Merge branch 'release/1.18.1'

ref: https://www.chatwoot.com/docs/self-hosted/telemetry

.circleci/config.yml

@@ -7,7 +7,7 @@ defaults: &defaults
   working_directory: ~/build
   docker:
     # specify the version you desire here
-    - image: circleci/ruby:2.7.1-node-browsers
+    - image: circleci/ruby:2.7.3-node-browsers
 
     # Specify service dependencies here if necessary
     # CircleCI maintains a library of pre-built images

.codeclimate.yml

@@ -30,3 +30,5 @@ exclude_patterns:
   - "**/*.md"
   - "**/*.yml"
   - "app/javascript/dashboard/i18n/locale"
+  - "**/*.stories.js"
+  - "stories/"

.devcontainer/Dockerfile

@@ -0,0 +1,8 @@
+# The below image is created out of the Dockerfile.base
+# It has the dependencies already installed so that codespace will boot up fast
+FROM ghcr.io/chatwoot/chatwoot_codespace:latest
+
+# Do the set up required for chatwoot app 
+WORKDIR /workspace
+COPY . /workspace
+RUN yarn && gem install bundler && bundle install 

.devcontainer/Dockerfile.base

@@ -0,0 +1,45 @@
+# pre-build stage
+ARG VARIANT=2.7
+FROM mcr.microsoft.com/vscode/devcontainers/ruby:${VARIANT}
+
+# Update args in docker-compose.yaml to set the UID/GID of the "vscode" user.
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+RUN if [ "$USER_GID" != "1000" ] || [ "$USER_UID" != "1000" ]; then \
+        groupmod --gid $USER_GID vscode \
+        && usermod --uid $USER_UID --gid $USER_GID vscode \
+        && chmod -R $USER_UID:$USER_GID /home/vscode; \
+    fi
+
+# [Option] Install Node.js
+ARG INSTALL_NODE="true"
+ARG NODE_VERSION="lts/*"
+RUN if [ "${INSTALL_NODE}" = "true" ]; then su vscode -c "source /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi
+
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+  && apt-get -y install --no-install-recommends \
+    libssl-dev \
+    tar \
+    tzdata \
+    postgresql-client \
+    yarn \
+    git \
+    imagemagick \
+    tmux \
+    zsh
+
+
+# Install overmind
+RUN curl -L https://github.com/DarthSim/overmind/releases/download/v2.1.0/overmind-v2.1.0-linux-amd64.gz > overmind.gz \
+  && gunzip overmind.gz \
+  && sudo mv overmind /usr/local/bin \
+  && chmod +x /usr/local/bin/overmind 
+
+# Do the set up required for chatwoot app 
+WORKDIR /workspace
+COPY . /workspace
+RUN yarn
+
+COPY Gemfile Gemfile.lock ./
+RUN gem install bundler && bundle install
+

.devcontainer/devcontainer.json

@@ -0,0 +1,39 @@
+{
+  "name": "Chatwoot Development Codespace",
+  "service": "app",
+  "dockerComposeFile": "docker-compose.yml",
+
+  "settings": {
+    "terminal.integrated.shell.linux": "/bin/zsh"
+  },
+
+
+  // Add the IDs of extensions you want installed when the container is created.
+  "extensions": [
+    "rebornix.Ruby",
+    "misogi.ruby-rubocop",
+    "wingrunr21.vscode-ruby",
+    "davidpallinder.rails-test-runner",
+    "eamodio.gitlens",
+    "github.copilot",
+    "mrmlnc.vscode-duplicate"
+  ],
+
+
+  // 5432 postgres
+  // 6379 redis
+  // 1025,8025 mailhog
+  "forwardPorts": [8025],
+  //your application may need to listen on all interfaces (0.0.0.0) not just localhost for it to be available externally. Defaults to []
+  "appPort": [3000, 3035],
+
+  "postCreateCommand": ".devcontainer/scripts/setup.sh && bundle exec rake db:chatwoot_prepare && yarn",
+  "portsAttributes": {
+    "3000": {
+      "label": "Rails Server"
+    },
+    "8025": {
+      "label": "Mailhog UI"
+    }
+  },
+}

.devcontainer/docker-compose.yml

@@ -0,0 +1,56 @@
+# https://github.com/microsoft/vscode-dev-containers/blob/master/containers/python-3-postgres/.devcontainer/docker-compose.yml
+# https://github.com/microsoft/vscode-dev-containers/blob/master/containers/ruby-rails/.devcontainer/devcontainer.json
+# 
+
+version: '3'
+
+services:
+  app: 
+    build:
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
+      args:
+        # Update 'VARIANT' to pick a Ruby version: 2, 2.7, 2.6, 2.5
+        VARIANT: 2.7
+        # [Choice] Install Node.js
+        INSTALL_NODE: "true"
+        NODE_VERSION: "lts/*"
+        # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000.
+        USER_UID: 1000
+        USER_GID: 1000
+
+    volumes:
+      - ..:/workspace:cached
+  
+    # Overrides default command so things don't shut down after the process ends.
+    command: sleep infinity
+    
+    # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function.
+    network_mode: service:db
+
+  db:
+    image: postgres:latest
+    restart: unless-stopped
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD: postgres
+
+  redis:
+    image: redis:latest
+    restart: unless-stopped
+    network_mode: service:db
+    volumes:
+      - redis-data:/data
+
+  mailhog:
+    restart: unless-stopped
+    image: mailhog/mailhog
+    network_mode: service:db
+  
+volumes:
+  postgres-data:
+  redis-data:
+  

.devcontainer/scripts/setup.sh

@@ -0,0 +1,8 @@
+cp .env.example .env
+sed -i -e '/REDIS_URL/ s/=.*/=redis:\/\/localhost:6379/' .env
+sed -i -e '/POSTGRES_HOST/ s/=.*/=localhost/' .env
+sed -i -e '/SMTP_ADDRESS/ s/=.*/=localhost/' .env
+sed -i -e "/FRONTEND_URL/ s/=.*/=https:\/\/$CODESPACE_NAME-3000.githubpreview.dev/" .env
+sed -i -e "/WEBPACKER_DEV_SERVER_PUBLIC/ s/=.*/=https:\/\/$CODESPACE_NAME-3035.githubpreview.dev/" .env
+# uncomment the webpacker env variable
+sed -i -e '/WEBPACKER_DEV_SERVER_PUBLIC/s/^# //' .env

.env.example

@@ -4,6 +4,10 @@ SECRET_KEY_BASE=replace_with_lengthy_secure_hex
 # Replace with the URL you are planning to use for your app
 FRONTEND_URL=http://0.0.0.0:3000
 
+# If the variable is set, all non-authenticated pages would fallback to the default locale.
+# Whenever a new account is created, the default language will be DEFAULT_LOCALE instead of en
+# DEFAULT_LOCALE=en
+
 # If you plan to use CDN for your assets, set Asset CDN Host
 ASSET_CDN_HOST=
 
@@ -14,7 +18,7 @@ FORCE_SSL=false
 # true : default option, allows sign ups
 # false : disables all the end points related to sign ups
 # api_only: disables the UI for signup, but you can create sign ups via the account apis
-ENABLE_ACCOUNT_SIGNUP=true
+ENABLE_ACCOUNT_SIGNUP=false
 
 # Redis config
 REDIS_URL=redis://redis:6379
@@ -22,6 +26,11 @@ REDIS_URL=redis://redis:6379
 # which will be the password for the redis service running inside the docker-compose
 # to make it secure
 REDIS_PASSWORD=
+# Redis Sentinel can be used by passing list of sentinel host and ports e,g. sentinel_host1:port1,sentinel_host2:port2
+REDIS_SENTINELS=
+# Redis sentinel master name is required when using sentinel, default value is "mymaster".
+# You can find list of master using "SENTINEL masters" command
+REDIS_SENTINEL_MASTER_NAME=
 
 # Postgres Database config variables
 POSTGRES_HOST=postgres
@@ -30,28 +39,35 @@ POSTGRES_PASSWORD=
 RAILS_ENV=development
 RAILS_MAX_THREADS=5
 
-# Mail outgoing
-MAILER_SENDER_EMAIL=accounts@chatwoot.com
-SMTP_PORT=1025
+# The email from which all outgoing emails are sent
+# could user either  `email@yourdomain.com` or `BrandName <email@yourdomain.com>`
+MAILER_SENDER_EMAIL=Chatwoot <accounts@chatwoot.com>
+
+
+#SMTP domain key is set up for HELO checking
 SMTP_DOMAIN=chatwoot.com
-# if you are running docker-compose, set SMTP_ADDRESS value as "mailhog",
-# else set the value as "localhost"
+# the default value is set "mailhog" and is used by docker-compose for development environments,
+# Set the value as "localhost" or your SMTP address in other environments
 SMTP_ADDRESS=mailhog
+SMTP_PORT=1025
 SMTP_USERNAME=
 SMTP_PASSWORD=
+# plain,login,cram_md5
 SMTP_AUTHENTICATION=
-SMTP_ENABLE_STARTTLS_AUTO=
+SMTP_ENABLE_STARTTLS_AUTO=true
+# Can be: 'none', 'peer', 'client_once', 'fail_if_no_peer_cert', see http://api.rubyonrails.org/classes/ActionMailer/Base.html
+SMTP_OPENSSL_VERIFY_MODE=peer
 
 # Mail Incoming
 # This is the domain set for the reply emails when conversation continuity is enabled
 MAILER_INBOUND_EMAIL_DOMAIN=
 # Set this to appropriate ingress channel with regards to incoming emails
 # Possible values are :
-# :relay for Exim, Postfix, Qmail
-# :mailgun for Mailgun
-# :mandrill for Mandrill
-# :postmark for Postmark
-# :sendgrid for Sendgrid
+# relay for Exim, Postfix, Qmail
+# mailgun for Mailgun
+# mandrill for Mandrill
+# postmark for Postmark
+# sendgrid for Sendgrid
 RAILS_INBOUND_EMAIL_SERVICE=
 # Use one of the following based on the email ingress service
 # Ref: https://edgeguides.rubyonrails.org/action_mailbox_basics.html
@@ -100,6 +116,16 @@ SLACK_CLIENT_SECRET=
 ### Change this env variable only if you are using a custom build mobile app
 ## Mobile app env variables
 IOS_APP_ID=6C953F3RX2.com.chatwoot.app
+ANDROID_BUNDLE_ID=com.chatwoot.app
+
+# https://developers.google.com/android/guides/client-auth (use keytool to print the fingerprint in the first section)
+ANDROID_SHA256_CERT_FINGERPRINT=AC:73:8E:DE:EB:56:EA:CC:10:87:02:A7:65:37:7B:38:D4:5D:D4:53:F8:3B:FB:D3:C6:28:64:1D:AA:08:1E:D8
+
+
+### Smart App Banner
+# https://developer.apple.com/library/archive/documentation/AppleApplications/Reference/SafariWebContent/PromotingAppswithAppBanners/PromotingAppswithAppBanners.html
+# You can find your app-id in https://itunesconnect.apple.com
+#IOS_APP_IDENTIFIER=1495796682
 
 ## Push Notification
 ## generate a new key value here : https://d3v.one/vapid-key-generator/
@@ -112,6 +138,22 @@ IOS_APP_ID=6C953F3RX2.com.chatwoot.app
 ## Bot Customizations
 USE_INBOX_AVATAR_FOR_BOT=true
 
+
+
+## IP look up configuration
+## ref https://github.com/alexreisner/geocoder/blob/master/README_API_GUIDE.md
+## works only on accounts with ip look up feature enabled
+# IP_LOOKUP_SERVICE=geoip2
+# maxmindb api key to use geoip2 service
+# IP_LOOKUP_API_KEY=
+
+
+## Running chatwoot as an API only server
+## setting this value to true will disable the frontend dashboard endpoints
+# CW_API_ONLY_SERVER=false
+
 ## Development Only Config
 # if you want to use letter_opener for local emails
 # LETTER_OPENER=true
+# meant to be used in github codespaces
+# WEBPACKER_DEV_SERVER_PUBLIC=

.github/ISSUE_TEMPLATE/bug_report.md

@@ -26,6 +26,14 @@ A clear and concise description of what you expected to happen.
 
 If applicable, add screenshots to help explain your problem.
 
+**Browser logs**
+
+Share the browser logs to debug the issue further
+
+**Server logs**
+
+Share the server logs to debug the issue further
+
 **Environment**
 
 Describe whether you are using Chatwoot Cloud (app.chatwoot.com) or a self hosted installation of Chatwoot. If you are using a self hosted installation of Chatwoot describe the type of deployment (Docker/Linux VM installation/Heroku)

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,9 +24,9 @@ Please describe the tests that you ran to verify your changes. Provide instructi
 
 - [ ] My code follows the style guidelines of this project
 - [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have commented on my code, particularly in hard-to-understand areas
 - [ ] I have made corresponding changes to the documentation
 - [ ] My changes generate no new warnings
 - [ ] I have added tests that prove my fix is effective or that my feature works
 - [ ] New and existing unit tests pass locally with my changes
-- [ ] Any dependent changes have been merged and published in downstream modules
+- [ ] Any dependent changes have been merged and published in downstream modules

.github/workflows/publish_codespace_image.yml

@@ -0,0 +1,23 @@
+name: Publish Codespace Base Image
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish-code-space-image:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v1
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Build the Codespace Base Image
+      run: |
+        docker build . -t ghcr.io/chatwoot/chatwoot_codespace:latest -f .devcontainer/Dockerfile.base 
+        docker push ghcr.io/chatwoot/chatwoot_codespace:latest

.gitignore

@@ -16,6 +16,7 @@
 /tmp/*
 !/log/.keep
 !/tmp/.keep
+*.mmdb
 
 # Ignore Byebug command history file.
 .byebug_history
@@ -23,7 +24,7 @@
 *.log
 # Ignore application configuration
 node_modules
-
+master.key
 *.rdb
 
 # Ignore env files
@@ -58,4 +59,7 @@ package-lock.json
 
 
 # cypress
-test/cypress/videos/*
+test/cypress/videos/*
+
+/config/master.key
+/config/*.enc

.prettierrc

@@ -1,5 +1,6 @@
 {
   "printWidth": 80,
   "singleQuote": true,
-  "trailingComma": "es5"
+  "trailingComma": "es5",
+  "arrowParens": "avoid"
 }

.rubocop.yml

@@ -11,6 +11,8 @@ Metrics/ClassLength:
   Max: 125
   Exclude:
     - 'app/models/conversation.rb'
+    - 'app/mailers/conversation_reply_mailer.rb'
+    - 'app/models/message.rb'
 RSpec/ExampleLength:
   Max: 25
 Style/Documentation:
@@ -42,12 +44,17 @@ Metrics/BlockLength:
     - '**/routes.rb'
     - 'config/environments/*'
     - db/schema.rb
+Metrics/ModuleLength:
+  Exclude:
+    - lib/woot_message_seeder.rb
 Rails/ApplicationController:
   Exclude:
     - 'app/controllers/api/v1/widget/messages_controller.rb'
     - 'app/controllers/dashboard_controller.rb'
     - 'app/controllers/widget_tests_controller.rb'
     - 'app/controllers/widgets_controller.rb'
+    - 'app/controllers/platform_controller.rb'
+    - 'app/controllers/public_controller.rb'
 Style/ClassAndModuleChildren:
   EnforcedStyle: compact
   Exclude:
@@ -98,10 +105,12 @@ Rails/BulkChangeTable:
     - 'db/migrate/20170511134418_latlong.rb'
     - 'db/migrate/20191027054756_create_contact_inboxes.rb'
     - 'db/migrate/20191130164019_add_template_type_to_messages.rb'
+    - 'db/migrate/20210425093724_convert_integration_hook_settings_field.rb'
 Rails/UniqueValidationWithoutIndex: 
   Exclude:
     - 'app/models/channel/twitter_profile.rb'
     - 'app/models/webhook.rb'
+    - 'app/models/contact.rb'
 Rails/RenderInline:
   Exclude:
     - 'app/controllers/swagger_controller.rb'
@@ -124,3 +133,4 @@ AllCops:
     - 'tmp/**/*'
     - 'storage/**/*'
     - 'db/migrate/20200225162150_init_schema.rb'
+    - 'config/initializers/azure_storage_service_patch.rb'

