Shivam MishraandGitHub
8dd0d08322
Conversation attachment uploads now go through the same authentication that every other account-scoped API endpoint uses. Agents continue to attach files exactly as before, and the upload request is now tied to the agent's dashboard session instead of a separately serialized access token. Because the upload request is now authenticated, the dashboard proves the agent's session directly instead of passing `currentUser.access_token`. This keeps uploads working alongside the profile access-token changes in #14973, including on accounts where that token is serialized as empty. ## What changed - `Api::V1::Accounts::Conversations::DirectUploadsController` now runs the standard account auth stack: API access token when the `api_access_token` header is present, dashboard session (devise-token-auth) otherwise, with agent-bot tokens rejected. Previously it inherited `ActiveStorage::DirectUploadsController` directly and did not run any authentication. - `EnsureCurrentAccountHelper#ensure_current_account` now returns `401` when a request has neither an authenticated user nor a bot resource, instead of continuing. This closes the same gap for any controller that relies on the helper. - The dashboard direct-upload paths (`useFileUpload.js` and the legacy `fileUploadMixin.js`) now attach the agent's session headers to the upload request via a new `directUploadsHelper.js`, instead of sending `currentUser.access_token`. ## How to test 1. As a logged-in agent, open a conversation and attach a file. Upload should succeed as before, on installs with direct uploads enabled. 2. Confirm attachments still work for an agent on an account whose profile access token is not serialized (e.g. a Cloud plan without `api_and_webhooks`). 3. Send a `POST` to `/api/v1/accounts/:account_id/conversations/:conversation_id/direct_uploads` with no credentials, an empty `api_access_token`, or an invalid token, and confirm it returns `401`. 4. Confirm a valid agent of the account (via API token or session) gets `200`, while an agent of a different account gets `401`.
39 lines
1.3 KiB
Ruby
39 lines
1.3 KiB
Ruby
class Api::V1::Accounts::Conversations::DirectUploadsController < ActiveStorage::DirectUploadsController
|
|
include DeviseTokenAuth::Concerns::SetUserByToken
|
|
include RequestExceptionHandler
|
|
include AccessTokenAuthHelper
|
|
include EnsureCurrentAccountHelper
|
|
|
|
skip_before_action :verify_authenticity_token, if: :authenticate_by_access_token?
|
|
|
|
around_action :handle_with_exception
|
|
before_action :authenticate_access_token!, if: :authenticate_by_access_token?
|
|
before_action :validate_bot_access_token!, if: :authenticate_by_access_token?
|
|
before_action :authenticate_user!, unless: :authenticate_by_access_token?
|
|
before_action :current_account
|
|
before_action :validate_token_api_access, if: :authenticate_by_access_token?
|
|
before_action :conversation
|
|
|
|
def create
|
|
return if @conversation.nil? || @current_account.nil?
|
|
|
|
super
|
|
end
|
|
|
|
private
|
|
|
|
def authenticate_by_access_token?
|
|
request.headers[:api_access_token].present? || request.headers[:HTTP_API_ACCESS_TOKEN].present?
|
|
end
|
|
|
|
def validate_token_api_access
|
|
return if Current.account.api_and_webhooks_enabled?
|
|
|
|
render json: { error: 'API access is not enabled for this account' }, status: :forbidden
|
|
end
|
|
|
|
def conversation
|
|
@conversation ||= Current.account.conversations.find_by(display_id: params[:conversation_id])
|
|
end
|
|
end
|