49c442751d
## Summary Restricts account-wide Dashboard App creation, updates, and deletion to administrators while keeping read access available to authenticated account users. ## Why Dashboard Apps are account-level integrations displayed in conversation views. Agents should be able to use them, but only administrators should be able to change their configuration. ## What changed - authorize Dashboard App actions through `DashboardAppPolicy` - allow index and show access for authenticated account users - restrict create, update, and destroy actions to administrators - add request coverage for administrator and agent mutation behavior ## Validation `bundle exec rspec spec/controllers/api/v1/accounts/dashboard_apps_controller_spec.rb` 17 examples, 0 failures. `bundle exec rubocop app/controllers/api/v1/accounts/dashboard_apps_controller.rb app/policies/dashboard_app_policy.rb` 2 files inspected, no offenses detected. --------- Co-authored-by: Gaurav Singhal <gauravsinghal@Gauravs-Mac-mini.local> Co-authored-by: Sojan Jose <sojan@pepalo.com>
22 lines
268 B
Ruby
22 lines
268 B
Ruby
class DashboardAppPolicy < ApplicationPolicy
|
|
def index?
|
|
true
|
|
end
|
|
|
|
def show?
|
|
true
|
|
end
|
|
|
|
def create?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def update?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def destroy?
|
|
@account_user.administrator?
|
|
end
|
|
end
|