Conversation attachment uploads now go through the same authentication that every other account-scoped API endpoint uses. Agents continue to attach files exactly as before, and the upload request is now tied to the agent's dashboard session instead of a separately serialized access token. Because the upload request is now authenticated, the dashboard proves the agent's session directly instead of passing `currentUser.access_token`. This keeps uploads working alongside the profile access-token changes in #14973, including on accounts where that token is serialized as empty. ## What changed - `Api::V1::Accounts::Conversations::DirectUploadsController` now runs the standard account auth stack: API access token when the `api_access_token` header is present, dashboard session (devise-token-auth) otherwise, with agent-bot tokens rejected. Previously it inherited `ActiveStorage::DirectUploadsController` directly and did not run any authentication. - `EnsureCurrentAccountHelper#ensure_current_account` now returns `401` when a request has neither an authenticated user nor a bot resource, instead of continuing. This closes the same gap for any controller that relies on the helper. - The dashboard direct-upload paths (`useFileUpload.js` and the legacy `fileUploadMixin.js`) now attach the agent's session headers to the upload request via a new `directUploadsHelper.js`, instead of sending `currentUser.access_token`. ## How to test 1. As a logged-in agent, open a conversation and attach a file. Upload should succeed as before, on installs with direct uploads enabled. 2. Confirm attachments still work for an agent on an account whose profile access token is not serialized (e.g. a Cloud plan without `api_and_webhooks`). 3. Send a `POST` to `/api/v1/accounts/:account_id/conversations/:conversation_id/direct_uploads` with no credentials, an empty `api_access_token`, or an invalid token, and confirm it returns `401`. 4. Confirm a valid agent of the account (via API token or session) gets `200`, while an agent of a different account gets `401`.
119 lines
3.3 KiB
JavaScript
119 lines
3.3 KiB
JavaScript
import { useMapGetter } from 'dashboard/composables/store';
|
|
import { useAlert } from 'dashboard/composables';
|
|
import { useI18n } from 'vue-i18n';
|
|
import { DirectUpload } from 'activestorage';
|
|
import { setDirectUploadAuthHeaders } from 'dashboard/helper/directUploadsHelper';
|
|
import { checkFileSizeLimit } from 'shared/helpers/FileHelper';
|
|
import { getMaxUploadSizeByChannel } from '@chatwoot/utils';
|
|
import {
|
|
DEFAULT_MAXIMUM_FILE_UPLOAD_SIZE,
|
|
resolveMaximumFileUploadSize,
|
|
} from 'shared/helpers/FileHelper';
|
|
import { INBOX_TYPES } from 'dashboard/helper/inbox';
|
|
|
|
/**
|
|
* Composable for handling file uploads in conversations
|
|
* @param {Object} options
|
|
* @param {Object} options.inbox - Current inbox object (has channel_type, medium, etc.)
|
|
* @param {Function} options.attachFile - Callback to handle file attachment
|
|
* @param {boolean} options.isPrivateNote - Whether the upload is for a private note
|
|
*/
|
|
export const useFileUpload = ({ inbox, attachFile, isPrivateNote = false }) => {
|
|
const { t } = useI18n();
|
|
|
|
const accountId = useMapGetter('getCurrentAccountId');
|
|
const currentChat = useMapGetter('getSelectedChat');
|
|
const globalConfig = useMapGetter('globalConfig/get');
|
|
|
|
const installationLimit = resolveMaximumFileUploadSize(
|
|
globalConfig.value?.maximumFileUploadSize
|
|
);
|
|
|
|
// helper: compute max upload size for a given file's mime
|
|
const maxSizeFor = mime => {
|
|
// Use default/installation limit for private notes
|
|
if (isPrivateNote) {
|
|
return installationLimit;
|
|
}
|
|
|
|
const channelType = inbox?.channel_type;
|
|
|
|
if (!channelType || channelType === INBOX_TYPES.WEB) {
|
|
return installationLimit;
|
|
}
|
|
|
|
const channelLimit = getMaxUploadSizeByChannel({
|
|
channelType,
|
|
medium: inbox?.medium, // e.g. 'sms' | 'whatsapp' | etc.
|
|
mime, // e.g. 'image/png'
|
|
});
|
|
|
|
if (channelLimit === DEFAULT_MAXIMUM_FILE_UPLOAD_SIZE) {
|
|
return installationLimit;
|
|
}
|
|
|
|
return Math.min(channelLimit, installationLimit);
|
|
};
|
|
|
|
const alertOverLimit = maxSizeMB =>
|
|
useAlert(
|
|
t('CONVERSATION.FILE_SIZE_LIMIT', {
|
|
MAXIMUM_SUPPORTED_FILE_UPLOAD_SIZE: maxSizeMB,
|
|
})
|
|
);
|
|
|
|
const handleDirectFileUpload = file => {
|
|
if (!file) return;
|
|
|
|
const mime = file.file?.type || file.type;
|
|
const maxSizeMB = maxSizeFor(mime);
|
|
|
|
if (!checkFileSizeLimit(file, maxSizeMB)) {
|
|
alertOverLimit(maxSizeMB);
|
|
return;
|
|
}
|
|
|
|
const upload = new DirectUpload(
|
|
file.file,
|
|
`/api/v1/accounts/${accountId.value}/conversations/${currentChat.value.id}/direct_uploads`,
|
|
{
|
|
directUploadWillCreateBlobWithXHR: xhr => {
|
|
setDirectUploadAuthHeaders(xhr);
|
|
},
|
|
}
|
|
);
|
|
|
|
upload.create((error, blob) => {
|
|
if (error) {
|
|
useAlert(error);
|
|
} else {
|
|
attachFile({ file, blob });
|
|
}
|
|
});
|
|
};
|
|
|
|
const handleIndirectFileUpload = file => {
|
|
if (!file) return;
|
|
|
|
const mime = file.file?.type || file.type;
|
|
const maxSizeMB = maxSizeFor(mime);
|
|
|
|
if (!checkFileSizeLimit(file, maxSizeMB)) {
|
|
alertOverLimit(maxSizeMB);
|
|
return;
|
|
}
|
|
|
|
attachFile({ file });
|
|
};
|
|
|
|
const onFileUpload = file => {
|
|
if (globalConfig.value.directUploadsEnabled) {
|
|
handleDirectFileUpload(file);
|
|
} else {
|
|
handleIndirectFileUpload(file);
|
|
}
|
|
};
|
|
|
|
return { onFileUpload };
|
|
};
|