49c442751d
## Summary Restricts account-wide Dashboard App creation, updates, and deletion to administrators while keeping read access available to authenticated account users. ## Why Dashboard Apps are account-level integrations displayed in conversation views. Agents should be able to use them, but only administrators should be able to change their configuration. ## What changed - authorize Dashboard App actions through `DashboardAppPolicy` - allow index and show access for authenticated account users - restrict create, update, and destroy actions to administrators - add request coverage for administrator and agent mutation behavior ## Validation `bundle exec rspec spec/controllers/api/v1/accounts/dashboard_apps_controller_spec.rb` 17 examples, 0 failures. `bundle exec rubocop app/controllers/api/v1/accounts/dashboard_apps_controller.rb app/policies/dashboard_app_policy.rb` 2 files inspected, no offenses detected. --------- Co-authored-by: Gaurav Singhal <gauravsinghal@Gauravs-Mac-mini.local> Co-authored-by: Sojan Jose <sojan@pepalo.com>
46 lines
940 B
Ruby
46 lines
940 B
Ruby
class Api::V1::Accounts::DashboardAppsController < Api::V1::Accounts::BaseController
|
|
before_action :check_authorization
|
|
before_action :fetch_dashboard_apps, except: [:create]
|
|
before_action :fetch_dashboard_app, only: [:show, :update, :destroy]
|
|
|
|
def index; end
|
|
|
|
def show; end
|
|
|
|
def create
|
|
@dashboard_app = Current.account.dashboard_apps.create!(
|
|
permitted_payload.merge(user_id: Current.user.id)
|
|
)
|
|
end
|
|
|
|
def update
|
|
@dashboard_app.update!(permitted_payload)
|
|
end
|
|
|
|
def destroy
|
|
@dashboard_app.destroy!
|
|
head :no_content
|
|
end
|
|
|
|
private
|
|
|
|
def fetch_dashboard_apps
|
|
@dashboard_apps = Current.account.dashboard_apps
|
|
end
|
|
|
|
def fetch_dashboard_app
|
|
@dashboard_app = @dashboard_apps.find(permitted_params[:id])
|
|
end
|
|
|
|
def permitted_payload
|
|
params.require(:dashboard_app).permit(
|
|
:title,
|
|
content: [:url, :type]
|
|
)
|
|
end
|
|
|
|
def permitted_params
|
|
params.permit(:id)
|
|
end
|
|
end
|