diff --git a/cmd/route_parity/main.go b/cmd/route_parity/main.go index 44644bd5..23b24533 100644 --- a/cmd/route_parity/main.go +++ b/cmd/route_parity/main.go @@ -236,6 +236,8 @@ var criticalRoutes = []route{ {Method: "POST", Path: "/api/v1/accounts/:account_id/twitter/authorization", Controller: "api/v1/accounts/twitter/authorizations#create", Source: "routes.rb:315"}, {Method: "POST", Path: "/api/v1/accounts/:account_id/microsoft/authorization", Controller: "api/v1/accounts/microsoft/authorizations#create", Source: "routes.rb:319"}, {Method: "POST", Path: "/api/v1/accounts/:account_id/google/authorization", Controller: "api/v1/accounts/google/authorizations#create", Source: "routes.rb:323"}, + {Method: "POST", Path: "/api/v1/accounts/:account_id/instagram/authorization", Controller: "api/v1/accounts/instagram/authorizations#create", Source: "routes.rb:327"}, + {Method: "POST", Path: "/api/v1/accounts/:account_id/tiktok/authorization", Controller: "api/v1/accounts/tiktok/authorizations#create", Source: "routes.rb:331"}, {Method: "POST", Path: "/api/v1/accounts/:account_id/notion/authorization", Controller: "api/v1/accounts/notion/authorizations#create", Source: "routes.rb:335"}, {Method: "DELETE", Path: "/api/v1/accounts/:account_id/integrations/shopify", Controller: "api/v1/accounts/integrations/shopify#destroy", Source: "routes.rb:361"}, {Method: "POST", Path: "/api/v1/accounts/:account_id/integrations/shopify/auth", Controller: "api/v1/accounts/integrations/shopify#auth", Source: "routes.rb:363"}, diff --git a/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md b/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md index f9baaa92..d6930e10 100644 --- a/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md +++ b/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md @@ -49,16 +49,16 @@ Hermes task landing checklist: ## Current Baseline -- Current tracking checkpoint: 2026-06-06 Google/Microsoft authorization parity checkpoint, prepared as `feat(channels): align email oauth authorization`. -- Latest implementation checkpoint: this checkpoint, prepared as `feat(channels): align email oauth authorization`. +- Current tracking checkpoint: 2026-06-06 Instagram/TikTok authorization parity checkpoint, prepared as `feat(channels): align social authorization`. +- Latest implementation checkpoint: this checkpoint, prepared as `feat(channels): align social authorization`. - Latest documentation/tooling checkpoint: this tracker update for P3.24 plus the landed parity tracker history; this document is the active follow-up plan and supersedes `.hermes/plans/*`. - Plan landing status: complete for the current known Hermes plans and user-confirmed scope. Future work should update this file directly instead of opening a parallel tracker. -- Worktree status at this implementation checkpoint: Google and Microsoft account authorization from `reference/chatwoot/config/routes.rb:319/323`, `Api::V1::Accounts::Google::AuthorizationsController`, `Api::V1::Accounts::Microsoft::AuthorizationsController`, their request specs, shared OAuth callback behavior, and reused dashboard `googleClient.js`/`microsoftClient.js` are implemented. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/google/authorization` and `POST /api/v1/accounts/:account_id/microsoft/authorization`, returns Chatwoot `{ success: true, url }` payloads, builds provider authorize URLs with Chatwoot scopes/redirects/provider parameters, signs callback state for the existing email OAuth callbacks, and keeps previously aligned Twitter/Notion behavior intact. Live API/browser/enterprise smoke still needs the full PostgreSQL/Redis/Meilisearch/GoChat/Vite/Chrome stack. +- Worktree status at this implementation checkpoint: Instagram and TikTok account authorization from `reference/chatwoot/config/routes.rb:327/331`, `Api::V1::Accounts::Instagram::AuthorizationsController`, `Api::V1::Accounts::Tiktok::AuthorizationsController`, their request specs, callback return hints, and reused dashboard `instagramClient.js`/`tiktokClient.js` are implemented. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/instagram/authorization` and `POST /api/v1/accounts/:account_id/tiktok/authorization`, returns Chatwoot `{ success: true, url }` payloads, builds provider authorize URLs with Chatwoot scopes/redirects/provider parameters, signs account callback state with optional `return_to`, and keeps previously aligned Twitter/Google/Microsoft/Notion behavior intact. Live API/browser/enterprise smoke still needs the full PostgreSQL/Redis/Meilisearch/GoChat/Vite/Chrome stack. - Next executable implementation checkpoint: continue Phase 2/3 drift audit, Phase 6 placeholder audit, or B12 live smoke from fresh reference/smoke evidence. - `go test ./...` passes when run outside the restricted socket sandbox; focused Shopify handler/service tests pass in the sandbox. -- Route dump succeeds with `945` registered routes after Google/Microsoft authorization tracking. +- Route dump succeeds with `947` registered routes after Instagram/TikTok authorization tracking. - Route parity artifacts now exist under `docs/parity/` and are generated by `cmd/route_parity`. -- Tracked frontend-critical route audit covers 408 Chatwoot routes: 395 exact, 0 method-compatible, 13 parameter-compatible, 0 missing. The 13 parameter-compatible routes are Gin-internal parameter-name differences for nested AgentCapacityPolicy users/inbox limits, dashboard app member `:id` names, plus the public article `.md`/`.png` suffixes served through the same external article route dispatcher. +- Tracked frontend-critical route audit covers 410 Chatwoot routes: 397 exact, 0 method-compatible, 13 parameter-compatible, 0 missing. The 13 parameter-compatible routes are Gin-internal parameter-name differences for nested AgentCapacityPolicy users/inbox limits, dashboard app member `:id` names, plus the public article `.md`/`.png` suffixes served through the same external article route dispatcher. - `/api/v1/widget` stubs are burned down and public inbox/contact/conversation/message core flows are backed by real handlers. - Handler test stability fixes are committed into the baseline before feature parity work continues. - `.codegraph/` is generated indexing output and is not part of tracked product code. @@ -140,6 +140,7 @@ This table is the shortest authoritative handoff view. If an older lower section | Priority | Workstream | Current state | Next checkpoint | Commit close