Allow bots to update their own messages

[ronaldlokers]

I'm using Campfire bots to post alerts from Prometheus Alertmanager into a room. Each alert fires and later resolves, and right now that's two messages — so the room becomes an append-only stream where you have to read backwards to work out what's still broken.

What I'd like is for the bot to update the message it already posted: "🚨 High memory on node-3" becomes "✅ Resolved: high memory on node-3", in place. The room then reads as current state rather than a log. The same pattern would suit anything with a lifecycle — deploys, backups, long-running jobs.

As far as I can tell the authorization model already allows this. In app/models/user/role.rb:

def can_administer?(record = nil)
  administrator? || self == record&.creator || record&.new_record?
end

A bot is record.creator for its own messages, so ensure_can_administer in MessagesController#update would already pass. The only things in the way are that config/routes.rb exposes just post ":bot_key/messages", and Messages::ByBotsController has allow_bot_access only: :create. CSRF is already exempt for bot-key auth.

So the change looks small: a patch route under the :bot_key scope, widening allow_bot_access, and returning head :ok rather than the Turbo redirect that MessagesController#update does.

The obvious objection is security, and I'd rather raise it than have it raised: a bot key is a token in a URL, scoped to a room. Today a leaked key can only add noise; with this it could rewrite history. A few ways that could be narrowed:

• update only, no destroy — editing is recoverable in a way deletion isn't.
• Keep relying on can_administer?, so a bot can only touch messages it created — a leaked key still can't alter anyone else's messages.
• Optionally a per-bot setting, default off.

[monorkin]

We should expose update and destroy actions for bot messages and, as you said, keep relying on can_administer?.

Do you want to create a PR for this?

[ronaldlokers]

Am I allowed to use Claude for this? I am not a Ruby developer myself.

[monorkin]

Yes, the use of AI agents is allowed and encouraged.

[monorkin]

Merged your PR! Thank you!