker'
+# Validate Data against JSON Schema
+gem 'json_schemer'
+# Rack middleware for blocking & throttling abusive requests
+gem 'rack-attack'
+# a utility tool for streaming, flexible and safe downloading of remote files
+gem 'down', '~> 5.0'
 
 ##-- for active storage --##
 gem 'aws-sdk-s3', require: false
 gem 'azure-storage-blob', require: false
 gem 'google-cloud-storage', require: false
-gem 'mini_magick'
+gem 'image_processing'
 
 ##-- gems for database --#
 gem 'groupdate'
 gem 'pg'
 gem 'redis'
 gem 'redis-namespace'
-gem 'redis-rack-cache'
+# super fast record imports in bulk
+gem 'activerecord-import'
 
 ##--- gems for server & infra configuration ---##
 gem 'dotenv-rails'
@@ -53,6 +62,7 @@ gem 'barnes'
 
 ##--- gems for authentication & authorization ---##
 gem 'devise'
+gem 'devise-secure_password', '~> 2.0', git: 'https://github.com/chatwoot/devise-secure_password'
 gem 'devise_token_auth'
 # authorization
 gem 'jwt'
@@ -66,8 +76,8 @@ gem 'wisper', '2.0.0'
 
 ##--- gems for channels ---##
 # TODO: bump up gem to 2.0
-gem 'facebook-messenger', '1.5.0'
-gem 'telegram-bot-ruby'
+gem 'facebook-messenger'
+gem 'line-bot-api'
 gem 'twilio-ruby', '~> 5.32.0'
 # twitty will handle subscription of twitter account events
 # gem 'twitty', git: 'https://github.com/chatwoot/twitty'
@@ -76,20 +86,50 @@ gem 'twitty'
 gem 'koala'
 # slack client
 gem 'slack-ruby-client'
+# for dialogflow integrations
+gem 'google-cloud-dialogflow'
 
 ##--- gems for debugging and error reporting ---##
 # static analysis
 gem 'brakeman'
+
+##-- apm and error monitoring ---#
+gem 'ddtrace'
+gem 'newrelic_rpm'
 gem 'scout_apm'
-gem 'sentry-raven'
+gem 'sentry-rails'
+gem 'sentry-ruby'
+gem 'sentry-sidekiq'
 
 ##-- background job processing --##
 gem 'sidekiq'
+# We want cron jobs
+gem 'sidekiq-cron'
 
 ##-- Push notification service --##
 gem 'fcm'
 gem 'webpush'
 
+##-- geocoding / parse location from ip --##
+# http://www.rubygeocoder.com/
+gem 'geocoder'
+# to parse maxmind db
+gem 'maxminddb'
+
+# to create db triggers
+gem 'hairtrigger'
+
+gem 'procore-sift'
+
+# parse email
+gem 'email_reply_trimmer'
+gem 'html2text'
+
+group :production, :staging do
+  # we dont want request timing out in development while using byebug
+  gem 'rack-timeout'
+end
+
 group :development do
   gem 'annotate'
   gem 'bullet'
@@ -97,7 +137,7 @@ group :development do
   gem 'web-console'
 
   # used in swagger build
-  gem 'json_refs', git: 'https://github.com/tzmfreedom/json_refs', ref: 'e32deb0'
+  gem 'json_refs'
 
   # When we want to squash migrations
   gem 'squasher'
@@ -108,28 +148,33 @@ group :test do
   gem 'cypress-on-rails', '~> 1.0'
   # fast cleaning of database
   gem 'database_cleaner'
+  # mock http calls
+  gem 'webmock'
 end
 
 group :development, :test do
-  # locking until https://github.com/codeclimate/test-reporter/issues/418 is resolved
-  gem 'action-cable-testing'
+  # TODO: is this needed ?
+  # errors thrown by devise password gem
+  gem 'flay'
+  gem 'rspec'
+  # for error thrown by devise password gem
+  gem 'active_record_query_trace'
   gem 'bundle-audit', require: false
   gem 'byebug', platform: :mri
+  gem 'climate_control'
   gem 'factory_bot_rails'
   gem 'faker'
   gem 'listen'
-  gem 'mock_redis', git: 'https://github.com/sds/mock_redis', ref: '16d00789f0341a3aac35126c0ffe97a596753ff9'
+  gem 'mock_redis'
   gem 'pry-rails'
-  gem 'rspec-rails', '~> 4.0.0.beta2'
+  gem 'rspec-rails', '~> 5.0.0'
   gem 'rubocop', require: false
   gem 'rubocop-performance', require: false
   gem 'rubocop-rails', require: false
   gem 'rubocop-rspec', require: false
-  gem 'scss_lint', require: false
   gem 'seed_dump'
   gem 'shoulda-matchers'
   gem 'simplecov', '0.17.1', require: false
   gem 'spring'
   gem 'spring-watcher-listen'
-  gem 'webmock'
 end

LICENSE

@@ -1,6 +1,10 @@
-The MIT License (MIT)
+Copyright (c) 2017-2021 Chatwoot Inc.
 
-Copyright (c) 2017-2020 ThoughtWoot Inc.
+Portions of this software are licensed as follows:
+
+* All content that resides under the "enterprise/" directory of this repository, if that directory exists, is licensed under the license defined in "enterprise/LICENSE".
+* All third party components incorporated into the Chatwoot Software are licensed under the original license provided by the owner of the applicable component.
+* Content outside of the above mentioned directories or restrictions above is available under the "MIT Expat" license as defined below.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Procfile

@@ -1,3 +1,3 @@
-release: bundle exec rails db:prepare
+release: bundle exec rails db:chatwoot_prepare
 web: bin/rails server -p $PORT -e $RAILS_ENV
 worker: bundle exec sidekiq -C config/sidekiq.yml

README.md

@@ -1,13 +1,15 @@
 <p align="center">
-  <img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/brand.svg" alt="Woot-logo" width="240">
+  <img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/brand.svg" alt="Woot-logo" width="240" />
 
-  <div align="center">A simple and elegant live chat software</div>
-  <div align="center">An opensource alternative to Intercom, Zendesk, Drift, Crisp etc.</div>
+  <p align="center">Customer engagement suite, an open-source alternative to Intercom, Zendesk, Salesforce Service Cloud etc.</p>
 </p>
 
 <p align="center">
   <a href="https://heroku.com/deploy?template=https://github.com/chatwoot/chatwoot/tree/master" alt="Deploy to Heroku">
-     <img alt="Deploy" src="https://www.herokucdn.com/deploy/button.svg"/>
+     <img width="150" alt="Deploy" src="https://www.herokucdn.com/deploy/button.svg"/>
+  </a>
+  <a href="https://marketplace.digitalocean.com/apps/chatwoot?refcode=f2238426a2a8" alt="Deploy to DigitalOcean">
+     <img width="200" alt="Deploy to DO" src="https://www.deploytodo.com/do-btn-blue.svg"/>
   </a>
 </p>
 
@@ -16,64 +18,69 @@ ___
 <p align="center">
   <a href="https://codeclimate.com/github/chatwoot/chatwoot/maintainability"><img src="https://api.codeclimate.com/v1/badges/80f9e1a7c72d186289ad/maintainability" alt="Maintainability"></a>
   <img src="https://img.shields.io/circleci/build/github/chatwoot/chatwoot" alt="CircleCI Badge">
+    <a href="https://hub.docker.com/r/chatwoot/chatwoot/"><img src="https://img.shields.io/docker/pulls/chatwoot/chatwoot" alt="Docker Pull Badge"></a>
   <a href="https://hub.docker.com/r/chatwoot/chatwoot/"><img src="https://img.shields.io/docker/cloud/build/chatwoot/chatwoot" alt="Docker Build Badge"></a>
-  <img src="https://img.shields.io/github/license/chatwoot/chatwoot" alt="License">
   <img src="https://img.shields.io/github/commit-activity/m/chatwoot/chatwoot" alt="Commits-per-month">
   <a title="Crowdin" target="_self" href="https://chatwoot.crowdin.com/chatwoot"><img src="https://badges.crowdin.net/e/37ced7eba411064bd792feb3b7a28b16/localized.svg"></a>
   <a href="https://discord.gg/cJXdrwS"><img src="https://img.shields.io/discord/647412545203994635" alt="Discord"></a>
+  <a href="https://huntr.dev/bounties/disclose"><img src="https://cdn.huntr.dev/huntr_security_badge_mono.svg" alt="Huntr"></a>
+  <a href="https://status.chatwoot.com"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fchatwoot%2Fstatus%2Fmaster%2Fapi%2Fchatwoot%2Fuptime.json" alt="uptime"></a>
+  <a href="https://status.chatwoot.com"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fchatwoot%2Fstatus%2Fmaster%2Fapi%2Fchatwoot%2Fresponse-time.json" alt="response time"></a>
 </p>
 
-<img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/chatwoot-dashboard-assets.png" width="100%" alt="Chat dashboard"/>
+<img src="https://chatwoot-public-assets.s3.amazonaws.com/github/screenshot.png" width="100%" alt="Chat dashboard"/>
 
-Chatwoot is an open-source omnichannel customer support software. The development of Chatwoot started in 2016. It failed to succeed as a business and eventually shut up shop in 2017. During 2019 #Hacktoberfest, the maintainers decided to make it open-source, instead of letting the code rust in a private repo. With a pleasant surprise, Chatwoot became a trending project on Hacker News and best of all, got lots of love from the community.
-Now, a failed project is back on track and the prospects are looking great. The team is back to working on the project and this time, we are building it in the open. Thanks to the ideas and contributions from the community.
 
----
 
-### Features
+Chatwoot is an open-source, self-hosted customer engagement suite. Chatwoot lets you view and manage your customer data, communicate with them irrespective of which medium they use, and re-engage them based on their profile.
 
-Chatwoot gives an integrated view of conversations happening in different communication channels. 
+## Features
 
-It supports the following conversation channels:
+Chatwoot supports the following conversation channels:
 
  - **Website**: Talk to your customers using our live chat widget and make use of our SDK to identify a user and provide contextual support.
  - **Facebook**: Connect your Facebook pages and start replying to the direct messages to your page.
+ - **Instagram**: Connect your Instagram profile and start replying to the direct messages.
  - **Twitter**: Connect your Twitter profiles and reply to direct messages or the tweets where you are mentioned.
- - **Whatsapp**: Connect your Whatsapp business account and manage the conversation in Chatwoot
- - **SMS**: Connect your Twilio SMS account and reply to the SMS queries in Chatwoot
+ - **Telegram**: Connect your Telegram bot and reply to your customers right from a single dashboard.
+ - **WhatsApp**: Connect your WhatsApp business account and manage the conversation in Chatwoot.
+ - **Line**: Connect your Line account and manage the conversations in Chatwoot.
+ - **SMS**: Connect your Twilio SMS account and reply to the SMS queries in Chatwoot.
  - **API Channel**: Build custom communication channels using our API channel.
- - **Email (beta)**: Forward all your email queries to Chatwoot and view it in our integrated dashboard.
+ - **Email**: Forward all your email queries to Chatwoot and view it in our integrated dashboard.
 
-Other features include: 
+And more.
 
-- **Multi-brand inboxes**: Manage multiple brands or pages using a single dashboard.
-- **Private notes**: Inter team communication is possible using private notes in a conversation.
+Other features include:
+
+- **CRM**: Save all your customer information right inside Chatwoot, use contact notes to log emails, phone calls, or meeting notes.
+- **Custom Attributes**: Define custom attribute attributes to store information about a contact or a conversation and extend the product to match your workflow.
+- **Shared multi-brand inboxes**: Manage multiple brands or pages using a shared inbox.
+- **Private notes**: Use @mentions and private notes to communicate internally about a conversation.
 - **Canned responses (Saved replies)**: Improve the response rate by adding saved replies for frequently asked questions.
-- **Conversation Labels**: Use conversation labelling to create custom workflows.
+- **Conversation Labels**: Use conversation labels to create custom workflows.
 - **Auto assignment**: Chatwoot intelligently assigns a ticket to the agents who have access to the inbox depending on their availability and load.
-- **Conversation continuity**: If the user has provided an email address through the chat widget, Chatwoot would send an email to the customer under the agent name so that the user can continue the conversation over the email.
+- **Conversation continuity**: If the user has provided an email address through the chat widget, Chatwoot will send an email to the customer under the agent name so that the user can continue the conversation over the email.
 - **Multi-lingual support**: Chatwoot supports 10+ languages.
 - **Powerful API & Webhooks**: Extend the capability of the software using Chatwoot’s webhooks and APIs.
 - **Integrations**: Chatwoot natively integrates with Slack right now. Manage your conversations in Slack without logging into the dashboard.
 
----
+## Documentation
 
-### Documentation
+Detailed documentation is available at [chatwoot.com/help-center](https://www.chatwoot.com/help-center).
 
-Detailed documentation is available at [www.chatwoot.com/help-center](https://www.chatwoot.com/help-center).
+## Translation process
 
----
+The translation process for Chatwoot web and mobile app is managed at [https://translate.chatwoot.com](https://translate.chatwoot.com) using Crowdin. Please read the [translation guide](https://www.chatwoot.com/docs/contributing/translating-chatwoot-to-your-language) for contributing to Chatwoot.
 
-### Branching model
+## Branching model
 
 We use the [git-flow](https://nvie.com/posts/a-successful-git-branching-model/) branching model. The base branch is `develop`.
-If you are looking for a stable version, please use the `master` or tags labelled as `v1.x.x`. 
+If you are looking for a stable version, please use the `master` or tags labelled as `v1.x.x`.
 
----
+## Deployment
 
-### Deployment
-
-#### Heroku one-click deploy
+### Heroku one-click deploy
 
 Deploying Chatwoot to Heroku is a breeze. It's as simple as clicking this button:
 
@@ -81,17 +88,34 @@ Deploying Chatwoot to Heroku is a breeze. It's as simple as clicking this button
 
 Follow this [link](https://www.chatwoot.com/docs/environment-variables) to understand setting the correct environment variables for the app to work with all the features. There might be breakages if you do not set the relevant environment variables.
 
-#### Other deployment options
 
-Please follow [deployment architecture guide](https://www.chatwoot.com/docs/deployment/architecture) to deploy with Docker or Caprover.
+### DigitalOcean 1-Click Kubernetes deployment
 
----
+Chatwoot now supports 1-Click deployment to DigitalOcean as a kubernetes app.
 
