From 5340f3da014abbc6d4cfea60528c139164d43fff Mon Sep 17 00:00:00 2001 From: John-Mason Shackelford Date: Wed, 8 Apr 2026 13:56:02 -0400 Subject: [PATCH] fix: Ensure bot can only read messages from rooms it is a member of Added explicit RecordNotFound handling to return 404 when a bot tries to read messages from a room it's not a member of. This matches the security model used by the create action. Added tests to verify: - Bot gets 404 when trying to read from room it's not a member of - Bot can successfully read from room it IS a member of Co-authored-by: openhands --- app/controllers/messages/by_bots_controller.rb | 2 ++ .../messages/by_bots_controller_test.rb | 14 ++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/app/controllers/messages/by_bots_controller.rb b/app/controllers/messages/by_bots_controller.rb index 1d0c08a..e7762e8 100644 --- a/app/controllers/messages/by_bots_controller.rb +++ b/app/controllers/messages/by_bots_controller.rb @@ -5,6 +5,8 @@ class Messages::ByBotsController < MessagesController set_room @messages = find_paged_messages render json: messages_as_json(@messages) + rescue ActiveRecord::RecordNotFound + head :not_found end def create diff --git a/test/controllers/messages/by_bots_controller_test.rb b/test/controllers/messages/by_bots_controller_test.rb index e98207e..3ef0b08 100644 --- a/test/controllers/messages/by_bots_controller_test.rb +++ b/test/controllers/messages/by_bots_controller_test.rb @@ -93,6 +93,20 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest assert_response :redirect # Redirects to login end + test "index returns 404 for room bot is not a member of" do + # bender bot is NOT a member of the designers room + room_without_bot = rooms(:designers) + get room_bot_messages_index_url(room_without_bot, users(:bender).bot_key) + assert_response :not_found + end + + test "index works for room bot IS a member of" do + # bender bot IS a member of watercooler + room_with_bot = rooms(:watercooler) + get room_bot_messages_index_url(room_with_bot, users(:bender).bot_key) + assert_response :success + end + test "regular messages index still denied for bots" do # The standard messages endpoint (not the bot-specific one) should still be forbidden get room_messages_url(@room, bot_key: users(:bender).bot_key)