Restructure omni services and add Chatwoot research snapshot

research/chatwoot/app/controllers/api/base_controller.rb

@@ -0,0 +1,23 @@
+class Api::BaseController < ApplicationController
+  include AccessTokenAuthHelper
+  respond_to :json
+  before_action :authenticate_access_token!, if: :authenticate_by_access_token?
+  before_action :validate_bot_access_token!, if: :authenticate_by_access_token?
+  before_action :authenticate_user!, unless: :authenticate_by_access_token?
+
+  private
+
+  def authenticate_by_access_token?
+    request.headers[:api_access_token].present? || request.headers[:HTTP_API_ACCESS_TOKEN].present?
+  end
+
+  def check_authorization(model = nil)
+    model ||= controller_name.classify.constantize
+
+    authorize(model)
+  end
+
+  def check_admin_authorization?
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/actions/contact_merges_controller.rb

@@ -0,0 +1,27 @@
+class Api::V1::Accounts::Actions::ContactMergesController < Api::V1::Accounts::BaseController
+  before_action :set_base_contact, only: [:create]
+  before_action :set_mergee_contact, only: [:create]
+
+  def create
+    contact_merge_action = ContactMergeAction.new(
+      account: Current.account,
+      base_contact: @base_contact,
+      mergee_contact: @mergee_contact
+    )
+    contact_merge_action.perform
+  end
+
+  private
+
+  def set_base_contact
+    @base_contact = contacts.find(params[:base_contact_id])
+  end
+
+  def set_mergee_contact
+    @mergee_contact = contacts.find(params[:mergee_contact_id])
+  end
+
+  def contacts
+    @contacts ||= Current.account.contacts
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/agent_bots_controller.rb

@@ -0,0 +1,51 @@
+class Api::V1::Accounts::AgentBotsController < Api::V1::Accounts::BaseController
+  before_action :current_account
+  before_action :check_authorization
+  before_action :agent_bot, except: [:index, :create]
+
+  def index
+    @agent_bots = AgentBot.accessible_to(Current.account)
+  end
+
+  def show; end
+
+  def create
+    @agent_bot = Current.account.agent_bots.create!(permitted_params.except(:avatar_url))
+    process_avatar_from_url
+  end
+
+  def update
+    @agent_bot.update!(permitted_params.except(:avatar_url))
+    process_avatar_from_url
+  end
+
+  def avatar
+    @agent_bot.avatar.purge if @agent_bot.avatar.attached?
+    @agent_bot
+  end
+
+  def destroy
+    @agent_bot.destroy!
+    head :ok
+  end
+
+  def reset_access_token
+    @agent_bot.access_token.regenerate_token
+    @agent_bot.reload
+  end
+
+  private
+
+  def agent_bot
+    @agent_bot = AgentBot.accessible_to(Current.account).find(params[:id]) if params[:action] == 'show'
+    @agent_bot ||= Current.account.agent_bots.find(params[:id])
+  end
+
+  def permitted_params
+    params.permit(:name, :description, :outgoing_url, :avatar, :avatar_url, :bot_type, bot_config: {})
+  end
+
+  def process_avatar_from_url
+    ::Avatar::AvatarFromUrlJob.perform_later(@agent_bot, params[:avatar_url]) if params[:avatar_url].present?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/agents_controller.rb

