From 057d56513eea9650b62b16568f079a0a8e01a203 Mon Sep 17 00:00:00 2001 From: John-Mason Shackelford Date: Wed, 8 Apr 2026 13:59:56 -0400 Subject: [PATCH] fix: Align create and index to both return 404 for non-member rooms Both create and index now return HTTP 404 Not Found when a bot tries to access a room it's not a member of. This is consistent with REST API security best practices (not revealing resource existence) and ensures read and write permissions are handled identically. Changed create action to no longer call super (which rendered HTML) and instead directly handle the request with proper JSON API error responses. Added test to verify create returns 404 for non-member rooms. Co-authored-by: openhands --- app/controllers/messages/by_bots_controller.rb | 7 ++++++- test/controllers/messages/by_bots_controller_test.rb | 11 ++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/app/controllers/messages/by_bots_controller.rb b/app/controllers/messages/by_bots_controller.rb index e7762e8..ec5d2b8 100644 --- a/app/controllers/messages/by_bots_controller.rb +++ b/app/controllers/messages/by_bots_controller.rb @@ -10,8 +10,13 @@ class Messages::ByBotsController < MessagesController end def create - super + set_room + @message = @room.messages.create_with_attachment!(message_params) + @message.broadcast_create + deliver_webhooks_to_bots head :created, location: message_url(@message) + rescue ActiveRecord::RecordNotFound + head :not_found end private diff --git a/test/controllers/messages/by_bots_controller_test.rb b/test/controllers/messages/by_bots_controller_test.rb index 3ef0b08..5a56b1d 100644 --- a/test/controllers/messages/by_bots_controller_test.rb +++ b/test/controllers/messages/by_bots_controller_test.rb @@ -93,7 +93,7 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest assert_response :redirect # Redirects to login end - test "index returns 404 for room bot is not a member of" do + test "index returns not_found for room bot is not a member of" do # bender bot is NOT a member of the designers room room_without_bot = rooms(:designers) get room_bot_messages_index_url(room_without_bot, users(:bender).bot_key) @@ -107,6 +107,15 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest assert_response :success end + test "create returns not_found for room bot is not a member of" do + # bender bot is NOT a member of the designers room - verify create matches index behavior + room_without_bot = rooms(:designers) + assert_no_difference -> { Message.count } do + post room_bot_messages_url(room_without_bot, users(:bender).bot_key), params: +"Hello!" + end + assert_response :not_found + end + test "regular messages index still denied for bots" do # The standard messages endpoint (not the bot-specific one) should still be forbidden get room_messages_url(@room, bot_key: users(:bender).bot_key)