rule | | --- | --- | --- | --- | --- | +| 0 | P3.31 Instagram/TikTok authorization parity | Implemented for reused dashboard Instagram and TikTok connect/reauthorization flows: `POST /api/v1/accounts/:account_id/instagram/authorization` and `POST /api/v1/accounts/:account_id/tiktok/authorization` are registered and tracked from `routes.rb:327/331`, both routes are administrator-gated like Chatwoot's shared OAuth authorization controller, responses return raw `{ success: true, url }`, Instagram authorize URLs target `https://api.instagram.com/oauth/authorize` with Chatwoot's required Instagram business scopes, `enable_fb_login=0`, and `force_authentication=1`, TikTok authorize URLs target `https://www.tiktok.com/v2/auth/authorize` with Chatwoot's required TikTok business scopes and `client_key`, and both sign account callback state with optional `return_to`. | Keep in Review; reopen only if live Instagram/TikTok OAuth smoke exposes GlobalID state compatibility requirements beyond signed callback state, provider config-source drift, onboarding return routing drift, or frontend payload drift beyond the inspected authorization controllers/specs/frontend clients. | Focused social authorization handler/router/route tests, route dump/parity regeneration (`947` routes; `397 exact`, `13 parameter-compatible`, `0 missing out of 410`), full `go test ./...`, and `git diff --check` must pass before commit. | | 0 | P3.30 Google/Microsoft authorization parity | Implemented for reused dashboard Gmail/Outlook connect and reauthorization flows: `POST /api/v1/accounts/:account_id/google/authorization` and `POST /api/v1/accounts/:account_id/microsoft/authorization` are registered and tracked from `routes.rb:319/323`, both routes are administrator-gated like Chatwoot's shared OAuth authorization controller, responses return raw `{ success: true, url }`, Google authorize URLs target `https://accounts.google.com/o/oauth2/auth` with `email profile https://mail.google.com/`, `prompt=consent`, and `access_type=offline`, Microsoft authorize URLs target `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` with Chatwoot's IMAP/SMTP/openid/profile/email scope and no prompt, and both sign account callback state for existing email OAuth callbacks. | Keep in Review; reopen only if live Gmail/Outlook OAuth smoke exposes GlobalID state compatibility requirements beyond signed callback state, provider config-source drift, onboarding return routing drift, or frontend payload drift beyond the inspected authorization controllers/specs/frontend clients. | Focused email OAuth authorization handler/router/route tests, route dump/parity regeneration (`945` routes; `395 exact`, `13 parameter-compatible`, `0 missing out of 408`), full `go test ./...`, and `git diff --check` must pass before commit. | | 0 | P3.29 Twitter authorization parity | Implemented for reused dashboard Twitter connect flow: `POST /api/v1/accounts/:account_id/twitter/authorization` is registered and tracked from `routes.rb:315`, the route is administrator-gated like Chatwoot's controller, the response returns raw `{ success: true, url }`, the request-token call uses Twitter OAuth1 signing with configured consumer key/secret and frontend `/twitter/callback?state=...`, and the returned URL targets `/oauth/authorize?oauth_token=...`. | Keep in Review; reopen only if live Twitter OAuth smoke exposes request-token signing/header drift, Redis request-token mapping requirements beyond signed callback state, provider base URL drift, or frontend payload drift beyond the inspected authorization controller/spec/frontend contract. | Focused Twitter authorization handler/router/route tests, route dump/parity regeneration (`943` routes; `393 exact`, `13 parameter-compatible`, `0 missing out of 406`), full `go test ./...`, and `git diff --check` must pass before commit. | | 0 | P3.28 Notion authorization parity | Implemented for reused dashboard Notion connect flow: `POST /api/v1/accounts/:account_id/notion/authorization` is registered and tracked from `routes.rb:335`, the route is administrator-gated like Chatwoot's `OauthAuthorizationController`, the response returns raw `{ success: true, url }`, the URL targets `https://api.notion.com/v1/oauth/authorize` with `response_type=code`, `owner=user`, frontend `/notion/callback`, configured `client_id`, and signed account state for the existing callback. | Keep in Review; reopen only if live Notion OAuth smoke exposes GlobalID state compatibility, config-source drift, feature-gate behavior, or frontend payload drift beyond the inspected authorization controller/spec/frontend contract. | Focused Notion authorization handler/service tests, route dump/parity regeneration (`942` routes; `392 exact`, `13 parameter-compatible`, `0 missing out of 405`), full `go test ./...`, and `git diff --check` must pass before commit. | @@ -149,7 +150,7 @@ This table is the shortest authoritative handoff view. If an older lower section | 0 | P3.24 Slack integration parity | Implemented for reused dashboard Slack settings flow: no-trailing and trailing singleton routes are registered for create/update/delete, `PUT` and `PATCH` update both work, create accepts frontend `code` and exchanges it for a Slack access token, hooks are persisted with `app_id: slack` and disabled status, update accepts frontend `reference_id`, fetches real private/public Slack channels with pagination, joins public channels, persists `reference_id/settings.channel_name/status`, create/update return raw Chatwoot app payloads with hooks, list-all returns raw channel arrays, invalid channels return Chatwoot's `422 { error }`, and delete returns empty `200 OK`. | Keep in Review; reopen only if live Slack OAuth/channel smoke exposes OAuth redirect, provider error, app serializer, or Slack channel pagination drift beyond the inspected controller/builder/spec/frontend contract. | Focused Slack handler/service tests, route dump/parity regeneration, sandbox focused `go test`, escalated full `go test ./...`, and `git diff --check` passed. | | 0 | P3.23 nested contact inbox creation API | Implemented for Chatwoot nested contact inbox creation: raw JSON/form/query params are accepted, contact and inbox are account-scoped, missing source IDs are generated through Chatwoot channel rules, duplicate contact+inbox+source rows are returned idempotently, `hmac_verified` is persisted on creation, and the response is raw `{ source_id, inbox }` rather than the local model/envelope. | Keep in Review; reopen only if live CRM/new-conversation smoke exposes inbox access-policy, unsupported channel, or serializer drift beyond the inspected controller/builder/Jbuilder contract. | Focused nested ContactInbox handler/service/repository tests, route parity check, full `go test ./...