.rubocop_todo.yml

@@ -6,13 +6,6 @@
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 1
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: native, lf, crlf
-Layout/EndOfLine:
-  Exclude:
-    - 'deploy/after_restart.rb'
-
 # Offense count: 1
 Lint/DuplicateMethods:
   Exclude:

.ruby-version

@@ -1 +1 @@
-2.7.1
+2.7.3

.storybook/main.js

@@ -0,0 +1,44 @@
+const path = require('path');
+const resolve = require('../config/webpack/resolve');
+
+// Chatwoot's webpack.config.js
+process.env.NODE_ENV = 'development';
+const custom = require('../config/webpack/environment');
+
+module.exports = {
+  stories: [
+    '../stories/**/*.stories.mdx',
+    '../app/javascript/**/*.stories.@(js|jsx|ts|tsx)',
+  ],
+  addons: [
+    {
+      name: '@storybook/addon-docs',
+      options: {
+        vueDocgenOptions: {
+          alias: {
+            '@': path.resolve(__dirname, '../'),
+          },
+        },
+      },
+    },
+    '@storybook/addon-links',
+    '@storybook/addon-essentials',
+  ],
+  webpackFinal: config => {
+    const newConfig = {
+      ...config,
+      resolve: {
+        ...config.resolve,
+        modules: custom.resolvedModules.map(i => i.value),
+      },
+    };
+
+    newConfig.module.rules.push({
+      test: /\.scss$/,
+      use: ['style-loader', 'css-loader', 'sass-loader'],
+      include: path.resolve(__dirname, '../app/javascript'),
+    });
+
+    return newConfig;
+  },
+};

.storybook/preview.js

@@ -0,0 +1,42 @@
+import { addDecorator } from '@storybook/vue';
+import Vue from 'vue';
+import Vuex from 'vuex';
+import VueI18n from 'vue-i18n';
+import Vuelidate from 'vuelidate';
+import Multiselect from 'vue-multiselect';
+
+import WootUiKit from '../app/javascript/dashboard/components';
+import i18n from '../app/javascript/dashboard/i18n';
+
+import '../app/javascript/dashboard/assets/scss/storybook.scss';
+
+Vue.use(VueI18n);
+Vue.use(Vuelidate);
+Vue.use(WootUiKit);
+Vue.use(Vuex);
+Vue.component('multiselect', Multiselect);
+
+const store = new Vuex.Store({});
+const i18nConfig = new VueI18n({
+  locale: 'en',
+  messages: i18n,
+});
+
+addDecorator(() => ({
+  template: '<story/>',
+  i18n: i18nConfig,
+  store,
+  beforeCreate: function() {
+    this.$root._i18n = this.$i18n;
+  },
+}));
+
+export const parameters = {
+  actions: { argTypesRegex: '^on[A-Z].*' },
+  controls: {
+    matchers: {
+      color: /(background|color)$/i,
+      date: /Date$/,
+    },
+  },
+};

Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-ruby '2.7.1'
+ruby '2.7.3'
 
 ##-- base gems for rails --##
 gem 'rack-cors', require: 'rack/cors'
@@ -27,8 +27,12 @@ gem 'uglifier'
 gem 'flag_shih_tzu'
 # Random name generator for user names
 gem 'haikunator'
-# Template parsing safetly
+# Template parsing safely
 gem 'liquid'
+# Parse Markdown to HTML
+gem 'commonmarker'
+# Validate Data against JSON Schema
+gem 'json_schemer'
 
 ##-- for active storage --##
 gem 'aws-sdk-s3', require: false
@@ -42,17 +46,21 @@ gem 'pg'
 gem 'redis'
 gem 'redis-namespace'
 gem 'redis-rack-cache'
+# super fast record imports in bulk
+gem 'activerecord-import'
 
 ##--- gems for server & infra configuration ---##
 gem 'dotenv-rails'
 gem 'foreman'
 gem 'puma'
+gem 'rack-timeout'
 gem 'webpacker', '~> 5.x'
 # metrics on heroku
 gem 'barnes'
 
 ##--- gems for authentication & authorization ---##
 gem 'devise'
+gem 'devise-secure_password', '~> 2.0'
 gem 'devise_token_auth'
 # authorization
 gem 'jwt'
@@ -66,7 +74,7 @@ gem 'wisper', '2.0.0'
 
 ##--- gems for channels ---##
 # TODO: bump up gem to 2.0
-gem 'facebook-messenger', '1.5.0'
+gem 'facebook-messenger'
 gem 'telegram-bot-ruby'
 gem 'twilio-ruby', '~> 5.32.0'
 # twitty will handle subscription of twitter account events
@@ -76,6 +84,8 @@ gem 'twitty'
 gem 'koala'
 # slack client
 gem 'slack-ruby-client'
+# for dialogflow integrations
+gem 'google-cloud-dialogflow'
 
 ##--- gems for debugging and error reporting ---##
 # static analysis
@@ -85,11 +95,24 @@ gem 'sentry-raven'
 
 ##-- background job processing --##
 gem 'sidekiq'
+# We want cron jobs
+gem 'sidekiq-cron'
 
 ##-- Push notification service --##
 gem 'fcm'
 gem 'webpush'
 
+##-- geocoding / parse location from ip --##
+# http://www.rubygeocoder.com/
+gem 'geocoder'
+# to parse maxmind db
+gem 'maxminddb'
+
+# to create db triggers
+gem 'hairtrigger'
+
+gem 'procore-sift'
+
 group :development do
   gem 'annotate'
   gem 'bullet'
@@ -97,7 +120,7 @@ group :development do
   gem 'web-console'
 
   # used in swagger build
-  gem 'json_refs', git: 'https://github.com/tzmfreedom/json_refs', ref: 'e32deb0'
+  gem 'json_refs', git: 'https://github.com/tzmfreedom/json_refs', ref: '131b11294fd6af9c428171f38516e6222a58c874'
 
   # When we want to squash migrations
   gem 'squasher'
@@ -111,8 +134,6 @@ group :test do
 end
 
 group :development, :test do
-  # locking until https://github.com/codeclimate/test-reporter/issues/418 is resolved
-  gem 'action-cable-testing'
   gem 'bundle-audit', require: false
   gem 'byebug', platform: :mri
   gem 'factory_bot_rails'

Gemfile.lock

@@ -7,67 +7,67 @@ GIT
 
 GIT
   remote: https://github.com/tzmfreedom/json_refs
-  revision: e32deb073ce9aef39bdd63556bffd7fe7c2a803d
-  ref: e32deb0
+  revision: 131b11294fd6af9c428171f38516e6222a58c874
+  ref: 131b11294fd6af9c428171f38516e6222a58c874
   specs:
-    json_refs (0.1.2)
+    json_refs (0.1.6)
       hana
 
 GEM
   remote: https://rubygems.org/
   specs:
-    action-cable-testing (0.6.1)
-      actioncable (>= 5.0)
-    actioncable (6.0.3.3)
-      actionpack (= 6.0.3.3)
+    actioncable (6.0.3.7)
+      actionpack (= 6.0.3.7)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionmailbox (6.0.3.7)
+      actionpack (= 6.0.3.7)
+      activejob (= 6.0.3.7)
+      activerecord (= 6.0.3.7)
+      activestorage (= 6.0.3.7)
+      activesupport (= 6.0.3.7)
       mail (>= 2.7.1)
-    actionmailer (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
+    actionmailer (6.0.3.7)
+      actionpack (= 6.0.3.7)
+      actionview (= 6.0.3.7)
+      activejob (= 6.0.3.7)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.0.3.3)
-      actionview (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionpack (6.0.3.7)
+      actionview (= 6.0.3.7)
+      activesupport (= 6.0.3.7)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actiontext (6.0.3.7)
+      actionpack (= 6.0.3.7)
+      activerecord (= 6.0.3.7)
+      activestorage (= 6.0.3.7)
+      activesupport (= 6.0.3.7)
       nokogiri (>= 1.8.5)
-    actionview (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionview (6.0.3.7)
+      activesupport (= 6.0.3.7)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    activejob (6.0.3.7)
+      activesupport (= 6.0.3.7)
       globalid (>= 0.3.6)
-    activemodel (6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activerecord (6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activestorage (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      marcel (~> 0.3.1)
-    activesupport (6.0.3.3)
+    activemodel (6.0.3.7)
+      activesupport (= 6.0.3.7)
+    activerecord (6.0.3.7)
+      activemodel (= 6.0.3.7)
+      activesupport (= 6.0.3.7)
+    activerecord-import (1.0.7)
+      activerecord (>= 3.2)
+    activestorage (6.0.3.7)
+      actionpack (= 6.0.3.7)
+      activejob (= 6.0.3.7)
+      activerecord (= 6.0.3.7)
+      marcel (~> 1.0.0)
+    activesupport (6.0.3.7)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -75,13 +75,12 @@ GEM
       zeitwerk (~> 2.2, >= 2.2.2)
     acts-as-taggable-on (6.5.0)
       activerecord (>= 5.0, < 6.1)
-    addressable (2.7.0)
+    addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
-    administrate (0.14.0)
-      actionpack (>= 4.2)
-      actionview (>= 4.2)
-      activerecord (>= 4.2)
-      autoprefixer-rails (>= 6.0)
+    administrate (0.16.0)
+      actionpack (>= 5.0)
+      actionview (>= 5.0)
+      activerecord (>= 5.0)
       datetime_picker_rails (~> 0.0.7)
       jquery-rails (>= 4.0)
       kaminari (>= 1.0)
@@ -93,8 +92,6 @@ GEM
       rake (>= 10.4, < 14.0)
     ast (2.4.1)
     attr_extras (6.2.4)
-    autoprefixer-rails (9.8.6.3)
-      execjs
     aws-eventstream (1.1.0)
     aws-partitions (1.360.0)
     aws-sdk-core (3.105.0)
@@ -115,22 +112,23 @@ GEM
       descendants_tracker (~> 0.0.4)
       ice_nine (~> 0.11.0)
       thread_safe (~> 0.3, >= 0.3.1)
-    azure-storage-blob (2.0.0)
+    azure-storage-blob (2.0.1)
       azure-storage-common (~> 2.0)
-      nokogiri (~> 1.10.4)
-    azure-storage-common (2.0.1)
+      nokogiri (~> 1.11.0.rc2)
+    azure-storage-common (2.0.2)
       faraday (~> 1.0)
       faraday_middleware (~> 1.0.0.rc1)
-      nokogiri (~> 1.10.4)
+      net-http-persistent (~> 4.0)
+      nokogiri (~> 1.11.0.rc2)
     barnes (0.0.8)
       multi_json (~> 1)
       statsd-ruby (~> 1.1)
-    bcrypt (3.1.15)
+    bcrypt (3.1.16)
     bindex (0.8.1)
     bootsnap (1.4.8)
       msgpack (~> 1.0)
     brakeman (4.9.0)
-    browser (4.2.0)
+    browser (5.3.1)
     builder (3.2.4)
     bullet (6.1.0)
       activesupport (>= 3.0.0)
@@ -144,7 +142,9 @@ GEM
     coderay (1.1.3)
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
-    concurrent-ruby (1.1.7)
+    commonmarker (0.21.1)
+      ruby-enum (~> 0.5)
+    concurrent-ruby (1.1.8)
     connection_pool (2.2.3)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
@@ -158,12 +158,15 @@ GEM
     declarative-option (0.1.0)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devise (4.7.2)
+    devise (4.8.0)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
+    devise-secure_password (2.0.1)
+      devise (>= 4.0.0, < 5.0.0)
+      railties (>= 5.0.0, < 7.0.0)
     devise_token_auth (1.1.4)
       bcrypt (~> 3.0)
       devise (> 3.5.2, < 5)
@@ -179,10 +182,14 @@ GEM
     dotenv-rails (2.7.6)
       dotenv (= 2.7.6)
       railties (>= 3.2)
+    ecma-re-validator (0.2.1)
+      regexp_parser (~> 1.2)
     equalizer (0.0.11)
-    erubi (1.9.0)
+    erubi (1.10.0)
+    et-orbi (1.2.4)
+      tzinfo
     execjs (2.7.0)
-    facebook-messenger (1.5.0)
+    facebook-messenger (2.0.1)
       httparty (~> 0.13, >= 0.13.7)
       rack (>= 1.4.5)
     factory_bot (6.1.0)
@@ -198,9 +205,19 @@ GEM
       faraday (~> 1.0)
     fcm (1.0.2)
       faraday (~> 1.0.0)
-    ffi (1.13.1)
+    ffi (1.15.0)
     flag_shih_tzu (0.3.23)
     foreman (0.87.2)
+    fugit (1.4.1)
+      et-orbi (~> 1.1, >= 1.1.8)
+      raabro (~> 1.4)
+    gapic-common (0.3.4)
+      google-protobuf (~> 3.12, >= 3.12.2)
+      googleapis-common-protos (>= 1.3.9, < 2.0)
+      googleapis-common-protos-types (>= 1.0.4, < 2.0)
+      googleauth (~> 0.9)
+      grpc (~> 1.25)
+    geocoder (1.6.3)
     gli (2.19.2)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
@@ -212,12 +229,18 @@ GEM
       representable (~> 3.0)
       retriable (>= 2.0, < 4.0)
       signet (~> 0.12)
-    google-cloud-core (1.5.0)
+    google-cloud-core (1.6.0)
       google-cloud-env (~> 1.0)
       google-cloud-errors (~> 1.0)
-    google-cloud-env (1.3.3)
+    google-cloud-dialogflow (1.2.0)
+      google-cloud-core (~> 1.5)
+      google-cloud-dialogflow-v2 (~> 0.1)
+    google-cloud-dialogflow-v2 (0.6.4)
+      gapic-common (~> 0.3)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (1.5.0)
       faraday (>= 0.17.3, < 2.0)
-    google-cloud-errors (1.0.1)
+    google-cloud-errors (1.1.0)
     google-cloud-storage (1.28.0)
       addressable (~> 2.5)
       digest-crc (~> 0.4)
@@ -225,17 +248,31 @@ GEM
       google-cloud-core (~> 1.2)
       googleauth (~> 0.9)
       mini_mime (~> 1.0)
-    googleauth (0.13.1)
+    google-protobuf (3.15.8)
+    googleapis-common-protos (1.3.11)
+      google-protobuf (~> 3.14)
+      googleapis-common-protos-types (>= 1.0.6, < 2.0)
+      grpc (~> 1.27)
+    googleapis-common-protos-types (1.0.6)
+      google-protobuf (~> 3.14)
+    googleauth (0.16.2)
       faraday (>= 0.17.3, < 2.0)
       jwt (>= 1.4, < 3.0)
       memoist (~> 0.16)
       multi_json (~> 1.11)
       os (>= 0.9, < 2.0)
       signet (~> 0.14)
-    groupdate (5.1.0)
+    groupdate (5.2.2)
       activesupport (>= 5)
+    grpc (1.37.1)
+      google-protobuf (~> 3.15)
+      googleapis-common-protos-types (~> 1.0)
     haikunator (1.1.0)
-    hana (1.3.6)
+    hairtrigger (0.2.23)
+      activerecord (>= 5.0, < 7)
+      ruby2ruby (~> 2.4)
+      ruby_parser (~> 3.10)
+    hana (1.3.7)
     hashdiff (1.0.1)
     hashie (4.1.0)
     hkdf (0.3.0)
@@ -246,7 +283,7 @@ GEM
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.8.5)
+    i18n (1.8.10)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     inflecto (0.0.2)
@@ -258,7 +295,12 @@ GEM
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
     json (2.3.1)
-    jwt (2.2.2)
+    json_schemer (0.2.16)
+      ecma-re-validator (~> 0.2)
+      hana (~> 1.3)
+      regexp_parser (~> 1.5)
+      uri_template (~> 0.7)
+    jwt (2.2.3)
     kaminari (1.2.1)
       activesupport (>= 4.1.0)
       kaminari-actionview (= 1.2.1)
@@ -280,53 +322,59 @@ GEM
     letter_opener (1.7.0)
       launchy (~> 2.2)
     liquid (4.0.3)
-    listen (3.2.1)
+    listen (3.3.3)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    loofah (2.7.0)
+    loofah (2.9.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
-    marcel (0.3.3)
-      mimemagic (~> 0.3.2)
+    marcel (1.0.1)
+    maxminddb (0.1.22)
     memoist (0.16.2)
     method_source (1.0.0)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2020.0512)
-    mimemagic (0.3.5)
+    mime-types-data (3.2021.0225)
     mini_magick (4.10.1)
-    mini_mime (1.0.2)
-    mini_portile2 (2.4.0)
-    minitest (5.14.2)
+    mini_mime (1.1.0)
+    mini_portile2 (2.5.1)
+    minitest (5.14.4)
     momentjs-rails (2.20.1)
       railties (>= 3.1)
     msgpack (1.3.3)
     multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
+    net-http-persistent (4.0.0)
+      connection_pool (~> 2.2)
     netrc (0.11.0)
-    nio4r (2.5.3)
-    nokogiri (1.10.10)
-      mini_portile2 (~> 2.4.0)
-    oauth (0.5.4)
+    nio4r (2.5.7)
+    nokogiri (1.11.6)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
+    oauth (0.5.6)
     orm_adapter (0.5.0)
     os (1.1.1)
     parallel (1.19.2)
     parser (2.7.1.4)
       ast (~> 2.4.1)
     pg (1.2.3)
+    procore-sift (0.15.0)
+      rails (> 4.2.0)
     pry (0.13.1)
       coderay (~> 1.1)
       method_source (~> 1.0)
     pry-rails (0.3.9)
       pry (>= 0.10.4)
-    public_suffix (4.0.5)
-    puma (4.3.5)
+    public_suffix (4.0.6)
+    puma (4.3.8)
       nio4r (~> 2.0)
     pundit (2.1.0)
       activesupport (>= 3.0.0)
+    raabro (1.4.0)
+    racc (1.5.2)
     rack (2.2.3)
     rack-cache (1.12.0)
       rack (>= 0.4)
@@ -336,34 +384,35 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (6.0.3.3)
-      actioncable (= 6.0.3.3)
-      actionmailbox (= 6.0.3.3)
-      actionmailer (= 6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actiontext (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    rack-timeout (0.6.0)
+    rails (6.0.3.7)
+      actioncable (= 6.0.3.7)
+      actionmailbox (= 6.0.3.7)
+      actionmailer (= 6.0.3.7)
+      actionpack (= 6.0.3.7)
+      actiontext (= 6.0.3.7)
+      actionview (= 6.0.3.7)
+      activejob (= 6.0.3.7)
+      activemodel (= 6.0.3.7)
+      activerecord (= 6.0.3.7)
+      activestorage (= 6.0.3.7)
+      activesupport (= 6.0.3.7)
       bundler (>= 1.3.0)
-      railties (= 6.0.3.3)
+      railties (= 6.0.3.7)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    railties (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    railties (6.0.3.7)
+      actionpack (= 6.0.3.7)
+      activesupport (= 6.0.3.7)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.20.3, < 2.0)
     rainbow (3.0.0)
-    rake (13.0.1)
+    rake (13.0.3)
     rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
@@ -389,7 +438,7 @@ GEM
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     retriable (3.1.2)
-    rexml (3.2.4)
+    rexml (3.2.5)
     rspec-core (3.9.2)
       rspec-support (~> 3.9.3)
     rspec-expectations (3.9.2)
@@ -420,13 +469,21 @@ GEM
       parser (>= 2.7.1.4)
     rubocop-performance (1.7.1)
       rubocop (>= 0.82.0)
-    rubocop-rails (2.7.1)
+    rubocop-rails (2.8.1)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 0.87.0)
     rubocop-rspec (1.43.2)
       rubocop (~> 0.87)
+    ruby-enum (0.9.0)
+      i18n
     ruby-progressbar (1.10.1)
+    ruby2ruby (2.4.4)
+      ruby_parser (~> 3.1)
+      sexp_processor (~> 4.6)
+    ruby_parser (3.15.0)
+      rubocop (>= 0.87.0)
+      sexp_processor (~> 4.9)
     safe_yaml (1.0.5)
     sass (3.7.4)
       sass-listen (~> 4.0.0)
@@ -452,13 +509,17 @@ GEM
     semantic_range (2.3.0)
     sentry-raven (3.0.3)
       faraday (>= 1.0)
+    sexp_processor (4.15.1)
     shoulda-matchers (4.4.1)
       activesupport (>= 4.2.0)
     sidekiq (6.1.1)
       connection_pool (>= 2.2.2)
       rack (~> 2.0)
       redis (>= 4.2.0)
-    signet (0.14.0)
+    sidekiq-cron (1.2.0)
+      fugit (~> 1.1)
+      sidekiq (>= 4.2.1)
+    signet (0.15.0)
       addressable (~> 2.3)
       faraday (>= 0.17.3, < 2.0)
       jwt (>= 1.5, < 3.0)
@@ -481,7 +542,7 @@ GEM
     sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.2.1)
+    sprockets-rails (3.2.2)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
@@ -492,7 +553,7 @@ GEM
       inflecto
       virtus
     telephone_number (1.4.9)
-    thor (1.0.1)
+    thor (1.1.0)
     thread_safe (0.3.6)
     tilt (2.0.10)
     time_diff (0.3.0)
@@ -504,7 +565,7 @@ GEM
       nokogiri (>= 1.6, < 2.0)
     twitty (0.1.1)
       oauth
-    tzinfo (1.2.7)
+    tzinfo (1.2.9)
       thread_safe (~> 0.1)
     tzinfo-data (1.2020.1)
       tzinfo (>= 1.0.0)
@@ -516,6 +577,7 @@ GEM
     unf_ext (0.0.7.7)
     unicode-display_width (1.7.0)
     uniform_notifier (1.13.0)
+    uri_template (0.7.0)
     valid_email2 (3.3.1)
       activemodel (>= 3.2)
       mail (~> 2.5)
@@ -524,8 +586,8 @@ GEM
       coercible (~> 1.0)
       descendants_tracker (~> 0.0, >= 0.0.3)
       equalizer (~> 0.0, >= 0.0.9)
-    warden (1.2.8)
-      rack (>= 2.0.6)
+    warden (1.2.9)
+      rack (>= 2.0.9)
     web-console (4.0.4)
       actionview (>= 6.0.0)
       activemodel (>= 6.0.0)
@@ -547,13 +609,13 @@ GEM
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     wisper (2.0.0)
-    zeitwerk (2.4.0)
+    zeitwerk (2.4.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  action-cable-testing
+  activerecord-import
   acts-as-taggable-on
   administrate
   annotate
@@ -567,36 +629,45 @@ DEPENDENCIES
   bullet
   bundle-audit
   byebug
+  commonmarker
   cypress-on-rails (~> 1.0)
   database_cleaner
   devise
+  devise-secure_password (~> 2.0)
   devise_token_auth
   dotenv-rails
-  facebook-messenger (= 1.5.0)
+  facebook-messenger
   factory_bot_rails
   faker
   fcm
   flag_shih_tzu
   foreman
+  geocoder
+  google-cloud-dialogflow
   google-cloud-storage
   groupdate
   haikunator
+  hairtrigger
   hashie
   jbuilder
   json_refs!
+  json_schemer
   jwt
   kaminari
   koala
   letter_opener
   liquid
   listen
+  maxminddb
   mini_magick
   mock_redis!
   pg
+  procore-sift
   pry-rails
   puma
   pundit
   rack-cors
+  rack-timeout
   rails
   redis
   redis-namespace
@@ -614,6 +685,7 @@ DEPENDENCIES
   sentry-raven
   shoulda-matchers
   sidekiq
+  sidekiq-cron
   simplecov (= 0.17.1)
   slack-ruby-client
   spring
@@ -634,7 +706,7 @@ DEPENDENCIES
   wisper (= 2.0.0)
 