-### Contributors ✨
+<a href="https://marketplace.digitalocean.com/apps/chatwoot?refcode=f2238426a2a8" alt="Deploy to DigitalOcean">
+  <img width="200" alt="Deploy to DO" src="https://www.deploytodo.com/do-btn-blue.svg"/>
+</a>
+
+### Other deployment options
+
+For other supported options, checkout our [deployment page](https://chatwoot.com/deploy). 
+
+## Security
+
+Looking to report a vulnerability? Please refer our [SECURITY.md](./SECURITY.md) file.
+
+
+## Community? Questions? Support ?
+
+If you need help or just want to hang out, come, say hi on our [Discord](https://discord.gg/cJXdrwS) server.
+
+
+## Contributors ✨
 
 Thanks goes to all these [wonderful people](https://www.chatwoot.com/docs/contributors):
 
 <a href="https://github.com/chatwoot/chatwoot/graphs/contributors"><img src="https://opencollective.com/chatwoot/contributors.svg?width=890&button=false" /></a>
 
 
-*Chatwoot* &copy; 2017-2020, ThoughtWoot Inc - Released under the MIT License.
+*Chatwoot* &copy; 2017-2021, Chatwoot Inc - Released under the MIT License.

SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+Chatwoot is looking forward to working with security researchers across the world to keep Chatwoot and our users safe. If you have found an issue in our systems/applications, please reach out to us.
+
+## Reporting a Vulnerability
+
+We use [huntr.dev](https://huntr.dev/) for security issues that affect our project. If you believe you have found a vulnerability, please disclose it via this [form](https://huntr.dev/bounties/disclose). 
+
+This will enable us to review the vulnerability, fix it promptly, and reward you for your efforts.
+
+If you have any questions about the process, feel free to reach out to security@chatwoot.com.
+
+
+## Out of scope
+
+Please do not perform testing against Chatwoot production services. Use a self hosted instance to perform tests.
+
+We consider the following to be out of scope, though there may be exceptions.
+
+- Missing HTTP security headers
+- Self XSS
+- HTTP Host Header XSS without working proof-of-concept
+- Incomplete/Missing SPF/DKIM
+- Denial of Service attacks
+- DNSSEC
+- Social Engineering attacks
+
+If you are not sure about the scope, please create a report.
+
+## Thanks
+
+Thank you for keeping Chatwoot and our users safe. 🙇

app.json

@@ -11,7 +11,7 @@
     "rails",
     "vue"
   ],
-  "success_url": "/app/login",
+  "success_url": "/",
   "env": {
     "SECRET_TOKEN": {
       "description": "A secret key for verifying the integrity of signed cookies.",
@@ -28,12 +28,20 @@
     "FRONTEND_URL": {
       "description": "Public root URL of the Chatwoot installation. This will be used in the emails.",
       "value": "https://CHANGE.herokuapp.com"
+    },
+    "INSTALLATION_ENV": {
+      "description": "Installation method used for Chatwoot.",
+      "value": "heroku"
     }
   },
   "formation": {
     "web": {
       "quantity": 1,
       "size": "FREE"
+    },
+    "worker": {
+      "quantity": 1,
+      "size": "FREE"
     }
   },
   "image": "heroku/ruby",

app/actions/contact_identify_action.rb

@@ -3,8 +3,9 @@ class ContactIdentifyAction
 
   def perform
     ActiveRecord::Base.transaction do
-      @contact = merge_contact(existing_identified_contact, @contact) if merge_contacts?(existing_identified_contact, @contact)
-      @contact = merge_contact(existing_email_contact, @contact) if merge_contacts?(existing_email_contact, @contact)
+      merge_if_existing_identified_contact
+      merge_if_existing_email_contact
+      merge_if_existing_phone_number_contact
       update_contact
     end
     @contact
@@ -16,6 +17,18 @@ class ContactIdentifyAction
     @account ||= @contact.account
   end
 
+  def merge_if_existing_identified_contact
+    @contact = merge_contact(existing_identified_contact, @contact) if merge_contacts?(existing_identified_contact, @contact)
+  end
+
+  def merge_if_existing_email_contact
+    @contact = merge_contact(existing_email_contact, @contact) if merge_contacts?(existing_email_contact, @contact)
+  end
+
+  def merge_if_existing_phone_number_contact
+    @contact = merge_contact(existing_phone_number_contact, @contact) if merge_contacts?(existing_phone_number_contact, @contact)
+  end
+
   def existing_identified_contact
     return if params[:identifier].blank?
 
@@ -28,13 +41,23 @@ class ContactIdentifyAction
     @existing_email_contact ||= Contact.where(account_id: account.id).find_by(email: params[:email])
   end
 
+  def existing_phone_number_contact
+    return if params[:phone_number].blank?
+
+    @existing_phone_number_contact ||= Contact.where(account_id: account.id).find_by(phone_number: params[:phone_number])
+  end
+
   def merge_contacts?(existing_contact, _contact)
     existing_contact && existing_contact.id != @contact.id
   end
 
   def update_contact
     custom_attributes = params[:custom_attributes] ? @contact.custom_attributes.merge(params[:custom_attributes]) : @contact.custom_attributes
-    @contact.update!(params.slice(:name, :email, :identifier).merge({ custom_attributes: custom_attributes }))
+    # blank identifier or email will throw unique index error
+    # TODO: replace reject { |_k, v| v.blank? } with compact_blank when rails is upgraded
+    @contact.update!(params.slice(:name, :email, :identifier, :phone_number).reject do |_k, v|
+                       v.blank?
+                     end.merge({ custom_attributes: custom_attributes }))
     ContactAvatarJob.perform_later(@contact, params[:avatar_url]) if params[:avatar_url].present?
   end
 

app/actions/contact_merge_action.rb

@@ -1,13 +1,18 @@
 class ContactMergeAction
+  include Events::Types
   pattr_initialize [:account!, :base_contact!, :mergee_contact!]
 
   def perform
+    # This case happens when an agent updates a contact email in dashboard,
+    # while the contact also update his email via email collect box
+    return @base_contact if base_contact.id == mergee_contact.id
+
     ActiveRecord::Base.transaction do
       validate_contacts
       merge_conversations
       merge_messages
       merge_contact_inboxes
-      remove_mergee_contact
+      merge_and_remove_mergee_contact
     end
     @base_contact
   end
@@ -36,7 +41,17 @@ class ContactMergeAction
     ContactInbox.where(contact_id: @mergee_contact.id).update(contact_id: @base_contact.id)
   end
 
-  def remove_mergee_contact
+  def merge_and_remove_mergee_contact
+    mergable_attribute_keys = %w[identifier name email phone_number additional_attributes custom_attributes]
+    base_contact_attributes = base_contact.attributes.slice(*mergable_attribute_keys).compact_blank
+    mergee_contact_attributes = mergee_contact.attributes.slice(*mergable_attribute_keys).compact_blank
+
+    # attributes in base contact are given preference
+    merged_attributes = mergee_contact_attributes.deep_merge(base_contact_attributes)
+
     @mergee_contact.destroy!
+    Rails.configuration.dispatcher.dispatch(CONTACT_MERGED, Time.zone.now, contact: @base_contact,
+                                                                           tokens: [@base_contact.contact_inboxes.filter_map(&:pubsub_token)])
+    @base_contact.update!(merged_attributes)
   end
 end

app/assets/stylesheets/administrate/utilities/_variables.scss

@@ -43,7 +43,7 @@ $woot-logo-padding: $space-large $space-two;
 // Colors
 $color-woot: #1f93ff;
 $color-gray: #6e6f73;
-$color-light-gray: #999a9b;
+$color-light-gray: #747677;
 $color-border: #e0e6ed;
 $color-border-light: #f0f4f5;
 $color-background: #f4f6fb;
@@ -55,7 +55,7 @@ $color-heading: #1f2d3d;
 $color-extra-light-blue: #f5f7f9;
 
 $primary-color: $color-woot;
-$secondary-color: #35c5ff;
+$secondary-color: #5d7592;
 $success-color: #44ce4b;
 $warning-color: #ffc532;
 $alert-color: #ff382d;

app/bot/facebook_bot.rb

@@ -1,28 +0,0 @@
-require 'facebook/messenger'
-
-class FacebookBot
-  include Facebook::Messenger
-
-  Bot.on :message do |message|
-    Rails.logger.info "MESSAGE_RECIEVED #{message}"
-    response = ::Integrations::Facebook::MessageParser.new(message)
-    ::Integrations::Facebook::MessageCreator.new(response).perform
-  end
-
-  Bot.on :delivery do |delivery|
-    # delivery.ids       # => 'mid.1457764197618:41d102a3e1ae206a38'
-    # delivery.sender    # => { 'id' => '1008372609250235' }
-    # delivery.recipient # => { 'id' => '2015573629214912' }
-    # delivery.at        # => 2016-04-22 21:30:36 +0200
-    # delivery.seq       # => 37
-    updater = Integrations::Facebook::DeliveryStatus.new(delivery)
-    updater.perform
-    Rails.logger.info "Human was online at #{delivery.at}"
-  end
-
-  Bot.on :message_echo do |message|
-    Rails.logger.info "MESSAGE_ECHO #{message}"
-    response = ::Integrations::Facebook::MessageParser.new(message)
-    ::Integrations::Facebook::MessageCreator.new(response).perform
-  end
-end

app/builders/account_builder.rb

@@ -2,7 +2,7 @@
 
 class AccountBuilder
   include CustomExceptions::Account
-  pattr_initialize [:account_name!, :email!, :confirmed!, :user]
+  pattr_initialize [:account_name!, :email!, :confirmed, :user, :user_full_name, :user_password]
 
   def perform
     if @user.nil?
@@ -15,7 +15,6 @@ class AccountBuilder
     end
     [@user, @account]
   rescue StandardError => e
-    @account&.destroy
     puts e.inspect
     raise e
   end
@@ -27,7 +26,7 @@ class AccountBuilder
     if address.valid? # && !address.disposable?
       true
     else
-      raise InvalidEmail.new(valid: address.valid?) # , disposable: address.disposable?})
+      raise InvalidEmail.new(valid: address.valid?)
     end
   end
 
@@ -40,7 +39,7 @@ class AccountBuilder
   end
 
   def create_account
-    @account = Account.create!(name: @account_name)
+    @account = Account.create!(name: @account_name, locale: I18n.locale)
     Current.account = @account
   end
 
@@ -61,17 +60,11 @@ class AccountBuilder
     )
   end
 
-  def email_to_name(email)
-    name = email[/[^@]+/]
-    name.split('.').map(&:capitalize).join(' ')
-  end
-
   def create_user
-    password = Time.now.to_i
     @user = User.new(email: @email,
-                     password: password,
-                     password_confirmation: password,
-                     name: email_to_name(@email))
+                     password: user_password,
+                     password_confirmation: user_password,
+                     name: @user_full_name)
     @user.confirm if @confirmed
     @user.save!
   end

app/builders/campaigns/campaign_conversation_builder.rb

@@ -0,0 +1,38 @@
+class Campaigns::CampaignConversationBuilder
+  pattr_initialize [:contact_inbox_id!, :campaign_display_id!, :conversation_additional_attributes]
+
+  def perform
+    @contact_inbox = ContactInbox.find(@contact_inbox_id)
+    @campaign = @contact_inbox.inbox.campaigns.find_by!(display_id: campaign_display_id)
+
+    ActiveRecord::Base.transaction do
+      @contact_inbox.lock!
+
+      # We won't send campaigns if a conversation is already present
+      return if @contact_inbox.reload.conversations.present?
+
+      @conversation = ::Conversation.create!(conversation_params)
+      Messages::MessageBuilder.new(@campaign.sender, @conversation, message_params).perform
+    end
+    @conversation
+  end
+
+  private
+
+  def message_params
+    ActionController::Parameters.new({
+                                       content: @campaign.message
+                                     })
+  end
+
+  def conversation_params
+    {
+      account_id: @campaign.account_id,
+      inbox_id: @contact_inbox.inbox_id,
+      contact_id: @contact_inbox.contact_id,
+      contact_inbox_id: @contact_inbox.id,
+      campaign_id: @campaign.id,
+      additional_attributes: conversation_additional_attributes
+    }
+  end
+end

app/builders/contact_builder.rb

@@ -1,11 +1,11 @@
 class ContactBuilder
-  pattr_initialize [:source_id!, :inbox!, :contact_attributes!]
+  pattr_initialize [:source_id!, :inbox!, :contact_attributes!, :hmac_verified]
 
   def perform
     contact_inbox = inbox.contact_inboxes.find_by(source_id: source_id)
     return contact_inbox if contact_inbox
 
-    build_contact
+    build_contact_inbox
   end
 
   private
@@ -18,7 +18,8 @@ class ContactBuilder
     ::ContactInbox.create!(
       contact_id: contact.id,
       inbox_id: inbox.id,
-      source_id: source_id
+      source_id: source_id,
+      hmac_verified: hmac_verified || false
     )
   end
 
@@ -26,21 +27,51 @@ class ContactBuilder
     ::ContactAvatarJob.perform_later(contact, contact_attributes[:avatar_url]) if contact_attributes[:avatar_url]
   end
 
-  def build_contact
-    ActiveRecord::Base.transaction do
-      contact = account.contacts.create!(
-        name: contact_attributes[:name],
-        phone_number: contact_attributes[:phone_number],
-        email: contact_attributes[:email],
-        identifier: contact_attributes[:identifier],
-        additional_attributes: contact_attributes[:additional_attributes]
-      )
+  def create_contact
+    account.contacts.create!(
+      name: contact_attributes[:name] || ::Haikunator.haikunate(1000),
+      phone_number: contact_attributes[:phone_number],
+      email: contact_attributes[:email],
+      identifier: contact_attributes[:identifier],
+      additional_attributes: contact_attributes[:additional_attributes],
+      custom_attributes: contact_attributes[:custom_attributes]
+    )
+  end
 
