46 lines
2.2 KiB
Ruby
46 lines
2.2 KiB
Ruby
if local_assigns[:include_access_tokens]
|
|
# Withhold the full-scope token from callers who authenticated with a
|
|
# read-only token — otherwise GET /api/v1/profile would let a read-only
|
|
# holder lift the full token and bypass the scope gate entirely.
|
|
json.access_token resource.access_token&.token unless @access_token&.scope == 'read_only'
|
|
json.read_only_access_token resource.read_only_access_token&.token
|
|
end
|
|
json.account_id resource.active_account_user&.account_id
|
|
json.available_name resource.available_name
|
|
json.avatar_url resource.avatar_url
|
|
json.confirmed resource.confirmed?
|
|
json.display_name resource.display_name
|
|
json.message_signature resource.message_signature
|
|
json.email resource.email
|
|
json.hmac_identifier resource.hmac_identifier if GlobalConfig.get('CHATWOOT_INBOX_HMAC_KEY')['CHATWOOT_INBOX_HMAC_KEY'].present?
|
|
json.id resource.id
|
|
json.inviter_id resource.active_account_user&.inviter_id
|
|
json.name resource.name
|
|
json.provider resource.provider
|
|
# Withhold the pubsub token from read-only token holders — it authenticates
|
|
# RoomChannel without any API-token scope check, letting a caller write presence
|
|
# and stream live account events (a write the read-only scope must not grant).
|
|
json.pubsub_token resource.pubsub_token unless @access_token&.scope == 'read_only'
|
|
json.custom_attributes resource.custom_attributes if resource.custom_attributes.present?
|
|
json.role resource.active_account_user&.role
|
|
json.ui_settings resource.ui_settings
|
|
json.uid resource.uid
|
|
json.type resource.type
|
|
json.accounts do
|
|
json.array! resource.account_users do |account_user|
|
|
json.id account_user.account_id
|
|
json.name account_user.account.name
|
|
json.status account_user.account.status
|
|
json.onboarding_step account_user.account.onboarding_step
|
|
json.active_at account_user.active_at
|
|
json.role account_user.role
|
|
json.permissions account_user.permissions
|
|
# the actual availability user has configured
|
|
json.availability account_user.availability
|
|
# availability derived from presence
|
|
json.availability_status account_user.availability_status
|
|
json.auto_offline account_user.auto_offline
|
|
json.partial! 'api/v1/models/account_user', account_user: account_user if ChatwootApp.enterprise?
|
|
end
|
|
end
|