105 lines
3.0 KiB
Ruby
105 lines
3.0 KiB
Ruby
# TODO : Delete this and associated spec once 'api/widget/config' end point is merged
|
|
class WidgetsController < ActionController::Base
|
|
include WidgetHelper
|
|
|
|
before_action :set_global_config
|
|
before_action :set_web_widget
|
|
before_action :ensure_account_is_active
|
|
before_action :ensure_inbox_active
|
|
before_action :ensure_location_is_supported
|
|
before_action :set_token
|
|
before_action :set_contact
|
|
before_action :build_contact
|
|
after_action :allow_iframe_requests
|
|
|
|
private
|
|
|
|
def set_global_config
|
|
@global_config = GlobalConfig.get(
|
|
'LOGO_THUMBNAIL',
|
|
'BRAND_NAME',
|
|
'WIDGET_BRAND_URL',
|
|
'DIRECT_UPLOADS_ENABLED',
|
|
'MAXIMUM_FILE_UPLOAD_SIZE',
|
|
'INSTALLATION_NAME'
|
|
)
|
|
end
|
|
|
|
def set_web_widget
|
|
@web_widget = ::Channel::WebWidget.find_by!(website_token: permitted_params[:website_token])
|
|
rescue ActiveRecord::RecordNotFound
|
|
Rails.logger.error('web widget does not exist')
|
|
render json: { error: 'web widget does not exist' }, status: :not_found
|
|
end
|
|
|
|
def set_token
|
|
@token = permitted_params[:cw_conversation]
|
|
@auth_token_params = if @token.present?
|
|
::Widget::TokenService.new(token: @token).decode_token
|
|
else
|
|
{}
|
|
end
|
|
end
|
|
|
|
def set_contact
|
|
return if @auth_token_params[:source_id].nil?
|
|
|
|
@contact_inbox = ::ContactInbox.find_by(
|
|
inbox_id: @web_widget.inbox.id,
|
|
source_id: @auth_token_params[:source_id]
|
|
)
|
|
|
|
@contact = @contact_inbox&.contact
|
|
end
|
|
|
|
def build_contact
|
|
return if @contact.present?
|
|
|
|
@contact_inbox, @token = build_contact_inbox_with_token(@web_widget, additional_attributes)
|
|
@contact = @contact_inbox.contact
|
|
end
|
|
|
|
def ensure_account_is_active
|
|
render json: { error: 'Account is suspended' }, status: :unauthorized unless @web_widget.inbox.account.active?
|
|
end
|
|
|
|
def ensure_inbox_active
|
|
head :not_found unless @web_widget.inbox.active?
|
|
end
|
|
|
|
def ensure_location_is_supported; end
|
|
|
|
def additional_attributes
|
|
if @web_widget.inbox.account.feature_enabled?('ip_lookup')
|
|
{ created_at_ip: request.remote_ip }
|
|
else
|
|
{}
|
|
end
|
|
end
|
|
|
|
def permitted_params
|
|
params.permit(:website_token, :cw_conversation)
|
|
end
|
|
|
|
def allow_iframe_requests
|
|
if @web_widget.allowed_domains.blank? || embedded_from_non_web_origin?
|
|
response.headers.delete('X-Frame-Options')
|
|
else
|
|
domains = @web_widget.allowed_domains.split(',').map(&:strip).join(' ')
|
|
response.headers['Content-Security-Policy'] = "frame-ancestors #{domains}"
|
|
end
|
|
end
|
|
|
|
# Mobile WebViews (iOS/Android) load content from file:// or null origins,
|
|
# which cannot match any domain in frame-ancestors. When the per-inbox flag
|
|
# is enabled, skip frame-ancestors for these requests.
|
|
def embedded_from_non_web_origin?
|
|
return false unless @web_widget.allow_mobile_webview?
|
|
|
|
origin = request.headers['Origin']
|
|
origin.blank? || origin == 'null' || origin&.start_with?('file://')
|
|
end
|
|
end
|
|
|
|
WidgetsController.prepend_mod_with('WidgetsController')
|