+  def find_contact
+    contact = find_contact_by_identifier(contact_attributes[:identifier])
+    contact ||= find_contact_by_email(contact_attributes[:email])
+    contact ||= find_contact_by_phone_number(contact_attributes[:phone_number])
+    contact
+  end
+
+  def find_contact_by_identifier(identifier)
+    return if identifier.blank?
+
+    account.contacts.find_by(identifier: identifier)
+  end
+
+  def find_contact_by_email(email)
+    return if email.blank?
+
+    account.contacts.find_by(email: email.downcase)
+  end
+
+  def find_contact_by_phone_number(phone_number)
+    return if phone_number.blank?
+
+    account.contacts.find_by(phone_number: phone_number)
+  end
+
+  def build_contact_inbox
+    ActiveRecord::Base.transaction do
+      contact = find_contact || create_contact
       contact_inbox = create_contact_inbox(contact)
       update_contact_avatar(contact)
       contact_inbox
     rescue StandardError => e
       Rails.logger.info e
+      raise e
     end
   end
 end

app/builders/contact_inbox_builder.rb

@@ -0,0 +1,49 @@
+class ContactInboxBuilder
+  pattr_initialize [:contact_id!, :inbox_id!, :source_id]
+
+  def perform
+    @contact = Contact.find(contact_id)
+    @inbox = @contact.account.inboxes.find(inbox_id)
+    return unless ['Channel::TwilioSms', 'Channel::Email', 'Channel::Api', 'Channel::Whatsapp'].include? @inbox.channel_type
+
+    source_id = @source_id || generate_source_id
+    create_contact_inbox(source_id) if source_id.present?
+  end
+
+  private
+
+  def generate_source_id
+    return twilio_source_id if @inbox.channel_type == 'Channel::TwilioSms'
+    return wa_source_id if @inbox.channel_type == 'Channel::Whatsapp'
+    return @contact.email if @inbox.channel_type == 'Channel::Email'
+    return SecureRandom.uuid if @inbox.channel_type == 'Channel::Api'
+
+    nil
+  end
+
+  def wa_source_id
+    return unless @contact.phone_number
+
+    # whatsapp doesn't want the + in e164 format
+    "#{@contact.phone_number}.delete('+')"
+  end
+
+  def twilio_source_id
+    return unless @contact.phone_number
+
+    case @inbox.channel.medium
+    when 'sms'
+      @contact.phone_number
+    when 'whatsapp'
+      "whatsapp:#{@contact.phone_number}"
+    end
+  end
+
+  def create_contact_inbox(source_id)
+    ::ContactInbox.find_or_create_by!(
+      contact_id: @contact.id,
+      inbox_id: @inbox.id,
+      source_id: source_id
+    )
+  end
+end

app/builders/csat_surveys/response_builder.rb

@@ -0,0 +1,28 @@
+class CsatSurveys::ResponseBuilder
+  pattr_initialize [:message]
+
+  def perform
+    raise 'Invalid Message' unless message.input_csat?
+
+    conversation = message.conversation
+    rating = message.content_attributes.dig('submitted_values', 'csat_survey_response', 'rating')
+    feedback_message = message.content_attributes.dig('submitted_values', 'csat_survey_response', 'feedback_message')
+
+    return if rating.blank?
+
+    process_csat_response(conversation, rating, feedback_message)
+  end
+
+  private
+
+  def process_csat_response(conversation, rating, feedback_message)
+    csat_survey_response = message.csat_survey_response || CsatSurveyResponse.new(
+      message_id: message.id, account_id: message.account_id, conversation_id: message.conversation_id,
+      contact_id: conversation.contact_id, assigned_agent: conversation.assignee
+    )
+    csat_survey_response.rating = rating
+    csat_survey_response.feedback_message = feedback_message
+    csat_survey_response.save!
+    csat_survey_response
+  end
+end

app/builders/messages/facebook/message_builder.rb

@@ -4,24 +4,32 @@
 #    based on this we are showing "not sent from chatwoot" message in frontend
 #    Hence there is no need to set user_id in message for outgoing echo messages.
 
-class Messages::Facebook::MessageBuilder
+class Messages::Facebook::MessageBuilder < Messages::Messenger::MessageBuilder
   attr_reader :response
 
   def initialize(response, inbox, outgoing_echo: false)
+    super()
     @response = response
     @inbox = inbox
     @outgoing_echo = outgoing_echo
     @sender_id = (@outgoing_echo ? @response.recipient_id : @response.sender_id)
     @message_type = (@outgoing_echo ? :outgoing : :incoming)
+    @attachments = (@response.attachments || [])
   end
 
   def perform
+    # This channel might require reauthorization, may be owner might have changed the fb password
+    return if @inbox.channel.reauthorization_required?
+
     ActiveRecord::Base.transaction do
       build_contact
       build_message
     end
+    ensure_contact_avatar
+  rescue Koala::Facebook::AuthenticationError
+    Rails.logger.info "Facebook Authorization expired for Inbox #{@inbox.id}"
   rescue StandardError => e
-    Raven.capture_exception(e)
+    Sentry.capture_exception(e)
     true
   end
 
@@ -35,24 +43,22 @@ class Messages::Facebook::MessageBuilder
     return if contact.present?
 
     @contact = Contact.create!(contact_params.except(:remote_avatar_url))
-    ContactAvatarJob.perform_later(@contact, contact_params[:remote_avatar_url]) if contact_params[:remote_avatar_url]
     @contact_inbox = ContactInbox.create(contact: contact, inbox: @inbox, source_id: @sender_id)
   end
 
   def build_message
     @message = conversation.messages.create!(message_params)
-    (response.attachments || []).each do |attachment|
-      attachment_obj = @message.attachments.new(attachment_params(attachment).except(:remote_file_url))
-      attachment_obj.save!
-      attach_file(attachment_obj, attachment_params(attachment)[:remote_file_url]) if attachment_params(attachment)[:remote_file_url]
+
+    @attachments.each do |attachment|
+      process_attachment(attachment)
     end
   end
 
-  def attach_file(attachment, file_url)
-    file_resource = LocalResource.new(file_url)
-    attachment.file.attach(io: file_resource.file, filename: file_resource.tmp_filename, content_type: file_resource.encoding)
-  rescue Errno::ETIMEDOUT, Errno::ECONNREFUSED, SocketError => e
-    Rails.logger.info "invalid url #{file_url} : #{e.message}"
+  def ensure_contact_avatar
+    return if contact_params[:remote_avatar_url].blank?
+    return if @contact.avatar.attached?
+
+    ContactAvatarJob.perform_later(@contact, contact_params[:remote_avatar_url])
   end
 
   def conversation
@@ -66,28 +72,6 @@ class Messages::Facebook::MessageBuilder
                          ))
   end
 
-  def attachment_params(attachment)
-    file_type = attachment['type'].to_sym
-    params = { file_type: file_type, account_id: @message.account_id }
-
-    if [:image, :file, :audio, :video].include? file_type
-      params.merge!(file_type_params(attachment))
-    elsif file_type == :location
-      params.merge!(location_params(attachment))
-    elsif file_type == :fallback
-      params.merge!(fallback_params(attachment))
-    end
-
-    params
-  end
-
-  def file_type_params(attachment)
-    {
-      external_url: attachment['payload']['url'],
-      remote_file_url: attachment['payload']['url']
-    }
-  end
-
   def location_params(attachment)
     lat = attachment['payload']['coordinates']['lat']
     long = attachment['payload']['coordinates']['long']
@@ -125,18 +109,30 @@ class Messages::Facebook::MessageBuilder
     }
   end
 
-  def contact_params
-    begin
-      k = Koala::Facebook::API.new(@inbox.channel.page_access_token) if @inbox.facebook?
-      result = k.get_object(@sender_id) || {}
-    rescue StandardError => e
-      result = {}
-      Raven.capture_exception(e)
-    end
+  def process_contact_params_result(result)
     {
       name: "#{result['first_name'] || 'John'} #{result['last_name'] || 'Doe'}",
       account_id: @inbox.account_id,
       remote_avatar_url: result['profile_pic'] || ''
     }
   end
+
+  def contact_params
+    begin
+      k = Koala::Facebook::API.new(@inbox.channel.page_access_token) if @inbox.facebook?
+      result = k.get_object(@sender_id) || {}
+    rescue Koala::Facebook::AuthenticationError
+      @inbox.channel.authorization_error!
+      raise
+    rescue Koala::Facebook::ClientError => e
+      result = {}
+      # OAuthException, code: 100, error_subcode: 2018218, message: (#100) No profile available for this user
+      # We don't need to capture this error as we don't care about contact params in case of echo messages
+      Sentry.capture_exception(e) unless @outgoing_echo
+    rescue StandardError => e
+      result = {}
+      Sentry.capture_exception(e)
+    end
+    process_contact_params_result(result)
+  end
 end

app/builders/messages/instagram/message_builder.rb

@@ -0,0 +1,145 @@
+# This class creates both outgoing messages from chatwoot and echo outgoing messages based on the flag `outgoing_echo`
+# Assumptions
+# 1. Incase of an outgoing message which is echo, source_id will NOT be nil,
+#    based on this we are showing "not sent from chatwoot" message in frontend
+#    Hence there is no need to set user_id in message for outgoing echo messages.
+
+class Messages::Instagram::MessageBuilder < Messages::Messenger::MessageBuilder
+  attr_reader :messaging
+
+  def initialize(messaging, inbox, outgoing_echo: false)
+    super()
+    @messaging = messaging
+    @inbox = inbox
+    @outgoing_echo = outgoing_echo
+  end
+
+  def perform
+    return if @inbox.channel.reauthorization_required?
+
+    ActiveRecord::Base.transaction do
+      build_message
+    end
+  rescue Koala::Facebook::AuthenticationError
+    @inbox.channel.authorization_error!
+    raise
+  rescue StandardError => e
+    Sentry.capture_exception(e)
+    true
+  end
+
+  private
+
+  def attachments
+    @messaging[:message][:attachments] || {}
+  end
+
+  def message_type
+    @outgoing_echo ? :outgoing : :incoming
+  end
+
+  def message_identifier
+    message[:mid]
+  end
+
+  def message_source_id
+    @outgoing_echo ? recipient_id : sender_id
+  end
+
+  def sender_id
+    @messaging[:sender][:id]
+  end
+
+  def recipient_id
+    @messaging[:recipient][:id]
+  end
+
+  def message
+    @messaging[:message]
+  end
+
+  def contact
+    @contact ||= @inbox.contact_inboxes.find_by(source_id: message_source_id)&.contact
+  end
+
+  def conversation
+    @conversation ||= Conversation.find_by(conversation_params) || build_conversation
+  end
+
+  def message_content
+    @messaging[:message][:text]
+  end
+
+  def build_message
+    return if @outgoing_echo && already_sent_from_chatwoot?
+
+    @message = conversation.messages.create!(message_params)
+
+    attachments.each do |attachment|
+      process_attachment(attachment)
+    end
+  end
+
+  def build_conversation
+    @contact_inbox ||= contact.contact_inboxes.find_by!(source_id: message_source_id)
+    Conversation.create!(conversation_params.merge(
+                           contact_inbox_id: @contact_inbox.id
+                         ))
+  end
+
+  def conversation_params
+    {
+      account_id: @inbox.account_id,
+      inbox_id: @inbox.id,
+      contact_id: contact.id,
+      additional_attributes: {
+        type: 'instagram_direct_message'
+      }
+    }
+  end
+
+  def message_params
+    {
+      account_id: conversation.account_id,
+      inbox_id: conversation.inbox_id,
+      message_type: message_type,
+      source_id: message_identifier,
+      content: message_content,
+      sender: @outgoing_echo ? nil : contact
+    }
+  end
+
+  def already_sent_from_chatwoot?
+    cw_message = conversation.messages.where(
+      source_id: @messaging[:message][:mid]
+    ).first
+
+    cw_message.present?
+  end
+
+  ### Sample response
+  # {
+  #   "object": "instagram",
+  #   "entry": [
+  #     {
+  #       "id": "<IGID>",// ig id of the business
+  #       "time": 1569262486134,
+  #       "messaging": [
+  #         {
+  #           "sender": {
+  #             "id": "<IGSID>"
+  #           },
+  #           "recipient": {
+  #             "id": "<IGID>"
+  #           },
+  #           "timestamp": 1569262485349,
+  #           "message": {
+  #             "mid": "<MESSAGE_ID>",
+  #             "text": "<MESSAGE_CONTENT>"
+  #           }
+  #         }
+  #       ]
+  #     }
+  #   ],
+  # }
+end

app/builders/messages/message_builder.rb

@@ -15,21 +15,36 @@ class Messages::MessageBuilder
 
   def perform
     @message = @conversation.messages.build(message_params)
-    if @attachments.present?
-      @attachments.each do |uploaded_attachment|
-        attachment = @message.attachments.new(
-          account_id: @message.account_id,
-          file_type: file_type(uploaded_attachment&.content_type)
-        )
-        attachment.file.attach(uploaded_attachment)
-      end
-    end
-    @message.save
+    process_attachments
+    process_emails
+    @message.save!
     @message
   end
 
   private
 
+  def process_attachments
+    return if @attachments.blank?
+
+    @attachments.each do |uploaded_attachment|
+      @message.attachments.build(
+        account_id: @message.account_id,
+        file_type: file_type(uploaded_attachment&.content_type),
+        file: uploaded_attachment
+      )
+    end
+  end
+
+  def process_emails
+    return unless @conversation.inbox&.inbox_type == 'Email'
+
+    cc_emails = @params[:cc_emails].split(',') if @params[:cc_emails]
+    bcc_emails = @params[:bcc_emails].split(',') if @params[:bcc_emails]
+
+    @message.content_attributes[:cc_emails] = cc_emails
+    @message.content_attributes[:bcc_emails] = bcc_emails
+  end
+
   def message_type
     if @conversation.inbox.channel_type != 'Channel::Api' && @message_type == 'incoming'
       raise StandardError, 'Incoming messages are only allowed in Api inboxes'
@@ -39,7 +54,17 @@ class Messages::MessageBuilder
   end
 
   def sender
-    message_type == 'outgoing' ? @user : @conversation.contact
+    message_type == 'outgoing' ? (message_sender || @user) : @conversation.contact
+  end
+
+  def external_created_at
+    @params[:external_created_at].present? ? { external_created_at: @params[:external_created_at] } : {}
+  end
+
+  def message_sender
+    return if @params[:sender_type] != 'AgentBot'
+
+    AgentBot.where(account_id: [nil, @conversation.account.id]).find_by(id: @params[:sender_id])
   end
 
   def message_params
@@ -54,6 +79,6 @@ class Messages::MessageBuilder
       items: @items,
       in_reply_to: @in_reply_to,
       echo_id: @params[:echo_id]
-    }
+    }.merge(external_created_at)
   end
 end

app/builders/messages/messenger/message_builder.rb

@@ -0,0 +1,42 @@
+class Messages::Messenger::MessageBuilder
+  def process_attachment(attachment)
+    return if attachment['type'].to_sym == :template
+
+    attachment_obj = @message.attachments.new(attachment_params(attachment).except(:remote_file_url))
+    attachment_obj.save!
+    attach_file(attachment_obj, attachment_params(attachment)[:remote_file_url]) if attachment_params(attachment)[:remote_file_url]
+  end
+
+  def attach_file(attachment, file_url)
+    attachment_file = Down.download(
+      file_url
+    )
+    attachment.file.attach(
+      io: attachment_file,
+      filename: attachment_file.original_filename,
+      content_type: attachment_file.content_type
+    )
+  end
+
+  def attachment_params(attachment)
+    file_type = attachment['type'].to_sym
+    params = { file_type: file_type, account_id: @message.account_id }
+
+    if [:image, :file, :audio, :video].include? file_type
+      params.merge!(file_type_params(attachment))
+    elsif file_type == :location
+      params.merge!(location_params(attachment))
+    elsif file_type == :fallback
+      params.merge!(fallback_params(attachment))
+    end
+
+    params
+  end
+
+  def file_type_params(attachment)
+    {
+      external_url: attachment['payload']['url'],
+      remote_file_url: attachment['payload']['url']
+    }
+  end
+end

app/builders/notification_subscription_builder.rb

@@ -4,7 +4,7 @@ class NotificationSubscriptionBuilder
   def perform
     # if multiple accounts were used to login in same browser
     move_subscription_to_user if identifier_subscription && identifier_subscription.user_id != user.id
-    build_identifier_subscription if identifier_subscription.blank?
+    identifier_subscription.blank? ? build_identifier_subscription : update_identifier_subscription
     identifier_subscription
   end
 
