Files
6c67eb9ba0 fix(notifications): Respect conversation access when notifying agents (#14412)
Agents with limited custom roles were receiving notifications (creation,
assignment, mentions, new messages, SLA) for conversations they couldn't
actually open. For example, an agent whose custom role only grants
`conversation_unassigned_manage` was getting notified about
conversations assigned to other agents.

Notifications now go through the same `ConversationPolicy#show?` check
that gates the conversation view itself, so an agent only gets notified
for conversations they're permitted to see. Administrators and agents
without custom roles are unaffected.

---------

Co-authored-by: Sojan Jose <sojan@pepalo.com>
Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
2026-05-12 10:57:29 +04:00

75 lines
2.2 KiB
Ruby

class Messages::MentionService
pattr_initialize [:message!]
def perform
return unless valid_mention_message?(message)
validated_mentioned_ids = filter_mentioned_ids_by_inbox
return if validated_mentioned_ids.blank?
Conversations::UserMentionJob.perform_later(validated_mentioned_ids, message.conversation.id, message.account.id)
add_mentioned_users_as_participants(validated_mentioned_ids)
generate_notifications_for_mentions(validated_mentioned_ids)
end
private
def valid_mention_message?(message)
message.private? && message.content.present? && mentioned_ids.present?
end
def mentioned_ids
user_mentions = message.content.scan(%r{\(mention://user/(\d+)/(.+?)\)}).map(&:first)
team_mentions = message.content.scan(%r{\(mention://team/(\d+)/(.+?)\)}).map(&:first)
expanded_user_ids = expand_team_mentions_to_users(team_mentions)
(user_mentions + expanded_user_ids).uniq
end
def expand_team_mentions_to_users(team_ids)
return [] if team_ids.blank?
message.inbox.account.teams
.joins(:team_members)
.where(id: team_ids)
.pluck('team_members.user_id')
.map(&:to_s)
end
def valid_mentionable_user_ids
@valid_mentionable_user_ids ||= begin
inbox = message.inbox
inbox.account.administrators.pluck(:id) + inbox.members.pluck(:id)
end
end
def filter_mentioned_ids_by_inbox
mentioned_ids & valid_mentionable_user_ids.map(&:to_s)
end
def generate_notifications_for_mentions(validated_mentioned_ids)
validated_mentioned_ids.each do |user_id|
next if self_mention?(user_id)
NotificationBuilder.new(
notification_type: 'conversation_mention',
user: User.find(user_id),
account: message.account,
primary_actor: message.conversation,
secondary_actor: message
).perform
end
end
def self_mention?(user_id)
message.sender_type == 'User' && user_id.to_i == message.sender_id
end
def add_mentioned_users_as_participants(validated_mentioned_ids)
validated_mentioned_ids.each do |user_id|
message.conversation.conversation_participants.find_or_create_by(user_id: user_id)
end
end
end