95463230cb
Account webhooks sign outgoing payloads with HMAC-SHA256, but agent bot and API inbox webhooks were delivered unsigned. This PR adds the same signing to both. Each model gets a dedicated `secret` column rather than reusing the agent bot's `access_token` (for API auth back into Chatwoot) or the API inbox's `hmac_token` (for inbound contact identity verification). These serve different trust boundaries and shouldn't be coupled — rotating a signing secret shouldn't invalidate API access or contact verification. The existing `Webhooks::Trigger` already signs when a secret is present, so the backend change is just passing `secret:` through to the jobs. Shared token logic is extracted into a `WebhookSecretable` concern included by `Webhook`, `AgentBot`, and `Channel::Api`. The frontend reuses the existing `AccessToken` component for secret display. Secrets are admin-only and excluded from enterprise audit logs. ### How to test Point an agent bot or API inbox webhook URL at a request inspector. Send a message and verify `X-Chatwoot-Signature` and `X-Chatwoot-Timestamp` headers are present. Reset the secret from settings and confirm subsequent deliveries use the new value. --------- Co-authored-by: Sojan Jose <sojan@pepalo.com>
56 lines
1.3 KiB
Ruby
56 lines
1.3 KiB
Ruby
class Api::V1::Accounts::AgentBotsController < Api::V1::Accounts::BaseController
|
|
before_action :current_account
|
|
before_action :check_authorization
|
|
before_action :agent_bot, except: [:index, :create]
|
|
|
|
def index
|
|
@agent_bots = AgentBot.accessible_to(Current.account)
|
|
end
|
|
|
|
def show; end
|
|
|
|
def create
|
|
@agent_bot = Current.account.agent_bots.create!(permitted_params.except(:avatar_url))
|
|
process_avatar_from_url
|
|
end
|
|
|
|
def update
|
|
@agent_bot.update!(permitted_params.except(:avatar_url))
|
|
process_avatar_from_url
|
|
end
|
|
|
|
def avatar
|
|
@agent_bot.avatar.purge if @agent_bot.avatar.attached?
|
|
@agent_bot
|
|
end
|
|
|
|
def destroy
|
|
@agent_bot.destroy!
|
|
head :ok
|
|
end
|
|
|
|
def reset_access_token
|
|
@agent_bot.access_token.regenerate_token
|
|
@agent_bot.reload
|
|
end
|
|
|
|
def reset_secret
|
|
@agent_bot.reset_secret!
|
|
end
|
|
|
|
private
|
|
|
|
def agent_bot
|
|
@agent_bot = AgentBot.accessible_to(Current.account).find(params[:id]) if params[:action] == 'show'
|
|
@agent_bot ||= Current.account.agent_bots.find(params[:id])
|
|
end
|
|
|
|
def permitted_params
|
|
params.permit(:name, :description, :outgoing_url, :avatar, :avatar_url, :bot_type, bot_config: {})
|
|
end
|
|
|
|
def process_avatar_from_url
|
|
::Avatar::AvatarFromUrlJob.perform_later(@agent_bot, params[:avatar_url]) if params[:avatar_url].present?
|
|
end
|
|
end
|