@@ -25,6 +25,10 @@ class NotificationSubscriptionBuilder
   end
 
   def build_identifier_subscription
-    user.notification_subscriptions.create(params.merge(identifier: identifier))
+    @identifier_subscription = user.notification_subscriptions.create(params.merge(identifier: identifier))
+  end
+
+  def update_identifier_subscription
+    identifier_subscription.update(params.merge(identifier: identifier))
   end
 end

app/builders/v2/report_builder.rb

@@ -1,4 +1,5 @@
 class V2::ReportBuilder
+  include DateRangeHelper
   attr_reader :account, :params
 
   def initialize(account, params)
@@ -31,17 +32,34 @@ class V2::ReportBuilder
   private
 
   def scope
-    return account if params[:type].match?('account')
-    return inbox if params[:type].match?('inbox')
-    return user if params[:type].match?('agent')
+    case params[:type]
+    when :account
+      account
+    when :inbox
+      inbox
+    when :agent
+      user
+    when :label
+      label
+    when :team
+      team
+    end
   end
 
   def inbox
-    @inbox ||= account.inboxes.where(id: params[:id]).first
+    @inbox ||= account.inboxes.find(params[:id])
   end
 
   def user
-    @user ||= account.users.where(id: params[:id]).first
+    @user ||= account.users.find(params[:id])
+  end
+
+  def label
+    @label ||= account.labels.find(params[:id])
+  end
+
+  def team
+    @team ||= account.teams.find(params[:id])
   end
 
   def conversations_count
@@ -50,15 +68,14 @@ class V2::ReportBuilder
          .count
   end
 
-  # unscoped removes all scopes added to a model previously
   def incoming_messages_count
-    scope.messages.unscoped.where(account_id: account.id).incoming
+    scope.messages.incoming.unscope(:order)
          .group_by_day(:created_at, range: range, default_value: 0)
          .count
   end
 
   def outgoing_messages_count
-    scope.messages.unscoped.where(account_id: account.id).outgoing
+    scope.messages.outgoing.unscope(:order)
          .group_by_day(:created_at, range: range, default_value: 0)
          .count
   end
@@ -83,10 +100,6 @@ class V2::ReportBuilder
          .average(:value)
   end
 
-  def range
-    parse_date_time(params[:since])..parse_date_time(params[:until])
-  end
-
   # Taking average of average is not too accurate
   # https://en.wikipedia.org/wiki/Simpson's_paradox
   # TODO: Will optimize this later
@@ -101,11 +114,4 @@ class V2::ReportBuilder
 
     (avg_first_response_time.values.sum / avg_first_response_time.values.length)
   end
-
-  def parse_date_time(datetime)
-    return datetime if datetime.is_a?(DateTime)
-    return datetime.to_datetime if datetime.is_a?(Time) || datetime.is_a?(Date)
-
-    DateTime.strptime(datetime, '%s')
-  end
 end

app/channels/room_channel.rb

@@ -31,7 +31,7 @@ class RoomChannel < ApplicationCable::Channel
 
   def current_user
     @current_user ||= if params[:user_id].blank?
-                        Contact.find_by!(pubsub_token: @pubsub_token)
+                        ContactInbox.find_by!(pubsub_token: @pubsub_token).contact
                       else
                         User.find_by!(pubsub_token: @pubsub_token, id: params[:user_id])
                       end

app/controllers/android_app_controller.rb

@@ -0,0 +1,5 @@
+class AndroidAppController < ApplicationController
+  def assetlinks
+    render layout: false
+  end
+end

app/controllers/api/base_controller.rb

@@ -10,4 +10,14 @@ class Api::BaseController < ApplicationController
   def authenticate_by_access_token?
     request.headers[:api_access_token].present? || request.headers[:HTTP_API_ACCESS_TOKEN].present?
   end
+
+  def check_authorization(model = nil)
+    model ||= controller_name.classify.constantize
+
+    authorize(model)
+  end
+
+  def check_admin_authorization?
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
 end

app/controllers/api/v1/accounts/agent_bots_controller.rb

@@ -0,0 +1,35 @@
+class Api::V1::Accounts::AgentBotsController < Api::V1::Accounts::BaseController
+  before_action :current_account
+  before_action :check_authorization
+  before_action :agent_bot, except: [:index, :create]
+
+  def index
+    @agent_bots = AgentBot.where(account_id: [nil, Current.account.id])
+  end
+
+  def show; end
+
+  def create
+    @agent_bot = Current.account.agent_bots.create!(permitted_params)
+  end
+
+  def update
+    @agent_bot.update!(permitted_params)
+  end
+
+  def destroy
+    @agent_bot.destroy
+    head :ok
+  end
+
+  private
+
+  def agent_bot
+    @agent_bot = AgentBot.where(account_id: [nil, Current.account.id]).find(params[:id]) if params[:action] == 'show'
+    @agent_bot ||= Current.account.agent_bots.find(params[:id])
+  end
+
+  def permitted_params
+    params.permit(:name, :description, :outgoing_url)
+  end
+end

app/controllers/api/v1/accounts/agents_controller.rb

@@ -2,6 +2,7 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
   before_action :fetch_agent, except: [:create, :index]
   before_action :check_authorization
   before_action :find_user, only: [:create]
+  before_action :validate_limit, only: [:create]
   before_action :create_user, only: [:create]
   before_action :save_account_user, only: [:create]
 
@@ -9,25 +10,22 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
     @agents = agents
   end
 
+  def create; end
+
+  def update
+    @agent.update!(agent_params.slice(:name).compact)
+    @agent.current_account_user.update!(agent_params.slice(:role, :availability, :auto_offline).compact)
+  end
+
   def destroy
     @agent.current_account_user.destroy
     head :ok
   end
 
-  def update
-    @agent.update!(agent_params.except(:role))
-    @agent.current_account_user.update!(role: agent_params[:role]) if agent_params[:role]
-    render partial: 'api/v1/models/agent.json.jbuilder', locals: { resource: @agent }
-  end
-
-  def create
-    render partial: 'api/v1/models/agent.json.jbuilder', locals: { resource: @user }
-  end
-
   private
 
   def check_authorization
-    authorize(User)
+    super(User)
   end
 
   def fetch_agent
@@ -38,6 +36,8 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
     @user =  User.find_by(email: new_agent_params[:email])
   end
 
+  # TODO: move this to a builder and combine the save account user method into a builder
+  # ensure the account user association is also created in a single transaction
   def create_user
     return if @user
 
@@ -45,25 +45,33 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
   end
 
   def save_account_user
-    AccountUser.create!(
+    AccountUser.create!({
       account_id: Current.account.id,
       user_id: @user.id,
-      role: new_agent_params[:role],
       inviter_id: current_user.id
-    )
+    }.merge({
+      role: new_agent_params[:role],
+      availability: new_agent_params[:availability],
+      auto_offline: new_agent_params[:auto_offline]
+    }.compact))
   end
 
   def agent_params
-    params.require(:agent).permit(:email, :name, :role)
+    params.require(:agent).permit(:name, :email, :name, :role, :availability, :auto_offline)
   end
 
   def new_agent_params
-    time = Time.now.to_i
-    params.require(:agent).permit(:email, :name, :role)
-          .merge!(password: time, password_confirmation: time, inviter: current_user)
+    # intial string ensures the password requirements are met
+    temp_password = "1!aA#{SecureRandom.alphanumeric(12)}"
+    params.require(:agent).permit(:email, :name, :role, :availability, :auto_offline)
+          .merge!(password: temp_password, password_confirmation: temp_password, inviter: current_user)
   end
 
   def agents
-    @agents ||= Current.account.users.order_by_full_name
+    @agents ||= Current.account.users.order_by_full_name.includes({ avatar_attachment: [:blob] })
+  end
+
+  def validate_limit
+    render_payment_required('Account limit exceeded. Upgrade to a higher plan') if agents.count >= Current.account.usage_limits[:agents]
   end
 end

app/controllers/api/v1/accounts/base_controller.rb

@@ -1,5 +1,7 @@
 class Api::V1::Accounts::BaseController < Api::BaseController
+  include SwitchLocale
   before_action :current_account
+  around_action :switch_locale_using_account_locale
 
   private
 
@@ -12,10 +14,9 @@ class Api::V1::Accounts::BaseController < Api::BaseController
     account = Account.find(params[:account_id])
     if current_user
       account_accessible_for_user?(account)
-    elsif @resource&.is_a?(AgentBot)
+    elsif @resource.is_a?(AgentBot)
       account_accessible_for_bot?(account)
     end
-    switch_locale account
     account
   end
 

app/controllers/api/v1/accounts/callbacks_controller.rb

@@ -12,9 +12,10 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
         page_access_token: page_access_token
       )
       @facebook_inbox = Current.account.inboxes.create!(name: inbox_name, channel: facebook_channel)
+      set_instagram_id(page_access_token, facebook_channel)
       set_avatar(@facebook_inbox, page_id)
     rescue StandardError => e
-      Rails.logger.info e
+      Sentry.capture_exception(e)
     end
   end
 
@@ -22,6 +23,15 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
     @page_details = mark_already_existing_facebook_pages(fb_object.get_connections('me', 'accounts'))
   end
 
+  def set_instagram_id(page_access_token, facebook_channel)
+    fb_object = Koala::Facebook::API.new(page_access_token)
+    response = fb_object.get_connections('me', '', { fields: 'instagram_business_account' })
+    return if response['instagram_business_account'].blank?
+
+    instagram_id = response['instagram_business_account']['id']
+    facebook_channel.update(instagram_id: instagram_id)
+  end
+
   # get params[:inbox_id], current_account. params[:omniauth_token]
   def reauthorize_page
     if @inbox&.facebook?
@@ -30,7 +40,7 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
 
       if (page_detail = (page_details || []).detect { |page| fb_page_id == page['id'] })
         update_fb_page(fb_page_id, page_detail['access_token'])
-        return head :ok
+        render and return
       end
     end
 
@@ -44,9 +54,14 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
   end
 
   def update_fb_page(fb_page_id, access_token)
-    get_fb_page(fb_page_id)&.update!(
-      user_access_token: @user_access_token, page_access_token: access_token
-    )
+    fb_page = get_fb_page(fb_page_id)
+    ActiveRecord::Base.transaction do
+      fb_page&.update!(user_access_token: @user_access_token, page_access_token: access_token)
+      set_instagram_id(access_token, fb_page)
+      fb_page&.reauthorized!
+    rescue StandardError => e
+      Sentry.capture_exception(e)
+    end
   end
 
   def get_fb_page(fb_page_id)
@@ -59,7 +74,7 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
   end
 
   def long_lived_token(omniauth_token)
-    koala = Koala::Facebook::OAuth.new(ENV['FB_APP_ID'], ENV['FB_APP_SECRET'])
+    koala = Koala::Facebook::OAuth.new(GlobalConfigService.load('FB_APP_ID', ''), GlobalConfigService.load('FB_APP_SECRET', ''))
     koala.exchange_access_token_info(omniauth_token)['access_token']
   rescue StandardError => e
     Rails.logger.info e
@@ -69,39 +84,15 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
     return [] if data.empty?
 
     data.inject([]) do |result, page_detail|
-      page_detail[:exists] = Current.account.facebook_pages.exists?(page_id: page_detail['id']) ? true : false
+      page_detail[:exists] = Current.account.facebook_pages.exists?(page_id: page_detail['id'])
       result << page_detail
     end
   end
 
   def set_avatar(facebook_inbox, page_id)
-    uri = get_avatar_url(page_id)
-
-    return unless uri
-
-    avatar_resource = LocalResource.new(uri)
-    facebook_inbox.avatar.attach(io: avatar_resource.file, filename: avatar_resource.tmp_filename, content_type: avatar_resource.encoding)
-  rescue Errno::ETIMEDOUT, Errno::ECONNREFUSED, SocketError => e
-    Rails.logger.info "invalid url #{file_url} : #{e.message}"
-  end
-
-  def get_avatar_url(page_id)
-    begin
-      url = 'http://graph.facebook.com/' << page_id << '/picture?type=large'
-      uri = URI.parse(url)
-      tries = 3
-      begin
-        response = uri.open(redirect: false)
-      rescue OpenURI::HTTPRedirect => e
-        uri = e.uri # assigned from the "Location" response header
-        retry if (tries -= 1).positive?
-        raise
-      end
-      pic_url = response.base_uri.to_s
-    rescue StandardError => e
-      Rails.logger.debug "Rescued: #{e.inspect}"
-      pic_url = nil
-    end
-    pic_url
+    avatar_file = Down.download(
+      "http://graph.facebook.com/#{page_id}/picture?type=large"
+    )
+    facebook_inbox.avatar.attach(io: avatar_file, filename: avatar_file.original_filename, content_type: avatar_file.content_type)
   end
 end

app/controllers/api/v1/accounts/campaigns_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::CampaignsController < Api::V1::Accounts::BaseController
+  before_action :campaign, except: [:index, :create]
+  before_action :check_authorization
+
+  def index
+    @campaigns = Current.account.campaigns
+  end
+
+  def create
+    @campaign = Current.account.campaigns.create!(campaign_params)
+  end
+
+  def destroy
+    @campaign.destroy
+    head :ok
+  end
+
+  def show; end
+
+  def update
+    @campaign.update(campaign_params)
+  end
+
+  private
+
+  def campaign
+    @campaign ||= Current.account.campaigns.find_by(display_id: params[:id])
+  end
+
+  def campaign_params
+    params.require(:campaign).permit(:title, :description, :message, :enabled, :trigger_only_during_business_hours, :inbox_id, :sender_id,
+                                     :scheduled_at, audience: [:type, :id], trigger_rules: {})
+  end
+end

app/controllers/api/v1/accounts/canned_responses_controller.rb

@@ -33,7 +33,7 @@ class Api::V1::Accounts::CannedResponsesController < Api::V1::Accounts::BaseCont
 
   def canned_responses
     if params[:search]
-      Current.account.canned_responses.where('short_code ILIKE ?', "#{params[:search]}%")
+      Current.account.canned_responses.where('short_code ILIKE :search OR content ILIKE :search', search: "%#{params[:search]}%")
     else
       Current.account.canned_responses
     end

app/controllers/api/v1/accounts/channels/twilio_channels_controller.rb

@@ -6,9 +6,8 @@ class Api::V1::Accounts::Channels::TwilioChannelsController < Api::V1::Accounts:
       authenticate_twilio
       build_inbox
       setup_webhooks if @twilio_channel.sms?
-    rescue Twilio::REST::TwilioError => e
-      render_could_not_create_error(e.message)
     rescue StandardError => e
+      Sentry.capture_exception(e)
       render_could_not_create_error(e.message)
     end
   end

