Sojan JoseandGitHub
0e07a27c74
Fixes https://linear.app/chatwoot/issue/CW-7559/inbox-limit-abuse ## Why The regular inbox API checked limits in the controller, but WhatsApp embedded signup creates inboxes through a service using `Inbox.create!`. That let Enterprise account inbox limits be skipped for embedded signup. ## What this change does - Adds an Inbox create-time validation hook in OSS and implements the limit check in the Enterprise Inbox module. - Removes the duplicate controller/helper limit check so the model is the single enforcement point. - Preserves the existing `402 Payment Required` API response for account inbox limit failures. - Keeps updates to existing inboxes allowed when an account is already at its inbox limit. ## Validation - `bundle exec rspec spec/controllers/api/v1/accounts/inboxes_controller_spec.rb spec/enterprise/models/inbox_spec.rb`
35 lines
1.1 KiB
Ruby
35 lines
1.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'rails_helper'
|
|
|
|
RSpec.describe 'Enterprise Callbacks API', type: :request do
|
|
describe 'POST /api/v1/accounts/{account.id}/callbacks/register_facebook_page' do
|
|
let(:account) { create(:account, limits: { inboxes: 1 }) }
|
|
let(:admin) { create(:user, account: account, role: :administrator) }
|
|
let(:params) do
|
|
{
|
|
user_access_token: 'user-token',
|
|
page_access_token: 'page-token',
|
|
page_id: '12345',
|
|
inbox_name: 'Facebook Inbox'
|
|
}
|
|
end
|
|
|
|
before do
|
|
create(:inbox, account: account)
|
|
end
|
|
|
|
it 'returns payment required before creating a Facebook channel when account inbox limit is reached' do
|
|
expect do
|
|
post "/api/v1/accounts/#{account.id}/callbacks/register_facebook_page",
|
|
headers: admin.create_new_auth_token,
|
|
params: params,
|
|
as: :json
|
|
end.not_to change(Channel::FacebookPage, :count)
|
|
|
|
expect(response).to have_http_status(:payment_required)
|
|
expect(response.parsed_body['error']).to eq('Account limit exceeded. Upgrade to a higher plan')
|
|
end
|
|
end
|
|
end
|