mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-12 10:00:42 +09:00
Ronald Lokers
3ca1dcbf77
Bots can only create. A lifecycle notification — an alert that fires and then resolves, a deploy that starts and finishes, a backup that runs — therefore has to post a second message, and the room becomes an append-only log of states rather than a view of the current one. Adds PATCH and DELETE inside the existing bot_key scope, routed to Messages::ByBotsController. The body is read the way create reads it, so updating a message is the same request shape as posting one. No new authorization: both actions already run through ensure_can_administer, and can_administer? grants access only to a record the user created, so a bot key reaches that bot's own messages and no others. set_room narrows it again by looking the room up through the bot's own memberships. A leaked bot key gains what it could already do by posting: write to rooms that bot belongs to. update answers head :ok rather than the redirect, which meant extracting the update and its broadcast into update_message — calling super and then head would double render, since the parent redirects inside the action. destroy needs no split, because the parent renders implicitly like create does.