Fix: Agent Reports counts when they have access to multiple accounts (#4663)

This change restricts the agent report API to fetch agent metrics from the current account.

Fixes: #4660

app/helpers/report_helper.rb

@@ -17,30 +17,30 @@ module ReportHelper
   end
 
   def conversations_count
-    (get_grouped_values scope.conversations).count
+    (get_grouped_values scope.conversations.where(account_id: account.id)).count
   end
 
   def incoming_messages_count
-    (get_grouped_values scope.messages.incoming.unscope(:order)).count
+    (get_grouped_values scope.messages.where(account_id: account.id).incoming.unscope(:order)).count
   end
 
   def outgoing_messages_count
-    (get_grouped_values scope.messages.outgoing.unscope(:order)).count
+    (get_grouped_values scope.messages.where(account_id: account.id).outgoing.unscope(:order)).count
   end
 
   def resolutions_count
-    (get_grouped_values scope.conversations.resolved).count
+    (get_grouped_values scope.conversations.where(account_id: account.id).resolved).count
   end
 
   def avg_first_response_time
-    grouped_reporting_events = (get_grouped_values scope.reporting_events.where(name: 'first_response'))
+    grouped_reporting_events = (get_grouped_values scope.reporting_events.where(name: 'first_response', account_id: account.id))
     return grouped_reporting_events.average(:value_in_business_hours) if params[:business_hours]
 
     grouped_reporting_events.average(:value)
   end
 
   def avg_resolution_time
-    grouped_reporting_events = (get_grouped_values scope.reporting_events.where(name: 'conversation_resolved'))
+    grouped_reporting_events = (get_grouped_values scope.reporting_events.where(name: 'conversation_resolved', account_id: account.id))
     return grouped_reporting_events.average(:value_in_business_hours) if params[:business_hours]
 
     grouped_reporting_events.average(:value)
@@ -48,7 +48,7 @@ module ReportHelper
 
   def avg_resolution_time_summary
     reporting_events = scope.reporting_events
-                            .where(name: 'conversation_resolved', created_at: range)
+                            .where(name: 'conversation_resolved', account_id: account.id, created_at: range)
     avg_rt = params[:business_hours] ? reporting_events.average(:value_in_business_hours) : reporting_events.average(:value)
 
     return 0 if avg_rt.blank?
@@ -58,7 +58,7 @@ module ReportHelper
 
   def avg_first_response_time_summary
     reporting_events = scope.reporting_events
-                            .where(name: 'first_response', created_at: range)
+                            .where(name: 'first_response', account_id: account.id, created_at: range)
     avg_frt = params[:business_hours] ? reporting_events.average(:value_in_business_hours) : reporting_events.average(:value)
 
     return 0 if avg_frt.blank?

spec/controllers/api/v2/accounts/report_controller_spec.rb

@@ -223,6 +223,40 @@ RSpec.describe 'Reports API', type: :request do
         expect(response).to have_http_status(:success)
       end
     end
+
+    context 'when an agent has access to multiple accounts' do
+      let(:account1) { create(:account) }
+      let(:account2) { create(:account) }
+
+      let(:params) do
+        super().merge(
+          type: :agent,
+          since: 30.days.ago.to_i.to_s,
+          until: date_timestamp.to_s
+        )
+      end
+
+      it 'returns agent metrics from the current account' do
+        admin1 = create(:user, account: account1, role: :administrator)
+        inbox1 = create(:inbox, account: account1)
+        inbox2 = create(:inbox, account: account2)
+
+        create(:account_user, user: admin1, account: account2)
+        create(:conversation, account: account1, inbox: inbox1,
+                              assignee: admin1, created_at: Time.zone.today - 2.days)
+        create(:conversation, account: account2, inbox: inbox2,
+                              assignee: admin1, created_at: Time.zone.today - 2.days)
+
+        get "/api/v2/accounts/#{account1.id}/reports/summary",
+            params: params.merge({ id: admin1.id }),
+            headers: admin1.create_new_auth_token
+
+        expect(response).to have_http_status(:success)
+
+        json_response = JSON.parse(response.body)
+        expect(json_response['conversations_count']).to eq(1)
+      end
+    end
   end
 
   describe 'GET /api/v2/accounts/:account_id/reports/inboxes' do