diff --git a/app/controllers/concerns/access_token_auth_helper.rb b/app/controllers/concerns/access_token_auth_helper.rb index c35a28d7d6a1..0a6c8986063e 100644 --- a/app/controllers/concerns/access_token_auth_helper.rb +++ b/app/controllers/concerns/access_token_auth_helper.rb @@ -14,7 +14,14 @@ def authenticate_access_token! render_unauthorized('Invalid Access Token') && return if @access_token.blank? @resource = @access_token.owner - Current.user = @resource if [User, AgentBot].include?(@resource.class) + Current.user = @resource if allowed_current_user_type?(@resource) + end + + def allowed_current_user_type?(resource) + return true if resource.is_a?(User) + return true if resource.is_a?(AgentBot) + + false end def validate_bot_access_token! diff --git a/spec/controllers/api/base_controller_spec.rb b/spec/controllers/api/base_controller_spec.rb index c0230240e0f4..ac2306d14202 100644 --- a/spec/controllers/api/base_controller_spec.rb +++ b/spec/controllers/api/base_controller_spec.rb @@ -29,6 +29,25 @@ end end + describe 'request with api_access_token for a super admin' do + before do + user.update!(type: 'SuperAdmin') + end + + context 'when its a valid api_access_token' do + it 'returns current user information' do + get '/api/v1/profile', + headers: { api_access_token: user.access_token.token }, + as: :json + + expect(response).to have_http_status(:success) + json_response = response.parsed_body + expect(json_response['id']).to eq(user.id) + expect(json_response['email']).to eq(user.email) + end + end + end + describe 'request with api_access_token for bot' do let!(:agent_bot) { create(:agent_bot) } let!(:inbox) { create(:inbox, account: account) }