Sojan JoseandGitHub
eae9841eb4
Token-authenticated requests to Agent Bots, Labels, and affected Captain endpoints return normal responses again. The regression was caused by duplicate `current_account` callbacks in subclasses moving account resolution behind the API entitlement check, leaving `Current.account` unset. ## Closes - https://linear.app/chatwoot/issue/CW-7641/5xx-errors-in-agent-bot-apis ## How to reproduce 1. Send `GET /api/v1/accounts/:account_id/agent_bots` with a valid administrator API access token. 2. Observe a `500` from `validate_token_api_access` because `Current.account` is `nil`. 3. With this change, account resolution runs in the base-controller order and the request succeeds. ## What changed - Removed redundant `current_account` callbacks from account-scoped controllers that already inherit the callback from `Api::V1::Accounts::BaseController`. - Kept the standalone direct-upload controller callback unchanged. - Added regression coverage for administrator API-token access to Agent Bots.
39 lines
962 B
Ruby
39 lines
962 B
Ruby
class Api::V1::Accounts::Captain::InboxesController < Api::V1::Accounts::BaseController
|
|
before_action -> { check_authorization(Captain::Assistant) }
|
|
|
|
before_action :set_assistant
|
|
def index
|
|
@inboxes = @assistant.inboxes
|
|
end
|
|
|
|
def create
|
|
inbox = Current.account.inboxes.find(assistant_params[:inbox_id])
|
|
@captain_inbox = @assistant.captain_inboxes.build(inbox: inbox)
|
|
@captain_inbox.save!
|
|
end
|
|
|
|
def destroy
|
|
@captain_inbox = @assistant.captain_inboxes.find_by!(inbox_id: permitted_params[:inbox_id])
|
|
@captain_inbox.destroy!
|
|
head :no_content
|
|
end
|
|
|
|
private
|
|
|
|
def set_assistant
|
|
@assistant = account_assistants.find(permitted_params[:assistant_id])
|
|
end
|
|
|
|
def account_assistants
|
|
@account_assistants ||= Current.account.captain_assistants
|
|
end
|
|
|
|
def permitted_params
|
|
params.permit(:assistant_id, :id, :account_id, :inbox_id)
|
|
end
|
|
|
|
def assistant_params
|
|
params.require(:inbox).permit(:inbox_id)
|
|
end
|
|
end
|