 RUBY VERSION
-   ruby 2.7.1p83
+   ruby 2.7.3p183
 
 BUNDLED WITH
    2.1.4

LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2017-2020 ThoughtWoot Inc.
+Copyright (c) 2017-2021 Chatwoot Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Procfile

@@ -1,3 +1,3 @@
-release: bundle exec rails db:prepare
+release: bundle exec rails db:chatwoot_prepare
 web: bin/rails server -p $PORT -e $RAILS_ENV
 worker: bundle exec sidekiq -C config/sidekiq.yml

README.md

@@ -1,8 +1,7 @@
 <p align="center">
-  <img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/brand.svg" alt="Woot-logo" width="240">
+  <img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/brand.svg" alt="Woot-logo" width="240" />
 
-  <div align="center">A simple and elegant live chat software</div>
-  <div align="center">An opensource alternative to Intercom, Zendesk, Drift, Crisp etc.</div>
+  <p align="center">Customer engagement suite, an open-source alternative to Intercom, Zendesk, Salesforce Service Cloud etc.</p>
 </p>
 
 <p align="center">
@@ -16,11 +15,13 @@ ___
 <p align="center">
   <a href="https://codeclimate.com/github/chatwoot/chatwoot/maintainability"><img src="https://api.codeclimate.com/v1/badges/80f9e1a7c72d186289ad/maintainability" alt="Maintainability"></a>
   <img src="https://img.shields.io/circleci/build/github/chatwoot/chatwoot" alt="CircleCI Badge">
+    <a href="https://hub.docker.com/r/chatwoot/chatwoot/"><img src="https://img.shields.io/docker/pulls/chatwoot/chatwoot" alt="Docker Pull Badge"></a>
   <a href="https://hub.docker.com/r/chatwoot/chatwoot/"><img src="https://img.shields.io/docker/cloud/build/chatwoot/chatwoot" alt="Docker Build Badge"></a>
   <img src="https://img.shields.io/github/license/chatwoot/chatwoot" alt="License">
   <img src="https://img.shields.io/github/commit-activity/m/chatwoot/chatwoot" alt="Commits-per-month">
   <a title="Crowdin" target="_self" href="https://chatwoot.crowdin.com/chatwoot"><img src="https://badges.crowdin.net/e/37ced7eba411064bd792feb3b7a28b16/localized.svg"></a>
   <a href="https://discord.gg/cJXdrwS"><img src="https://img.shields.io/discord/647412545203994635" alt="Discord"></a>
+  <a href="https://huntr.dev/bounties/disclose"><img src="https://cdn.huntr.dev/huntr_security_badge_mono.svg" alt="Huntr"></a>
 </p>
 
 <img src="https://s3.us-west-2.amazonaws.com/gh-assets.chatwoot.com/chatwoot-dashboard-assets.png" width="100%" alt="Chat dashboard"/>
@@ -32,7 +33,7 @@ Now, a failed project is back on track and the prospects are looking great. The
 
 ### Features
 
-Chatwoot gives an integrated view of conversations happening in different communication channels. 
+Chatwoot gives an integrated view of conversations happening in different communication channels.
 
 It supports the following conversation channels:
 
@@ -44,7 +45,7 @@ It supports the following conversation channels:
  - **API Channel**: Build custom communication channels using our API channel.
  - **Email (beta)**: Forward all your email queries to Chatwoot and view it in our integrated dashboard.
 
-Other features include: 
+Other features include:
 
 - **Multi-brand inboxes**: Manage multiple brands or pages using a single dashboard.
 - **Private notes**: Inter team communication is possible using private notes in a conversation.
@@ -62,12 +63,16 @@ Other features include:
 
 Detailed documentation is available at [www.chatwoot.com/help-center](https://www.chatwoot.com/help-center).
 
+### Translation process
+
+The translation process for Chatwoot web and mobile app is managed at [https://translate.chatwoot.com](https://translate.chatwoot.com) using Crowdin. Please read the [translation guide](https://www.chatwoot.com/docs/contributing/translating-chatwoot-to-your-language) for contributing to Chatwoot.
+
 ---
 
 ### Branching model
 
 We use the [git-flow](https://nvie.com/posts/a-successful-git-branching-model/) branching model. The base branch is `develop`.
-If you are looking for a stable version, please use the `master` or tags labelled as `v1.x.x`. 
+If you are looking for a stable version, please use the `master` or tags labelled as `v1.x.x`.
 
 ---
 
@@ -94,4 +99,4 @@ Thanks goes to all these [wonderful people](https://www.chatwoot.com/docs/contri
 <a href="https://github.com/chatwoot/chatwoot/graphs/contributors"><img src="https://opencollective.com/chatwoot/contributors.svg?width=890&button=false" /></a>
 
 
-*Chatwoot* &copy; 2017-2020, ThoughtWoot Inc - Released under the MIT License.
+*Chatwoot* &copy; 2017-2021, Chatwoot Inc - Released under the MIT License.

SECURITY.md

@@ -0,0 +1,8 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We use [huntr.dev](https://huntr.dev/) for security issues that affect our project. If you believe you have found a vulnerability, please disclose it via this [form](https://huntr.dev/bounties/disclose). 
+This will enable us to review the vulnerability, fix it promptly, and reward you for your efforts.
+
+If you have any questions about the process, feel free to reach out to hello@chatwoot.com.

app.json

@@ -11,7 +11,7 @@
     "rails",
     "vue"
   ],
-  "success_url": "/app/login",
+  "success_url": "/",
   "env": {
     "SECRET_TOKEN": {
       "description": "A secret key for verifying the integrity of signed cookies.",
@@ -34,6 +34,10 @@
     "web": {
       "quantity": 1,
       "size": "FREE"
+    },
+    "worker": {
+      "quantity": 1,
+      "size": "FREE"
     }
   },
   "image": "heroku/ruby",

app/actions/contact_identify_action.rb

@@ -34,7 +34,9 @@ class ContactIdentifyAction
 
   def update_contact
     custom_attributes = params[:custom_attributes] ? @contact.custom_attributes.merge(params[:custom_attributes]) : @contact.custom_attributes
-    @contact.update!(params.slice(:name, :email, :identifier).merge({ custom_attributes: custom_attributes }))
+    # blank identifier or email will throw unique index error
+    # TODO: replace reject { |_k, v| v.blank? } with compact_blank when rails is upgraded
+    @contact.update!(params.slice(:name, :email, :identifier).reject { |_k, v| v.blank? }.merge({ custom_attributes: custom_attributes }))
     ContactAvatarJob.perform_later(@contact, params[:avatar_url]) if params[:avatar_url].present?
   end
 

app/actions/contact_merge_action.rb

@@ -2,6 +2,10 @@ class ContactMergeAction
   pattr_initialize [:account!, :base_contact!, :mergee_contact!]
 
   def perform
+    # This case happens when an agent updates a contact email in dashboard,
+    # while the contact also update his email via email collect box
+    return @base_contact if base_contact.id == mergee_contact.id
+
     ActiveRecord::Base.transaction do
       validate_contacts
       merge_conversations

app/assets/stylesheets/administrate/utilities/_variables.scss

@@ -55,7 +55,7 @@ $color-heading: #1f2d3d;
 $color-extra-light-blue: #f5f7f9;
 
 $primary-color: $color-woot;
-$secondary-color: #35c5ff;
+$secondary-color: #5d7592;
 $success-color: #44ce4b;
 $warning-color: #ffc532;
 $alert-color: #ff382d;

app/bot/facebook_bot.rb

@@ -1,15 +1,13 @@
 require 'facebook/messenger'
 
 class FacebookBot
-  include Facebook::Messenger
-
-  Bot.on :message do |message|
+  Facebook::Messenger::Bot.on :message do |message|
     Rails.logger.info "MESSAGE_RECIEVED #{message}"
     response = ::Integrations::Facebook::MessageParser.new(message)
     ::Integrations::Facebook::MessageCreator.new(response).perform
   end
 
-  Bot.on :delivery do |delivery|
+  Facebook::Messenger::Bot.on :delivery do |delivery|
     # delivery.ids       # => 'mid.1457764197618:41d102a3e1ae206a38'
     # delivery.sender    # => { 'id' => '1008372609250235' }
     # delivery.recipient # => { 'id' => '2015573629214912' }
@@ -20,7 +18,7 @@ class FacebookBot
     Rails.logger.info "Human was online at #{delivery.at}"
   end
 
