Tanmay Deep Sharma 94d7ccf5e9 fix(security): gate custom role APIs on the custom_roles feature (#15208)
Custom Roles is a premium feature, but the account's `custom_roles` flag
was never checked by the API. An account on a plan without Custom Roles
— or one whose plan was downgraded and had the flag revoked — could
still list, create, edit and delete custom roles, and could still attach
a `custom_role_id` to an agent through the agents API. Both paths now
require the feature.

## How to reproduce

1. Disable the `custom_roles` feature for an account (Super Admin →
Account → Features, or a plan downgrade).
2. `GET /api/v1/accounts/{id}/custom_roles` — returns 200 with the
account's roles instead of denying.
3. `PATCH /api/v1/accounts/{id}/agents/{agent_id}` with `custom_role_id`
— the role is assigned.

## What changed

- `Api::V1::Accounts::CustomRolesController` gains a
`ensure_custom_roles_feature_enabled` guard, matching the shape already
used by the SLA policies controller.
-
`Enterprise::Api::V1::Accounts::AgentsController#associate_agent_with_custom_role`
ignores `custom_role_id` when the feature is off, rather than writing
it.

Existing custom role assignments are deliberately left untouched — they
are evaluated at request time by `Enterprise::AccountUser#permissions`
and the conversation policy, where custom roles mostly *narrow* an
agent's scope. Dropping them on revocation would widen conversation
visibility for restricted agents, which is a separate product decision.

---------

Co-authored-by: Vishnu Narayanan <iamwishnu@gmail.com>
2026-08-03 14:39:56 +05:30
2026-07-30 16:04:17 +05:30
2026-01-15 20:28:13 -08:00
2026-07-18 02:59:24 -07:00
2026-07-17 13:56:39 -07:00
2024-10-02 00:36:30 -07:00
2024-10-02 00:36:30 -07:00
2024-10-02 00:36:30 -07:00
2025-01-16 10:59:33 -08:00
2026-07-27 15:42:11 +05:30

Header light mode Header dark mode

Chatwoot

The modern customer support platform, an open-source alternative to Intercom, Zendesk, Salesforce Service Cloud etc.

CircleCI Badge Docker Pull Badge Docker Build Badge Commits-per-month Discord uptime response time Artifact HUB

Deploy Deploy to DO

Chat dashboard dark mode Chat dashboard

Chatwoot is the modern, open-source, and self-hosted customer support platform designed to help businesses deliver exceptional customer support experience. Built for scale and flexibility, Chatwoot gives you full control over your customer data while providing powerful tools to manage conversations across channels.

Captain AI Agent for Support

Supercharge your support with Captain, Chatwoots AI agent. Captain helps automate responses, handle common queries, and reduce agent workload—ensuring customers get instant, accurate answers. With Captain, your team can focus on complex conversations while routine questions are resolved automatically. Read more about Captain here.

💬 Omnichannel Support Desk

Chatwoot centralizes all customer conversations into one powerful inbox, no matter where your customers reach out from. It supports live chat on your website, email, Facebook, Instagram, Twitter, WhatsApp, Telegram, Line, SMS etc.

📚 Help center portal

Publish help articles, FAQs, and guides through the built-in Help Center Portal. Enable customers to find answers on their own, reduce repetitive queries, and keep your support team focused on more complex issues.

🗂️ Other features

Collaboration & Productivity

  • Private Notes and @mentions for internal team discussions.
  • Labels to organize and categorize conversations.
  • Keyboard Shortcuts and a Command Bar for quick navigation.
  • Canned Responses to reply faster to frequently asked questions.
  • Auto-Assignment to route conversations based on agent availability.
  • Multi-lingual Support to serve customers in multiple languages.
  • Custom Views and Filters for better inbox organization.
  • Business Hours and Auto-Responders to manage response expectations.
  • Teams and Automation tools for scaling support workflows.
  • Agent Capacity Management to balance workload across the team.

Customer Data & Segmentation

  • Contact Management with profiles and interaction history.
  • Contact Segments and Notes for targeted communication.
  • Campaigns to proactively engage customers.
  • Custom Attributes for storing additional customer data.
  • Pre-Chat Forms to collect user information before starting conversations.

Integrations

  • Slack Integration to manage conversations directly from Slack.
  • Dialogflow Integration for chatbot automation.
  • Dashboard Apps to embed internal tools within Chatwoot.
  • Shopify Integration to view and manage customer orders right within Chatwoot.
  • Use Google Translate to translate messages from your customers in realtime.
  • Create and manage Linear tickets within Chatwoot.

Reports & Insights

  • Live View of ongoing conversations for real-time monitoring.
  • Conversation, Agent, Inbox, Label, and Team Reports for operational visibility.
  • CSAT Reports to measure customer satisfaction.
  • Downloadable Reports for offline analysis and reporting.

Documentation

Detailed documentation is available at chatwoot.com/help-center.

Translation process

The translation process for Chatwoot web and mobile app is managed at https://translate.chatwoot.com using Crowdin. Please read the translation guide for contributing to Chatwoot.

Branching model

We use the git-flow branching model. The base branch is develop. If you are looking for a stable version, please use the master or tags labelled as v1.x.x.

Deployment

Heroku one-click deploy

Deploying Chatwoot to Heroku is a breeze. It's as simple as clicking this button:

Deploy

Follow this link to understand setting the correct environment variables for the app to work with all the features. There might be breakages if you do not set the relevant environment variables.

DigitalOcean 1-Click Kubernetes deployment

Chatwoot now supports 1-Click deployment to DigitalOcean as a kubernetes app.

Deploy to DO

Other deployment options

For other supported options, checkout our deployment page.

Security

Looking to report a vulnerability? Please refer our SECURITY.md file.

Community

If you need help or just want to hang out, come, say hi on our Discord server.

Contributors

Thanks goes to all these wonderful people:

Chatwoot © 2017-2026, Chatwoot Inc - Released under the MIT License.

Description
No description provided
Readme MIT 426 MiB
Languages
Ruby 49.5%
Vue 25.9%
JavaScript 21.6%
HTML 1.7%
SCSS 0.4%
Other 0.8%