Non-admin agents could delete an account's Linear, Notion, or Shopify integration through the dedicated integration endpoints, which — unlike the generic hooks endpoint — never checked the caller's role. This restores the intended admin-only boundary for removing an integration. ## Closes - https://linear.app/chatwoot/issue/CW-7383 - https://linear.app/chatwoot/issue/CW-7384 - https://linear.app/chatwoot/issue/CW-7189 ## How to reproduce As a non-admin **agent**, `DELETE /api/v1/accounts/:id/integrations/{linear,notion,shopify}` returned `200` and removed the account-wide integration. After this change it returns `401` and the integration is preserved; administrators can still remove it. ## What changed - Route integration-hook deletion through `HookPolicy` (admin-only) via a shared `Integrations::BaseController`, matching the generic hooks controller. Co-authored-by: Vishnu Narayanan <iamwishnu@gmail.com>
42 lines
1.0 KiB
Ruby
42 lines
1.0 KiB
Ruby
class Api::V1::Accounts::Integrations::HooksController < Api::V1::Accounts::Integrations::BaseController
|
|
before_action :fetch_hook, except: [:create]
|
|
before_action :check_authorization
|
|
|
|
def create
|
|
@hook = Current.account.hooks.create!(permitted_params)
|
|
end
|
|
|
|
def update
|
|
@hook.update!(permitted_params.slice(:status, :settings))
|
|
end
|
|
|
|
def process_event
|
|
response = @hook.process_event(params[:event])
|
|
|
|
# for cases like an invalid event, or when conversation does not have enough messages
|
|
# for a label suggestion, the response is nil
|
|
if response.nil?
|
|
render json: { message: nil }
|
|
elsif response[:error]
|
|
render json: { error: response[:error] }, status: :unprocessable_entity
|
|
else
|
|
render json: { message: response[:message] }
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
@hook.destroy!
|
|
head :ok
|
|
end
|
|
|
|
private
|
|
|
|
def fetch_hook
|
|
@hook = Current.account.hooks.find(params[:id])
|
|
end
|
|
|
|
def permitted_params
|
|
params.require(:hook).permit(:app_id, :inbox_id, :status, settings: {})
|
|
end
|
|
end
|