-  Bot.on :message_echo do |message|
+  Facebook::Messenger::Bot.on :message_echo do |message|
     Rails.logger.info "MESSAGE_ECHO #{message}"
     response = ::Integrations::Facebook::MessageParser.new(message)
     ::Integrations::Facebook::MessageCreator.new(response).perform

app/builders/account_builder.rb

@@ -2,7 +2,7 @@
 
 class AccountBuilder
   include CustomExceptions::Account
-  pattr_initialize [:account_name!, :email!, :confirmed!, :user]
+  pattr_initialize [:account_name!, :email!, :confirmed, :user, :user_full_name, :user_password]
 
   def perform
     if @user.nil?
@@ -15,7 +15,6 @@ class AccountBuilder
     end
     [@user, @account]
   rescue StandardError => e
-    @account&.destroy
     puts e.inspect
     raise e
   end
@@ -27,7 +26,7 @@ class AccountBuilder
     if address.valid? # && !address.disposable?
       true
     else
-      raise InvalidEmail.new(valid: address.valid?) # , disposable: address.disposable?})
+      raise InvalidEmail.new(valid: address.valid?)
     end
   end
 
@@ -40,7 +39,7 @@ class AccountBuilder
   end
 
   def create_account
-    @account = Account.create!(name: @account_name)
+    @account = Account.create!(name: @account_name, locale: I18n.locale)
     Current.account = @account
   end
 
@@ -61,17 +60,11 @@ class AccountBuilder
     )
   end
 
-  def email_to_name(email)
-    name = email[/[^@]+/]
-    name.split('.').map(&:capitalize).join(' ')
-  end
-
   def create_user
-    password = Time.now.to_i
     @user = User.new(email: @email,
-                     password: password,
-                     password_confirmation: password,
-                     name: email_to_name(@email))
+                     password: user_password,
+                     password_confirmation: user_password,
+                     name: @user_full_name)
     @user.confirm if @confirmed
     @user.save!
   end

app/builders/campaigns/campaign_conversation_builder.rb

@@ -0,0 +1,38 @@
+class Campaigns::CampaignConversationBuilder
+  pattr_initialize [:contact_inbox_id!, :campaign_display_id!, :conversation_additional_attributes]
+
+  def perform
+    @contact_inbox = ContactInbox.find(@contact_inbox_id)
+    @campaign = @contact_inbox.inbox.campaigns.find_by!(display_id: campaign_display_id)
+
+    ActiveRecord::Base.transaction do
+      @contact_inbox.lock!
+
+      # We won't send campaigns if a conversation is already present
+      return if @contact_inbox.reload.conversations.present?
+
+      @conversation = ::Conversation.create!(conversation_params)
+      Messages::MessageBuilder.new(@campaign.sender, @conversation, message_params).perform
+    end
+    @conversation
+  end
+
+  private
+
+  def message_params
+    ActionController::Parameters.new({
+                                       content: @campaign.message
+                                     })
+  end
+
+  def conversation_params
+    {
+      account_id: @campaign.account_id,
+      inbox_id: @contact_inbox.inbox_id,
+      contact_id: @contact_inbox.contact_id,
+      contact_inbox_id: @contact_inbox.id,
+      campaign_id: @campaign.id,
+      additional_attributes: conversation_additional_attributes
+    }
+  end
+end

app/builders/contact_builder.rb

@@ -1,11 +1,11 @@
 class ContactBuilder
-  pattr_initialize [:source_id!, :inbox!, :contact_attributes!]
+  pattr_initialize [:source_id!, :inbox!, :contact_attributes!, :hmac_verified]
 
   def perform
     contact_inbox = inbox.contact_inboxes.find_by(source_id: source_id)
     return contact_inbox if contact_inbox
 
-    build_contact
+    build_contact_inbox
   end
 
   private
@@ -18,7 +18,8 @@ class ContactBuilder
     ::ContactInbox.create!(
       contact_id: contact.id,
       inbox_id: inbox.id,
-      source_id: source_id
+      source_id: source_id,
+      hmac_verified: hmac_verified || false
     )
   end
 
@@ -26,16 +27,31 @@ class ContactBuilder
     ::ContactAvatarJob.perform_later(contact, contact_attributes[:avatar_url]) if contact_attributes[:avatar_url]
   end
 
-  def build_contact
-    ActiveRecord::Base.transaction do
-      contact = account.contacts.create!(
-        name: contact_attributes[:name],
-        phone_number: contact_attributes[:phone_number],
-        email: contact_attributes[:email],
-        identifier: contact_attributes[:identifier],
-        additional_attributes: contact_attributes[:additional_attributes]
-      )
+  def create_contact
+    account.contacts.create!(
+      name: contact_attributes[:name] || ::Haikunator.haikunate(1000),
+      phone_number: contact_attributes[:phone_number],
+      email: contact_attributes[:email],
+      identifier: contact_attributes[:identifier],
+      additional_attributes: contact_attributes[:additional_attributes]
+    )
+  end
 
+  def find_contact
+    contact = nil
+
+    contact = account.contacts.find_by(identifier: contact_attributes[:identifier]) if contact_attributes[:identifier].present?
+
+    contact ||= account.contacts.find_by(email: contact_attributes[:email]) if contact_attributes[:email].present?
+
+    contact ||= account.contacts.find_by(phone_number: contact_attributes[:phone_number]) if contact_attributes[:phone_number].present?
+
+    contact
+  end
+
+  def build_contact_inbox
+    ActiveRecord::Base.transaction do
+      contact = find_contact || create_contact
       contact_inbox = create_contact_inbox(contact)
       update_contact_avatar(contact)
       contact_inbox

app/builders/contact_inbox_builder.rb

@@ -0,0 +1,41 @@
+class ContactInboxBuilder
+  pattr_initialize [:contact_id!, :inbox_id!, :source_id]
+
+  def perform
+    @contact = Contact.find(contact_id)
+    @inbox = @contact.account.inboxes.find(inbox_id)
+    return unless ['Channel::TwilioSms', 'Channel::Email', 'Channel::Api'].include? @inbox.channel_type
+
+    source_id = @source_id || generate_source_id
+    create_contact_inbox(source_id) if source_id.present?
+  end
+
+  private
+
+  def generate_source_id
+    return twilio_source_id if @inbox.channel_type == 'Channel::TwilioSms'
+    return @contact.email if @inbox.channel_type == 'Channel::Email'
+    return SecureRandom.uuid if @inbox.channel_type == 'Channel::Api'
+
+    nil
+  end
+
+  def twilio_source_id
+    return unless @contact.phone_number
+
+    case @inbox.channel.medium
+    when 'sms'
+      @contact.phone_number
+    when 'whatsapp'
+      "whatsapp:#{@contact.phone_number}"
+    end
+  end
+
+  def create_contact_inbox(source_id)
+    ::ContactInbox.find_or_create_by!(
+      contact_id: @contact.id,
+      inbox_id: @inbox.id,
+      source_id: source_id
+    )
+  end
+end

app/builders/csat_surveys/response_builder.rb

@@ -0,0 +1,28 @@
+class CsatSurveys::ResponseBuilder
+  pattr_initialize [:message]
+
+  def perform
+    raise 'Invalid Message' unless message.input_csat?
+
+    conversation = message.conversation
+    rating = message.content_attributes.dig('submitted_values', 'csat_survey_response', 'rating')
+    feedback_message = message.content_attributes.dig('submitted_values', 'csat_survey_response', 'feedback_message')
+
+    return if rating.blank?
+
+    process_csat_response(conversation, rating, feedback_message)
+  end
+
+  private
+
+  def process_csat_response(conversation, rating, feedback_message)
+    csat_survey_response = message.csat_survey_response || CsatSurveyResponse.new(
+      message_id: message.id, account_id: message.account_id, conversation_id: message.conversation_id,
+      contact_id: conversation.contact_id, assigned_agent: conversation.assignee
+    )
+    csat_survey_response.rating = rating
+    csat_survey_response.feedback_message = feedback_message
+    csat_survey_response.save!
+    csat_survey_response
+  end
+end

app/builders/messages/facebook/message_builder.rb

@@ -13,6 +13,7 @@ class Messages::Facebook::MessageBuilder
     @outgoing_echo = outgoing_echo
     @sender_id = (@outgoing_echo ? @response.recipient_id : @response.sender_id)
     @message_type = (@outgoing_echo ? :outgoing : :incoming)
+    @attachments = (@response.attachments || [])
   end
 
   def perform
@@ -41,17 +42,23 @@ class Messages::Facebook::MessageBuilder
 
   def build_message
     @message = conversation.messages.create!(message_params)
-    (response.attachments || []).each do |attachment|
-      attachment_obj = @message.attachments.new(attachment_params(attachment).except(:remote_file_url))
-      attachment_obj.save!
-      attach_file(attachment_obj, attachment_params(attachment)[:remote_file_url]) if attachment_params(attachment)[:remote_file_url]
+    @attachments.each do |attachment|
+      process_attachment(attachment)
     end
   end
 
+  def process_attachment(attachment)
+    return if attachment['type'].to_sym == :template
+
+    attachment_obj = @message.attachments.new(attachment_params(attachment).except(:remote_file_url))
+    attachment_obj.save!
+    attach_file(attachment_obj, attachment_params(attachment)[:remote_file_url]) if attachment_params(attachment)[:remote_file_url]
+  end
+
   def attach_file(attachment, file_url)
     file_resource = LocalResource.new(file_url)
-    attachment.file.attach(io: file_resource.file, filename: file_resource.tmp_filename, content_type: file_resource.encoding)
-  rescue Errno::ETIMEDOUT, Errno::ECONNREFUSED, SocketError => e
+    attachment.file.attach(io: file_resource.file, filename: file_resource.filename, content_type: file_resource.encoding)
+  rescue *ExceptionList::URI_EXCEPTIONS => e
     Rails.logger.info "invalid url #{file_url} : #{e.message}"
   end
 

app/builders/messages/message_builder.rb

@@ -39,7 +39,17 @@ class Messages::MessageBuilder
   end
 
   def sender
-    message_type == 'outgoing' ? @user : @conversation.contact
+    message_type == 'outgoing' ? (message_sender || @user) : @conversation.contact
+  end
+
+  def external_created_at
+    @params[:external_created_at].present? ? { external_created_at: @params[:external_created_at] } : {}
+  end
+
+  def message_sender
+    return if @params[:sender_type] != 'AgentBot'
+
+    AgentBot.where(account_id: [nil, @conversation.account.id]).find_by(id: @params[:sender_id])
   end
 
   def message_params
@@ -54,6 +64,6 @@ class Messages::MessageBuilder
       items: @items,
       in_reply_to: @in_reply_to,
       echo_id: @params[:echo_id]
-    }
+    }.merge(external_created_at)
   end
 end

app/builders/v2/report_builder.rb

@@ -1,4 +1,5 @@
 class V2::ReportBuilder
+  include DateRangeHelper
   attr_reader :account, :params
 
   def initialize(account, params)
@@ -83,10 +84,6 @@ class V2::ReportBuilder
          .average(:value)
   end
 
-  def range
-    parse_date_time(params[:since])..parse_date_time(params[:until])
-  end
-
   # Taking average of average is not too accurate
   # https://en.wikipedia.org/wiki/Simpson's_paradox
   # TODO: Will optimize this later
@@ -101,11 +98,4 @@ class V2::ReportBuilder
 
     (avg_first_response_time.values.sum / avg_first_response_time.values.length)
   end
-
-  def parse_date_time(datetime)
-    return datetime if datetime.is_a?(DateTime)
-    return datetime.to_datetime if datetime.is_a?(Time) || datetime.is_a?(Date)
-
-    DateTime.strptime(datetime, '%s')
-  end
 end

app/controllers/android_app_controller.rb

@@ -0,0 +1,5 @@
+class AndroidAppController < ApplicationController
+  def assetlinks
+    render layout: false
+  end
+end

app/controllers/api/base_controller.rb

@@ -10,4 +10,14 @@ class Api::BaseController < ApplicationController
   def authenticate_by_access_token?
     request.headers[:api_access_token].present? || request.headers[:HTTP_API_ACCESS_TOKEN].present?
   end
+
+  def check_authorization(model = nil)
+    model ||= controller_name.classify.constantize
+
+    authorize(model)
+  end
+
+  def check_admin_authorization?
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
 end

app/controllers/api/v1/accounts/agent_bots_controller.rb

@@ -0,0 +1,35 @@
+class Api::V1::Accounts::AgentBotsController < Api::V1::Accounts::BaseController
+  before_action :current_account
+  before_action :check_authorization
+  before_action :agent_bot, except: [:index, :create]
+
+  def index
+    @agent_bots = AgentBot.where(account_id: [nil, Current.account.id])
+  end
+
+  def show; end
+
+  def create
+    @agent_bot = Current.account.agent_bots.create!(permitted_params)
+  end
+
+  def update
+    @agent_bot.update!(permitted_params)
+  end
+
+  def destroy
+    @agent_bot.destroy
+    head :ok
+  end
+
+  private
+
+  def agent_bot
+    @agent_bot = AgentBot.where(account_id: [nil, Current.account.id]).find(params[:id]) if params[:action] == 'show'
+    @agent_bot ||= Current.account.agent_bots.find(params[:id])
+  end
+
+  def permitted_params
+    params.permit(:name, :description, :outgoing_url)
+  end
+end

app/controllers/api/v1/accounts/agents_controller.rb

@@ -27,7 +27,7 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
   private
 
   def check_authorization
-    authorize(User)
+    super(User)
   end
 
   def fetch_agent
@@ -38,6 +38,8 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
     @user =  User.find_by(email: new_agent_params[:email])
   end
 
+  # TODO: move this to a builder and combine the save account user method into a builder
+  # ensure the account user association is also created in a single transaction
   def create_user
     return if @user
 
@@ -58,12 +60,13 @@ class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
   end
 
   def new_agent_params
-    time = Time.now.to_i
+    # intial string ensures the password requirements are met
+    temp_password = "1!aA#{SecureRandom.alphanumeric(12)}"
     params.require(:agent).permit(:email, :name, :role)
-          .merge!(password: time, password_confirmation: time, inviter: current_user)
+          .merge!(password: temp_password, password_confirmation: temp_password, inviter: current_user)
   end
 
   def agents
-    @agents ||= Current.account.users.order_by_full_name
+    @agents ||= Current.account.users.order_by_full_name.includes({ avatar_attachment: [:blob] })
   end
 end

app/controllers/api/v1/accounts/base_controller.rb

@@ -1,5 +1,7 @@
 class Api::V1::Accounts::BaseController < Api::BaseController
+  include SwitchLocale
   before_action :current_account
+  around_action :switch_locale_using_account_locale
 
   private
 
@@ -15,7 +17,6 @@ class Api::V1::Accounts::BaseController < Api::BaseController
     elsif @resource&.is_a?(AgentBot)
       account_accessible_for_bot?(account)
     end
-    switch_locale account
     account
   end
 

app/controllers/api/v1/accounts/callbacks_controller.rb

@@ -30,7 +30,7 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
 
       if (page_detail = (page_details || []).detect { |page| fb_page_id == page['id'] })
         update_fb_page(fb_page_id, page_detail['access_token'])
-        return head :ok
+        render and return
       end
     end
 
