121b743f88
## Description Fixes account scoping for Captain assistant responses. Create and update accepted an `assistant_id` from the request. The model then set the response account from that assistant. The controller lookup read the top level parameter, while the API sends the ID inside `assistant_response`, and create did not use the lookup result. The controller now resolves the nested assistant ID through `Current.account`, removes `assistant_id` before assigning request fields, and assigns the scoped assistant directly. The model now fills the account only when it is blank and rejects a response when its account and assistant do not match. Linear issue: [CW-7913](https://linear.app/chatwoot/issue/CW-7913/ghsa-phpm-m2mf-r8r9-captain-assistant-responses-writes-into-another) ## Type of change - [x] Bug fix ## How has this been tested? - Ran `bundle exec rspec spec/enterprise/controllers/api/v1/accounts/captain/assistant_responses_controller_spec.rb spec/enterprise/models/captain/assistant_response_spec.rb`. All 19 examples passed. - Ran the two new account isolation examples against the original code. Both failed and reproduced the create and update issue. Both pass with this fix. - Ran RuboCop on the five changed Ruby files. It found no offenses. ## Checklist - [x] My code follows the style guidelines of this project - [x] I have performed a self review of my code - [x] I have added tests that prove the fix is effective - [x] New and existing unit tests pass locally with my changes
22 lines
761 B
Ruby
22 lines
761 B
Ruby
require 'rails_helper'
|
|
|
|
RSpec.describe Captain::AssistantResponse, type: :model do
|
|
describe 'account validation' do
|
|
it 'uses the assistant account when the account is not set' do
|
|
assistant = create(:captain_assistant)
|
|
assistant_response = build(:captain_assistant_response, assistant: assistant, account: nil)
|
|
|
|
expect(assistant_response).to be_valid
|
|
expect(assistant_response.account).to eq(assistant.account)
|
|
end
|
|
|
|
it 'rejects an assistant from another account' do
|
|
account = create(:account)
|
|
assistant_response = build(:captain_assistant_response, account: account)
|
|
|
|
expect(assistant_response).not_to be_valid
|
|
expect(assistant_response.errors[:assistant]).to include('is invalid')
|
|
end
|
|
end
|
|
end
|