app/controllers/api/v1/accounts/contacts/base_controller.rb

@@ -0,0 +1,9 @@
+class Api::V1::Accounts::Contacts::BaseController < Api::V1::Accounts::BaseController
+  before_action :ensure_contact
+
+  private
+
+  def ensure_contact
+    @contact = Current.account.contacts.find(params[:contact_id])
+  end
+end

app/controllers/api/v1/accounts/contacts/contact_inboxes_controller.rb

@@ -1,26 +1,15 @@
-class Api::V1::Accounts::Contacts::ContactInboxesController < Api::V1::Accounts::BaseController
-  before_action :ensure_contact
+class Api::V1::Accounts::Contacts::ContactInboxesController < Api::V1::Accounts::Contacts::BaseController
   before_action :ensure_inbox, only: [:create]
-  before_action :validate_channel_type
 
   def create
     source_id = params[:source_id] || SecureRandom.uuid
-    @contact_inbox = ContactInbox.create(contact: @contact, inbox: @inbox, source_id: source_id)
+    @contact_inbox = ContactInbox.create!(contact: @contact, inbox: @inbox, source_id: source_id)
   end
 
   private
 
-  def validate_channel_type
-    return if @inbox.channel_type == 'Channel::Api'
-
-    render json: { error: 'Contact Inbox creation is only allowed in API inboxes' }, status: :unprocessable_entity
-  end
-
   def ensure_inbox
     @inbox = Current.account.inboxes.find(params[:inbox_id])
-  end
-
-  def ensure_contact
-    @contact = Current.account.contacts.find(params[:contact_id])
+    authorize @inbox, :show?
   end
 end

app/controllers/api/v1/accounts/contacts/conversations_controller.rb

@@ -1,23 +1,17 @@
-class Api::V1::Accounts::Contacts::ConversationsController < Api::V1::Accounts::BaseController
+class Api::V1::Accounts::Contacts::ConversationsController < Api::V1::Accounts::Contacts::BaseController
   def index
     @conversations = Current.account.conversations.includes(
-      :assignee, :contact, :inbox
-    ).where(inbox_id: inbox_ids, contact_id: permitted_params[:contact_id])
+      :assignee, :contact, :inbox, :taggings
+    ).where(inbox_id: inbox_ids, contact_id: @contact.id)
   end
 
   private
 
   def inbox_ids
-    if current_user.administrator?
-      Current.account.inboxes.pluck(:id)
-    elsif current_user.agent?
-      current_user.assigned_inboxes.pluck(:id)
+    if Current.user.administrator? || Current.user.agent?
+      Current.user.assigned_inboxes.pluck(:id)
     else
       []
     end
   end
-
-  def permitted_params
-    params.permit(:contact_id)
-  end
 end

app/controllers/api/v1/accounts/contacts/labels_controller.rb

@@ -0,0 +1,13 @@
+class Api::V1::Accounts::Contacts::LabelsController < Api::V1::Accounts::Contacts::BaseController
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= @contact
+  end
+
+  def permitted_params
+    params.permit(labels: [])
+  end
+end

app/controllers/api/v1/accounts/contacts/notes_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Contacts::NotesController < Api::V1::Accounts::Contacts::BaseController
+  before_action :note, except: [:index, :create]
+
+  def index
+    @notes = @contact.notes.latest.includes(:user)
+  end
+
+  def create
+    @note = @contact.notes.create!(note_params)
+  end
+
+  def destroy
+    @note.destroy
+    head :ok
+  end
+
+  def show; end
+
+  def update
+    @note.update(note_params)
+  end
+
+  private
+
+  def note
+    @note ||= @contact.notes.find(params[:id])
+  end
+
+  def note_params
+    params.require(:note).permit(:content).merge({ contact_id: @contact.id, user_id: Current.user.id })
+  end
+end

app/controllers/api/v1/accounts/contacts_controller.rb

@@ -1,15 +1,75 @@
 class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
-  protect_from_forgery with: :null_session
+  include Sift
+  sort_on :email, type: :string
+  sort_on :name, internal_name: :order_on_name, type: :scope, scope_params: [:direction]
+  sort_on :phone_number, type: :string
+  sort_on :last_activity_at, internal_name: :order_on_last_activity_at, type: :scope, scope_params: [:direction]
+  sort_on :company, internal_name: :order_on_company_name, type: :scope, scope_params: [:direction]
+  sort_on :city, internal_name: :order_on_city, type: :scope, scope_params: [:direction]
+  sort_on :country, internal_name: :order_on_country_name, type: :scope, scope_params: [:direction]
+
+  RESULTS_PER_PAGE = 15
 
   before_action :check_authorization
-  before_action :fetch_contact, only: [:show, :update]
+  before_action :set_current_page, only: [:index, :active, :search, :filter]
+  before_action :fetch_contact, only: [:show, :update, :destroy, :contactable_inboxes, :destroy_custom_attributes]
+  before_action :set_include_contact_inboxes, only: [:index, :search, :filter]
 
   def index
-    @contacts = Current.account.contacts
+    @contacts_count = resolved_contacts.count
+    @contacts = fetch_contacts_with_conversation_count(resolved_contacts)
+  end
+
+  def search
+    render json: { error: 'Specify search string with parameter q' }, status: :unprocessable_entity if params[:q].blank? && return
+
+    contacts = resolved_contacts.where(
+      'name ILIKE :search OR email ILIKE :search OR phone_number ILIKE :search OR contacts.identifier LIKE :search',
+      search: "%#{params[:q]}%"
+    )
+    @contacts_count = contacts.count
+    @contacts = fetch_contacts_with_conversation_count(contacts)
+  end
+
+  def import
+    render json: { error: I18n.t('errors.contacts.import.failed') }, status: :unprocessable_entity and return if params[:import_file].blank?
+
+    ActiveRecord::Base.transaction do
+      import = Current.account.data_imports.create!(data_type: 'contacts')
+      import.import_file.attach(params[:import_file])
+    end
+
+    head :ok
+  end
+
+  # returns online contacts
+  def active
+    contacts = Current.account.contacts.where(id: ::OnlineStatusTracker
+                  .get_available_contact_ids(Current.account.id))
+    @contacts_count = contacts.count
+    @contacts = contacts.page(@current_page)
   end
 
   def show; end
 
+  def filter
+    result = ::Contacts::FilterService.new(params.permit!, current_user).perform
+    contacts = result[:contacts]
+    @contacts_count = result[:count]
+    @contacts = fetch_contacts_with_conversation_count(contacts)
+  end
+
+  def contactable_inboxes
+    @all_contactable_inboxes = Contacts::ContactableInboxesService.new(contact: @contact).get
+    @contactable_inboxes = @all_contactable_inboxes.select { |contactable_inbox| policy(contactable_inbox[:inbox]).show? }
+  end
+
+  # TODO : refactor this method into dedicated contacts/custom_attributes controller class and routes
+  def destroy_custom_attributes
+    @contact.custom_attributes = @contact.custom_attributes.excluding(params[:custom_attributes])
+    @contact.save!
+  end
+
   def create
     ActiveRecord::Base.transaction do
       @contact = Current.account.contacts.new(contact_params)
@@ -19,24 +79,48 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
   end
 
   def update
-    @contact.update!(contact_update_params)
-  rescue ActiveRecord::RecordInvalid => e
-    render json: {
-      message: e.record.errors.full_messages.join(', '),
-      contact: Contact.find_by(email: contact_params[:email])
-    }, status: :unprocessable_entity
+    @contact.assign_attributes(contact_update_params)
+    @contact.save!
   end
 
-  def search
-    render json: { error: 'Specify search string with parameter q' }, status: :unprocessable_entity if params[:q].blank? && return
+  def destroy
+    if ::OnlineStatusTracker.get_presence(
+      @contact.account.id, 'Contact', @contact.id
+    )
+      return render_error({ message: I18n.t('contacts.online.delete', contact_name: @contact.name.capitalize) },
+                          :unprocessable_entity)
+    end
 
-    @contacts = Current.account.contacts.where('name LIKE :search OR email LIKE :search', search: "%#{params[:q]}%")
+    @contact.destroy!
+    head :ok
   end
 
   private
 
-  def check_authorization
-    authorize(Contact)
+  # TODO: Move this to a finder class
+  def resolved_contacts
+    return @resolved_contacts if @resolved_contacts
+
+    @resolved_contacts = Current.account.contacts.resolved_contacts
+
+    @resolved_contacts = @resolved_contacts.tagged_with(params[:labels], any: true) if params[:labels].present?
+    @resolved_contacts
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def fetch_contacts_with_conversation_count(contacts)
+    contacts_with_conversation_count = filtrate(contacts).left_outer_joins(:conversations)
+                                                         .select('contacts.*, COUNT(conversations.id) as conversations_count')
+                                                         .group('contacts.id')
+                                                         .includes([{ avatar_attachment: [:blob] }])
+                                                         .page(@current_page).per(RESULTS_PER_PAGE)
+
+    return contacts_with_conversation_count.includes([{ contact_inboxes: [:inbox] }]) if @include_contact_inboxes
+
+    contacts_with_conversation_count
   end
 
   def build_contact_inbox
@@ -48,7 +132,7 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
   end
 
   def contact_params
-    params.require(:contact).permit(:name, :email, :phone_number, additional_attributes: {}, custom_attributes: {})
+    params.require(:contact).permit(:name, :identifier, :email, :phone_number, additional_attributes: {}, custom_attributes: {})
   end
 
   def contact_custom_attributes
@@ -62,7 +146,19 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
     contact_params.except(:custom_attributes).merge({ custom_attributes: contact_custom_attributes })
   end
 
+  def set_include_contact_inboxes
+    @include_contact_inboxes = if params[:include_contact_inboxes].present?
+                                 params[:include_contact_inboxes] == 'true'
+                               else
+                                 true
+                               end
+  end
+
   def fetch_contact
-    @contact = Current.account.contacts.find(params[:id])
+    @contact = Current.account.contacts.includes(contact_inboxes: [:inbox]).find(params[:id])
+  end
+
+  def render_error(error, error_status)
+    render json: error, status: error_status
   end
 end

app/controllers/api/v1/accounts/conversations/assignments_controller.rb

@@ -1,9 +1,34 @@
 class Api::V1::Accounts::Conversations::AssignmentsController < Api::V1::Accounts::Conversations::BaseController
-  # assign agent to a conversation
+  # assigns agent/team to a conversation
   def create
-    # if params[:assignee_id] is not a valid id, it will set to nil, hence unassigning the conversation
-    assignee = Current.account.users.find_by(id: params[:assignee_id])
-    @conversation.update_assignee(assignee)
-    render json: assignee
+    if params.key?(:assignee_id)
+      set_agent
+    elsif params.key?(:team_id)
+      set_team
+    else
+      render json: nil
+    end
+  end
+
+  private
+
+  def set_agent
+    @agent = Current.account.users.find_by(id: params[:assignee_id])
+    @conversation.update_assignee(@agent)
+    render_agent
+  end
+
+  def render_agent
+    if @agent.nil?
+      render json: nil
+    else
+      render partial: 'api/v1/models/agent', formats: [:json], locals: { resource: @agent }
+    end
+  end
+
+  def set_team
+    @team = Current.account.teams.find_by(id: params[:team_id])
+    @conversation.update!(team: @team)
+    render json: @team
   end
 end

app/controllers/api/v1/accounts/conversations/base_controller.rb

@@ -5,5 +5,6 @@ class Api::V1::Accounts::Conversations::BaseController < Api::V1::Accounts::Base
 
   def conversation
     @conversation ||= Current.account.conversations.find_by(display_id: params[:conversation_id])
+    authorize @conversation.inbox, :show?
   end
 end

app/controllers/api/v1/accounts/conversations/labels_controller.rb

@@ -1,11 +1,13 @@
 class Api::V1::Accounts::Conversations::LabelsController < Api::V1::Accounts::Conversations::BaseController
-  def create
-    @conversation.update_labels(params[:labels])
-    @labels = @conversation.label_list
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= @conversation
   end
 
-  # all labels of the current conversation
-  def index
-    @labels = @conversation.label_list
+  def permitted_params
+    params.permit(:conversation_id, labels: [])
   end
 end

app/controllers/api/v1/accounts/conversations/messages_controller.rb

@@ -4,16 +4,31 @@ class Api::V1::Accounts::Conversations::MessagesController < Api::V1::Accounts::
   end
 
   def create
-    user = current_user || @resource
+    user = Current.user || @resource
     mb = Messages::MessageBuilder.new(user, @conversation, params)
     @message = mb.perform
   rescue StandardError => e
     render_could_not_create_error(e.message)
   end
 
+  def destroy
+    ActiveRecord::Base.transaction do
+      message.update!(content: I18n.t('conversations.messages.deleted'), deleted: true)
+      message.attachments.destroy_all
+    end
+  end
+
   private
 
+  def message
+    @message ||= @conversation.messages.find(permitted_params[:id])
+  end
+
   def message_finder
     @message_finder ||= MessageFinder.new(@conversation, params)
   end
+
+  def permitted_params
+    params.permit(:id)
+  end
 end

app/controllers/api/v1/accounts/conversations_controller.rb

@@ -1,7 +1,8 @@
 class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseController
   include Events::Types
+  include DateRangeHelper
 
-  before_action :conversation, except: [:index]
+  before_action :conversation, except: [:index, :meta, :search, :create, :filter]
   before_action :contact_inbox, only: [:create]
 
   def index
@@ -15,26 +16,48 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
     @conversations_count = result[:count]
   end
 
+  def search
+    result = conversation_finder.perform
+    @conversations = result[:conversations]
+    @conversations_count = result[:count]
+  end
+
   def create
-    @conversation = ::Conversation.create!(conversation_params)
+    ActiveRecord::Base.transaction do
+      @conversation = ::Conversation.create!(conversation_params)
+      Messages::MessageBuilder.new(Current.user, @conversation, params[:message]).perform if params[:message].present?
+    end
   end
 
   def show; end
 
+  def filter
+    result = ::Conversations::FilterService.new(params.permit!, current_user).perform
+    @conversations = result[:conversations]
+    @conversations_count = result[:count]
+  end
+
   def mute
     @conversation.mute!
     head :ok
   end
 