@@ -44,9 +44,9 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
   end
 
   def update_fb_page(fb_page_id, access_token)
-    get_fb_page(fb_page_id)&.update!(
-      user_access_token: @user_access_token, page_access_token: access_token
-    )
+    fb_page = get_fb_page(fb_page_id)
+    fb_page&.update!(user_access_token: @user_access_token, page_access_token: access_token)
+    fb_page&.reauthorized!
   end
 
   def get_fb_page(fb_page_id)
@@ -81,7 +81,7 @@ class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
 
     avatar_resource = LocalResource.new(uri)
     facebook_inbox.avatar.attach(io: avatar_resource.file, filename: avatar_resource.tmp_filename, content_type: avatar_resource.encoding)
-  rescue Errno::ETIMEDOUT, Errno::ECONNREFUSED, SocketError => e
+  rescue *ExceptionList::URI_EXCEPTIONS => e
     Rails.logger.info "invalid url #{file_url} : #{e.message}"
   end
 

app/controllers/api/v1/accounts/campaigns_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::CampaignsController < Api::V1::Accounts::BaseController
+  before_action :campaign, except: [:index, :create]
+  before_action :check_authorization
+
+  def index
+    @campaigns = Current.account.campaigns
+  end
+
+  def create
+    @campaign = Current.account.campaigns.create!(campaign_params)
+  end
+
+  def destroy
+    @campaign.destroy
+    head :ok
+  end
+
+  def show; end
+
+  def update
+    @campaign.update(campaign_params)
+  end
+
+  private
+
+  def campaign
+    @campaign ||= Current.account.campaigns.find_by(display_id: params[:id])
+  end
+
+  def campaign_params
+    params.require(:campaign).permit(:title, :description, :message, :enabled, :inbox_id, :sender_id,
+                                     :scheduled_at, audience: [:type, :id], trigger_rules: {})
+  end
+end

app/controllers/api/v1/accounts/contacts/contact_inboxes_controller.rb

@@ -1,23 +1,17 @@
 class Api::V1::Accounts::Contacts::ContactInboxesController < Api::V1::Accounts::BaseController
   before_action :ensure_contact
   before_action :ensure_inbox, only: [:create]
-  before_action :validate_channel_type
 
   def create
     source_id = params[:source_id] || SecureRandom.uuid
-    @contact_inbox = ContactInbox.create(contact: @contact, inbox: @inbox, source_id: source_id)
+    @contact_inbox = ContactInbox.create!(contact: @contact, inbox: @inbox, source_id: source_id)
   end
 
   private
 
-  def validate_channel_type
-    return if @inbox.channel_type == 'Channel::Api'
-
-    render json: { error: 'Contact Inbox creation is only allowed in API inboxes' }, status: :unprocessable_entity
-  end
-
   def ensure_inbox
     @inbox = Current.account.inboxes.find(params[:inbox_id])
+    authorize @inbox, :show?
   end
 
   def ensure_contact

app/controllers/api/v1/accounts/contacts/conversations_controller.rb

@@ -1,17 +1,15 @@
 class Api::V1::Accounts::Contacts::ConversationsController < Api::V1::Accounts::BaseController
   def index
     @conversations = Current.account.conversations.includes(
-      :assignee, :contact, :inbox
+      :assignee, :contact, :inbox, :taggings
     ).where(inbox_id: inbox_ids, contact_id: permitted_params[:contact_id])
   end
 
   private
 
   def inbox_ids
-    if current_user.administrator?
-      Current.account.inboxes.pluck(:id)
-    elsif current_user.agent?
-      current_user.assigned_inboxes.pluck(:id)
+    if Current.user.administrator? || Current.user.agent?
+      Current.user.assigned_inboxes.pluck(:id)
     else
       []
     end

app/controllers/api/v1/accounts/contacts/labels_controller.rb

@@ -0,0 +1,13 @@
+class Api::V1::Accounts::Contacts::LabelsController < Api::V1::Accounts::BaseController
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= Current.account.contacts.find(permitted_params[:contact_id])
+  end
+
+  def permitted_params
+    params.permit(:contact_id, labels: [])
+  end
+end

app/controllers/api/v1/accounts/contacts_controller.rb

@@ -1,15 +1,56 @@
 class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
-  protect_from_forgery with: :null_session
+  include Sift
+
+  sort_on :email, type: :string
+  sort_on :name, type: :string
+  sort_on :phone_number, type: :string
+  sort_on :last_activity_at, type: :datetime
+
+  RESULTS_PER_PAGE = 15
 
   before_action :check_authorization
-  before_action :fetch_contact, only: [:show, :update]
+  before_action :set_current_page, only: [:index, :active, :search]
+  before_action :fetch_contact, only: [:show, :update, :contactable_inboxes]
 
   def index
-    @contacts = Current.account.contacts
+    @contacts_count = resolved_contacts.count
+    @contacts = fetch_contacts_with_conversation_count(resolved_contacts)
+  end
+
+  def search
+    render json: { error: 'Specify search string with parameter q' }, status: :unprocessable_entity if params[:q].blank? && return
+
+    contacts = resolved_contacts.where(
+      'name ILIKE :search OR email ILIKE :search OR phone_number ILIKE :search',
+      search: "%#{params[:q]}%"
+    )
+    @contacts_count = contacts.count
+    @contacts = fetch_contacts_with_conversation_count(contacts)
+  end
+
+  def import
+    ActiveRecord::Base.transaction do
+      import = Current.account.data_imports.create!(data_type: 'contacts')
+      import.import_file.attach(params[:import_file])
+    end
+    head :ok
+  end
+
+  # returns online contacts
+  def active
+    contacts = Current.account.contacts.where(id: ::OnlineStatusTracker
+                  .get_available_contact_ids(Current.account.id))
+    @contacts_count = contacts.count
+    @contacts = contacts.page(@current_page)
   end
 
   def show; end
 
+  def contactable_inboxes
+    @all_contactable_inboxes = Contacts::ContactableInboxesService.new(contact: @contact).get
+    @contactable_inboxes = @all_contactable_inboxes.select { |contactable_inbox| policy(contactable_inbox[:inbox]).show? }
+  end
+
   def create
     ActiveRecord::Base.transaction do
       @contact = Current.account.contacts.new(contact_params)
@@ -19,24 +60,38 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
   end
 
   def update
-    @contact.update!(contact_update_params)
+    @contact.assign_attributes(contact_update_params)
+    @contact.save!
   rescue ActiveRecord::RecordInvalid => e
     render json: {
       message: e.record.errors.full_messages.join(', '),
-      contact: Contact.find_by(email: contact_params[:email])
+      contact: Current.account.contacts.find_by(email: contact_params[:email])
     }, status: :unprocessable_entity
   end
 
-  def search
-    render json: { error: 'Specify search string with parameter q' }, status: :unprocessable_entity if params[:q].blank? && return
-
-    @contacts = Current.account.contacts.where('name LIKE :search OR email LIKE :search', search: "%#{params[:q]}%")
-  end
-
   private
 
-  def check_authorization
-    authorize(Contact)
+  # TODO: Move this to a finder class
+  def resolved_contacts
+    return @resolved_contacts if @resolved_contacts
+
+    @resolved_contacts = Current.account.contacts
+                                .where.not(email: [nil, ''])
+                                .or(Current.account.contacts.where.not(phone_number: [nil, '']))
+    @resolved_contacts = @resolved_contacts.tagged_with(params[:labels], any: true) if params[:labels].present?
+    @resolved_contacts
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def fetch_contacts_with_conversation_count(contacts)
+    filtrate(contacts).left_outer_joins(:conversations)
+                      .select('contacts.*, COUNT(conversations.id) as conversations_count')
+                      .group('contacts.id')
+                      .includes([{ avatar_attachment: [:blob] }, { contact_inboxes: [:inbox] }])
+                      .page(@current_page).per(RESULTS_PER_PAGE)
   end
 
   def build_contact_inbox
@@ -63,6 +118,6 @@ class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
   end
 
   def fetch_contact
-    @contact = Current.account.contacts.find(params[:id])
+    @contact = Current.account.contacts.includes(contact_inboxes: [:inbox]).find(params[:id])
   end
 end

app/controllers/api/v1/accounts/conversations/assignments_controller.rb

@@ -1,9 +1,20 @@
 class Api::V1::Accounts::Conversations::AssignmentsController < Api::V1::Accounts::Conversations::BaseController
-  # assign agent to a conversation
+  # assigns agent/team to a conversation
   def create
+    set_assignee
+    render json: @assignee
+  end
+
+  private
+
+  def set_assignee
     # if params[:assignee_id] is not a valid id, it will set to nil, hence unassigning the conversation
-    assignee = Current.account.users.find_by(id: params[:assignee_id])
-    @conversation.update_assignee(assignee)
-    render json: assignee
+    if params.key?(:assignee_id)
+      @assignee = Current.account.users.find_by(id: params[:assignee_id])
+      @conversation.update_assignee(@assignee)
+    elsif params.key?(:team_id)
+      @assignee = Current.account.teams.find_by(id: params[:team_id])
+      @conversation.update!(team: @assignee)
+    end
   end
 end

app/controllers/api/v1/accounts/conversations/base_controller.rb

@@ -5,5 +5,6 @@ class Api::V1::Accounts::Conversations::BaseController < Api::V1::Accounts::Base
 
   def conversation
     @conversation ||= Current.account.conversations.find_by(display_id: params[:conversation_id])
+    authorize @conversation.inbox, :show?
   end
 end

app/controllers/api/v1/accounts/conversations/labels_controller.rb

@@ -1,11 +1,13 @@
 class Api::V1::Accounts::Conversations::LabelsController < Api::V1::Accounts::Conversations::BaseController
-  def create
-    @conversation.update_labels(params[:labels])
-    @labels = @conversation.label_list
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= @conversation
   end
 
-  # all labels of the current conversation
-  def index
-    @labels = @conversation.label_list
+  def permitted_params
+    params.permit(:conversation_id, labels: [])
   end
 end

app/controllers/api/v1/accounts/conversations/messages_controller.rb

@@ -4,16 +4,31 @@ class Api::V1::Accounts::Conversations::MessagesController < Api::V1::Accounts::
   end
 
   def create
-    user = current_user || @resource
+    user = Current.user || @resource
     mb = Messages::MessageBuilder.new(user, @conversation, params)
     @message = mb.perform
   rescue StandardError => e
     render_could_not_create_error(e.message)
   end
 
+  def destroy
+    ActiveRecord::Base.transaction do
+      message.update!(content: I18n.t('conversations.messages.deleted'), deleted: true)
+      message.attachments.destroy_all
+    end
+  end
+
   private
 
+  def message
+    @message ||= @conversation.messages.find(permitted_params[:id])
+  end
+
   def message_finder
     @message_finder ||= MessageFinder.new(@conversation, params)
   end
+
+  def permitted_params
+    params.permit(:id)
+  end
 end

app/controllers/api/v1/accounts/conversations_controller.rb

@@ -1,7 +1,7 @@
 class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseController
   include Events::Types
 
-  before_action :conversation, except: [:index]
+  before_action :conversation, except: [:index, :meta, :search, :create]
   before_action :contact_inbox, only: [:create]
 
   def index
@@ -15,8 +15,17 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
     @conversations_count = result[:count]
   end
 
+  def search
+    result = conversation_finder.perform
+    @conversations = result[:conversations]
+    @conversations_count = result[:count]
+  end
+
   def create
-    @conversation = ::Conversation.create!(conversation_params)
+    ActiveRecord::Base.transaction do
+      @conversation = ::Conversation.create!(conversation_params)
+      Messages::MessageBuilder.new(Current.user, @conversation, params[:message]).perform if params[:message].present?
+    end
   end
 
   def show; end
@@ -26,8 +35,15 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
     head :ok
   end
 
+  def unmute
+    @conversation.unmute!
+    head :ok
+  end
+
   def transcript
-    ConversationReplyMailer.conversation_transcript(@conversation, params[:email])&.deliver_later if params[:email].present?
+    render json: { error: 'email param missing' }, status: :unprocessable_entity and return if params[:email].blank?
+
+    ConversationReplyMailer.with(account: @conversation.account).conversation_transcript(@conversation, params[:email])&.deliver_later
     head :ok
   end
 
@@ -63,20 +79,40 @@ class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseContro
   end
 
   def conversation
-    @conversation ||= Current.account.conversations.find_by(display_id: params[:id])
+    @conversation ||= Current.account.conversations.find_by!(display_id: params[:id])
+    authorize @conversation.inbox, :show?
   end
 
   def contact_inbox
+    @contact_inbox = build_contact_inbox
+
     @contact_inbox ||= ::ContactInbox.find_by!(source_id: params[:source_id])
+    authorize @contact_inbox.inbox, :show?
+  end
+
+  def build_contact_inbox
+    return if params[:contact_id].blank? || params[:inbox_id].blank?
+
+    inbox = Current.account.inboxes.find(params[:inbox_id])
+    authorize inbox, :show?
+
+    ContactInboxBuilder.new(
+      contact_id: params[:contact_id],
+      inbox_id: inbox.id,
+      source_id: params[:source_id]
+    ).perform
   end
 
   def conversation_params
+    additional_attributes = params[:additional_attributes]&.permit! || {}
+    status = params[:status].present? ? { status: params[:status] } : {}
     {
       account_id: Current.account.id,
       inbox_id: @contact_inbox.inbox_id,
       contact_id: @contact_inbox.contact_id,
-      contact_inbox_id: @contact_inbox.id
-    }
+      contact_inbox_id: @contact_inbox.id,
+      additional_attributes: additional_attributes
+    }.merge(status)
   end
 
   def conversation_finder

app/controllers/api/v1/accounts/csat_survey_responses_controller.rb

@@ -0,0 +1,44 @@
+class Api::V1::Accounts::CsatSurveyResponsesController < Api::V1::Accounts::BaseController
+  include Sift
+  include DateRangeHelper
+
+  RESULTS_PER_PAGE = 25
+
+  before_action :check_authorization
+  before_action :set_csat_survey_responses, only: [:index, :metrics]
+  before_action :set_current_page, only: [:index]
+  before_action :set_current_page_surveys, only: [:index]
+  before_action :set_total_sent_messages_count, only: [:metrics]
+
+  sort_on :created_at, type: :datetime
+
+  def index; end
+
+  def metrics
+    @total_count = @csat_survey_responses.count
+    @ratings_count = @csat_survey_responses.group(:rating).count
+  end
+
+  private
+
+  def set_total_sent_messages_count
+    @csat_messages = Current.account.messages.input_csat
+    @csat_messages = @csat_messages.where(created_at: range) if range.present?
+    @total_sent_messages_count = @csat_messages.count
+  end
+
+  def set_csat_survey_responses
+    @csat_survey_responses = filtrate(
+      Current.account.csat_survey_responses.includes([:conversation, :assigned_agent, :contact])
+    )
+    @csat_survey_responses = @csat_survey_responses.where(created_at: range) if range.present?
+  end
+
+  def set_current_page_surveys
+    @csat_survey_responses = @csat_survey_responses.page(@current_page).per(RESULTS_PER_PAGE)
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+end

app/controllers/api/v1/accounts/custom_filters_controller.rb

@@ -0,0 +1,49 @@
+class Api::V1::Accounts::CustomFiltersController < Api::V1::Accounts::BaseController
+  before_action :fetch_custom_filters, except: [:create]
+  before_action :fetch_custom_filter, only: [:show, :update, :destroy]
+  DEFAULT_FILTER_TYPE = 'conversation'.freeze
+
+  def index; end
+
+  def show; end
+
+  def create
+    @custom_filter = current_user.custom_filters.create!(
+      permitted_payload.merge(account_id: Current.account.id)
+    )
+  end
+
+  def update
+    @custom_filter.update!(permitted_payload)
+  end
+
+  def destroy
+    @custom_filter.destroy
+    head :no_content
+  end
+
+  private
+
+  def fetch_custom_filters
+    @custom_filters = current_user.custom_filters.where(
+      account_id: Current.account.id,
+      filter_type: permitted_params[:filter_type] || DEFAULT_FILTER_TYPE
+    )
+  end
+
+  def fetch_custom_filter
+    @custom_filter = @custom_filters.find(permitted_params[:id])
+  end
+
+  def permitted_payload
+    params.require(:custom_filter).permit(
+      :name,
+      :filter_type,
+      query: {}
+    )
+  end
+
+  def permitted_params
+    params.permit(:id, :filter_type)
+  end
+end

app/controllers/api/v1/accounts/facebook_indicators_controller.rb

@@ -1,55 +0,0 @@
-class Api::V1::Accounts::FacebookIndicatorsController < Api::V1::Accounts::BaseController
-  before_action :set_access_token
-  around_action :handle_with_exception
-
-  def mark_seen
-    fb_bot.deliver(payload('mark_seen'), access_token: @access_token)
-    head :ok
-  end
-
-  def typing_on
-    fb_bot.deliver(payload('typing_on'), access_token: @access_token)
-    head :ok
-  end
-
-  def typing_off
-    fb_bot.deliver(payload('typing_off'), access_token: @access_token)
-    head :ok
-  end
-
-  private
-
-  def fb_bot
-    ::Facebook::Messenger::Bot
-  end
-
-  def handle_with_exception
-    yield
-  rescue Facebook::Messenger::Error => e
-    Rails.logger.debug "Rescued: #{e.inspect}"
-    true
-  end
-
-  def payload(action)
-    {
-      recipient: { id: contact.source_id },
-      sender_action: action
-    }
-  end
-
-  def inbox
-    @inbox ||= Current.account.inboxes.find(permitted_params[:inbox_id])
-  end
-
-  def set_access_token
-    @access_token = inbox.channel.page_access_token
-  end
-
-  def contact
-    @contact ||= inbox.contact_inboxes.find_by!(contact_id: permitted_params[:contact_id])
-  end
-
-  def permitted_params
-    params.permit(:inbox_id, :contact_id)
-  end
-end

app/controllers/api/v1/accounts/inbox_members_controller.rb

@@ -3,15 +3,19 @@ class Api::V1::Accounts::InboxMembersController < Api::V1::Accounts::BaseControl
   before_action :current_agents_ids, only: [:create]
 
   def create
-    # update also done via same action
-    update_agents_list
-    head :ok
-  rescue StandardError => e
-    Rails.logger.debug "Rescued: #{e.inspect}"
-    render_could_not_create_error('Could not add agents to inbox')
+    authorize @inbox, :create?
+    begin
+      # update also done via same action
+      update_agents_list
+      head :ok
+    rescue StandardError => e
+      Rails.logger.debug "Rescued: #{e.inspect}"
+      render_could_not_create_error('Could not add agents to inbox')
+    end
   end
 
   def show
+    authorize @inbox, :show?
     @agents = Current.account.users.where(id: @inbox.members.select(:user_id))
   end
 
@@ -22,9 +26,10 @@ class Api::V1::Accounts::InboxMembersController < Api::V1::Accounts::BaseControl
     # get the list of  user_ids from params
     # the missing ones are the agents which are to be deleted from the inbox
     # the new ones are the agents which are to be added to the inbox
-
-    agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
-    agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    ActiveRecord::Base.transaction do
+      agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
+      agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    end
   end
 
   def agents_to_be_added_ids

app/controllers/api/v1/accounts/inboxes_controller.rb

@@ -4,7 +4,15 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
   before_action :check_authorization
 
   def index
-    @inboxes = policy_scope(Current.account.inboxes.order_by_name.includes(:channel, :avatar_attachment))
+    @inboxes = policy_scope(Current.account.inboxes.order_by_name.includes(:channel, { avatar_attachment: [:blob] }))
+  end
+
+  def assignable_agents
+    @assignable_agents = (Current.account.users.where(id: @inbox.members.select(:user_id)) + Current.account.administrators).uniq
+  end
+
+  def campaigns
+    @campaigns = @inbox.campaigns
   end
 
   def create
@@ -23,12 +31,17 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
 
   def update
     @inbox.update(inbox_update_params.except(:channel))
+    @inbox.update_working_hours(params.permit(working_hours: Inbox::OFFISABLE_ATTRS)[:working_hours]) if params[:working_hours]
     return unless @inbox.channel.is_a?(Channel::WebWidget) && inbox_update_params[:channel].present?
 