@@ -0,0 +1,113 @@
+class Api::V1::Accounts::AgentsController < Api::V1::Accounts::BaseController
+  before_action :fetch_agent, except: [:create, :index, :bulk_create]
+  before_action :check_authorization
+  before_action :validate_limit, only: [:create]
+  before_action :validate_limit_for_bulk_create, only: [:bulk_create]
+
+  def index
+    @agents = agents
+  end
+
+  def create
+    builder = AgentBuilder.new(
+      email: new_agent_params['email'],
+      name: new_agent_params['name'],
+      role: new_agent_params['role'],
+      availability: new_agent_params['availability'],
+      auto_offline: new_agent_params['auto_offline'],
+      inviter: current_user,
+      account: Current.account
+    )
+
+    @agent = builder.perform
+  end
+
+  def update
+    @agent.update!(agent_params.slice(:name).compact)
+    @agent.current_account_user.update!(agent_params.slice(*account_user_attributes).compact)
+  end
+
+  def destroy
+    @agent.current_account_user.destroy!
+    delete_user_record(@agent)
+    head :ok
+  end
+
+  def bulk_create
+    emails = params[:emails]
+
+    emails.each do |email|
+      builder = AgentBuilder.new(
+        email: email,
+        name: email.split('@').first,
+        inviter: current_user,
+        account: Current.account
+      )
+      begin
+        builder.perform
+      rescue ActiveRecord::RecordInvalid => e
+        Rails.logger.info "[Agent#bulk_create] ignoring email #{email}, errors: #{e.record.errors}"
+      end
+    end
+
+    # This endpoint is used to bulk create agents during onboarding
+    # onboarding_step key in present in Current account custom attributes, since this is a one time operation
+    Current.account.custom_attributes.delete('onboarding_step')
+    Current.account.save!
+    head :ok
+  end
+
+  private
+
+  def check_authorization
+    super(User)
+  end
+
+  def fetch_agent
+    @agent = agents.find(params[:id])
+  end
+
+  def account_user_attributes
+    [:role, :availability, :auto_offline]
+  end
+
+  def allowed_agent_params
+    [:name, :email, :role, :availability, :auto_offline]
+  end
+
+  def agent_params
+    params.require(:agent).permit(allowed_agent_params)
+  end
+
+  def new_agent_params
+    params.require(:agent).permit(:email, :name, :role, :availability, :auto_offline)
+  end
+
+  def agents
+    @agents ||= Current.account.users.order_by_full_name.includes(:account_users, { avatar_attachment: [:blob] })
+  end
+
+  def validate_limit_for_bulk_create
+    limit_available = params[:emails].count <= available_agent_count
+
+    render_payment_required('Account limit exceeded. Please purchase more licenses') unless limit_available
+  end
+
+  def validate_limit
+    render_payment_required('Account limit exceeded. Please purchase more licenses') unless can_add_agent?
+  end
+
+  def available_agent_count
+    Current.account.usage_limits[:agents] - agents.count
+  end
+
+  def can_add_agent?
+    available_agent_count.positive?
+  end
+
+  def delete_user_record(agent)
+    DeleteObjectJob.perform_later(agent) if agent.reload.account_users.blank?
+  end
+end
+
+Api::V1::Accounts::AgentsController.prepend_mod_with('Api::V1::Accounts::AgentsController')

