Chatwoot/app/controllers/platform/api/v1/users_controller.rb
Pranav Raj S 2a07eae69f
fix: URL encode params on Platform API call (#3929)
Add URL encoding for the params in platform API calls.

Fixes: product#307
Fixes: #2186
2022-02-07 15:17:36 -08:00

52 lines
1.5 KiB
Ruby

class Platform::Api::V1::UsersController < PlatformController
# ref: https://stackoverflow.com/a/45190318/939299
# set resource is called for other actions already in platform controller
# we want to add login to that chain as well
before_action(only: [:login]) { set_resource }
before_action(only: [:login]) { validate_platform_app_permissible }
def create
@resource = (User.find_by(email: user_params[:email]) || User.new(user_params))
@resource.save!
@resource.confirm
@platform_app.platform_app_permissibles.find_or_create_by(permissible: @resource)
end
def login
encoded_email = ERB::Util.url_encode(@resource.email)
render json: { url: "#{ENV['FRONTEND_URL']}/app/login?email=#{encoded_email}&sso_auth_token=#{@resource.generate_sso_auth_token}" }
end
def show; end
def update
@resource.assign_attributes(user_update_params)
@resource.save!
end
def destroy
DeleteObjectJob.perform_later(@resource)
head :ok
end
private
def user_custom_attributes
return @resource.custom_attributes.merge(user_params[:custom_attributes]) if user_params[:custom_attributes]
@resource.custom_attributes
end
def user_update_params
# we want the merged custom attributes not the original one
user_params.except(:custom_attributes).merge({ custom_attributes: user_custom_attributes })
end
def set_resource
@resource = User.find(params[:id])
end
def user_params
params.permit(:name, :email, :password, custom_attributes: {})
end
end