     @inbox.channel.update!(inbox_update_params[:channel])
     update_channel_feature_flags
   end
 
+  def agent_bot
+    @agent_bot = @inbox.agent_bot
+  end
+
   def set_agent_bot
     if @agent_bot
       agent_bot_inbox = @inbox.agent_bot_inbox || AgentBotInbox.new(inbox: @inbox)
@@ -49,16 +62,13 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
 
   def fetch_inbox
     @inbox = Current.account.inboxes.find(params[:id])
+    authorize @inbox, :show?
   end
 
   def fetch_agent_bot
     @agent_bot = AgentBot.find(params[:agent_bot]) if params[:agent_bot]
   end
 
-  def check_authorization
-    authorize(Inbox)
-  end
-
   def create_channel
     case permitted_params[:channel][:type]
     when 'web_widget'
@@ -78,12 +88,13 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
   end
 
   def permitted_params
-    params.permit(:id, :avatar, :name, :greeting_message, :greeting_enabled, channel:
-      [:type, :website_url, :widget_color, :welcome_title, :welcome_tagline, :webhook_url, :email])
+    params.permit(:id, :avatar, :name, :greeting_message, :greeting_enabled, :enable_email_collect, :csat_survey_enabled, channel:
+      [:type, :website_url, :widget_color, :welcome_title, :welcome_tagline, :webhook_url, :email, :reply_time])
   end
 
   def inbox_update_params
-    params.permit(:enable_auto_assignment, :name, :avatar, :greeting_message, :greeting_enabled,
+    params.permit(:enable_auto_assignment, :enable_email_collect, :name, :avatar, :greeting_message, :greeting_enabled, :csat_survey_enabled,
+                  :working_hours_enabled, :out_of_office_message, :timezone,
                   channel: [
                     :website_url,
                     :widget_color,
@@ -91,6 +102,9 @@ class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
                     :welcome_tagline,
                     :webhook_url,
                     :email,
+                    :reply_time,
+                    :pre_chat_form_enabled,
+                    { pre_chat_form_options: [:pre_chat_message, :require_email] },
                     { selected_feature_flags: [] }
                   ])
   end

app/controllers/api/v1/accounts/integrations/apps_controller.rb

@@ -1,4 +1,5 @@
 class Api::V1::Accounts::Integrations::AppsController < Api::V1::Accounts::BaseController
+  before_action :check_admin_authorization?
   before_action :fetch_apps, only: [:index]
   before_action :fetch_app, only: [:show]
 

app/controllers/api/v1/accounts/integrations/hooks_controller.rb

@@ -0,0 +1,31 @@
+class Api::V1::Accounts::Integrations::HooksController < Api::V1::Accounts::BaseController
+  before_action :fetch_hook, only: [:update, :destroy]
+  before_action :check_authorization
+
+  def create
+    @hook = Current.account.hooks.create!(permitted_params)
+  end
+
+  def update
+    @hook.update!(permitted_params.slice(:status, :settings))
+  end
+
+  def destroy
+    @hook.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_hook
+    @hook = Current.account.hooks.find(params[:id])
+  end
+
+  def check_authorization
+    authorize(:hook)
+  end
+
+  def permitted_params
+    params.require(:hook).permit(:app_id, :inbox_id, :status, settings: {})
+  end
+end

app/controllers/api/v1/accounts/integrations/slack_controller.rb

@@ -1,14 +1,17 @@
 class Api::V1::Accounts::Integrations::SlackController < Api::V1::Accounts::BaseController
+  before_action :check_admin_authorization?
   before_action :fetch_hook, only: [:update, :destroy]
 
   def create
-    builder = Integrations::Slack::HookBuilder.new(
-      account: Current.account,
-      code: params[:code],
-      inbox_id: params[:inbox_id]
-    )
-    @hook = builder.perform
-    create_chatwoot_slack_channel
+    ActiveRecord::Base.transaction do
+      builder = Integrations::Slack::HookBuilder.new(
+        account: Current.account,
+        code: params[:code],
+        inbox_id: params[:inbox_id]
+      )
+      @hook = builder.perform
+      create_chatwoot_slack_channel
+    end
   end
 
   def update

app/controllers/api/v1/accounts/kbase/base_controller.rb

@@ -0,0 +1,9 @@
+class Api::V1::Accounts::Kbase::BaseController < Api::V1::Accounts::BaseController
+  before_action :portal
+
+  private
+
+  def portal
+    @portal ||= Current.account.kbase_portals.find_by(id: params[:portal_id])
+  end
+end

app/controllers/api/v1/accounts/kbase/categories_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Kbase::CategoriesController < Api::V1::Accounts::Kbase::BaseController
+  before_action :fetch_category, except: [:index, :create]
+
+  def index
+    @categories = @portal.categories
+  end
+
+  def create
+    @category = @portal.categories.create!(category_params)
+  end
+
+  def update
+    @category.update!(category_params)
+  end
+
+  def destroy
+    @category.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_category
+    @category = @portal.categories.find(params[:id])
+  end
+
+  def category_params
+    params.require(:category).permit(
+      :name, :description, :position
+    )
+  end
+end

app/controllers/api/v1/accounts/kbase/portals_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Kbase::PortalsController < Api::V1::Accounts::Kbase::BaseController
+  before_action :fetch_portal, except: [:index, :create]
+
+  def index
+    @portals = Current.account.kbase_portals
+  end
+
+  def create
+    @portal = Current.account.kbase_portals.create!(portal_params)
+  end
+
+  def update
+    @portal.update!(portal_params)
+  end
+
+  def destroy
+    @portal.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_portal
+    @portal = current_account.kbase_portals.find(params[:id])
+  end
+
+  def portal_params
+    params.require(:portal).permit(
+      :account_id, :color, :custom_domain, :header_text, :homepage_link, :name, :page_title, :slug
+    )
+  end
+end

app/controllers/api/v1/accounts/labels_controller.rb

@@ -28,10 +28,6 @@ class Api::V1::Accounts::LabelsController < Api::V1::Accounts::BaseController
     @label = Current.account.labels.find(params[:id])
   end
 
-  def check_authorization
-    authorize(Label)
-  end
-
   def permitted_params
     params.require(:label).permit(:title, :description, :color, :show_on_sidebar)
   end

app/controllers/api/v1/accounts/notifications_controller.rb

@@ -1,22 +1,25 @@
 class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseController
-  protect_from_forgery with: :null_session
+  RESULTS_PER_PAGE = 15
 
   before_action :fetch_notification, only: [:update]
   before_action :set_primary_actor, only: [:read_all]
+  before_action :set_current_page, only: [:index]
 
   def index
     @unread_count = current_user.notifications.where(account_id: current_account.id, read_at: nil).count
-    @notifications = current_user.notifications.where(account_id: current_account.id).page params[:page]
+    @count = notifications.count
+    @notifications = notifications.page(@current_page).per(RESULTS_PER_PAGE)
   end
 
   def read_all
+    # rubocop:disable Rails/SkipsModelValidations
     if @primary_actor
       current_user.notifications.where(account_id: current_account.id, primary_actor: @primary_actor, read_at: nil)
-                  .update(read_at: DateTime.now.utc)
+                  .update_all(read_at: DateTime.now.utc)
     else
-      current_user.notifications.where(account_id: current_account.id, read_at: nil).update(read_at: DateTime.now.utc)
+      current_user.notifications.where(account_id: current_account.id, read_at: nil).update_all(read_at: DateTime.now.utc)
     end
-
+    # rubocop:enable Rails/SkipsModelValidations
     head :ok
   end
 
@@ -25,6 +28,11 @@ class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseContro
     render json: @notification
   end
 
+  def unread_count
+    @unread_count = current_user.notifications.where(account_id: current_account.id, read_at: nil).count
+    render json: @unread_count
+  end
+
   private
 
   def set_primary_actor
@@ -37,4 +45,12 @@ class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseContro
   def fetch_notification
     @notification = current_user.notifications.find(params[:id])
   end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def notifications
+    @notifications ||= current_user.notifications.where(account_id: current_account.id)
+  end
 end

app/controllers/api/v1/accounts/team_members_controller.rb

@@ -0,0 +1,48 @@
+class Api::V1::Accounts::TeamMembersController < Api::V1::Accounts::BaseController
+  before_action :fetch_team
+  before_action :check_authorization
+
+  def index
+    @team_members = @team.team_members.map(&:user)
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      @team_members = params[:user_ids].map { |user_id| @team.add_member(user_id) }
+    end
+  end
+
+  def update
+    ActiveRecord::Base.transaction do
+      members_to_be_added_ids.each { |user_id| @team.add_member(user_id) }
+      members_to_be_removed_ids.each { |user_id| @team.remove_member(user_id) }
+    end
+    @team_members = @team.members
+    render action: 'create'
+  end
+
+  def destroy
+    ActiveRecord::Base.transaction do
+      params[:user_ids].map { |user_id| @team.remove_member(user_id) }
+    end
+    head :ok
+  end
+
+  private
+
+  def members_to_be_added_ids
+    params[:user_ids] - current_members_ids
+  end
+
+  def members_to_be_removed_ids
+    current_members_ids - params[:user_ids]
+  end
+
+  def current_members_ids
+    @current_members_ids ||= @team.members.pluck(:id)
+  end
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:team_id])
+  end
+end

app/controllers/api/v1/accounts/teams_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::TeamsController < Api::V1::Accounts::BaseController
+  before_action :fetch_team, only: [:show, :update, :destroy]
+  before_action :check_authorization
+
+  def index
+    @teams = Current.account.teams
+  end
+
+  def show; end
+
+  def create
+    @team = Current.account.teams.new(team_params)
+    @team.save!
+  end
+
+  def update
+    @team.update!(team_params)
+  end
+
+  def destroy
+    @team.destroy
+    head :ok
+  end
+
+  private
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:id])
+  end
+
+  def team_params
+    params.require(:team).permit(:name, :description, :allow_auto_assign)
+  end
+end

app/controllers/api/v1/accounts/twitter/authorizations_controller.rb

@@ -0,0 +1,29 @@
+class Api::V1::Accounts::Twitter::AuthorizationsController < Api::V1::Accounts::BaseController
+  include TwitterConcern
+
+  before_action :check_authorization
+
+  def create
+    @response = twitter_client.request_oauth_token(url: twitter_callback_url)
+    if @response.status == '200'
+      ::Redis::Alfred.setex(oauth_token, Current.account.id)
+      render json: { success: true, url: oauth_authorize_endpoint(oauth_token) }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def oauth_token
+    parsed_body['oauth_token']
+  end
+
+  def oauth_authorize_endpoint(oauth_token)
+    "#{twitter_api_base_url}/oauth/authorize?oauth_token=#{oauth_token}"
+  end
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
+end

app/controllers/api/v1/accounts/webhooks_controller.rb

@@ -29,8 +29,4 @@ class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
   def fetch_webhook
     @webhook = Current.account.webhooks.find(params[:id])
   end
-
-  def check_authorization
-    authorize(Webhook)
-  end
 end

app/controllers/api/v1/accounts/working_hours_controller.rb

@@ -0,0 +1,18 @@
+class Api::V1::Accounts::WorkingHoursController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+  before_action :fetch_webhook, only: [:update]
+
+  def update
+    @working_hour.update!(working_hour_params)
+  end
+
+  private
+
+  def working_hour_params
+    params.require(:working_hour).permit(:inbox_id, :open_hour, :open_minutes, :close_hour, :close_minutes, :closed_all_day)
+  end
+
+  def fetch_working_hour
+    @working_hour = Current.account.working_hours.find(params[:id])
+  end
+end

app/controllers/api/v1/accounts_controller.rb

@@ -1,7 +1,6 @@
 class Api::V1::AccountsController < Api::BaseController
   include AuthHelper
 
-  skip_before_action :verify_authenticity_token, only: [:create]
   skip_before_action :authenticate_user!, :set_current_user, :handle_with_exception,
                      only: [:create], raise: false
   before_action :check_signup_enabled, only: [:create]
@@ -16,8 +15,9 @@ class Api::V1::AccountsController < Api::BaseController
   def create
     @user, @account = AccountBuilder.new(
       account_name: account_params[:account_name],
+      user_full_name: account_params[:user_full_name],
       email: account_params[:email],
-      confirmed: confirmed?,
+      user_password: account_params[:password],
       user: current_user
     ).perform
     if @user
@@ -29,11 +29,12 @@ class Api::V1::AccountsController < Api::BaseController
   end
 
   def show
+    @latest_chatwoot_version = ::Redis::Alfred.get(::Redis::Alfred::LATEST_CHATWOOT_VERSION)
     render 'api/v1/accounts/show.json'
   end
 
   def update
-    @account.update!(account_params.slice(:name, :locale, :domain, :support_email))
+    @account.update!(account_params.slice(:name, :locale, :domain, :support_email, :auto_resolve_duration))
   end
 
   def update_active_at
@@ -44,21 +45,13 @@ class Api::V1::AccountsController < Api::BaseController
 
   private
 
-  def check_authorization
-    authorize(Account)
-  end
-
-  def confirmed?
-    super_admin? && params[:confirmed]
-  end
-
   def fetch_account
     @account = current_user.accounts.find(params[:id])
     @current_account_user = @account.account_users.find_by(user_id: current_user.id)
   end
 
   def account_params
-    params.permit(:account_name, :email, :name, :locale, :domain, :support_email)
+    params.permit(:account_name, :email, :name, :password, :locale, :domain, :support_email, :auto_resolve_duration, :user_full_name)
   end
 
   def check_signup_enabled

app/controllers/api/v1/agent_bots_controller.rb

@@ -1,7 +0,0 @@
-class Api::V1::AgentBotsController < Api::BaseController
-  skip_before_action :authenticate_user!
-
-  def index
-    render json: AgentBot.all
-  end
-end

app/controllers/api/v1/profiles_controller.rb

@@ -6,6 +6,12 @@ class Api::V1::ProfilesController < Api::BaseController
   end
 
   def update
+    if password_params[:password].present?
+      render_could_not_create_error('Invalid current password') and return unless @user.valid_password?(password_params[:current_password])
+
+      @user.update!(password_params.except(:current_password))
+    end
+
     @user.update!(profile_params)
   end
 