`, and `git diff --check` passed. | | 1 | P3.2a invitation/confirmation mail parity | Implemented for current non-SSO reference behavior: profile resend is no longer a TODO-only log, new invited agents and unconfirmed invited profile resends generate reset-password invitation links, normal unconfirmed profile resends generate confirmation links, `users.unconfirmed_email` is modeled for email-update routing, and fakeable/environment SMTP mailers keep default tests offline. | Keep in Review; reopen only if reused frontend smoke or fresh reference evidence exposes additional Devise confirmation states outside excluded SSO/SAML/LDAP/OIDC variants. | Focused profile and agent invitation tests, combined handler/service/repository/router/migrate/app tests, full `go test ./...`, and `git diff --check` passed. | -| 2 | Phase 2/3 drift | Tracked route parity is 0 missing for the current 408-route critical set; dashboard `/app` shell routes from `routes.rb:19-20`, `.well-known` app association and custom-domain challenge routes from `routes.rb:657-660`, Twilio callback routes from `routes.rb:639-640`, enterprise Twilio voice routes from `routes.rb:643-646`, root Linear/Shopify/Notion OAuth callback routes from `routes.rb:630/634/654`, root Twitter/Google/Microsoft/Instagram/TikTok callback routes from `routes.rb:626/649-652`, assignment policy routes from `routes.rb:306-313`, help-center portal/category/article routes from `routes.rb:385-404`, public help-center portal/sitemap/article/category/search/article-detail routes from `routes.rb:590-601`, enterprise contact outbound voice call from `routes.rb:216`, account agent-bot routes from `routes.rb:94-97`, account webhook routes from `routes.rb:342`, account integration app/hook routes from `routes.rb:345-348`, account Slack routes from `routes.rb:350-352`, account Dyte routes from `routes.rb:357-358`, account Shopify routes from `routes.rb:361-364`, account Linear routes from `routes.rb:365-373`, account Notion authorization/destroy routes from `routes.rb:335/379`, account Twitter/Google/Microsoft authorization routes from `routes.rb:315/319/323`, dashboard app routes from `routes.rb:130`, canned response routes from `routes.rb:114`, notification subscription routes from `routes.rb:440`, team/team-member routes from `routes.rb:296-300`, conversation participant routes from `routes.rb:150`, conversation direct upload route from `routes.rb:151`, conversation draft message routes from `routes.rb:152`, conversation inbox assistant route from `routes.rb:165`, conversation reporting events route from `routes.rb:166`, and account reporting events route from `routes.rb:234` are now explicitly tracked. Notification list/action serializers, user notification-settings raw payloads, campaigns raw payload/display-id routes, Devise password reset/confirmation payloads, CRM shared attachment payloads plus fixed 100-row attachment pagination, account/settings payloads, assignable-agent payloads, agent index full-list behavior, agent create/update/delete defaults/errors/scope, account agent-bot route/payload/mutation behavior, account webhook payload/mutation behavior, integration app/hook payload behavior, account Slack OAuth/channel payload behavior, account Dyte create/join payload behavior, account Shopify customer-order payload behavior, account Linear GraphQL issue payload behavior, account Notion authorization/destroy behavior, account Twitter/Google/Microsoft authorization behavior, dashboard app raw payload/serializer behavior, canned response raw payload/search/delete behavior, notification subscription payload behavior, team update/frontend route behavior, conversation participant route/payload/final-set update behavior, conversation direct upload ActiveStorage behavior, conversation draft message Redis-key-equivalent behavior, conversation inbox assistant Copilot payload behavior, conversation reporting-event raw array behavior, account reporting-events payload/filter/pagination behavior, label CRUD payloads, custom filters, custom attribute definitions, contact outbound voice calls, assignment policy CRUD and inbox binding payloads, Twilio inbound/status callbacks, enterprise Twilio voice callbacks, Linear/Shopify/Notion root integration callbacks, Shopify OAuth auth redirects, root channel OAuth callbacks, help-center portal/category/article payloads, dashboard app shell route behavior, app association JSON payloads, Cloudflare custom hostname verification, public widget popular-article lists, public help-center category list/show payloads, public portal show/default-locale payloads, public portal search payloads, public article show/markdown/tracking routes, and public sitemap XML now match the inspected Chatwoot contract. | Continue the next evidence-backed route/controller/serializer drift after Google/Microsoft authorization parity or from B12 findings. | Regenerate parity artifacts when routes change and add endpoint-family fixture tests. | +| 2 | Phase 2/3 drift | Tracked route parity is 0 missing for the current 410-route critical set; dashboard `/app` shell routes from `routes.rb:19-20`, `.well-known` app association and custom-domain challenge routes from `routes.rb:657-660`, Twilio callback routes from `routes.rb:639-640`, enterprise Twilio voice routes from `routes.rb:643-646`, root Linear/Shopify/Notion OAuth callback routes from `routes.rb:630/634/654`, root Twitter/Google/Microsoft/Instagram/TikTok callback routes from `routes.rb:626/649-652`, assignment policy routes from `routes.rb:306-313`, help-center portal/category/article routes from `routes.rb:385-404`, public help-center portal/sitemap/article/category/search/article-detail routes from `routes.rb:590-601`, enterprise contact outbound voice call from `routes.rb:216`, account agent-bot routes from `routes.rb:94-97`, account webhook routes from `routes.rb:342`, account integration app/hook routes from `routes.rb:345-348`, account Slack routes from `routes.rb:350-352`, account Dyte routes from `routes.rb:357-358`, account Shopify routes from `routes.rb:361-364`, account Linear routes from `routes.rb:365-373`, account Notion