+  def unmute
+    @conversation.unmute!
+    head :ok
+  end
+
   def transcript
-    ConversationReplyMailer.conversation_transcript(@conversation, params[:email])&.deliver_later if params[:email].present?
+    render json: { error: 'email param missing' }, status: :unprocessable_entity and return if params[:email].blank?
+
+    ConversationReplyMailer.with(account: @conversation.account).conversation_transcript(@conversation, params[:email])&.deliver_later
     head :ok
   end
 
   def toggle_status
     if params[:status]
-      @conversation.status = params[:status]
-      @status = @conversation.save
+      set_conversation_status
+      @status = @conversation.save!
     else
       @status = @conversation.toggle_status
     end
@@ -43,43 +66,88 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
   def toggle_typing_status
     case params[:typing_status]
     when 'on'
-      trigger_typing_event(CONVERSATION_TYPING_ON)
+      trigger_typing_event(CONVERSATION_TYPING_ON, params[:is_private])
     when 'off'
-      trigger_typing_event(CONVERSATION_TYPING_OFF)
+      trigger_typing_event(CONVERSATION_TYPING_OFF, params[:is_private])
     end
     head :ok
   end
 
   def update_last_seen
-    @conversation.agent_last_seen_at = DateTime.now.utc
+    # rubocop:disable Rails/SkipsModelValidations
+    @conversation.update_column(:agent_last_seen_at, DateTime.now.utc)
+    @conversation.update_column(:assignee_last_seen_at, DateTime.now.utc) if assignee?
+    # rubocop:enable Rails/SkipsModelValidations
+  end
+
+  def custom_attributes
+    @conversation.custom_attributes = params.permit(custom_attributes: {})[:custom_attributes]
     @conversation.save!
   end
 
   private
 
-  def trigger_typing_event(event)
+  def set_conversation_status
+    status = params[:status] == 'bot' ? 'pending' : params[:status]
+    @conversation.status = status
+    @conversation.snoozed_until = parse_date_time(params[:snoozed_until].to_s) if params[:snoozed_until]
+  end
+
+  def trigger_typing_event(event, is_private)
     user = current_user.presence || @resource
-    Rails.configuration.dispatcher.dispatch(event, Time.zone.now, conversation: @conversation, user: user)
+    Rails.configuration.dispatcher.dispatch(event, Time.zone.now, conversation: @conversation, user: user, is_private: is_private)
   end
 
   def conversation
-    @conversation ||= Current.account.conversations.find_by(display_id: params[:id])
+    @conversation ||= Current.account.conversations.find_by!(display_id: params[:id])
+    authorize @conversation.inbox, :show?
   end
 
   def contact_inbox
+    @contact_inbox = build_contact_inbox
+
     @contact_inbox ||= ::ContactInbox.find_by!(source_id: params[:source_id])
+    authorize @contact_inbox.inbox, :show?
+  end
+
+  def build_contact_inbox
+    return if params[:contact_id].blank? || params[:inbox_id].blank?
+
+    inbox = Current.account.inboxes.find(params[:inbox_id])
+    authorize inbox, :show?
+
+    ContactInboxBuilder.new(
+      contact_id: params[:contact_id],
+      inbox_id: inbox.id,
+      source_id: params[:source_id]
+    ).perform
   end
 
   def conversation_params
+    additional_attributes = params[:additional_attributes]&.permit! || {}
+    custom_attributes = params[:custom_attributes]&.permit! || {}
+    status = params[:status].present? ? { status: params[:status] } : {}
+
+    # TODO: temporary fallback for the old bot status in conversation, we will remove after couple of releases
+    status = { status: 'pending' } if status[:status] == 'bot'
     {
       account_id: Current.account.id,
       inbox_id: @contact_inbox.inbox_id,
       contact_id: @contact_inbox.contact_id,
-      contact_inbox_id: @contact_inbox.id
-    }
+      contact_inbox_id: @contact_inbox.id,
+      additional_attributes: additional_attributes,
+      custom_attributes: custom_attributes,
+      snoozed_until: params[:snoozed_until],
+      assignee_id: params[:assignee_id],
+      team_id: params[:team_id]
+    }.merge(status)
   end
 
   def conversation_finder
     @conversation_finder ||= ConversationFinder.new(current_user, params)
   end
+
+  def assignee?
+    @conversation.assignee_id? && current_user == @conversation.assignee
+  end
 end

app/controllers/api/v1/accounts/csat_survey_responses_controller.rb

@@ -0,0 +1,44 @@
+class Api::V1::Accounts::CsatSurveyResponsesController < Api::V1::Accounts::BaseController
+  include Sift
+  include DateRangeHelper
+
+  RESULTS_PER_PAGE = 25
+
+  before_action :check_authorization
+  before_action :set_csat_survey_responses, only: [:index, :metrics]
+  before_action :set_current_page, only: [:index]
+  before_action :set_current_page_surveys, only: [:index]
+  before_action :set_total_sent_messages_count, only: [:metrics]
+
+  sort_on :created_at, type: :datetime
+
+  def index; end
+
+  def metrics
+    @total_count = @csat_survey_responses.count
+    @ratings_count = @csat_survey_responses.group(:rating).count
+  end
+
+  private
+
+  def set_total_sent_messages_count
+    @csat_messages = Current.account.messages.input_csat
+    @csat_messages = @csat_messages.where(created_at: range) if range.present?
+    @total_sent_messages_count = @csat_messages.count
+  end
+
+  def set_csat_survey_responses
+    @csat_survey_responses = filtrate(
+      Current.account.csat_survey_responses.includes([:conversation, :assigned_agent, :contact])
+    )
+    @csat_survey_responses = @csat_survey_responses.where(created_at: range) if range.present?
+  end
+
+  def set_current_page_surveys
+    @csat_survey_responses = @csat_survey_responses.page(@current_page).per(RESULTS_PER_PAGE)
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+end

app/controllers/api/v1/accounts/custom_attribute_definitions_controller.rb

@@ -0,0 +1,49 @@
+class Api::V1::Accounts::CustomAttributeDefinitionsController < Api::V1::Accounts::BaseController
+  before_action :fetch_custom_attributes_definitions, except: [:create]
+  before_action :fetch_custom_attribute_definition, only: [:show, :update, :destroy]
+  DEFAULT_ATTRIBUTE_MODEL = 'conversation_attribute'.freeze
+
+  def index; end
+
+  def show; end
+
+  def create
+    @custom_attribute_definition = Current.account.custom_attribute_definitions.create!(
+      permitted_payload
+    )
+  end
+
+  def update
+    @custom_attribute_definition.update!(permitted_payload)
+  end
+
+  def destroy
+    @custom_attribute_definition.destroy
+    head :no_content
+  end
+
+  private
+
+  def fetch_custom_attributes_definitions
+    @custom_attribute_definitions = Current.account.custom_attribute_definitions.with_attribute_model(permitted_params[:attribute_model])
+  end
+
+  def fetch_custom_attribute_definition
+    @custom_attribute_definition = Current.account.custom_attribute_definitions.find(permitted_params[:id])
+  end
+
+  def permitted_payload
+    params.require(:custom_attribute_definition).permit(
+      :attribute_display_name,
+      :attribute_description,
+      :attribute_display_type,
+      :attribute_key,
+      :attribute_model,
+      attribute_values: []
+    )
+  end
+
+  def permitted_params
+    params.permit(:id, :filter_type, :attribute_model)
+  end
+end

app/controllers/api/v1/accounts/custom_filters_controller.rb

@@ -0,0 +1,49 @@
+class Api::V1::Accounts::CustomFiltersController < Api::V1::Accounts::BaseController
+  before_action :fetch_custom_filters, except: [:create]
+  before_action :fetch_custom_filter, only: [:show, :update, :destroy]
+  DEFAULT_FILTER_TYPE = 'conversation'.freeze
+
+  def index; end
+
+  def show; end
+
+  def create
+    @custom_filter = current_user.custom_filters.create!(
+      permitted_payload.merge(account_id: Current.account.id)
+    )
+  end
+
+  def update
+    @custom_filter.update!(permitted_payload)
+  end
+
+  def destroy
+    @custom_filter.destroy
+    head :no_content
+  end
+
+  private
+
+  def fetch_custom_filters
+    @custom_filters = current_user.custom_filters.where(
+      account_id: Current.account.id,
+      filter_type: permitted_params[:filter_type] || DEFAULT_FILTER_TYPE
+    )
+  end
+
+  def fetch_custom_filter
+    @custom_filter = @custom_filters.find(permitted_params[:id])
+  end
+
+  def permitted_payload
+    params.require(:custom_filter).permit(
+      :name,
+      :filter_type,
+      query: {}
+    )
+  end
+
+  def permitted_params
+    params.permit(:id, :filter_type)
+  end
+end

app/controllers/api/v1/accounts/facebook_indicators_controller.rb

@@ -1,55 +0,0 @@
-class Api::V1::Accounts::FacebookIndicatorsController < Api::V1::Accounts::BaseController
-  before_action :set_access_token
-  around_action :handle_with_exception
-
-  def mark_seen
-    fb_bot.deliver(payload('mark_seen'), access_token: @access_token)
-    head :ok
-  end
-
-  def typing_on
-    fb_bot.deliver(payload('typing_on'), access_token: @access_token)
-    head :ok
-  end
-
-  def typing_off
-    fb_bot.deliver(payload('typing_off'), access_token: @access_token)
-    head :ok
-  end
-
-  private
-
-  def fb_bot
-    ::Facebook::Messenger::Bot
-  end
-
-  def handle_with_exception
-    yield
-  rescue Facebook::Messenger::Error => e
-    Rails.logger.debug "Rescued: #{e.inspect}"
-    true
-  end
-
-  def payload(action)
-    {
-      recipient: { id: contact.source_id },
-      sender_action: action
-    }
-  end
-
-  def inbox
-    @inbox ||= Current.account.inboxes.find(permitted_params[:inbox_id])
-  end
-
-  def set_access_token
-    @access_token = inbox.channel.page_access_token
-  end
-
-  def contact
-    @contact ||= inbox.contact_inboxes.find_by!(contact_id: permitted_params[:contact_id])
-  end
-
-  def permitted_params
-    params.permit(:inbox_id, :contact_id)
-  end
-end

app/controllers/api/v1/accounts/inbox_members_controller.rb

@@ -1,30 +1,49 @@
 class Api::V1::Accounts::InboxMembersController < Api::V1::Accounts::BaseController
-  before_action :fetch_inbox, only: [:create, :show]
-  before_action :current_agents_ids, only: [:create]
+  before_action :fetch_inbox
+  before_action :current_agents_ids, only: [:create, :update]
 
   def create
-    # update also done via same action
-    update_agents_list
-    head :ok
-  rescue StandardError => e
-    Rails.logger.debug "Rescued: #{e.inspect}"
-    render_could_not_create_error('Could not add agents to inbox')
+    authorize @inbox, :create?
+    ActiveRecord::Base.transaction do
+      agents_to_be_added_ids.map { |user_id| @inbox.add_member(user_id) }
+    end
+    fetch_updated_agents
   end
 
   def show
-    @agents = Current.account.users.where(id: @inbox.members.select(:user_id))
+    authorize @inbox, :show?
+    fetch_updated_agents
+  end
+
+  def update
+    authorize @inbox, :update?
+    update_agents_list
+    fetch_updated_agents
+  end
+
+  def destroy
+    authorize @inbox, :destroy?
+    ActiveRecord::Base.transaction do
+      params[:user_ids].map { |user_id| @inbox.remove_member(user_id) }
+    end
+    head :ok
   end
 
   private
 
+  def fetch_updated_agents
+    @agents = Current.account.users.where(id: @inbox.members.select(:user_id))
+  end
+
   def update_agents_list
     # get all the user_ids which the inbox currently has as members.
     # get the list of  user_ids from params
     # the missing ones are the agents which are to be deleted from the inbox
     # the new ones are the agents which are to be added to the inbox
-
-    agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
-    agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    ActiveRecord::Base.transaction do
+      agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
+      agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    end
   end
 
   def agents_to_be_added_ids

app/controllers/api/v1/accounts/inboxes_controller.rb

@@ -1,34 +1,62 @@
 class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
+  include Api::V1::InboxesHelper
   before_action :fetch_inbox, except: [:index, :create]
   before_action :fetch_agent_bot, only: [:set_agent_bot]
-  before_action :check_authorization
+  # we are already handling the authorization in fetch inbox
+  before_action :check_authorization, except: [:show]
 
   def index
-    @inboxes = policy_scope(Current.account.inboxes.order_by_name.includes(:channel, :avatar_attachment))
+    @inboxes = policy_scope(Current.account.inboxes.order_by_name.includes(:channel, { avatar_attachment: [:blob] }))
+  end
+
+  def show; end
+
+  def assignable_agents
+    @assignable_agents = (Current.account.users.where(id: @inbox.members.select(:user_id)) + Current.account.administrators).uniq
+  end
+
+  def campaigns
+    @campaigns = @inbox.campaigns
+  end
+
+  def avatar
+    @inbox.avatar.attachment.destroy! if @inbox.avatar.attached?
+    head :ok
   end
 
   def create
     ActiveRecord::Base.transaction do
       channel = create_channel
       @inbox = Current.account.inboxes.build(
-        name: permitted_params[:name],
-        greeting_message: permitted_params[:greeting_message],
-        greeting_enabled: permitted_params[:greeting_enabled],
-        channel: channel
+        {
+          name: inbox_name(channel),
+          channel: channel
+        }.merge(
+          permitted_params.except(:channel)
+        )
       )
-      @inbox.avatar.attach(permitted_params[:avatar])
       @inbox.save!
     end
   end
 
   def update
-    @inbox.update(inbox_update_params.except(:channel))
-    return unless @inbox.channel.is_a?(Channel::WebWidget) && inbox_update_params[:channel].present?
+    @inbox.update(permitted_params.except(:channel))
+    @inbox.update_working_hours(params.permit(working_hours: Inbox::OFFISABLE_ATTRS)[:working_hours]) if params[:working_hours]
+    channel_attributes = get_channel_attributes(@inbox.channel_type)
 
-    @inbox.channel.update!(inbox_update_params[:channel])
+    # Inbox update doesn't necessarily need channel attributes
+    return if permitted_params(channel_attributes)[:channel].blank?
+
+    validate_email_channel(channel_attributes) if @inbox.inbox_type == 'Email'
+
+    @inbox.channel.update!(permitted_params(channel_attributes)[:channel])
     update_channel_feature_flags
   end
 
+  def agent_bot
+    @agent_bot = @inbox.agent_bot
+  end
+
   def set_agent_bot
     if @agent_bot
       agent_bot_inbox = @inbox.agent_bot_inbox || AgentBotInbox.new(inbox: @inbox)
@@ -49,49 +77,57 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
 
   def fetch_inbox
     @inbox = Current.account.inboxes.find(params[:id])
+    authorize @inbox, :show?
   end
 
   def fetch_agent_bot
     @agent_bot = AgentBot.find(params[:agent_bot]) if params[:agent_bot]
   end
 