research/chatwoot/app/controllers/api/v1/accounts/articles_controller.rb

@@ -0,0 +1,86 @@
+class Api::V1::Accounts::ArticlesController < Api::V1::Accounts::BaseController
+  before_action :portal
+  before_action :check_authorization
+  before_action :fetch_article, except: [:index, :create, :reorder]
+  before_action :set_current_page, only: [:index]
+
+  def index
+    @portal_articles = @portal.articles
+
+    set_article_count
+
+    @articles = @articles.search(list_params)
+
+    @articles = if list_params[:category_slug].present?
+                  @articles.order_by_position.page(@current_page)
+                else
+                  @articles.order_by_updated_at.page(@current_page)
+                end
+  end
+
+  def show; end
+  def edit; end
+
+  def create
+    params_with_defaults = article_params
+    params_with_defaults[:status] ||= :draft
+    @article = @portal.articles.create!(params_with_defaults)
+    @article.associate_root_article(article_params[:associated_article_id])
+    render json: { error: @article.errors.messages }, status: :unprocessable_entity and return unless @article.valid?
+  end
+
+  def update
+    @article.update!(article_params) if params[:article].present?
+    render json: { error: @article.errors.messages }, status: :unprocessable_entity and return unless @article.valid?
+  end
+
+  def destroy
+    @article.destroy!
+    head :ok
+  end
+
+  def reorder
+    Article.update_positions(params[:positions_hash])
+    head :ok
+  end
+
+  private
+
+  def set_article_count
+    # Search the params without status and author_id, use this to
+    # compute mine count published draft etc
+    base_search_params = list_params.except(:status, :author_id)
+    @articles = @portal_articles.search(base_search_params)
+
+    @articles_count = @articles.count
+    @mine_articles_count = @articles.search_by_author(Current.user.id).count
+    @published_articles_count = @articles.published.count
+    @draft_articles_count = @articles.draft.count
+    @archived_articles_count = @articles.archived.count
+  end
+
+  def fetch_article
+    @article = @portal.articles.find(params[:id])
+  end
+
+  def portal
+    @portal ||= Current.account.portals.find_by!(slug: params[:portal_id])
+  end
+
+  def article_params
+    params.require(:article).permit(
+      :title, :slug, :position, :content, :description, :category_id, :author_id, :associated_article_id, :status,
+      :locale, meta: [:title,
+                      :description,
+                      { tags: [] }]
+    )
+  end
+
+  def list_params
+    params.permit(:locale, :query, :page, :category_slug, :status, :author_id)
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/assignable_agents_controller.rb

@@ -0,0 +1,24 @@
+class Api::V1::Accounts::AssignableAgentsController < Api::V1::Accounts::BaseController
+  before_action :fetch_inboxes
+
+  def index
+    agent_ids = @inboxes.map do |inbox|
+      authorize inbox, :show?
+      member_ids = inbox.members.pluck(:user_id)
+      member_ids
+    end
+    agent_ids = agent_ids.inject(:&)
+    agents = Current.account.users.where(id: agent_ids)
+    @assignable_agents = (agents + Current.account.administrators).uniq
+  end
+
+  private
+
+  def fetch_inboxes
+    @inboxes = Current.account.inboxes.find(permitted_params[:inbox_ids])
+  end
+
+  def permitted_params
+    params.permit(inbox_ids: [])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/assignment_policies/inboxes_controller.rb

@@ -0,0 +1,20 @@
+class Api::V1::Accounts::AssignmentPolicies::InboxesController < Api::V1::Accounts::BaseController
+  before_action :fetch_assignment_policy
+  before_action -> { check_authorization(AssignmentPolicy) }
+
+  def index
+    @inboxes = @assignment_policy.inboxes
+  end
+
+  private
+
+  def fetch_assignment_policy
+    @assignment_policy = Current.account.assignment_policies.find(
+      params[:assignment_policy_id]
+    )
+  end
+
+  def permitted_params
+    params.permit(:assignment_policy_id)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/assignment_policies_controller.rb

@@ -0,0 +1,36 @@
+class Api::V1::Accounts::AssignmentPoliciesController < Api::V1::Accounts::BaseController
+  before_action :fetch_assignment_policy, only: [:show, :update, :destroy]
+  before_action :check_authorization
+
+  def index
+    @assignment_policies = Current.account.assignment_policies
+  end
+
+  def show; end
+
+  def create
+    @assignment_policy = Current.account.assignment_policies.create!(assignment_policy_params)
+  end
+
+  def update
+    @assignment_policy.update!(assignment_policy_params)
+  end
+
+  def destroy
+    @assignment_policy.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_assignment_policy
+    @assignment_policy = Current.account.assignment_policies.find(params[:id])
+  end
+
+  def assignment_policy_params
+    params.require(:assignment_policy).permit(
+      :name, :description, :assignment_order, :conversation_priority,
+      :fair_distribution_limit, :fair_distribution_window, :enabled
+    )
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/automation_rules_controller.rb