authorization/destroy routes from `routes.rb:335/379`, account Twitter/Google/Microsoft/Instagram/TikTok authorization routes from `routes.rb:315/319/323/327/331`, dashboard app routes from `routes.rb:130`, canned response routes from `routes.rb:114`, notification subscription routes from `routes.rb:440`, team/team-member routes from `routes.rb:296-300`, conversation participant routes from `routes.rb:150`, conversation direct upload route from `routes.rb:151`, conversation draft message routes from `routes.rb:152`, conversation inbox assistant route from `routes.rb:165`, conversation reporting events route from `routes.rb:166`, and account reporting events route from `routes.rb:234` are now explicitly tracked. Notification list/action serializers, user notification-settings raw payloads, campaigns raw payload/display-id routes, Devise password reset/confirmation payloads, CRM shared attachment payloads plus fixed 100-row attachment pagination, account/settings payloads, assignable-agent payloads, agent index full-list behavior, agent create/update/delete defaults/errors/scope, account agent-bot route/payload/mutation behavior, account webhook payload/mutation behavior, integration app/hook payload behavior, account Slack OAuth/channel payload behavior, account Dyte create/join payload behavior, account Shopify customer-order payload behavior, account Linear GraphQL issue payload behavior, account Notion authorization/destroy behavior, account Twitter/Google/Microsoft/Instagram/TikTok authorization behavior, dashboard app raw payload/serializer behavior, canned response raw payload/search/delete behavior, notification subscription payload behavior, team update/frontend route behavior, conversation participant route/payload/final-set update behavior, conversation direct upload ActiveStorage behavior, conversation draft message Redis-key-equivalent behavior, conversation inbox assistant Copilot payload behavior, conversation reporting-event raw array behavior, account reporting-events payload/filter/pagination behavior, label CRUD payloads, custom filters, custom attribute definitions, contact outbound voice calls, assignment policy CRUD and inbox binding payloads, Twilio inbound/status callbacks, enterprise Twilio voice callbacks, Linear/Shopify/Notion root integration callbacks, Shopify OAuth auth redirects, root channel OAuth callbacks, help-center portal/category/article payloads, dashboard app shell route behavior, app association JSON payloads, Cloudflare custom hostname verification, public widget popular-article lists, public help-center category list/show payloads, public portal show/default-locale payloads, public portal search payloads, public article show/markdown/tracking routes, and public sitemap XML now match the inspected Chatwoot contract. | Continue the next evidence-backed route/controller/serializer drift after Instagram/TikTok authorization parity or from B12 findings. | Regenerate parity artifacts when routes change and add endpoint-family fixture tests. | | 3 | Phase 6 placeholder audit | Widget/public/webhook critical placeholders are burned down; inbox WhatsApp health/register-webhook and sync-template drift are closed; refreshed `docs/parity/placeholder_audit.md` shows only webhook nil-handler fallbacks still call `chatwootParityStub`; dashboard conversation transcript/custom-attribute response drift and message retry status drift are closed. | Keep in Review; reopen only if fresh `rg`, route smoke, or B12 finds a frontend-reachable placeholder/stub in account/contact/conversation/message/inbox/widget/public paths. | `rg` placeholder audit and `scripts/parity_frontend_smoke.sh --check` are recorded; no reused-frontend blocker is ownerless. | | 4 | P3.9 account agent-bot API | Implemented for the reused dashboard AgentBots settings route with no-trailing-slash routes, PATCH update, raw Jbuilder-style payloads, account mutation scope, system-bot show/list visibility, empty `200 OK` delete, and full reset/avatar action payloads. | Keep in Review; reopen only if live settings smoke exposes avatar upload storage or administrator-secret gating drift. | Focused AgentBot handler tests, service/router focused tests, route dump/parity regeneration, full `go test ./...`, and `git diff --check` passed. | | 5 | P3.10 account webhooks API | Implemented for the reused dashboard Webhooks settings route with PATCH update, Chatwoot `{ payload }` list/mutation serializers, nested `{ webhook: ... }` bodies, generated secret, account-scoped mutations, URL/subscription validation, optional inbox serialization, and empty `200 OK` delete. | Keep in Review; reopen only if live settings smoke exposes audit writer or delivery-signature drift beyond the existing delivery service boundary. | Focused webhook handler/service/router tests, migration test, route dump/parity regeneration, full `go test ./...`, and `git diff --check` passed. | @@ -245,6 +246,7 @@ This ledger records the committed parity checkpoints that future slices should b | Commit | Scope | Verification summary | Follow-up state | | --- | --- | --- | --- | +| `feat(channels): align social authorization` | Advances P3.31 Instagram/TikTok authorization parity by matching Chatwoot `Api::V1::Accounts::Instagram::AuthorizationsController#create`, `Api::V1::Accounts::Tiktok::AuthorizationsController#create`, shared OAuth authorization behavior, routes `327/331`, request specs, callback return hints, and reused dashboard `instagramClient.js`/`tiktokClient.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/instagram/authorization` and `POST /api/v1/accounts/:account_id/tiktok/authorization`, returns raw `{ success: true, url }`, builds Chatwoot-scoped provider authorize URLs with frontend callback redirects, and signs account state with optional `return_to` for the existing social callback paths. | `go test ./internal/handler/api/v1 -run 'InstagramAuthorization\|TikTokAuthorization\|SocialAuthorization' -count=1`; `go test ./internal/router ./cmd/route_parity -run 'Router\|RouteParity' -count=1`; `go run ./cmd/dump_routes > docs/parity/gochat_routes.txt`; `go run ./cmd/route_parity`; full `go test ./...