-  def check_authorization
-    authorize(Inbox)
+  def inbox_name(channel)
+    return channel.try(:bot_name) if channel.is_a?(Channel::Telegram)
+
+    permitted_params[:name]
   end
 
   def create_channel
     case permitted_params[:channel][:type]
     when 'web_widget'
-      Current.account.web_widgets.create!(permitted_params[:channel].except(:type))
+      Current.account.web_widgets.create!(permitted_params(Channel::WebWidget::EDITABLE_ATTRS)[:channel].except(:type))
     when 'api'
-      Current.account.api_channels.create!(permitted_params[:channel].except(:type))
+      Current.account.api_channels.create!(permitted_params(Channel::Api::EDITABLE_ATTRS)[:channel].except(:type))
     when 'email'
-      Current.account.email_channels.create!(permitted_params[:channel].except(:type))
+      Current.account.email_channels.create!(permitted_params(Channel::Email::EDITABLE_ATTRS)[:channel].except(:type))
+    when 'line'
+      Current.account.line_channels.create!(permitted_params(Channel::Line::EDITABLE_ATTRS)[:channel].except(:type))
+    when 'telegram'
+      Current.account.telegram_channels.create!(permitted_params(Channel::Telegram::EDITABLE_ATTRS)[:channel].except(:type))
+    when 'whatsapp'
+      Current.account.whatsapp_channels.create!(permitted_params(Channel::Whatsapp::EDITABLE_ATTRS)[:channel].except(:type))
     end
   end
 
   def update_channel_feature_flags
-    return unless inbox_update_params[:channel].key? :selected_feature_flags
+    return unless @inbox.web_widget?
+    return unless permitted_params(Channel::WebWidget::EDITABLE_ATTRS)[:channel].key? :selected_feature_flags
 
-    @inbox.channel.selected_feature_flags = inbox_update_params[:channel][:selected_feature_flags]
+    @inbox.channel.selected_feature_flags = permitted_params(Channel::WebWidget::EDITABLE_ATTRS)[:channel][:selected_feature_flags]
     @inbox.channel.save!
   end
 
-  def permitted_params
-    params.permit(:id, :avatar, :name, :greeting_message, :greeting_enabled, channel:
-      [:type, :website_url, :widget_color, :welcome_title, :welcome_tagline, :webhook_url, :email])
+  def permitted_params(channel_attributes = [])
+    params.permit(
+      :name, :avatar, :greeting_enabled, :greeting_message, :enable_email_collect, :csat_survey_enabled,
+      :enable_auto_assignment, :working_hours_enabled, :out_of_office_message, :timezone,
+      channel: [:type, *channel_attributes]
+    )
   end
 
-  def inbox_update_params
-    params.permit(:enable_auto_assignment, :name, :avatar, :greeting_message, :greeting_enabled,
-                  channel: [
-                    :website_url,
-                    :widget_color,
-                    :welcome_title,
-                    :welcome_tagline,
-                    :webhook_url,
-                    :email,
-                    { selected_feature_flags: [] }
-                  ])
+  def get_channel_attributes(channel_type)
+    if channel_type.constantize.const_defined?('EDITABLE_ATTRS')
+      channel_type.constantize::EDITABLE_ATTRS.presence
+    else
+      []
+    end
   end
 end

app/controllers/api/v1/accounts/integrations/apps_controller.rb

@@ -1,4 +1,5 @@
 class Api::V1::Accounts::Integrations::AppsController < Api::V1::Accounts::BaseController
+  before_action :check_admin_authorization?
   before_action :fetch_apps, only: [:index]
   before_action :fetch_app, only: [:show]
 

app/controllers/api/v1/accounts/integrations/hooks_controller.rb

@@ -0,0 +1,31 @@
+class Api::V1::Accounts::Integrations::HooksController < Api::V1::Accounts::BaseController
+  before_action :fetch_hook, only: [:update, :destroy]
+  before_action :check_authorization
+
+  def create
+    @hook = Current.account.hooks.create!(permitted_params)
+  end
+
+  def update
+    @hook.update!(permitted_params.slice(:status, :settings))
+  end
+
+  def destroy
+    @hook.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_hook
+    @hook = Current.account.hooks.find(params[:id])
+  end
+
+  def check_authorization
+    authorize(:hook)
+  end
+
+  def permitted_params
+    params.require(:hook).permit(:app_id, :inbox_id, :status, settings: {})
+  end
+end

app/controllers/api/v1/accounts/integrations/slack_controller.rb

@@ -1,14 +1,17 @@
 class Api::V1::Accounts::Integrations::SlackController < Api::V1::Accounts::BaseController
+  before_action :check_admin_authorization?
   before_action :fetch_hook, only: [:update, :destroy]
 
   def create
-    builder = Integrations::Slack::HookBuilder.new(
-      account: Current.account,
-      code: params[:code],
-      inbox_id: params[:inbox_id]
-    )
-    @hook = builder.perform
-    create_chatwoot_slack_channel
+    ActiveRecord::Base.transaction do
+      builder = Integrations::Slack::HookBuilder.new(
+        account: Current.account,
+        code: params[:code],
+        inbox_id: params[:inbox_id]
+      )
+      @hook = builder.perform
+      create_chatwoot_slack_channel
+    end
   end
 
   def update

app/controllers/api/v1/accounts/kbase/base_controller.rb

@@ -0,0 +1,9 @@
+class Api::V1::Accounts::Kbase::BaseController < Api::V1::Accounts::BaseController
+  before_action :portal
+
+  private
+
+  def portal
+    @portal ||= Current.account.kbase_portals.find_by(id: params[:portal_id])
+  end
+end

app/controllers/api/v1/accounts/kbase/categories_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Kbase::CategoriesController < Api::V1::Accounts::Kbase::BaseController
+  before_action :fetch_category, except: [:index, :create]
+
+  def index
+    @categories = @portal.categories
+  end
+
+  def create
+    @category = @portal.categories.create!(category_params)
+  end
+
+  def update
+    @category.update!(category_params)
+  end
+
+  def destroy
+    @category.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_category
+    @category = @portal.categories.find(params[:id])
+  end
+
+  def category_params
+    params.require(:category).permit(
+      :name, :description, :position
+    )
+  end
+end

app/controllers/api/v1/accounts/kbase/portals_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Kbase::PortalsController < Api::V1::Accounts::Kbase::BaseController
+  before_action :fetch_portal, except: [:index, :create]
+
+  def index
+    @portals = Current.account.kbase_portals
+  end
+
+  def create
+    @portal = Current.account.kbase_portals.create!(portal_params)
+  end
+
+  def update
+    @portal.update!(portal_params)
+  end
+
+  def destroy
+    @portal.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_portal
+    @portal = current_account.kbase_portals.find(params[:id])
+  end
+
+  def portal_params
+    params.require(:portal).permit(
+      :account_id, :color, :custom_domain, :header_text, :homepage_link, :name, :page_title, :slug
+    )
+  end
+end

app/controllers/api/v1/accounts/labels_controller.rb

@@ -28,10 +28,6 @@ class Api::V1::Accounts::LabelsController < Api::V1::Accounts::BaseController
     @label = Current.account.labels.find(params[:id])
   end
 
-  def check_authorization
-    authorize(Label)
-  end
-
   def permitted_params
     params.require(:label).permit(:title, :description, :color, :show_on_sidebar)
   end

app/controllers/api/v1/accounts/notifications_controller.rb

@@ -1,22 +1,25 @@
 class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseController
-  protect_from_forgery with: :null_session
+  RESULTS_PER_PAGE = 15
 
   before_action :fetch_notification, only: [:update]
   before_action :set_primary_actor, only: [:read_all]
+  before_action :set_current_page, only: [:index]
 
   def index
     @unread_count = current_user.notifications.where(account_id: current_account.id, read_at: nil).count
-    @notifications = current_user.notifications.where(account_id: current_account.id).page params[:page]
+    @count = notifications.count
+    @notifications = notifications.page(@current_page).per(RESULTS_PER_PAGE)
   end
 
   def read_all
+    # rubocop:disable Rails/SkipsModelValidations
     if @primary_actor
       current_user.notifications.where(account_id: current_account.id, primary_actor: @primary_actor, read_at: nil)
-                  .update(read_at: DateTime.now.utc)
+                  .update_all(read_at: DateTime.now.utc)
     else
-      current_user.notifications.where(account_id: current_account.id, read_at: nil).update(read_at: DateTime.now.utc)
+      current_user.notifications.where(account_id: current_account.id, read_at: nil).update_all(read_at: DateTime.now.utc)
     end
-
+    # rubocop:enable Rails/SkipsModelValidations
     head :ok
   end
 
@@ -25,6 +28,11 @@ class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseContro
     render json: @notification
   end
 
+  def unread_count
+    @unread_count = current_user.notifications.where(account_id: current_account.id, read_at: nil).count
+    render json: @unread_count
+  end
+
   private
 
   def set_primary_actor
@@ -37,4 +45,12 @@ class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseContro
   def fetch_notification
     @notification = current_user.notifications.find(params[:id])
   end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def notifications
+    @notifications ||= current_user.notifications.where(account_id: current_account.id)
+  end
 end

app/controllers/api/v1/accounts/team_members_controller.rb

@@ -0,0 +1,48 @@
+class Api::V1::Accounts::TeamMembersController < Api::V1::Accounts::BaseController
+  before_action :fetch_team
+  before_action :check_authorization
+
+  def index
+    @team_members = @team.team_members.map(&:user)
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      @team_members = members_to_be_added_ids.map { |user_id| @team.add_member(user_id) }
+    end
+  end
+
+  def update
+    ActiveRecord::Base.transaction do
+      members_to_be_added_ids.each { |user_id| @team.add_member(user_id) }
+      members_to_be_removed_ids.each { |user_id| @team.remove_member(user_id) }
+    end
+    @team_members = @team.members
+    render action: 'create'
+  end
+
+  def destroy
+    ActiveRecord::Base.transaction do
+      params[:user_ids].map { |user_id| @team.remove_member(user_id) }
+    end
+    head :ok
+  end
+
+  private
+
+  def members_to_be_added_ids
+    params[:user_ids] - current_members_ids
+  end
+
+  def members_to_be_removed_ids
+    current_members_ids - params[:user_ids]
+  end
+
+  def current_members_ids
+    @current_members_ids ||= @team.members.pluck(:id)
+  end
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:team_id])
+  end
+end

app/controllers/api/v1/accounts/teams_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::TeamsController < Api::V1::Accounts::BaseController
+  before_action :fetch_team, only: [:show, :update, :destroy]
+  before_action :check_authorization
+
+  def index
+    @teams = Current.account.teams
+  end
+
+  def show; end
+
+  def create
+    @team = Current.account.teams.new(team_params)
+    @team.save!
+  end
+
+  def update
+    @team.update!(team_params)
+  end
+
+  def destroy
+    @team.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:id])
+  end
+
+  def team_params
+    params.require(:team).permit(:name, :description, :allow_auto_assign)
+  end
+end

app/controllers/api/v1/accounts/twitter/authorizations_controller.rb

@@ -0,0 +1,29 @@
+class Api::V1::Accounts::Twitter::AuthorizationsController < Api::V1::Accounts::BaseController
+  include TwitterConcern
+
+  before_action :check_authorization
+
+  def create
+    @response = twitter_client.request_oauth_token(url: twitter_callback_url)
+    if @response.status == '200'
+      ::Redis::Alfred.setex(oauth_token, Current.account.id)
+      render json: { success: true, url: oauth_authorize_endpoint(oauth_token) }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def oauth_token
+    parsed_body['oauth_token']
+  end
+
+  def oauth_authorize_endpoint(oauth_token)
+    "#{twitter_api_base_url}/oauth/authorize?oauth_token=#{oauth_token}"
+  end
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
+end

app/controllers/api/v1/accounts/webhooks_controller.rb

@@ -29,8 +29,4 @@ class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
   def fetch_webhook
     @webhook = Current.account.webhooks.find(params[:id])
   end
-
-  def check_authorization
-    authorize(Webhook)
-  end
 end

app/controllers/api/v1/accounts/working_hours_controller.rb

@@ -0,0 +1,18 @@
+class Api::V1::Accounts::WorkingHoursController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+  before_action :fetch_webhook, only: [:update]
+
+  def update
+    @working_hour.update!(working_hour_params)
+  end
+
+  private
+
+  def working_hour_params
+    params.require(:working_hour).permit(:inbox_id, :open_hour, :open_minutes, :close_hour, :close_minutes, :closed_all_day)
+  end
+
+  def fetch_working_hour
+    @working_hour = Current.account.working_hours.find(params[:id])
+  end
+end

app/controllers/api/v1/accounts_controller.rb

@@ -1,7 +1,6 @@
 class Api::V1::AccountsController < Api::BaseController
   include AuthHelper
 
-  skip_before_action :verify_authenticity_token, only: [:create]
   skip_before_action :authenticate_user!, :set_current_user, :handle_with_exception,
                      only: [:create], raise: false
   before_action :check_signup_enabled, only: [:create]
@@ -16,8 +15,9 @@ class Api::V1::AccountsController < Api::BaseController
   def create
     @user, @account = AccountBuilder.new(
       account_name: account_params[:account_name],
+      user_full_name: account_params[:user_full_name],
       email: account_params[:email],
-      confirmed: confirmed?,
+      user_password: account_params[:password],
       user: current_user
     ).perform
     if @user
@@ -29,11 +29,12 @@ class Api::V1::AccountsController < Api::BaseController
   end
 
   def show
+    @latest_chatwoot_version = ::Redis::Alfred.get(::Redis::Alfred::LATEST_CHATWOOT_VERSION)
     render 'api/v1/accounts/show.json'
   end
 
   def update
-    @account.update!(account_params.slice(:name, :locale, :domain, :support_email))
+    @account.update!(account_params.slice(:name, :locale, :domain, :support_email, :auto_resolve_duration))
   end
 
   def update_active_at
@@ -44,25 +45,17 @@ class Api::V1::AccountsController < Api::BaseController
 
   private
 
-  def check_authorization
-    authorize(Account)
-  end
-
-  def confirmed?
-    super_admin? && params[:confirmed]
-  end
-
   def fetch_account
     @account = current_user.accounts.find(params[:id])
     @current_account_user = @account.account_users.find_by(user_id: current_user.id)
   end
 
   def account_params
-    params.permit(:account_name, :email, :name, :locale, :domain, :support_email)
+    params.permit(:account_name, :email, :name, :password, :locale, :domain, :support_email, :auto_resolve_duration, :user_full_name)
   end
 
   def check_signup_enabled
-    raise ActionController::RoutingError, 'Not Found' if ENV.fetch('ENABLE_ACCOUNT_SIGNUP', true) == 'false'
+    raise ActionController::RoutingError, 'Not Found' if GlobalConfig.get_value('ENABLE_ACCOUNT_SIGNUP') == 'false'
   end
 
   def pundit_user

app/controllers/api/v1/agent_bots_controller.rb

@@ -1,7 +0,0 @@
-class Api::V1::AgentBotsController < Api::BaseController
-  skip_before_action :authenticate_user!
-
-  def index
-    render json: AgentBot.all
-  end
-end

app/controllers/api/v1/profiles_controller.rb

@@ -1,29 +1,52 @@
 class Api::V1::ProfilesController < Api::BaseController
   before_action :set_user
 
