13db36609d
## Summary Keeps Agent Bot list and show access available to agents while restricting account bot access tokens to administrators. ## Why Agents need Agent Bot metadata for existing product workflows, but the bot access token can be replayed against bot-authorized APIs and should not be exposed to them. ## What changed - serialize `access_token` only for administrators - verify agents can read Agent Bot metadata without receiving the token - verify administrators still receive the token from index and show responses ## Validation `bundle exec rspec spec/controllers/api/v1/accounts/agent_bots_controller_spec.rb` 27 examples, 0 failures. Related follow-up: [CW-7595](https://linear.app/chatwoot/issue/CW-7595/standardize-one-time-credential-disclosure-across-chatwoot-apis) --------- Co-authored-by: Gaurav Singhal <gauravsinghal@Gauravs-Mac-mini.local> Co-authored-by: Sojan Jose <sojan@pepalo.com>
12 lines
533 B
Ruby
12 lines
533 B
Ruby
json.id resource.id
|
|
json.name resource.name
|
|
json.description resource.description
|
|
json.thumbnail resource.avatar_url
|
|
json.outgoing_url resource.outgoing_url unless resource.system_bot?
|
|
json.bot_type resource.bot_type
|
|
json.bot_config resource.bot_config
|
|
json.account_id resource.account_id
|
|
json.access_token resource.access_token if resource.access_token.present? && Current.account_user&.administrator?
|
|
json.secret resource.secret if !resource.system_bot? && Current.account_user&.administrator?
|
|
json.system_bot resource.system_bot?
|