@@ -0,0 +1,68 @@
+class Api::V1::Accounts::AutomationRulesController < Api::V1::Accounts::BaseController
+  include AttachmentConcern
+
+  before_action :check_authorization
+  before_action :fetch_automation_rule, only: [:show, :update, :destroy, :clone]
+
+  def index
+    @automation_rules = Current.account.automation_rules
+  end
+
+  def show; end
+
+  def create
+    blobs, actions, error = validate_and_prepare_attachments(params[:actions])
+    return render_could_not_create_error(error) if error
+
+    @automation_rule = Current.account.automation_rules.new(automation_rules_permit)
+    @automation_rule.actions = actions
+    @automation_rule.conditions = params[:conditions]
+
+    return render_could_not_create_error(@automation_rule.errors.messages) unless @automation_rule.valid?
+
+    @automation_rule.save!
+    blobs.each { |blob| @automation_rule.files.attach(blob) }
+  end
+
+  def update
+    blobs, actions, error = validate_and_prepare_attachments(params[:actions], @automation_rule)
+    return render_could_not_create_error(error) if error
+
+    ActiveRecord::Base.transaction do
+      @automation_rule.assign_attributes(automation_rules_permit)
+      @automation_rule.actions = actions if params[:actions]
+      @automation_rule.conditions = params[:conditions] if params[:conditions]
+      @automation_rule.save!
+      blobs.each { |blob| @automation_rule.files.attach(blob) }
+    rescue StandardError => e
+      Rails.logger.error e
+      render_could_not_create_error(@automation_rule.errors.messages)
+    end
+  end
+
+  def destroy
+    @automation_rule.destroy!
+    head :ok
+  end
+
+  def clone
+    automation_rule = Current.account.automation_rules.find_by(id: params[:automation_rule_id])
+    new_rule = automation_rule.dup
+    new_rule.save!
+    @automation_rule = new_rule
+  end
+
+  private
+
+  def automation_rules_permit
+    params.permit(
+      :name, :description, :event_name, :active,
+      conditions: [:attribute_key, :filter_operator, :query_operator, :custom_attribute_type, { values: [] }],
+      actions: [:action_name, { action_params: [] }]
+    )
+  end
+
+  def fetch_automation_rule
+    @automation_rule = Current.account.automation_rules.find_by(id: params[:id])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/base_controller.rb

@@ -0,0 +1,6 @@
+class Api::V1::Accounts::BaseController < Api::BaseController
+  include SwitchLocale
+  include EnsureCurrentAccountHelper
+  before_action :current_account
+  around_action :switch_locale_using_account_locale
+end

research/chatwoot/app/controllers/api/v1/accounts/bulk_actions_controller.rb

@@ -0,0 +1,68 @@
+class Api::V1::Accounts::BulkActionsController < Api::V1::Accounts::BaseController
+  def create
+    case normalized_type
+    when 'Conversation'
+      enqueue_conversation_job
+      head :ok
+    when 'Contact'
+      check_authorization_for_contact_action
+      enqueue_contact_job
+      head :ok
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def normalized_type
+    params[:type].to_s.camelize
+  end
+
+  def enqueue_conversation_job
+    ::BulkActionsJob.perform_later(
+      account: @current_account,
+      user: current_user,
+      params: conversation_params
+    )
+  end
+
+  def enqueue_contact_job
+    Contacts::BulkActionJob.perform_later(
+      @current_account.id,
+      current_user.id,
+      contact_params
+    )
+  end
+
+  def delete_contact_action?
+    params[:action_name] == 'delete'
+  end
+
+  def check_authorization_for_contact_action
+    authorize(Contact, :destroy?) if delete_contact_action?
+  end
+
+  def conversation_params
+    # TODO: Align conversation payloads with the `{ action_name, action_attributes }`
+    # and then remove this method in favor of a common params method.
+    base = params.permit(
+      :snoozed_until,
+      fields: [:status, :assignee_id, :team_id]
+    )
+    append_common_bulk_attributes(base)
+  end
+
+  def contact_params
+    # TODO: remove this method in favor of a common params method.
+    # once legacy conversation payloads are migrated.
+    append_common_bulk_attributes({})
+  end
+
+  def append_common_bulk_attributes(base_params)
+    # NOTE: Conversation payloads historically diverged per action. Going forward we
+    # want all objects to share a common contract: `{ action_name, action_attributes }`
+    common = params.permit(:type, :action_name, ids: [], labels: [add: [], remove: []])
+    base_params.merge(common)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/callbacks_controller.rb

