397b0bcc9d
Agent bot conversations now feel more natural because AgentBot tokens can toggle typing status, so end users see a live typing indicator in the widget while the bot is preparing a reply. This keeps the interaction responsive and human-like without weakening token authorization boundaries. ## Closes - https://github.com/chatwoot/chatwoot/issues/8928 - https://linear.app/chatwoot/issue/CW-5205 ## How to test 1. Open the widget and start a conversation as a customer. 2. Connect an AgentBot to the same inbox. 3. Trigger `toggle_typing_status` with the AgentBot token (`typing_status: on`). 4. Confirm the customer sees the typing indicator in the widget. 5. Trigger `toggle_typing_status` with `typing_status: off` and confirm the indicator disappears. ## What changed - Added `toggle_typing_status` to bot-accessible conversation endpoints. - Restricted bot-accessible endpoint usage to `AgentBot` token owners only (non-user tokens like `PlatformApp` remain unauthorized). - Updated typing status flow to preserve AgentBot identity in dispatch/broadcast paths. - Added request coverage for AgentBot success and PlatformApp unauthorized behavior. - Added Swagger documentation for `POST /api/v1/accounts/{account_id}/conversations/{conversation_id}/toggle_typing_status` and regenerated swagger artifacts.
40 lines
1.3 KiB
Ruby
40 lines
1.3 KiB
Ruby
module AccessTokenAuthHelper
|
|
BOT_ACCESSIBLE_ENDPOINTS = {
|
|
'api/v1/accounts/conversations' => %w[toggle_status toggle_typing_status toggle_priority create update custom_attributes],
|
|
'api/v1/accounts/conversations/messages' => ['create'],
|
|
'api/v1/accounts/conversations/assignments' => ['create']
|
|
}.freeze
|
|
|
|
def ensure_access_token
|
|
token = request.headers[:api_access_token] || request.headers[:HTTP_API_ACCESS_TOKEN]
|
|
@access_token = AccessToken.find_by(token: token) if token.present?
|
|
end
|
|
|
|
def authenticate_access_token!
|
|
ensure_access_token
|
|
render_unauthorized('Invalid Access Token') && return if @access_token.blank?
|
|
|
|
# NOTE: This ensures that current_user is set and available for the rest of the controller actions
|
|
@resource = @access_token.owner
|
|
Current.user = @resource if allowed_current_user_type?(@resource)
|
|
end
|
|
|
|
def allowed_current_user_type?(resource)
|
|
return true if resource.is_a?(User)
|
|
return true if resource.is_a?(AgentBot)
|
|
|
|
false
|
|
end
|
|
|
|
def validate_bot_access_token!
|
|
return if Current.user.is_a?(User)
|
|
return if @resource.is_a?(AgentBot) && agent_bot_accessible?
|
|
|
|
render_unauthorized('Access to this endpoint is not authorized for bots')
|
|
end
|
|
|
|
def agent_bot_accessible?
|
|
BOT_ACCESSIBLE_ENDPOINTS.fetch(params[:controller], []).include?(params[:action])
|
|
end
|
|
end
|