`; `git diff --check`. Route dump is `TOTAL: 947`; tracked route parity is `397 exact, 0 method-compatible, 13 parameter-compatible, 0 missing out of 410`. | P3.31 moves to Review for current Instagram/TikTok authorization evidence; continue Phase 2/3 drift audit, Phase 6 placeholder audit, B12 live smoke, or fresh reference/smoke drift. | | `feat(channels): align email oauth authorization` | Advances P3.30 Google/Microsoft authorization parity by matching Chatwoot `Api::V1::Accounts::Google::AuthorizationsController#create`, `Api::V1::Accounts::Microsoft::AuthorizationsController#create`, shared `OauthAuthorizationController`, routes `319/323`, request specs, email OAuth callbacks, and reused dashboard `googleClient.js`/`microsoftClient.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/google/authorization` and `POST /api/v1/accounts/:account_id/microsoft/authorization`, returns raw `{ success: true, url }`, builds Chatwoot-scoped provider authorize URLs with frontend callback redirects, and signs callback state for the existing email OAuth callback paths. | `go test ./internal/handler/api/v1 -run 'GoogleAuthorization\|MicrosoftAuthorization\|EmailOAuthAuthorization' -count=1`; `go test ./cmd/route_parity ./internal/router -run 'RouteParity\|Router' -count=1`; `go run ./cmd/dump_routes > docs/parity/gochat_routes.txt`; `go run ./cmd/route_parity`; full `go test ./...`; `git diff --check`. Route dump is `TOTAL: 945`; tracked route parity is `395 exact, 0 method-compatible, 13 parameter-compatible, 0 missing out of 408`. | P3.30 moves to Review for current Google/Microsoft authorization evidence; continue Phase 2/3 drift audit, Phase 6 placeholder audit, B12 live smoke, or fresh reference/smoke drift. | | `feat(channels): align twitter authorization` | Advances P3.29 Twitter authorization parity by matching Chatwoot `Api::V1::Accounts::Twitter::AuthorizationsController#create`, route `315`, request specs, callback expectations, and reused dashboard `twitterClient.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/twitter/authorization`, requests a Twitter OAuth1 token through a fakeable signed request-token client, returns raw `{ success: true, url }`, and signs callback state for the existing Twitter callback path. | `go test ./internal/handler/api/v1 ./internal/router ./cmd/route_parity -run 'TwitterAuthorization\|Router\|RouteParity' -count=1`; `go run ./cmd/dump_routes > docs/parity/gochat_routes.txt`; `go run ./cmd/route_parity`; full `go test ./...`; `git diff --check`. Route dump is `TOTAL: 943`; tracked route parity is `393 exact, 0 method-compatible, 13 parameter-compatible, 0 missing out of 406`. | P3.29 moves to Review for current Twitter authorization evidence; continue Phase 2/3 drift audit, Phase 6 placeholder audit, B12 live smoke, or fresh reference/smoke drift. | | `feat(integrations): align notion authorization` | Advances P3.28 Notion authorization parity by matching Chatwoot `Api::V1::Accounts::Notion::AuthorizationsController#create`, route `335`, request specs, and reused dashboard `notion_auth.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/notion/authorization`, returns raw `{ success: true, url }`, builds the Notion OAuth authorize URL with `response_type=code`, `owner=user`, frontend `/notion/callback`, configured client ID, and signed account state compatible with the existing callback. | `go test ./internal/service ./internal/handler/api/v1 ./internal/router ./cmd/route_parity -run 'NotionIntegration\|Router\|RouteParity' -count=1`; `go run ./cmd/dump_routes > docs/parity/gochat_routes.txt`; `go run ./cmd/route_parity`; full `go test ./...`; `git diff --check`. Route dump is `TOTAL: 942`; tracked route parity is `392 exact, 0 method-compatible, 13 parameter-compatible, 0 missing out of 405`. | P3.28 moves to Review for current Notion authorization evidence; continue Phase 2/3 drift audit, Phase 6 placeholder audit, B12 live smoke, or fresh reference/smoke drift. | @@ -2455,3 +2457,4 @@ Verification milestone gates: - 2026-06-06: P3.28 Notion authorization checkpoint prepared as `feat(integrations): align notion authorization`; audited Chatwoot Notion account authorization controller/specs, route `335`, callback state handling, and reused dashboard `notion_auth.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/notion/authorization`, returns raw `{ success: true, url }`, builds Notion OAuth URLs with `response_type=code`, `owner=user`, frontend `/notion/callback`, configured client ID, and signed account state, and tracks the account authorization route in route parity. Focused Notion authorization handler/service tests, route dump/parity regeneration (`942` routes; `392 exact`, `13 parameter-compatible`, `0 missing out of 405`), full `go test ./...`, and `git diff --check` passed; continue Phase 2/3 drift audit, Phase 6 placeholder audit, or B12 live smoke. - 2026-06-06: P3.29 Twitter authorization checkpoint prepared as `feat(channels): align twitter authorization`; audited Chatwoot Twitter account authorization controller/specs, route `315`, Twitter callback behavior, and reused dashboard `twitterClient.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/twitter/authorization`, signs and sends the OAuth1 request-token call through a fakeable client, returns raw `{ success: true, url }`, builds `/oauth/authorize?oauth_token=...` URLs, signs callback state for the existing Twitter callback, and tracks the account authorization route in route parity. Focused Twitter authorization handler/router tests, route dump/parity regeneration (`943` routes; `393 exact`, `13 parameter-compatible`, `0 missing out of 406`), full `go test ./...`, and `git diff --check` passed; continue Phase 2/3 drift audit, Phase 6 placeholder audit, or B12 live smoke. - 2026-06-06: P3.30 Google/Microsoft authorization checkpoint prepared as `feat(channels): align email oauth authorization`; audited Chatwoot Google and Microsoft account authorization controllers/specs, shared OAuth authorization controller, routes `319/323`, email callback behavior, and reused dashboard `googleClient.js`/`microsoftClient.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/google/authorization` and `POST /api/v1/accounts/:account_id/microsoft/authorization`, returns raw `{ success: true, url }`, builds Chatwoot provider authorize URLs with exact frontend callback redirects and scopes, includes Google `prompt=consent` plus `access_type=offline`, omits Microsoft prompt, signs account callback state for the existing email OAuth callbacks, and tracks both account authorization routes in route parity. Focused email authorization handler/router tests, route dump/parity regeneration (`945` routes; `395 exact`, `13 parameter-compatible`, `0 missing out of 408`), full `go test ./...