Shivam MishraandGitHub
8dd0d08322
Conversation attachment uploads now go through the same authentication that every other account-scoped API endpoint uses. Agents continue to attach files exactly as before, and the upload request is now tied to the agent's dashboard session instead of a separately serialized access token. Because the upload request is now authenticated, the dashboard proves the agent's session directly instead of passing `currentUser.access_token`. This keeps uploads working alongside the profile access-token changes in #14973, including on accounts where that token is serialized as empty. ## What changed - `Api::V1::Accounts::Conversations::DirectUploadsController` now runs the standard account auth stack: API access token when the `api_access_token` header is present, dashboard session (devise-token-auth) otherwise, with agent-bot tokens rejected. Previously it inherited `ActiveStorage::DirectUploadsController` directly and did not run any authentication. - `EnsureCurrentAccountHelper#ensure_current_account` now returns `401` when a request has neither an authenticated user nor a bot resource, instead of continuing. This closes the same gap for any controller that relies on the helper. - The dashboard direct-upload paths (`useFileUpload.js` and the legacy `fileUploadMixin.js`) now attach the agent's session headers to the upload request via a new `directUploadsHelper.js`, instead of sending `currentUser.access_token`. ## How to test 1. As a logged-in agent, open a conversation and attach a file. Upload should succeed as before, on installs with direct uploads enabled. 2. Confirm attachments still work for an agent on an account whose profile access token is not serialized (e.g. a Cloud plan without `api_and_webhooks`). 3. Send a `POST` to `/api/v1/accounts/:account_id/conversations/:conversation_id/direct_uploads` with no credentials, an empty `api_access_token`, or an invalid token, and confirm it returns `401`. 4. Confirm a valid agent of the account (via API token or session) gets `200`, while an agent of a different account gets `401`.
36 lines
1.1 KiB
Ruby
36 lines
1.1 KiB
Ruby
module EnsureCurrentAccountHelper
|
|
private
|
|
|
|
def current_account
|
|
@current_account ||= ensure_current_account
|
|
Current.account = @current_account
|
|
end
|
|
|
|
def ensure_current_account
|
|
account = Account.find(params[:account_id])
|
|
render_unauthorized('Account is suspended') and return unless account.active?
|
|
|
|
if current_user
|
|
account_accessible_for_user?(account)
|
|
elsif @resource.is_a?(AgentBot)
|
|
account_accessible_for_bot?(account)
|
|
else
|
|
render_unauthorized(I18n.t('errors.account.not_authorized'))
|
|
end
|
|
account
|
|
end
|
|
|
|
def account_accessible_for_user?(account)
|
|
@current_account_user = account.account_users.find_by(user_id: current_user.id)
|
|
Current.account_user = @current_account_user
|
|
render_unauthorized(I18n.t('errors.account.not_authorized')) unless @current_account_user
|
|
end
|
|
|
|
def account_accessible_for_bot?(account)
|
|
return if @resource.account_id == account.id
|
|
return if @resource.agent_bot_inboxes.find_by(account_id: account.id)
|
|
|
|
render_unauthorized('Bot is not authorized to access this account')
|
|
end
|
|
end
|