Sojan JoseandGitHub
eae9841eb4
Token-authenticated requests to Agent Bots, Labels, and affected Captain endpoints return normal responses again. The regression was caused by duplicate `current_account` callbacks in subclasses moving account resolution behind the API entitlement check, leaving `Current.account` unset. ## Closes - https://linear.app/chatwoot/issue/CW-7641/5xx-errors-in-agent-bot-apis ## How to reproduce 1. Send `GET /api/v1/accounts/:account_id/agent_bots` with a valid administrator API access token. 2. Observe a `500` from `validate_token_api_access` because `Current.account` is `nil`. 3. With this change, account resolution runs in the base-controller order and the request succeeds. ## What changed - Removed redundant `current_account` callbacks from account-scoped controllers that already inherit the callback from `Api::V1::Accounts::BaseController`. - Kept the standalone direct-upload controller callback unchanged. - Added regression coverage for administrator API-token access to Agent Bots.
43 lines
919 B
Ruby
43 lines
919 B
Ruby
class Api::V1::Accounts::LabelsController < Api::V1::Accounts::BaseController
|
|
before_action :fetch_label, except: [:index, :create]
|
|
before_action :check_authorization
|
|
|
|
def index
|
|
@labels = policy_scope(Current.account.labels)
|
|
end
|
|
|
|
def show; end
|
|
|
|
def create
|
|
@label = Current.account.labels.create!(permitted_params)
|
|
end
|
|
|
|
def update
|
|
@label.update!(permitted_params)
|
|
end
|
|
|
|
def destroy
|
|
label_title = @label.title
|
|
account_id = Current.account.id
|
|
label_deleted_at = Time.current
|
|
|
|
@label.destroy!
|
|
Labels::RemoveAssociationsJob.perform_later(
|
|
label_title: label_title,
|
|
account_id: account_id,
|
|
label_deleted_at: label_deleted_at
|
|
)
|
|
head :ok
|
|
end
|
|
|
|
private
|
|
|
|
def fetch_label
|
|
@label = Current.account.labels.find(params[:id])
|
|
end
|
|
|
|
def permitted_params
|
|
params.require(:label).permit(:title, :description, :color, :show_on_sidebar)
|
|
end
|
|
end
|