@@ -0,0 +1,116 @@
+class Api::V1::Accounts::CallbacksController < Api::V1::Accounts::BaseController
+  before_action :inbox, only: [:reauthorize_page]
+
+  def register_facebook_page
+    user_access_token = params[:user_access_token]
+    page_access_token = params[:page_access_token]
+    page_id = params[:page_id]
+    inbox_name = params[:inbox_name]
+    ActiveRecord::Base.transaction do
+      facebook_channel = Current.account.facebook_pages.create!(
+        page_id: page_id, user_access_token: user_access_token,
+        page_access_token: page_access_token
+      )
+      @facebook_inbox = Current.account.inboxes.create!(name: inbox_name, channel: facebook_channel)
+      set_instagram_id(page_access_token, facebook_channel)
+      set_avatar(@facebook_inbox, page_id)
+    end
+  rescue StandardError => e
+    ChatwootExceptionTracker.new(e).capture_exception
+    Rails.logger.error "Error in register_facebook_page: #{e.message}"
+    # Additional log statements
+    log_additional_info
+  end
+
+  def log_additional_info
+    Rails.logger.debug do
+      "user_access_token: #{params[:user_access_token]} , page_access_token: #{params[:page_access_token]} ,
+      page_id: #{params[:page_id]}, inbox_name: #{params[:inbox_name]}"
+    end
+  end
+
+  def facebook_pages
+    pages = []
+    fb_pages = fb_object.get_connections('me', 'accounts')
+    pages.concat(fb_pages)
+    while fb_pages.respond_to?(:next_page) && (next_page = fb_pages.next_page)
+      fb_pages = next_page
+      pages.concat(fb_pages)
+    end
+    @page_details = mark_already_existing_facebook_pages(pages)
+  end
+
+  def set_instagram_id(page_access_token, facebook_channel)
+    fb_object = Koala::Facebook::API.new(page_access_token)
+    response = fb_object.get_connections('me', '', { fields: 'instagram_business_account' })
+    return if response['instagram_business_account'].blank?
+
+    instagram_id = response['instagram_business_account']['id']
+    facebook_channel.update(instagram_id: instagram_id)
+  rescue StandardError => e
+    Rails.logger.error "Error in set_instagram_id: #{e.message}"
+  end
+
+  # get params[:inbox_id], current_account. params[:omniauth_token]
+  def reauthorize_page
+    if @inbox&.facebook?
+      fb_page_id = @inbox.channel.page_id
+      page_details = fb_object.get_connections('me', 'accounts')
+
+      if (page_detail = (page_details || []).detect { |page| fb_page_id == page['id'] })
+        update_fb_page(fb_page_id, page_detail['access_token'])
+        render and return
+      end
+    end
+
+    head :unprocessable_entity
+  end
+
+  private
+
+  def inbox
