95463230cb
Account webhooks sign outgoing payloads with HMAC-SHA256, but agent bot and API inbox webhooks were delivered unsigned. This PR adds the same signing to both. Each model gets a dedicated `secret` column rather than reusing the agent bot's `access_token` (for API auth back into Chatwoot) or the API inbox's `hmac_token` (for inbound contact identity verification). These serve different trust boundaries and shouldn't be coupled — rotating a signing secret shouldn't invalidate API access or contact verification. The existing `Webhooks::Trigger` already signs when a secret is present, so the backend change is just passing `secret:` through to the jobs. Shared token logic is extracted into a `WebhookSecretable` concern included by `Webhook`, `AgentBot`, and `Channel::Api`. The frontend reuses the existing `AccessToken` component for secret display. Secrets are admin-only and excluded from enterprise audit logs. ### How to test Point an agent bot or API inbox webhook URL at a request inspector. Send a message and verify `X-Chatwoot-Signature` and `X-Chatwoot-Timestamp` headers are present. Reset the secret from settings and confirm subsequent deliveries use the new value. --------- Co-authored-by: Sojan Jose <sojan@pepalo.com>
58 lines
1.3 KiB
JavaScript
58 lines
1.3 KiB
JavaScript
/* global axios */
|
|
import CacheEnabledApiClient from './CacheEnabledApiClient';
|
|
|
|
class Inboxes extends CacheEnabledApiClient {
|
|
constructor() {
|
|
super('inboxes', { accountScoped: true });
|
|
}
|
|
|
|
// eslint-disable-next-line class-methods-use-this
|
|
get cacheModelName() {
|
|
return 'inbox';
|
|
}
|
|
|
|
getCampaigns(inboxId) {
|
|
return axios.get(`${this.url}/${inboxId}/campaigns`);
|
|
}
|
|
|
|
deleteInboxAvatar(inboxId) {
|
|
return axios.delete(`${this.url}/${inboxId}/avatar`);
|
|
}
|
|
|
|
getAgentBot(inboxId) {
|
|
return axios.get(`${this.url}/${inboxId}/agent_bot`);
|
|
}
|
|
|
|
setAgentBot(inboxId, botId) {
|
|
return axios.post(`${this.url}/${inboxId}/set_agent_bot`, {
|
|
agent_bot: botId,
|
|
});
|
|
}
|
|
|
|
syncTemplates(inboxId) {
|
|
return axios.post(`${this.url}/${inboxId}/sync_templates`);
|
|
}
|
|
|
|
createCSATTemplate(inboxId, template) {
|
|
return axios.post(`${this.url}/${inboxId}/csat_template`, {
|
|
template,
|
|
});
|
|
}
|
|
|
|
getCSATTemplateStatus(inboxId) {
|
|
return axios.get(`${this.url}/${inboxId}/csat_template`);
|
|
}
|
|
|
|
analyzeCSATTemplateUtility(inboxId, template) {
|
|
return axios.post(`${this.url}/${inboxId}/csat_template/analyze`, {
|
|
template,
|
|
});
|
|
}
|
|
|
|
resetSecret(inboxId) {
|
|
return axios.post(`${this.url}/${inboxId}/reset_secret`);
|
|
}
|
|
}
|
|
|
|
export default new Inboxes();
|