-  def show
-    render partial: 'api/v1/models/user.json.jbuilder', locals: { resource: @user }
-  end
+  def show; end
 
   def update
+    if password_params[:password].present?
+      render_could_not_create_error('Invalid current password') and return unless @user.valid_password?(password_params[:current_password])
+
+      @user.update!(password_params.except(:current_password))
+    end
+
     @user.update!(profile_params)
   end
 
+  def avatar
+    @user.avatar.attachment.destroy! if @user.avatar.attached?
+    head :ok
+  end
+
+  def availability
+    @user.account_users.find_by!(account_id: availability_params[:account_id]).update!(availability: availability_params[:availability])
+  end
+
   private
 
   def set_user
     @user = current_user
   end
 
+  def availability_params
+    params.require(:profile).permit(:account_id, :availability)
+  end
+
   def profile_params
     params.require(:profile).permit(
       :email,
       :name,
       :display_name,
-      :password,
-      :password_confirmation,
       :avatar,
-      :availability
+      ui_settings: {}
+    )
+  end
+
+  def password_params
+    params.require(:profile).permit(
+      :current_password,
+      :password,
+      :password_confirmation
     )
   end
 end

app/controllers/api/v1/webhooks_controller.rb

@@ -10,7 +10,7 @@ class Api::V1::WebhooksController < ApplicationController
     twitter_consumer.consume
     head :ok
   rescue StandardError => e
-    Raven.capture_exception(e)
+    Sentry.capture_exception(e)
     head :ok
   end
 

app/controllers/api/v1/widget/base_controller.rb

@@ -1,34 +1,83 @@
 class Api::V1::Widget::BaseController < ApplicationController
+  include SwitchLocale
+
   before_action :set_web_widget
   before_action :set_contact
 
   private
 
+  def conversations
+    if @contact_inbox.hmac_verified?
+      verified_contact_inbox_ids = @contact.contact_inboxes.where(inbox_id: auth_token_params[:inbox_id], hmac_verified: true).map(&:id)
+      @conversations = @contact.conversations.where(contact_inbox_id: verified_contact_inbox_ids)
+    else
+      @conversations = @contact_inbox.conversations.where(inbox_id: auth_token_params[:inbox_id])
+    end
+  end
+
   def conversation
-    @conversation ||= @contact_inbox.conversations.where(
-      inbox_id: auth_token_params[:inbox_id]
-    ).last
+    @conversation ||= conversations.last
   end
 
   def auth_token_params
-    @auth_token_params ||= ::Widget::TokenService.new(token: request.headers[header_name]).decode_token
-  end
-
-  def header_name
-    'X-Auth-Token'
+    @auth_token_params ||= ::Widget::TokenService.new(token: request.headers['X-Auth-Token']).decode_token
   end
 
   def set_web_widget
     @web_widget = ::Channel::WebWidget.find_by!(website_token: permitted_params[:website_token])
-    @account = @web_widget.account
-    switch_locale @account
+    @current_account = @web_widget.account
   end
 
   def set_contact
     @contact_inbox = @web_widget.inbox.contact_inboxes.find_by(
       source_id: auth_token_params[:source_id]
     )
-    @contact = @contact_inbox.contact
+    @contact = @contact_inbox&.contact
+    raise ActiveRecord::RecordNotFound unless @contact
+  end
+
+  def create_conversation
+    ::Conversation.create!(conversation_params)
+  end
+
+  def inbox
+    @inbox ||= ::Inbox.find_by(id: auth_token_params[:inbox_id])
+  end
+
+  def conversation_params
+    # FIXME: typo referrer in additional attributes, will probably require a migration.
+    {
+      account_id: inbox.account_id,
+      inbox_id: inbox.id,
+      contact_id: @contact.id,
+      contact_inbox_id: @contact_inbox.id,
+      additional_attributes: {
+        browser: browser_params,
+        referer: permitted_params[:message][:referer_url],
+        initiated_at: timestamp_params
+      }
+    }
+  end
+
+  def update_contact(email)
+    contact_with_email = @current_account.contacts.find_by(email: email)
+    if contact_with_email
+      @contact = ::ContactMergeAction.new(
+        account: @current_account,
+        base_contact: contact_with_email,
+        mergee_contact: @contact
+      ).perform
+    else
+      @contact.update!(email: email, name: contact_name)
+    end
+  end
+
+  def contact_email
+    permitted_params[:contact][:email].downcase
+  end
+
+  def contact_name
+    params[:contact][:name] || contact_email.split('@')[0]
   end
 
   def browser_params
@@ -40,4 +89,23 @@ class Api::V1::Widget::BaseController < ApplicationController
       platform_version: browser.platform.version
     }
   end
+
+  def timestamp_params
+    { timestamp: permitted_params[:message][:timestamp] }
+  end
+
+  def permitted_params
+    params.permit(:website_token)
+  end
+
+  def message_params
+    {
+      account_id: conversation.account_id,
+      sender: @contact,
+      content: permitted_params[:message][:content],
+      inbox_id: conversation.inbox_id,
+      echo_id: permitted_params[:message][:echo_id],
+      message_type: :incoming
+    }
+  end
 end

app/controllers/api/v1/widget/campaigns_controller.rb

@@ -0,0 +1,7 @@
+class Api::V1::Widget::CampaignsController < Api::V1::Widget::BaseController
+  skip_before_action :set_contact
+
+  def index
+    @campaigns = @web_widget.inbox.campaigns.where(enabled: true)
+  end
+end

app/controllers/api/v1/widget/configs_controller.rb

@@ -0,0 +1,41 @@
+class Api::V1::Widget::ConfigsController < Api::V1::Widget::BaseController
+  before_action :set_global_config
+
+  def create
+    build_contact
+    set_token
+  end
+
+  private
+
+  def set_global_config
+    @global_config = GlobalConfig.get('LOGO_THUMBNAIL', 'BRAND_NAME', 'WIDGET_BRAND_URL')
+  end
+
+  def set_contact
+    @contact_inbox = @web_widget.inbox.contact_inboxes.find_by(
+      source_id: auth_token_params[:source_id]
+    )
+    @contact = @contact_inbox&.contact
+  end
+
+  def build_contact
+    return if @contact.present?
+
+    @contact_inbox = @web_widget.create_contact_inbox(additional_attributes)
+    @contact = @contact_inbox.contact
+  end
+
+  def set_token
+    payload = { source_id: @contact_inbox.source_id, inbox_id: @web_widget.inbox.id }
+    @token = ::Widget::TokenService.new(payload: payload).generate_token
+  end
+
+  def additional_attributes
+    if @web_widget.inbox.account.feature_enabled?('ip_lookup')
+      { created_at_ip: request.remote_ip }
+    else
+      {}
+    end
+  end
+end

app/controllers/api/v1/widget/contacts_controller.rb

@@ -1,15 +1,51 @@
 class Api::V1::Widget::ContactsController < Api::V1::Widget::BaseController
+  before_action :process_hmac, only: [:update]
+
+  def show; end
+
   def update
     contact_identify_action = ContactIdentifyAction.new(
       contact: @contact,
       params: permitted_params.to_h.deep_symbolize_keys
     )
-    render json: contact_identify_action.perform
+    @contact = contact_identify_action.perform
+  end
+
+  # TODO : clean up this with proper routes delete contacts/custom_attributes
+  def destroy_custom_attributes
+    @contact.custom_attributes = @contact.custom_attributes.excluding(params[:custom_attributes])
+    @contact.save!
+    render json: @contact
   end
 
   private
 
+  def process_hmac
+    return unless should_verify_hmac?
+
+    render json: { error: 'HMAC failed: Invalid Identifier Hash Provided' }, status: :unauthorized unless valid_hmac?
+
+    @contact_inbox.update(hmac_verified: true)
+  end
+
+  def should_verify_hmac?
+    return false if params[:identifier_hash].blank? && !@web_widget.hmac_mandatory
+
+    # Taking an extra caution that the hmac is triggered whenever identifier is present
+    return false if params[:custom_attributes].present? && params[:identifier].blank?
+
+    true
+  end
+
+  def valid_hmac?
+    params[:identifier_hash] == OpenSSL::HMAC.hexdigest(
+      'sha256',
+      @web_widget.hmac_token,
+      params[:identifier].to_s
+    )
+  end
+
   def permitted_params
-    params.permit(:website_token, :identifier, :email, :name, :avatar_url, custom_attributes: {})
+    params.permit(:website_token, :identifier, :identifier_hash, :email, :name, :avatar_url, :phone_number, custom_attributes: {})
   end
 end

app/controllers/api/v1/widget/conversations_controller.rb

@@ -5,6 +5,14 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
     @conversation = conversation
   end
 
+  def create
+    ActiveRecord::Base.transaction do
+      update_contact(contact_email) if @contact.email.blank? && contact_email.present?
+      @conversation = create_conversation
+      conversation.messages.create(message_params)
+    end
+  end
+
   def update_last_seen
     head :ok && return if conversation.nil?
 
@@ -15,7 +23,7 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
 
   def transcript
     if permitted_params[:email].present? && conversation.present?
-      ConversationReplyMailer.conversation_transcript(
+      ConversationReplyMailer.with(account: conversation.account).conversation_transcript(
         conversation,
         permitted_params[:email]
       )&.deliver_later
@@ -43,6 +51,6 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
   end
 
   def permitted_params
-    params.permit(:id, :typing_status, :website_token, :email)
+    params.permit(:id, :typing_status, :website_token, :email, contact: [:name, :email], message: [:content, :referer_url, :timestamp, :echo_id])
   end
 end

app/controllers/api/v1/widget/events_controller.rb

@@ -2,7 +2,8 @@ class Api::V1::Widget::EventsController < Api::V1::Widget::BaseController
   include Events::Types
 
   def create
-    Rails.configuration.dispatcher.dispatch(permitted_params[:name], Time.zone.now, contact_inbox: @contact_inbox, event_info: event_info)
+    Rails.configuration.dispatcher.dispatch(permitted_params[:name], Time.zone.now, contact_inbox: @contact_inbox,
+                                                                                    event_info: permitted_params[:event_info].to_h.merge(event_info))
     head :no_content
   end
 
@@ -17,6 +18,6 @@ class Api::V1::Widget::EventsController < Api::V1::Widget::BaseController
   end
 
   def permitted_params
-    params.permit(:name, :website_token)
+    params.permit(:name, :website_token, event_info: {})
   end
 end

app/controllers/api/v1/widget/inbox_members_controller.rb

@@ -4,10 +4,4 @@ class Api::V1::Widget::InboxMembersController < Api::V1::Widget::BaseController
   def index
     @inbox_members = @web_widget.inbox.inbox_members.includes(:user)
   end
-
-  private
-
-  def permitted_params
-    params.permit(:website_token)
-  end
 end

app/controllers/api/v1/widget/labels_controller.rb

@@ -1,20 +1,29 @@
 class Api::V1::Widget::LabelsController < Api::V1::Widget::BaseController
   def create
-    conversation.label_list.add(permitted_params[:label])
-    conversation.save!
+    if conversation.present? && label_defined_in_account?
+      conversation.label_list.add(permitted_params[:label])
+      conversation.save!
+    end
 
     head :no_content
   end
 
   def destroy
-    conversation.label_list.remove(permitted_params[:id])
-    conversation.save!
+    if conversation.present?
+      conversation.label_list.remove(permitted_params[:id])
+      conversation.save!
+    end
 
     head :no_content
   end
 
   private
 
+  def label_defined_in_account?
+    label = @current_account.labels&.find_by(title: permitted_params[:label])
+    label.present?
+  end
+
   def permitted_params
     params.permit(:id, :label, :website_token)
   end

app/controllers/api/v1/widget/messages_controller.rb

@@ -8,8 +8,8 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
 
   def create
     @message = conversation.messages.new(message_params)
-    @message.save
     build_attachment
+    @message.save!
   end
 
   def update
@@ -20,7 +20,7 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
       @message.update!(message_update_params[:message])
     end
   rescue StandardError => e
-    render json: { error: @contact.errors, message: e.message }.to_json, status: 500
+    render json: { error: @contact.errors, message: e.message }.to_json, status: :internal_server_error
   end
 
   private
@@ -29,52 +29,16 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
     return if params[:message][:attachments].blank?
 
     params[:message][:attachments].each do |uploaded_attachment|
-      attachment = @message.attachments.new(
+      @message.attachments.new(
         account_id: @message.account_id,
-        file_type: helpers.file_type(uploaded_attachment&.content_type)
+        file_type: helpers.file_type(uploaded_attachment&.content_type),
+        file: uploaded_attachment
       )
-      attachment.file.attach(uploaded_attachment)
     end
-    @message.save!
   end
 
   def set_conversation
-    @conversation = ::Conversation.create!(conversation_params) if conversation.nil?
-  end
-
-  def message_params
-    {
-      account_id: conversation.account_id,
-      sender: @contact,
-      content: permitted_params[:message][:content],
-      inbox_id: conversation.inbox_id,
-      echo_id: permitted_params[:message][:echo_id],
-      message_type: :incoming
-    }
-  end
-
-  def conversation_params
-    {
-      account_id: inbox.account_id,
-      inbox_id: inbox.id,
-      contact_id: @contact.id,
-      contact_inbox_id: @contact_inbox.id,
-      additional_attributes: {
-        browser: browser_params,
-        referer: permitted_params[:message][:referer_url],
-        initiated_at: timestamp_params
-      }
-    }
-  end
-
-  def timestamp_params
-    {
-      timestamp: permitted_params[:message][:timestamp]
-    }
-  end
-
-  def inbox
-    @inbox ||= ::Inbox.find_by(id: auth_token_params[:inbox_id])
+    @conversation = create_conversation if conversation.nil?
   end
 
   def message_finder_params
@@ -88,36 +52,13 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
     @message_finder ||= MessageFinder.new(conversation, message_finder_params)
   end
 
-  def update_contact(email)
-    contact_with_email = @account.contacts.find_by(email: email)
-    if contact_with_email
-      @contact = ::ContactMergeAction.new(
-        account: @account,
-        base_contact: contact_with_email,
-        mergee_contact: @contact
-      ).perform
-    else
-      @contact.update!(
-        email: email,
-        name: contact_name
-      )
-    end
-  end
-
-  def contact_email
-    permitted_params[:contact][:email].downcase
-  end
-
-  def contact_name
-    contact_email.split('@')[0]
-  end
-
   def message_update_params
-    params.permit(message: [{ submitted_values: [:name, :title, :value] }])
+    params.permit(message: [{ submitted_values: [:name, :title, :value, { csat_survey_response: [:feedback_message, :rating] }] }])
   end
 
   def permitted_params
-    params.permit(:id, :before, :website_token, contact: [:email], message: [:content, :referer_url, :timestamp, :echo_id])
+    # timestamp parameter is used in create conversation method
+    params.permit(:id, :before, :website_token, contact: [:name, :email], message: [:content, :referer_url, :timestamp, :echo_id])
   end
 
   def set_message