`, and `git diff --check` passed; continue Phase 2/3 drift audit, Phase 6 placeholder audit, or B12 live smoke. +- 2026-06-06: P3.31 Instagram/TikTok authorization checkpoint prepared as `feat(channels): align social authorization`; audited Chatwoot Instagram and TikTok account authorization controllers/specs, shared OAuth authorization behavior, routes `327/331`, callback return hints, and reused dashboard `instagramClient.js`/`tiktokClient.js`. GoChat now exposes administrator-gated `POST /api/v1/accounts/:account_id/instagram/authorization` and `POST /api/v1/accounts/:account_id/tiktok/authorization`, returns raw `{ success: true, url }`, builds Chatwoot provider authorize URLs with exact frontend callback redirects and required social scopes, includes Instagram `enable_fb_login=0` plus `force_authentication=1`, includes TikTok `client_key`, signs account callback state with optional `return_to`, and tracks both account authorization routes in route parity. Focused social authorization handler/router tests, route dump/parity regeneration (`947` routes; `397 exact`, `13 parameter-compatible`, `0 missing out of 410`), full `go test ./...`, and `git diff --check` passed; continue Phase 2/3 drift audit, Phase 6 placeholder audit, or B12 live smoke. diff --git a/docs/parity/gochat_routes.txt b/docs/parity/gochat_routes.txt index 7547a4af..8dd7d355 100644 --- a/docs/parity/gochat_routes.txt +++ b/docs/parity/gochat_routes.txt @@ -699,6 +699,7 @@ POST /api/v1/accounts/:account_id/inboxes/:inbox_id/reset_secret POST /api/v1/accounts/:account_id/inboxes/:inbox_id/set_agent_bot POST /api/v1/accounts/:account_id/inboxes/:inbox_id/sync_templates POST /api/v1/accounts/:account_id/inboxes/web_widget +POST /api/v1/accounts/:account_id/instagram/authorization POST /api/v1/accounts/:account_id/instagram/webhooks POST /api/v1/accounts/:account_id/instagram_channels/ POST /api/v1/accounts/:account_id/integrations/dyte/add_participant_to_meeting @@ -757,6 +758,7 @@ POST /api/v1/accounts/:account_id/teams POST /api/v1/accounts/:account_id/teams/ POST /api/v1/accounts/:account_id/teams/:team_id/team_members POST /api/v1/accounts/:account_id/teams/:team_id/team_members/ +POST /api/v1/accounts/:account_id/tiktok/authorization POST /api/v1/accounts/:account_id/tiktok_channels/ POST /api/v1/accounts/:account_id/twilio_sms_channels/ POST /api/v1/accounts/:account_id/twitter/authorization @@ -943,4 +945,4 @@ PUT /public/api/v1/csat_survey/:id PUT /public/api/v1/inboxes/:inbox_id/contacts/:contact_id PUT /public/api/v1/inboxes/:inbox_id/contacts/:contact_id/conversations/:conversation_id/messages/:message_id PUT /widget/direct_uploads/:upload_uuid -TOTAL: 945 +TOTAL: 947 diff --git a/docs/parity/route_parity.md b/docs/parity/route_parity.md index 9c2efe2c..46d3385d 100644 --- a/docs/parity/route_parity.md +++ b/docs/parity/route_parity.md @@ -7,7 +7,7 @@ Generated from: This report covers tracked frontend-critical Chatwoot routes from `reference/chatwoot/config/routes.rb`, including API v1 account routes, Captain/Copilot, assignment policies, widget/public APIs, and API v2 reports. Ruby is not installed in the workspace, so Chatwoot routes are sourced from static route declarations instead of `bin/rails routes`. -Summary: 395 exact, 0 method-compatible, 13 parameter-compatible, 0 missing out of 408 tracked critical routes. +Summary: 397 exact, 0 method-compatible, 13 parameter-compatible, 0 missing out of 410 tracked critical routes. ## Missing Critical Routes @@ -346,6 +346,7 @@ These routes exist with equivalent method and path shape but different parameter | POST | `/api/v1/accounts/:account_id/inboxes/:inbox_id/reset_secret` | `/api/v1/accounts/:account_id/inboxes/:inbox_id/reset_secret` | `api/v1/accounts/inboxes#reset_secret` | `routes.rb:262` | exact | | POST | `/api/v1/accounts/:account_id/inboxes/:inbox_id/set_agent_bot` | `/api/v1/accounts/:account_id/inboxes/:inbox_id/set_agent_bot` | `api/v1/accounts/inboxes#set_agent_bot` | `routes.rb:256` | exact | | POST | `/api/v1/accounts/:account_id/inboxes/:inbox_id/sync_templates` | `/api/v1/accounts/:account_id/inboxes/:inbox_id/sync_templates` | `api/v1/accounts/inboxes#sync_templates` | `routes.rb:258` | exact | +| POST | `/api/v1/accounts/:account_id/instagram/authorization` | `/api/v1/accounts/:account_id/instagram/authorization` | `api/v1/accounts/instagram/authorizations#create` | `routes.rb:327` | exact | | POST | `/api/v1/accounts/:account_id/integrations/dyte/add_participant_to_meeting` | `/api/v1/accounts/:account_id/integrations/dyte/add_participant_to_meeting` | `api/v1/accounts/integrations/dyte#add_participant_to_meeting` | `routes.rb:358` | exact | | POST | `/api/v1/accounts/:account_id/integrations/dyte/create_a_meeting` | `/api/v1/accounts/:account_id/integrations/dyte/create_a_meeting` | `api/v1/accounts/integrations/dyte#create_a_meeting` | `routes.rb:357` | exact | | POST | `/api/v1/accounts/:account_id/integrations/hooks` | `/api/v1/accounts/:account_id/integrations/hooks` | `api/v1/accounts/integrations/hooks#create` | `routes.rb:346` | exact | @@ -374,6 +375,7 @@ These routes exist with equivalent method and path shape but different parameter | POST | `/api/v1/accounts/:account_id/sla_policies` | `/api/v1/accounts/:account_id/sla_policies` | `api/v1/accounts/sla_policies#create` | `routes.rb:121` | exact | | POST | `/api/v1/accounts/:account_id/teams/` | `/api/v1/accounts/:account_id/teams/` | `api/v1/accounts/teams#create` | `routes.rb:296` | exact | | POST | `/api/v1/accounts/:account_id/teams/:team_id/team_members/` | `/api/v1/accounts/:account_id/teams/:team_id/team_members/` | `api/v1/accounts/teams/team_members#create` | `routes.rb:297` | exact | +| POST | `/api/v1/accounts/:account_id/tiktok/authorization` | `/api/v1/accounts/:account_id/tiktok/authorization` | `api/v1/accounts/tiktok/authorizations#create` | `routes.rb:331` | exact | | POST | `/api/v1/accounts/:account_id/twitter/authorization` | `/api/v1/accounts/:account_id/twitter/authorization` | `api/v1/accounts/twitter/authorizations#create` | `routes.rb:315` | exact | | POST | `/api/v1/accounts/:account_id/update_active_at` | `/api/v1/accounts/:account_id/update_active_at` | `api/v1/accounts#update_active_at` | `routes.rb:49` | exact | | POST | `/api/v1/accounts/:account_id/webhooks` | `/api/v1/accounts/:account_id/webhooks` | `api/v1/accounts/webhooks#create` | `routes.rb:342` | exact | diff --git