95463230cb
Account webhooks sign outgoing payloads with HMAC-SHA256, but agent bot and API inbox webhooks were delivered unsigned. This PR adds the same signing to both. Each model gets a dedicated `secret` column rather than reusing the agent bot's `access_token` (for API auth back into Chatwoot) or the API inbox's `hmac_token` (for inbound contact identity verification). These serve different trust boundaries and shouldn't be coupled — rotating a signing secret shouldn't invalidate API access or contact verification. The existing `Webhooks::Trigger` already signs when a secret is present, so the backend change is just passing `secret:` through to the jobs. Shared token logic is extracted into a `WebhookSecretable` concern included by `Webhook`, `AgentBot`, and `Channel::Api`. The frontend reuses the existing `AccessToken` component for secret display. Secrets are admin-only and excluded from enterprise audit logs. ### How to test Point an agent bot or API inbox webhook URL at a request inspector. Send a message and verify `X-Chatwoot-Signature` and `X-Chatwoot-Timestamp` headers are present. Reset the secret from settings and confirm subsequent deliveries use the new value. --------- Co-authored-by: Sojan Jose <sojan@pepalo.com>
73 lines
1.2 KiB
Ruby
73 lines
1.2 KiB
Ruby
class InboxPolicy < ApplicationPolicy
|
|
class Scope
|
|
attr_reader :user_context, :user, :scope, :account, :account_user
|
|
|
|
def initialize(user_context, scope)
|
|
@user_context = user_context
|
|
@user = user_context[:user]
|
|
@account = user_context[:account]
|
|
@account_user = user_context[:account_user]
|
|
@scope = scope
|
|
end
|
|
|
|
def resolve
|
|
user.assigned_inboxes
|
|
end
|
|
end
|
|
|
|
def index?
|
|
true
|
|
end
|
|
|
|
def show?
|
|
# FIXME: for agent bots, lets bring this validation to policies as well in future
|
|
return true if @user.is_a?(AgentBot)
|
|
|
|
Current.user.assigned_inboxes.include? record
|
|
end
|
|
|
|
def assignable_agents?
|
|
true
|
|
end
|
|
|
|
def agent_bot?
|
|
true
|
|
end
|
|
|
|
def campaigns?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def create?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def update?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def destroy?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def set_agent_bot?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def avatar?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def sync_templates?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def health?
|
|
@account_user.administrator?
|
|
end
|
|
|
|
def reset_secret?
|
|
@account_user.administrator?
|
|
end
|
|
end
|