diff --git a/app/controllers/concerns/ensure_current_account_helper.rb b/app/controllers/concerns/ensure_current_account_helper.rb index eb781dbfe..5d02e96c8 100644 --- a/app/controllers/concerns/ensure_current_account_helper.rb +++ b/app/controllers/concerns/ensure_current_account_helper.rb @@ -8,7 +8,7 @@ module EnsureCurrentAccountHelper def ensure_current_account account = Account.find(params[:account_id]) - ensure_account_is_active?(account) + render_unauthorized('Account is suspended') and return unless account.active? if current_user account_accessible_for_user?(account) @@ -27,8 +27,4 @@ module EnsureCurrentAccountHelper def account_accessible_for_bot?(account) render_unauthorized('You are not authorized to access this account') unless @resource.agent_bot_inboxes.find_by(account_id: account.id) end - - def ensure_account_is_active?(account) - render_unauthorized('Account is suspended') unless account.active? - end end diff --git a/spec/controllers/api/base_controller_spec.rb b/spec/controllers/api/base_controller_spec.rb index f3cb98a92..c0230240e 100644 --- a/spec/controllers/api/base_controller_spec.rb +++ b/spec/controllers/api/base_controller_spec.rb @@ -67,6 +67,18 @@ RSpec.describe 'API Base', type: :request do expect(response).to have_http_status(:unauthorized) end + + # this exception occured in a client instance (DoubleRender error) + it 'will not throw exception if user does not have access to suspended account' do + user_with_out_access = create(:user) + account.update!(status: :suspended) + + post "/api/v1/accounts/#{account.id}/canned_responses", + headers: { api_access_token: user_with_out_access.access_token.token }, + as: :json + + expect(response).to have_http_status(:unauthorized) + end end end end