a/internal/handler/api/v1/email_oauth_authorization.go b/internal/handler/api/v1/email_oauth_authorization.go index 266e4696..f46cf046 100644 --- a/internal/handler/api/v1/email_oauth_authorization.go +++ b/internal/handler/api/v1/email_oauth_authorization.go @@ -46,9 +46,17 @@ func buildChatwootEmailOAuthAuthorizationURL(accountID uint, cfg chatwootEmailOA } func signedChatwootOAuthState(accountID uint, secret string) (string, error) { - token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{ + return signedChatwootOAuthStateWithReturnTo(accountID, secret, "") +} + +func signedChatwootOAuthStateWithReturnTo(accountID uint, secret string, returnTo string) (string, error) { + claims := jwt.MapClaims{ "sub": accountID, "iat": time.Now().Unix(), - }) + } + if strings.TrimSpace(returnTo) != "" { + claims["return_to"] = strings.TrimSpace(returnTo) + } + token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) return token.SignedString([]byte(secret)) } diff --git a/internal/handler/api/v1/instagram_channel_handler.go b/internal/handler/api/v1/instagram_channel_handler.go index 1c5eae52..875d65b8 100644 --- a/internal/handler/api/v1/instagram_channel_handler.go +++ b/internal/handler/api/v1/instagram_channel_handler.go @@ -31,6 +31,7 @@ import ( "github.com/gochat/gochat/internal/repository" "github.com/gochat/gochat/internal/service" applogger "github.com/gochat/gochat/pkg/logger" + "github.com/gochat/gochat/pkg/response" ) // InstagramChannelHandler handles Instagram DM channel management. @@ -103,6 +104,24 @@ func (h *InstagramChannelHandler) Authorization(c *gin.Context) { }) } +// ChatwootAuthorization creates an Instagram OAuth authorization URL. +// POST /api/v1/accounts/:account_id/instagram/authorization +func (h *InstagramChannelHandler) ChatwootAuthorization(c *gin.Context) { + accountID, err := parseUintParam(c, "account_id") + if err != nil { + response.AbortWithStatusError(c, http.StatusBadRequest, response.ErrBadRequest, "invalid account_id") + return + } + + redirectURL, err := buildInstagramChatwootAuthorizationURL(accountID, authorizationReturnTo(c)) + if err != nil { + applogger.L().Errorf("Failed to build Instagram authorization URL: %v", err) + c.JSON(http.StatusUnprocessableEntity, gin.H{"success": false}) + return + } + c.JSON(http.StatusOK, gin.H{"success": true, "url": redirectURL}) +} + // InstagramOAuthCallbackRequest is the DTO for the OAuth callback. type InstagramOAuthCallbackRequest struct { Code string `json:"code" validate:"required"` diff --git a/internal/handler/api/v1/social_authorization.go b/internal/handler/api/v1/social_authorization.go new file mode 100644 index 00000000..89052fa7 --- /dev/null +++ b/internal/handler/api/v1/social_authorization.go @@ -0,0 +1,70 @@ +package v1 + +import ( + "fmt" + "net/url" + "os" + "strings" + + "github.com/gin-gonic/gin" +) + +const instagramAuthorizationScope = "instagram_business_basic,instagram_business_manage_messages" + +const tiktokAuthorizationScope = "user.info.basic,user.info.username,user.info.stats,user.info.profile,user.account.type,user.insights,message.list.read,message.list.send,message.list.manage" + +func authorizationReturnTo(c *gin.Context) string { + if value := strings.TrimSpace(c.Query("return_to")); value != "" { + return value + } + var payload struct { + ReturnTo string `json:"return_to" form:"return_to"` + } + _ = c.ShouldBind(&payload) + return strings.TrimSpace(payload.ReturnTo) +} + +func buildInstagramChatwootAuthorizationURL(accountID uint, returnTo string) (string, error) { + clientID := strings.TrimSpace(os.Getenv("INSTAGRAM_APP_ID")) + clientSecret := strings.TrimSpace(os.Getenv("INSTAGRAM_APP_SECRET")) + if clientID == "" || clientSecret == "" { + return "", fmt.Errorf("Instagram OAuth is not configured") + } + + state, err := signedChatwootOAuthStateWithReturnTo(accountID, clientSecret, returnTo) + if err != nil { + return "", err + } + frontendURL := strings.TrimRight(envOrDefaultV1("FRONTEND_URL", "http://localhost:3000"), "/") + params := url.Values{} + params.Set("client_id", clientID) + params.Set("redirect_uri", frontendURL+"/instagram/callback") + params.Set("scope", instagramAuthorizationScope) + params.Set("enable_fb_login", "0") + params.Set("force_authentication", "1") + params.Set("response_type", "code") + params.Set("state", state) + return "https://api.instagram.com/oauth/authorize?" + params.Encode(), nil +} + +func buildTikTokChatwootAuthorizationURL(accountID uint, returnTo string) (string, error) { + clientID := strings.TrimSpace(os.Getenv("TIKTOK_APP_ID")) + clientSecret := strings.TrimSpace(os.Getenv("TIKTOK_APP_SECRET")) + if clientID == "" || clientSecret == "" { + return "", fmt.Errorf("TikTok OAuth is not configured") + } + + state, err := signedChatwootOAuthStateWithReturnTo(accountID, clientSecret, returnTo) + if err != nil { + return "", err + } + frontendURL := strings.TrimRight(envOrDefaultV1("FRONTEND_URL", "http://localhost:3000"), "/") + params := url.Values{} + params.Set("client_id", clientID) + params.Set("client_key", clientID) + params.Set("redirect_uri", frontendURL+"/tiktok/callback") + params.Set("response_type", "code") + params.Set("scope", tiktokAuthorizationScope) + params.Set("state", state) + return "https://www.tiktok.com/v2/auth/authorize?" + params.Encode(), nil +} diff --git a/internal/handler/api/v1/social_authorization_test.go b/internal/handler/api/v1/social_authorization_test.go new file mode 100644 index 00000000..4d23d467 --- /dev/null +++ b/internal/handler/api/v1/social_authorization_test.go @@ -0,0 +1,121 @@ +package v1 + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "net/url" + "strings" + "testing" + + "github.com/gin-gonic/gin" + "github.com/golang-jwt/jwt/v5" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func setupSocialAuthorizationRouter() *gin.Engine { + gin.SetMode(gin.TestMode) + r := gin.New() + r.RedirectTrailingSlash = false + instagramHandler := NewInstagramChannelHandler(nil, nil, nil, nil) + tiktokHandler := NewTikTokChannelHandler(nil, nil, nil, nil) + r.POST("/api/v1/accounts/:account_id/instagram/authorization", instagramHandler.ChatwootAuthorization) + r.POST("/api/v1/accounts/:account_id/tiktok/authorization", tiktokHandler.ChatwootAuthorization) + return r +} + +func TestInstagramAuthorization_ReturnsChatwootPayload(t *testing.T) { + t.Setenv("INSTAGRAM_APP_ID", "instagram-client") + t.Setenv("INSTAGRAM_APP_SECRET", "instagram-secret") + t.Setenv("FRONTEND_URL", "https://app.example.test/") + + r := setupSocialAuthorizationRouter() + w := httptest.NewRecorder() + req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/42/instagram/authorization", strings.NewReader(`{"return_to":"onboarding"}`)) + req.Header.Set("Content-Type", "application/json") + r.ServeHTTP(w, req) + + assert.Equal(t, http.StatusOK, w.Code) + var resp map[string]interface{} + require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp)) + assert.Equal(t, true, resp["success"]) + + parsed, err := url.Parse(resp["url"].