+    @inbox = Current.account.inboxes.find_by(id: params[:inbox_id])
+  end
+
+  def update_fb_page(fb_page_id, access_token)
+    fb_page = get_fb_page(fb_page_id)
+    ActiveRecord::Base.transaction do
+      fb_page&.update!(user_access_token: @user_access_token, page_access_token: access_token)
+      set_instagram_id(access_token, fb_page)
+      fb_page&.reauthorized!
+    rescue StandardError => e
+      ChatwootExceptionTracker.new(e).capture_exception
+      Rails.logger.error "Error in update_fb_page: #{e.message}"
+    end
+  end
+
+  def get_fb_page(fb_page_id)
+    Current.account.facebook_pages.find_by(page_id: fb_page_id)
+  end
+
+  def fb_object
+    @user_access_token = long_lived_token(params[:omniauth_token])
+    Koala::Facebook::API.new(@user_access_token)
+  end
+
+  def long_lived_token(omniauth_token)
+    koala = Koala::Facebook::OAuth.new(GlobalConfigService.load('FB_APP_ID', ''), GlobalConfigService.load('FB_APP_SECRET', ''))
+    koala.exchange_access_token_info(omniauth_token)['access_token']
+  rescue StandardError => e
+    Rails.logger.error "Error in long_lived_token: #{e.message}"
+  end
+
+  def mark_already_existing_facebook_pages(data)
+    return [] if data.empty?
+
+    data.inject([]) do |result, page_detail|
+      page_detail[:exists] = Current.account.facebook_pages.exists?(page_id: page_detail['id'])
+      result << page_detail
+    end
+  end
+
+  def set_avatar(facebook_inbox, page_id)
+    avatar_url = "https://graph.facebook.com/#{page_id}/picture?type=large"
+    Avatar::AvatarFromUrlJob.perform_later(facebook_inbox, avatar_url)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/campaigns_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::CampaignsController < Api::V1::Accounts::BaseController
+  before_action :campaign, except: [:index, :create]
+  before_action :check_authorization
+
+  def index
+    @campaigns = Current.account.campaigns
+  end
+
+  def show; end
+
+  def create
+    @campaign = Current.account.campaigns.create!(campaign_params)
+  end
+
+  def update
+    @campaign.update!(campaign_params)
+  end
+
+  def destroy
+    @campaign.destroy!
+    head :ok
+  end
+
+  private
+
+  def campaign
+    @campaign ||= Current.account.campaigns.find_by(display_id: params[:id])
+  end
+
+  def campaign_params
+    params.require(:campaign).permit(:title, :description, :message, :enabled, :trigger_only_during_business_hours, :inbox_id, :sender_id,
+                                     :scheduled_at, audience: [:type, :id], trigger_rules: {}, template_params: {})
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/canned_responses_controller.rb

