121b743f88
## Description Fixes account scoping for Captain assistant responses. Create and update accepted an `assistant_id` from the request. The model then set the response account from that assistant. The controller lookup read the top level parameter, while the API sends the ID inside `assistant_response`, and create did not use the lookup result. The controller now resolves the nested assistant ID through `Current.account`, removes `assistant_id` before assigning request fields, and assigns the scoped assistant directly. The model now fills the account only when it is blank and rejects a response when its account and assistant do not match. Linear issue: [CW-7913](https://linear.app/chatwoot/issue/CW-7913/ghsa-phpm-m2mf-r8r9-captain-assistant-responses-writes-into-another) ## Type of change - [x] Bug fix ## How has this been tested? - Ran `bundle exec rspec spec/enterprise/controllers/api/v1/accounts/captain/assistant_responses_controller_spec.rb spec/enterprise/models/captain/assistant_response_spec.rb`. All 19 examples passed. - Ran the two new account isolation examples against the original code. Both failed and reproduced the create and update issue. Both pass with this fix. - Ran RuboCop on the five changed Ruby files. It found no offenses. ## Checklist - [x] My code follows the style guidelines of this project - [x] I have performed a self review of my code - [x] I have added tests that prove the fix is effective - [x] New and existing unit tests pass locally with my changes
14 lines
449 B
Ruby
14 lines
449 B
Ruby
FactoryBot.define do
|
|
factory :captain_assistant_response, class: 'Captain::AssistantResponse' do
|
|
association :assistant, factory: :captain_assistant
|
|
account { assistant.account }
|
|
sequence(:question) { |n| "Test question #{n}?" }
|
|
sequence(:answer) { |n| "Test answer #{n}" }
|
|
embedding { Array.new(1536) { rand(-1.0..1.0) } }
|
|
|
|
trait :with_document do
|
|
association :document, factory: :captain_document
|
|
end
|
|
end
|
|
end
|