Chatwoot/app/controllers/api/v1/accounts/contacts/conversations_controller.rb
Sojan Jose 534acfbf96
chore: Ensure privilege validations for API endpoints (#2224)
Co-authored-by: Pranav Raj S <pranav@chatwoot.com>
2021-06-11 11:44:31 +05:30

21 lines
525 B
Ruby

class Api::V1::Accounts::Contacts::ConversationsController < Api::V1::Accounts::BaseController
def index
@conversations = Current.account.conversations.includes(
:assignee, :contact, :inbox, :taggings
).where(inbox_id: inbox_ids, contact_id: permitted_params[:contact_id])
end
private
def inbox_ids
if Current.user.administrator? || Current.user.agent?
Current.user.assigned_inboxes.pluck(:id)
else
[]
end
end
def permitted_params
params.permit(:contact_id)
end
end