(string)) + require.NoError(t, err) + assert.Equal(t, "https://api.instagram.com/oauth/authorize", parsed.Scheme+"://"+parsed.Host+parsed.Path) + query := parsed.Query() + assert.Equal(t, "instagram-client", query.Get("client_id")) + assert.Equal(t, "https://app.example.test/instagram/callback", query.Get("redirect_uri")) + assert.Equal(t, "instagram_business_basic,instagram_business_manage_messages", query.Get("scope")) + assert.Equal(t, "0", query.Get("enable_fb_login")) + assert.Equal(t, "1", query.Get("force_authentication")) + assert.Equal(t, "code", query.Get("response_type")) + assertSocialSignedState(t, query.Get("state"), "instagram-secret", 42, "onboarding") +} + +func TestTikTokAuthorization_ReturnsChatwootPayload(t *testing.T) { + t.Setenv("TIKTOK_APP_ID", "tiktok-client") + t.Setenv("TIKTOK_APP_SECRET", "tiktok-secret") + t.Setenv("FRONTEND_URL", "https://app.example.test") + + r := setupSocialAuthorizationRouter() + w := httptest.NewRecorder() + req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/42/tiktok/authorization?return_to=onboarding", nil) + r.ServeHTTP(w, req) + + assert.Equal(t, http.StatusOK, w.Code) + var resp map[string]interface{} + require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp)) + assert.Equal(t, true, resp["success"]) + + parsed, err := url.Parse(resp["url"].(string)) + require.NoError(t, err) + assert.Equal(t, "https://www.tiktok.com/v2/auth/authorize", parsed.Scheme+"://"+parsed.Host+parsed.Path) + query := parsed.Query() + assert.Equal(t, "tiktok-client", query.Get("client_id")) + assert.Equal(t, "tiktok-client", query.Get("client_key")) + assert.Equal(t, "https://app.example.test/tiktok/callback", query.Get("redirect_uri")) + assert.Equal(t, tiktokAuthorizationScope, query.Get("scope")) + assert.Equal(t, "code", query.Get("response_type")) + assertSocialSignedState(t, query.Get("state"), "tiktok-secret", 42, "onboarding") +} + +func TestSocialAuthorization_BadAccountID(t *testing.T) { + r := setupSocialAuthorizationRouter() + w := httptest.NewRecorder() + req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/abc/instagram/authorization", nil) + r.ServeHTTP(w, req) + + assert.Equal(t, http.StatusBadRequest, w.Code) + var resp map[string]interface{} + require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp)) + errBody := resp["error"].(map[string]interface{}) + assert.Contains(t, errBody["message"], "invalid account_id") +} + +func TestSocialAuthorization_NotConfigured(t *testing.T) { + t.Setenv("INSTAGRAM_APP_ID", "") + t.Setenv("INSTAGRAM_APP_SECRET", "") + r := setupSocialAuthorizationRouter() + w := httptest.NewRecorder() + req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/42/instagram/authorization", nil) + r.ServeHTTP(w, req) + + assert.Equal(t, http.StatusUnprocessableEntity, w.Code) + var resp map[string]interface{} + require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp)) + assert.Equal(t, false, resp["success"]) +} + +func assertSocialSignedState(t *testing.T, state string, secret string, accountID float64, returnTo string) { + t.Helper() + claims := jwt.MapClaims{} + token, err := jwt.ParseWithClaims(state, claims, func(token *jwt.Token) (any, error) { + return []byte(secret), nil + }) + require.NoError(t, err) + require.True(t, token.Valid) + assert.Equal(t, accountID, claims["sub"]) + assert.Equal(t, returnTo, claims["return_to"]) +} diff --git a/internal/handler/api/v1/tiktok_channel_handler.go b/internal/handler/api/v1/tiktok_channel_handler.go index f8e15209..fefc994a 100644 --- a/internal/handler/api/v1/tiktok_channel_handler.go +++ b/internal/handler/api/v1/tiktok_channel_handler.go @@ -23,6 +23,7 @@ import ( "github.com/gochat/gochat/internal/repository" "github.com/gochat/gochat/internal/service" applogger "github.com/gochat/gochat/pkg/logger" + "github.com/gochat/gochat/pkg/response" ) // TikTokChannelHandler handles TikTok Business channel management. @@ -52,6 +53,24 @@ func NewTikTokChannelHandler( // === TikTok Channel CRUD === +// ChatwootAuthorization creates a TikTok OAuth authorization URL. +// POST /api/v1/accounts/:account_id/tiktok/authorization +func (h *TikTokChannelHandler) ChatwootAuthorization(c *gin.Context) { + accountID, err := parseUintParam(c, "account_id") + if err != nil { + response.AbortWithStatusError(c, http.StatusBadRequest, response.ErrBadRequest, "invalid account_id") + return + } + + redirectURL, err := buildTikTokChatwootAuthorizationURL(accountID, authorizationReturnTo(c)) + if err != nil { + applogger.L().Errorf("Failed to build TikTok authorization URL: %v", err) + c.JSON(http.StatusUnprocessableEntity, gin.H{"success": false}) + return + } + c.JSON(http.StatusOK, gin.H{"success": true, "url": redirectURL}) +} + // CreateTikTokChannelRequest is the DTO for creating a TikTok Business channel inbox. type CreateTikTokChannelRequest struct { Name string `json:"name" validate:"required,min=2"` diff --git a/internal/router/router.go b/internal/router/router.go index 9b0c38a6..44a34584 100644 --- a/internal/router/router.go +++ b/internal/router/router.go @@ -1584,6 +1584,8 @@ func registerV1Routes(g *gin.RouterGroup, h *Handlers) { accountScoped.POST("/twitter/authorization", middleware.RoleCheck("administrator"), h.TwitterChannel.ChatwootAuthorization) accountScoped.POST("/microsoft/authorization", middleware.RoleCheck("administrator"), h.MicrosoftChannel.ChatwootAuthorization) accountScoped.POST("/google/authorization", middleware.RoleCheck("administrator"), h.GoogleChannel.ChatwootAuthorization) + accountScoped.POST("/instagram/authorization", middleware.RoleCheck("administrator"), h.InstagramChannel.ChatwootAuthorization) + accountScoped.POST("/tiktok/authorization", middleware.RoleCheck("administrator"), h.TikTokChannel.ChatwootAuthorization) // G16: Third-party Integrations — IntegrationHook CRUD + Slack/Shopify/Linear/Notion // Reference: Chatwoot namespace :integrations under :account