@@ -20,10 +26,17 @@ class Api::V1::ProfilesController < Api::BaseController
       :email,
       :name,
       :display_name,
-      :password,
-      :password_confirmation,
       :avatar,
-      :availability
+      :availability,
+      ui_settings: {}
+    )
+  end
+
+  def password_params
+    params.require(:profile).permit(
+      :current_password,
+      :password,
+      :password_confirmation
     )
   end
 end

app/controllers/api/v1/widget/base_controller.rb

@@ -1,34 +1,83 @@
 class Api::V1::Widget::BaseController < ApplicationController
+  include SwitchLocale
+
   before_action :set_web_widget
   before_action :set_contact
 
   private
 
+  def conversations
+    if @contact_inbox.hmac_verified?
+      verified_contact_inbox_ids = @contact.contact_inboxes.where(inbox_id: auth_token_params[:inbox_id], hmac_verified: true).map(&:id)
+      @conversations = @contact.conversations.where(contact_inbox_id: verified_contact_inbox_ids)
+    else
+      @conversations = @contact_inbox.conversations.where(inbox_id: auth_token_params[:inbox_id])
+    end
+  end
+
   def conversation
-    @conversation ||= @contact_inbox.conversations.where(
-      inbox_id: auth_token_params[:inbox_id]
-    ).last
+    @conversation ||= conversations.last
   end
 
   def auth_token_params
-    @auth_token_params ||= ::Widget::TokenService.new(token: request.headers[header_name]).decode_token
-  end
-
-  def header_name
-    'X-Auth-Token'
+    @auth_token_params ||= ::Widget::TokenService.new(token: request.headers['X-Auth-Token']).decode_token
   end
 
   def set_web_widget
     @web_widget = ::Channel::WebWidget.find_by!(website_token: permitted_params[:website_token])
-    @account = @web_widget.account
-    switch_locale @account
+    @current_account = @web_widget.account
   end
 
   def set_contact
     @contact_inbox = @web_widget.inbox.contact_inboxes.find_by(
       source_id: auth_token_params[:source_id]
     )
-    @contact = @contact_inbox.contact
+    @contact = @contact_inbox&.contact
+    raise ActiveRecord::RecordNotFound unless @contact
+  end
+
+  def create_conversation
+    ::Conversation.create!(conversation_params)
+  end
+
+  def inbox
+    @inbox ||= ::Inbox.find_by(id: auth_token_params[:inbox_id])
+  end
+
+  def conversation_params
+    # FIXME: typo referrer in additional attributes, will probably require a migration.
+    {
+      account_id: inbox.account_id,
+      inbox_id: inbox.id,
+      contact_id: @contact.id,
+      contact_inbox_id: @contact_inbox.id,
+      additional_attributes: {
+        browser: browser_params,
+        referer: permitted_params[:message][:referer_url],
+        initiated_at: timestamp_params
+      }
+    }
+  end
+
+  def update_contact(email)
+    contact_with_email = @current_account.contacts.find_by(email: email)
+    if contact_with_email
+      @contact = ::ContactMergeAction.new(
+        account: @current_account,
+        base_contact: contact_with_email,
+        mergee_contact: @contact
+      ).perform
+    else
+      @contact.update!(email: email, name: contact_name)
+    end
+  end
+
+  def contact_email
+    permitted_params[:contact][:email].downcase
+  end
+
+  def contact_name
+    params[:contact][:name] || contact_email.split('@')[0]
   end
 
   def browser_params
@@ -40,4 +89,19 @@ class Api::V1::Widget::BaseController < ApplicationController
       platform_version: browser.platform.version
     }
   end
+
+  def timestamp_params
+    { timestamp: permitted_params[:message][:timestamp] }
+  end
+
+  def message_params
+    {
+      account_id: conversation.account_id,
+      sender: @contact,
+      content: permitted_params[:message][:content],
+      inbox_id: conversation.inbox_id,
+      echo_id: permitted_params[:message][:echo_id],
+      message_type: :incoming
+    }
+  end
 end

app/controllers/api/v1/widget/campaigns_controller.rb

@@ -0,0 +1,13 @@
+class Api::V1::Widget::CampaignsController < Api::V1::Widget::BaseController
+  skip_before_action :set_contact
+
+  def index
+    @campaigns = @web_widget.inbox.campaigns.where(enabled: true)
+  end
+
+  private
+
+  def permitted_params
+    params.permit(:website_token)
+  end
+end

app/controllers/api/v1/widget/contacts_controller.rb

@@ -1,4 +1,8 @@
 class Api::V1::Widget::ContactsController < Api::V1::Widget::BaseController
+  before_action :process_hmac
+
+  def show; end
+
   def update
     contact_identify_action = ContactIdentifyAction.new(
       contact: @contact,
@@ -9,7 +13,22 @@ class Api::V1::Widget::ContactsController < Api::V1::Widget::BaseController
 
   private
 
+  def process_hmac
+    return if params[:identifier_hash].blank?
+    raise StandardError, 'HMAC failed: Invalid Identifier Hash Provided' unless valid_hmac?
+
+    @contact_inbox.update(hmac_verified: true)
+  end
+
+  def valid_hmac?
+    params[:identifier_hash] == OpenSSL::HMAC.hexdigest(
+      'sha256',
+      @web_widget.hmac_token,
+      params[:identifier].to_s
+    )
+  end
+
   def permitted_params
-    params.permit(:website_token, :identifier, :email, :name, :avatar_url, custom_attributes: {})
+    params.permit(:website_token, :identifier, :identifier_hash, :email, :name, :avatar_url, custom_attributes: {})
   end
 end

app/controllers/api/v1/widget/conversations_controller.rb

@@ -5,6 +5,14 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
     @conversation = conversation
   end
 
+  def create
+    ActiveRecord::Base.transaction do
+      update_contact(contact_email) if @contact.email.blank? && contact_email.present?
+      @conversation = create_conversation
+      conversation.messages.create(message_params)
+    end
+  end
+
   def update_last_seen
     head :ok && return if conversation.nil?
 
@@ -15,7 +23,7 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
 
   def transcript
     if permitted_params[:email].present? && conversation.present?
-      ConversationReplyMailer.conversation_transcript(
+      ConversationReplyMailer.with(account: conversation.account).conversation_transcript(
         conversation,
         permitted_params[:email]
       )&.deliver_later
@@ -43,6 +51,6 @@ class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
   end
 
   def permitted_params
-    params.permit(:id, :typing_status, :website_token, :email)
+    params.permit(:id, :typing_status, :website_token, :email, contact: [:name, :email], message: [:content, :referer_url, :timestamp, :echo_id])
   end
 end

app/controllers/api/v1/widget/events_controller.rb

@@ -2,7 +2,8 @@ class Api::V1::Widget::EventsController < Api::V1::Widget::BaseController
   include Events::Types
 
   def create
-    Rails.configuration.dispatcher.dispatch(permitted_params[:name], Time.zone.now, contact_inbox: @contact_inbox, event_info: event_info)
+    Rails.configuration.dispatcher.dispatch(permitted_params[:name], Time.zone.now, contact_inbox: @contact_inbox,
+                                                                                    event_info: permitted_params[:event_info].to_h.merge(event_info))
     head :no_content
   end
 
@@ -17,6 +18,6 @@ class Api::V1::Widget::EventsController < Api::V1::Widget::BaseController
   end
 
   def permitted_params
-    params.permit(:name, :website_token)
+    params.permit(:name, :website_token, event_info: {})
   end
 end

app/controllers/api/v1/widget/labels_controller.rb

@@ -1,20 +1,29 @@
 class Api::V1::Widget::LabelsController < Api::V1::Widget::BaseController
   def create
-    conversation.label_list.add(permitted_params[:label])
-    conversation.save!
+    if conversation.present? && label_defined_in_account?
+      conversation.label_list.add(permitted_params[:label])
+      conversation.save!
+    end
 
     head :no_content
   end
 
   def destroy
-    conversation.label_list.remove(permitted_params[:id])
-    conversation.save!
+    if conversation.present?
+      conversation.label_list.remove(permitted_params[:id])
+      conversation.save!
+    end
 
     head :no_content
   end
 
   private
 
+  def label_defined_in_account?
+    label = @current_account.labels&.find_by(title: permitted_params[:label])
+    label.present?
+  end
+
   def permitted_params
     params.permit(:id, :label, :website_token)
   end

app/controllers/api/v1/widget/messages_controller.rb

@@ -20,7 +20,7 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
       @message.update!(message_update_params[:message])
     end
   rescue StandardError => e
-    render json: { error: @contact.errors, message: e.message }.to_json, status: 500
+    render json: { error: @contact.errors, message: e.message }.to_json, status: :internal_server_error
   end
 
   private
@@ -39,42 +39,7 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
   end
 
   def set_conversation
-    @conversation = ::Conversation.create!(conversation_params) if conversation.nil?
-  end
-
-  def message_params
-    {
-      account_id: conversation.account_id,
-      sender: @contact,
-      content: permitted_params[:message][:content],
-      inbox_id: conversation.inbox_id,
-      echo_id: permitted_params[:message][:echo_id],
-      message_type: :incoming
-    }
-  end
-
-  def conversation_params
-    {
-      account_id: inbox.account_id,
-      inbox_id: inbox.id,
-      contact_id: @contact.id,
-      contact_inbox_id: @contact_inbox.id,
-      additional_attributes: {
-        browser: browser_params,
-        referer: permitted_params[:message][:referer_url],
-        initiated_at: timestamp_params
-      }
-    }
-  end
-
-  def timestamp_params
-    {
-      timestamp: permitted_params[:message][:timestamp]
-    }
-  end
-
-  def inbox
-    @inbox ||= ::Inbox.find_by(id: auth_token_params[:inbox_id])
+    @conversation = create_conversation if conversation.nil?
   end
 
   def message_finder_params
@@ -88,36 +53,13 @@ class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
     @message_finder ||= MessageFinder.new(conversation, message_finder_params)
   end
 
-  def update_contact(email)
-    contact_with_email = @account.contacts.find_by(email: email)
-    if contact_with_email
-      @contact = ::ContactMergeAction.new(
-        account: @account,
-        base_contact: contact_with_email,
-        mergee_contact: @contact
-      ).perform
-    else
-      @contact.update!(
-        email: email,
-        name: contact_name
-      )
-    end
-  end
-
-  def contact_email
-    permitted_params[:contact][:email].downcase
-  end
-
-  def contact_name
-    contact_email.split('@')[0]
-  end
-
   def message_update_params
-    params.permit(message: [{ submitted_values: [:name, :title, :value] }])
+    params.permit(message: [{ submitted_values: [:name, :title, :value, { csat_survey_response: [:feedback_message, :rating] }] }])
   end
 
   def permitted_params
-    params.permit(:id, :before, :website_token, contact: [:email], message: [:content, :referer_url, :timestamp, :echo_id])
+    # timestamp parameter is used in create conversation method
+    params.permit(:id, :before, :website_token, contact: [:name, :email], message: [:content, :referer_url, :timestamp, :echo_id])
   end
 
   def set_message

app/controllers/api/v2/accounts/reports_controller.rb

@@ -1,4 +1,6 @@
 class Api::V2::Accounts::ReportsController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+
   def account
     builder = V2::ReportBuilder.new(Current.account, account_report_params)
     data = builder.build
@@ -9,8 +11,24 @@ class Api::V2::Accounts::ReportsController < Api::V1::Accounts::BaseController
     render json: account_summary_metrics
   end
 
+  def agents
+    response.headers['Content-Type'] = 'text/csv'
+    response.headers['Content-Disposition'] = 'attachment; filename=agents_report.csv'
+    render layout: false, template: 'api/v2/accounts/reports/agents.csv.erb', format: 'csv'
+  end
+
+  def inboxes
+    response.headers['Content-Type'] = 'text/csv'
+    response.headers['Content-Disposition'] = 'attachment; filename=inboxes_report.csv'
+    render layout: false, template: 'api/v2/accounts/reports/inboxes.csv.erb', format: 'csv'
+  end
+
   private
 
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
+
   def account_summary_params
     {
       type: :account,

app/controllers/application_controller.rb

@@ -1,13 +1,14 @@
 class ApplicationController < ActionController::Base
   include DeviseTokenAuth::Concerns::SetUserByToken
   include Pundit
+  include SwitchLocale
 
-  protect_from_forgery with: :null_session
+  skip_before_action :verify_authenticity_token
 
   before_action :set_current_user, unless: :devise_controller?
+  around_action :switch_locale
   around_action :handle_with_exception, unless: :devise_controller?
 
-  # after_action :verify_authorized
   rescue_from ActiveRecord::RecordInvalid, with: :render_record_invalid
 
   private
@@ -21,7 +22,7 @@ class ApplicationController < ActionController::Base
     render_unauthorized('You are not authorized to do this action')
   ensure
     # to address the thread variable leak issues in Puma/Thin webserver
-    Current.user = nil
+    Current.reset
   end
 
   def set_current_user
@@ -59,22 +60,6 @@ class ApplicationController < ActionController::Base
     render json: exception.to_hash, status: exception.http_status
   end
 
-  def locale_from_params
-    I18n.available_locales.map(&:to_s).include?(params[:locale]) ? params[:locale] : nil
-  end
-
-  def locale_from_account(account)
-    I18n.available_locales.map(&:to_s).include?(account.locale) ? account.locale : nil
-  end
-
-  def switch_locale(account)
-    # priority is for locale set in query string (mostly for widget/from js sdk)
-    locale ||= locale_from_params
-    # if local is not set in param, lets try account
-    locale ||= locale_from_account(account)
-    I18n.locale = locale || I18n.default_locale
-  end
-
   def pundit_user
     {
       user: Current.user,

app/controllers/concerns/access_token_auth_helper.rb

@@ -14,15 +14,11 @@ module AccessTokenAuthHelper
     render_unauthorized('Invalid Access Token') && return if @access_token.blank?
 
     @resource = @access_token.owner
-  end
-
-  def super_admin?
-    @resource.present? && @resource.is_a?(SuperAdmin)
+    Current.user = @resource if current_user.is_a?(User)
   end
 
   def validate_bot_access_token!
-    return if current_user.is_a?(User)
-    return if super_admin?
+    return if Current.user.is_a?(User)
     return if agent_bot_accessible?
 
     render_unauthorized('Access to this endpoint is not authorized for bots')

app/controllers/concerns/label_concern.rb

@@ -0,0 +1,10 @@
+module LabelConcern
+  def create
+    model.update_labels(permitted_params[:labels])
+    @labels = model.label_list
+  end
+
+  def index
+    @labels = model.label_list
+  end
+end

app/controllers/concerns/switch_locale.rb

@@ -0,0 +1,42 @@
+module SwitchLocale
+  extend ActiveSupport::Concern
+
+  private
+
+  def switch_locale(&action)
+    # priority is for locale set in query string (mostly for widget/from js sdk)
+    locale ||= locale_from_params
+    # if locale is not set in account, let's use DEFAULT_LOCALE env variable
+    locale ||= locale_from_env_variable
+    set_locale(locale, &action)
+  end
+
+  def switch_locale_using_account_locale(&action)
+    locale = locale_from_account(@current_account)
+    set_locale(locale, &action)
+  end
+
+  def set_locale(locale, &action)
+    # if locale is empty, use default_locale
+    locale ||= I18n.default_locale
+    # Ensure locale won't bleed into other requests
+    # https://guides.rubyonrails.org/i18n.html#managing-the-locale-across-requests
+    I18n.with_locale(locale, &action)
+  end
+
+  def locale_from_params
+    I18n.available_locales.map(&:to_s).include?(params[:locale]) ? params[:locale] : nil
+  end
+
+  def locale_from_account(account)
+    return unless account
+
+    I18n.available_locales.map(&:to_s).include?(account.locale) ? account.locale : nil
+  end
+
+  def locale_from_env_variable
+    return unless ENV.fetch('DEFAULT_LOCALE', nil)
+
+    I18n.available_locales.map(&:to_s).include?(ENV.fetch('DEFAULT_LOCALE')) ? ENV.fetch('DEFAULT_LOCALE') : nil
+  end
+end

app/controllers/concerns/twitter_concern.rb

@@ -0,0 +1,26 @@
+module TwitterConcern
+  extend ActiveSupport::Concern
+
+  private
+
+  def parsed_body
+    @parsed_body ||= Rack::Utils.parse_nested_query(@response.raw_response.body)
+  end
+
+  def host
+    ENV.fetch('FRONTEND_URL', '')
+  end
+
+  def twitter_client
+    Twitty::Facade.new do |config|
+      config.consumer_key = ENV.fetch('TWITTER_CONSUMER_KEY', nil)
+      config.consumer_secret = ENV.fetch('TWITTER_CONSUMER_SECRET', nil)
+      config.base_url = twitter_api_base_url
+      config.environment = ENV.fetch('TWITTER_ENVIRONMENT', '')
+    end
+  end
+
+  def twitter_api_base_url
+    'https://api.twitter.com'
+  end
+end

app/controllers/dashboard_controller.rb

@@ -1,5 +1,9 @@
 class DashboardController < ActionController::Base
+  include SwitchLocale
+
   before_action :set_global_config
+  around_action :switch_locale
+  before_action :ensure_installation_onboarding, only: [:index]
 
   layout 'vueapp'
 
@@ -16,9 +20,16 @@ class DashboardController < ActionController::Base
       'TERMS_URL',
       'PRIVACY_URL',
       'DISPLAY_MANIFEST',
-      'CREATE_NEW_ACCOUNT_FROM_DASHBOARD'
+      'CREATE_NEW_ACCOUNT_FROM_DASHBOARD',
+      'CHATWOOT_INBOX_TOKEN',
+      'API_CHANNEL_NAME',
+      'API_CHANNEL_THUMBNAIL'
     ).merge(
       APP_VERSION: Chatwoot.config[:version]
     )
   end
+
+  def ensure_installation_onboarding
+    redirect_to '/installation/onboarding' if ::Redis::Alfred.get(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING)
+  end
 end

app/controllers/devise_overrides/confirmations_controller.rb

@@ -1,24 +1,31 @@
 class DeviseOverrides::ConfirmationsController < Devise::ConfirmationsController
+  include AuthHelper
   skip_before_action :require_no_authentication, raise: false
   skip_before_action :authenticate_user!, raise: false
 
   def create
     @confirmable = User.find_by(confirmation_token: params[:confirmation_token])
-    if @confirmable
-      if @confirmable.confirm || (@confirmable.confirmed_at && @confirmable.reset_password_token)
-        # confirmed now or already confirmed but quit before setting a password
-        render json: { "message": 'Success', "redirect_url": create_reset_token_link(@confirmable) }, status: :ok
-      elsif @confirmable.confirmed_at
-        render json: { "message": 'Already confirmed', "redirect_url": '/' }, status: 422
-      else
-        render json: { "message": 'Failure', "redirect_url": '/' }, status: 422
-      end
-    else
-      render json: { "message": 'Invalid token', "redirect_url": '/' }, status: 422
-    end
+    render_confirmation_success and return if @confirmable&.confirm
+
+    render_confirmation_error
   end
 
-  protected
+  private
+
+  def render_confirmation_success
+    send_auth_headers(@confirmable)
+    render partial: 'devise/auth.json', locals: { resource: @confirmable }
+  end
+
+  def render_confirmation_error
+    if @confirmable.blank?
+      render json: { message: 'Invalid token', redirect_url: '/' }, status: :unprocessable_entity
+    elsif @confirmable.confirmed_at
+      render json: { message: 'Already confirmed', redirect_url: '/' }, status: :unprocessable_entity
+    else
+      render json: { message: 'Failure', redirect_url: '/' }, status: :unprocessable_entity
+    end
+  end
 
   def create_reset_token_link(user)
     raw, enc = Devise.token_generator.generate(user.class, :reset_password_token)

app/controllers/devise_overrides/passwords_controller.rb

@@ -13,7 +13,7 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController
       send_auth_headers(@recoverable)
       render partial: 'devise/auth.json', locals: { resource: @recoverable }
     else
-      render json: { "message": 'Invalid token', "redirect_url": '/' }, status: 422
+      render json: { message: 'Invalid token', redirect_url: '/' }, status: :unprocessable_entity
     end
   end
 
@@ -27,7 +27,7 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController
     end
   end
 
-  protected
+  private
 
   def reset_password_and_confirmation(recoverable)
     recoverable.confirm unless recoverable.confirmed? # confirm if user resets password without confirming anytime before
@@ -40,7 +40,7 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController
 
   def build_response(message, status)
     render json: {
-      "message": message
+      message: message
     }, status: status
   end
 end

app/controllers/devise_overrides/sessions_controller.rb

@@ -2,8 +2,38 @@ class DeviseOverrides::SessionsController < ::DeviseTokenAuth::SessionsControlle
   # Prevent session parameter from being passed
   # Unpermitted parameter: session
   wrap_parameters format: []
+  before_action :process_sso_auth_token, only: [:create]
+
+  def create
+    # Authenticate user via the temporary sso auth token
+    if params[:sso_auth_token].present? && @resource.present?
+      authenticate_resource_with_sso_token
+      yield @resource if block_given?
+      render_create_success
+    else
+      super
+    end
+  end
 
   def render_create_success
     render partial: 'devise/auth.json', locals: { resource: @resource }
   end
+
+  private
+
+  def authenticate_resource_with_sso_token
+    @token = @resource.create_token
+    @resource.save
+
+    sign_in(:user, @resource, store: false, bypass: false)
+    # invalidate the token after the user is signed in
+    @resource.invalidate_sso_auth_token(params[:sso_auth_token])
+  end
+
+  def process_sso_auth_token
+    return if params[:email].blank?
+
+    user = User.find_by(email: params[:email])
+    @resource = user if user&.valid_sso_auth_token?(params[:sso_auth_token])
+  end
 end

app/controllers/installation/onboarding_controller.rb

@@ -0,0 +1,42 @@
+class Installation::OnboardingController < ApplicationController
+  before_action :ensure_installation_onboarding
+
+  def index; end
+
+  def create
+    begin
+      AccountBuilder.new(
+        account_name: onboarding_params.dig(:user, :company),
+        user_full_name: onboarding_params.dig(:user, :name),
+        email: onboarding_params.dig(:user, :email),
+        user_password: params.dig(:user, :password),
+        confirmed: true
+      ).perform
+    rescue StandardError => e
+      redirect_to '/', flash: { error: e.message } and return
+    end
+    finish_onboarding
+    redirect_to '/'
+  end
+
+  private
+
+  def onboarding_params
+    params.permit(:subscribe_to_updates, user: [:name, :company, :email])
+  end
+
+  def finish_onboarding
+    ::Redis::Alfred.delete(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING)
+    return if onboarding_params[:subscribe_to_updates].blank?
+
+    ChatwootHub.register_instance(
+      onboarding_params.dig(:user, :company),
+      onboarding_params.dig(:user, :name),
+      onboarding_params.dig(:user, :email)
+    )
+  end
+
+  def ensure_installation_onboarding
+    redirect_to '/' unless ::Redis::Alfred.get(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING)
+  end
+end

app/controllers/platform/api/v1/account_users_controller.rb

@@ -0,0 +1,29 @@
+class Platform::Api::V1::AccountUsersController < PlatformController
+  before_action :set_resource
+  before_action :validate_platform_app_permissible
+
+  def index
+    render json: @resource.account_users
+  end
+
+  def create
+    @account_user = @resource.account_users.find_or_initialize_by(user_id: account_user_params[:user_id])
+    @account_user.update!(account_user_params)
+    render json: @account_user
+  end
+
+  def destroy
+    @resource.account_users.find_by(user_id: account_user_params[:user_id])&.destroy
+    head :ok
+  end
+
+  private
+
+  def set_resource
+    @resource = Account.find(params[:account_id])
+  end
+
+  def account_user_params
+    params.permit(:user_id, :role)
+  end
+end

app/controllers/platform/api/v1/accounts_controller.rb

@@ -0,0 +1,32 @@
+class Platform::Api::V1::AccountsController < PlatformController
+  def create
+    @resource = Account.new(account_params)
+    @resource.save!
+    @platform_app.platform_app_permissibles.find_or_create_by(permissible: @resource)
+    render json: @resource
+  end
+
+  def show
+    render json: @resource
+  end
+
+  def update
+    @resource.update!(account_params)
+    render json: @resource
+  end
+
+  def destroy
+    # TODO: obfusicate account
+    head :ok
+  end
+
+  private
+
+  def set_resource
+    @resource = Account.find(params[:id])
+  end
+
+  def account_params
+    params.permit(:name)
+  end
+end

app/controllers/platform/api/v1/agent_bots_controller.rb

@@ -0,0 +1,35 @@
+class Platform::Api::V1::AgentBotsController < PlatformController
+  before_action :set_resource, except: [:index, :create]
+  before_action :validate_platform_app_permissible, except: [:index, :create]
+
+  def index
+    @resources = @platform_app.platform_app_permissibles.where(permissible_type: 'AgentBot').all
+  end
+
+  def create
+    @resource = AgentBot.new(agent_bot_params)
+    @resource.save!
+    @platform_app.platform_app_permissibles.find_or_create_by(permissible: @resource)
+  end
+
+  def show; end
+
+  def update
+    @resource.update!(agent_bot_params)
+  end
+
+  def destroy
+    @resource.destroy!
+    head :ok
+  end
+
+  private
+
+  def set_resource
+    @resource = AgentBot.find(params[:id])
+  end
+
+  def agent_bot_params
+    params.permit(:name, :description, :account_id, :outgoing_url)
+  end
+end

app/controllers/platform/api/v1/users_controller.rb

@@ -0,0 +1,39 @@
+class Platform::Api::V1::UsersController < PlatformController
+  # ref: https://stackoverflow.com/a/45190318/939299
+  # set resource is called for other actions already in platform controller
+  # we want to add login to that chain as well
+  before_action(only: [:login]) { set_resource }
+  before_action(only: [:login]) { validate_platform_app_permissible }
+
+  def create
+    @resource = (User.find_by(email: user_params[:email]) || User.new(user_params))
+    @resource.confirm
+    @resource.save!
+    @platform_app.platform_app_permissibles.find_or_create_by(permissible: @resource)
+  end
+
+  def login
+    render json: { url: "#{ENV['FRONTEND_URL']}/app/login?email=#{@resource.email}&sso_auth_token=#{@resource.generate_sso_auth_token}" }
+  end
+
+  def show; end
+
+  def update
+    @resource.update!(user_params)
+  end
+
+  def destroy
+    # TODO: obfusicate user
+    head :ok
+  end
+
+  private
+
+  def set_resource
+    @resource = User.find(params[:id])
+  end
+
+  def user_params
+    params.permit(:name, :email, :password)
+  end
+end

app/controllers/platform_controller.rb

@@ -0,0 +1,35 @@
+class PlatformController < ActionController::API
+  before_action :ensure_access_token
+  before_action :set_platform_app
+  before_action :set_resource, only: [:update, :show, :destroy]
+  before_action :validate_platform_app_permissible, only: [:update, :show, :destroy]
+
+  def show; end
+
+  def update; end
+
+  def destroy; end
+
+  private
+
+  def ensure_access_token
+    token = request.headers[:api_access_token] || request.headers[:HTTP_API_ACCESS_TOKEN]
+    @access_token = AccessToken.find_by(token: token) if token.present?
+  end
+
+  def set_platform_app
+    @platform_app = @access_token.owner if @access_token && @access_token.owner.is_a?(PlatformApp)
+    render json: { error: 'Invalid access_token' }, status: :unauthorized if @platform_app.blank?
+  end
+
+  def set_resource
+    # set @resource in your controller
+    raise 'Overwrite this method your controller'
+  end
+
+  def validate_platform_app_permissible
+    return if @platform_app.platform_app_permissibles.find_by(permissible: @resource)
+
+    render json: { error: 'Non permissible resource' }, status: :unauthorized
+  end
+end

app/controllers/public/api/v1/inboxes/contacts_controller.rb

@@ -0,0 +1,48 @@
+class Public::Api::V1::Inboxes::ContactsController < Public::Api::V1::InboxesController
+  before_action :contact_inbox, except: [:create]
+  before_action :process_hmac
+
+  def create
+    source_id = params[:source_id] || SecureRandom.uuid
+    @contact_inbox = ::ContactBuilder.new(
+      source_id: source_id,
+      inbox: @inbox_channel.inbox,
+      contact_attributes: permitted_params.except(:identifier, :identifier_hash)
+    ).perform
+  end
+
+  def show; end
+
+  def update
+    contact_identify_action = ContactIdentifyAction.new(
+      contact: @contact_inbox.contact,
+      params: permitted_params.to_h.deep_symbolize_keys.except(:identifier)
+    )
+    render json: contact_identify_action.perform
+  end
+
+  private
+
+  def contact_inbox
+    @contact_inbox = @inbox_channel.inbox.contact_inboxes.find_by!(source_id: params[:id])
+  end
+
+  def process_hmac
+    return if params[:identifier_hash].blank? && !@inbox_channel.hmac_mandatory
+    raise StandardError, 'HMAC failed: Invalid Identifier Hash Provided' unless valid_hmac?
+
+    @contact_inbox.update(hmac_verified: true) if @contact_inbox.present?
+  end
+
+  def valid_hmac?
+    params[:identifier_hash] == OpenSSL::HMAC.hexdigest(
+      'sha256',
+      @inbox_channel.hmac_token,
+      params[:identifier].to_s
+    )
+  end
+
+  def permitted_params
+    params.permit(:identifier, :identifier_hash, :email, :name, :avatar_url, custom_attributes: {})
+  end
+end

app/controllers/public/api/v1/inboxes/conversations_controller.rb

@@ -0,0 +1,24 @@
+class Public::Api::V1::Inboxes::ConversationsController < Public::Api::V1::InboxesController
+  def index
+    @conversations = @contact_inbox.hmac_verified? ? @contact.conversations : @contact_inbox.conversations
+  end
+
+  def create
+    @conversation = create_conversation
+  end
+
+  private
+
+  def create_conversation
+    ::Conversation.create!(conversation_params)
+  end
+
+  def conversation_params
+    {
+      account_id: @contact_inbox.contact.account_id,
+      inbox_id: @contact_inbox.inbox_id,
+      contact_id: @contact_inbox.contact_id,
+      contact_inbox_id: @contact_inbox.id
+    }
+  end
+end

app/controllers/public/api/v1/inboxes/messages_controller.rb

@@ -0,0 +1,68 @@
+class Public::Api::V1::Inboxes::MessagesController < Public::Api::V1::InboxesController
+  before_action :set_message, only: [:update]
+
+  def index
+    @messages = @conversation.nil? ? [] : message_finder.perform
+  end
+
+  def create
+    @message = @conversation.messages.new(message_params)
+    @message.save
+    build_attachment
+  end
+
+  def update
+    @message.update!(message_update_params)
+  rescue StandardError => e
+    render json: { error: @contact.errors, message: e.message }.to_json, status: 500
+  end
+
+  private
+
+  def build_attachment
+    return if params[:attachments].blank?
+
+    params[:attachments].each do |uploaded_attachment|
+      attachment = @message.attachments.new(
+        account_id: @message.account_id,
+        file_type: helpers.file_type(uploaded_attachment&.content_type)
+      )
+      attachment.file.attach(uploaded_attachment)
+    end
+    @message.save!
+  end
+
+  def message_finder_params
+    {
+      filter_internal_messages: true,
+      before: params[:before]
+    }
+  end
+
+  def message_finder
+    @message_finder ||= MessageFinder.new(@conversation, message_finder_params)
+  end
+
+  def message_update_params
+    params.permit(submitted_values: [:name, :title, :value])
+  end
+
+  def permitted_params
+    params.permit(:content, :echo_id)
+  end
+
+  def set_message
+    @message = @conversation.messages.find(params[:id])
+  end
+
+  def message_params
+    {
+      account_id: @conversation.account_id,
+      sender: @contact_inbox.contact,
+      content: permitted_params[:content],
+      inbox_id: @conversation.inbox_id,
+      echo_id: permitted_params[:echo_id],
+      message_type: :incoming
+    }
+  end
+end