@@ -0,0 +1,44 @@
+class Api::V1::Accounts::CannedResponsesController < Api::V1::Accounts::BaseController
+  before_action :fetch_canned_response, only: [:update, :destroy]
+
+  def index
+    render json: canned_responses
+  end
+
+  def create
+    @canned_response = Current.account.canned_responses.new(canned_response_params)
+    @canned_response.save!
+    render json: @canned_response
+  end
+
+  def update
+    @canned_response.update!(canned_response_params)
+    render json: @canned_response
+  end
+
+  def destroy
+    @canned_response.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_canned_response
+    @canned_response = Current.account.canned_responses.find(params[:id])
+  end
+
+  def canned_response_params
+    params.require(:canned_response).permit(:short_code, :content)
+  end
+
+  def canned_responses
+    if params[:search]
+      Current.account.canned_responses
+             .where('short_code ILIKE :search OR content ILIKE :search', search: "%#{params[:search]}%")
+             .order_by_search(params[:search])
+
+    else
+      Current.account.canned_responses
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/captain/preferences_controller.rb

@@ -0,0 +1,76 @@
+class Api::V1::Accounts::Captain::PreferencesController < Api::V1::Accounts::BaseController
+  before_action :current_account
+  before_action :authorize_account_update, only: [:update]
+
+  def show
+    render json: preferences_payload
+  end
+
+  def update
+    params_to_update = captain_params
+    @current_account.captain_models = params_to_update[:captain_models] if params_to_update[:captain_models]
+    @current_account.captain_features = params_to_update[:captain_features] if params_to_update[:captain_features]
+    @current_account.save!
+
+    render json: preferences_payload
+  end
+
+  private
+
+  def preferences_payload
+    {
+      providers: Llm::Models.providers,
+      models: Llm::Models.models,
+      features: features_with_account_preferences
+    }
+  end
+
+  def authorize_account_update
+    authorize @current_account, :update?
+  end
+
+  def captain_params
+    permitted = {}
+    permitted[:captain_models] = merged_captain_models if params[:captain_models].present?
+    permitted[:captain_features] = merged_captain_features if params[:captain_features].present?
+    permitted
+  end
+
+  def merged_captain_models
+    existing_models = @current_account.captain_models || {}
+    existing_models.merge(permitted_captain_models)
+  end
+
+  def merged_captain_features
+    existing_features = @current_account.captain_features || {}
+    existing_features.merge(permitted_captain_features)
+  end
+
+  def permitted_captain_models
+    params.require(:captain_models).permit(
+      :editor, :assistant, :copilot, :label_suggestion,
+      :audio_transcription, :help_center_search
+    ).to_h.stringify_keys
+  end
+
+  def permitted_captain_features
+    params.require(:captain_features).permit(
+      :editor, :assistant, :copilot, :label_suggestion,
+      :audio_transcription, :help_center_search
+    ).to_h.stringify_keys
+  end
+
+  def features_with_account_preferences
+    preferences = Current.account.captain_preferences
+    account_features = preferences[:features] || {}
+    account_models = preferences[:models] || {}
+
+    Llm::Models.feature_keys.index_with do |feature_key|
+      config = Llm::Models.feature_config(feature_key)
+      config.merge(
+        enabled: account_features[feature_key] == true,
+        selected: account_models[feature_key] || config[:default]
+      )
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/categories_controller.rb

@@ -0,0 +1,58 @@
+class Api::V1::Accounts::CategoriesController < Api::V1::Accounts::BaseController
+  before_action :portal
+  before_action :check_authorization
+  before_action :fetch_category, except: [:index, :create]
+  before_action :set_current_page, only: [:index]
+
+  def index
+    @current_locale = params[:locale]
+    @categories = @portal.categories.search(params)
+  end
+
+  def show; end
+
+  def create
+    @category = @portal.categories.create!(category_params)
+    @category.related_categories << related_categories_records
+    render json: { error: @category.errors.messages }, status: :unprocessable_entity and return unless @category.valid?
+
+    @category.save!
+  end
+
+  def update
+    @category.update!(category_params)
+    @category.related_categories = related_categories_records if related_categories_records.any?
+    render json: { error: @category.errors.messages }, status: :unprocessable_entity and return unless @category.valid?
+
+    @category.save!
+  end
+
+  def destroy
+    @category.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_category
+    @category = @portal.categories.find(params[:id])
+  end
+
+  def portal
+    @portal ||= Current.account.portals.find_by(slug: params[:portal_id])
+  end
+
+  def related_categories_records
+    @portal.categories.where(id: params[:category][:related_category_ids])
+  end
+
+  def category_params
+    params.require(:category).permit(
+      :name, :description, :position, :slug, :locale, :icon, :parent_category_id, :associated_category_id
+    )
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/channels/twilio_channels_controller.rb

@@ -0,0 +1,70 @@
+# TODO : Move this to inboxes controller and deprecate this controller
+# No need to retain this controller as we could handle everything centrally in inboxes controller
+
+class Api::V1::Accounts::Channels::TwilioChannelsController < Api::V1::Accounts::BaseController
+  before_action :authorize_request
+
+  def create
+    process_create
+  rescue StandardError => e
+    render_could_not_create_error(e.message)
+  end
+
+  private
+
+  def authorize_request
+    authorize ::Inbox
+  end
+
+  def process_create
+    ActiveRecord::Base.transaction do
+      authenticate_twilio
+      build_inbox
+      setup_webhooks if @twilio_channel.sms?
+    end
+  end
+
+  def authenticate_twilio
+    client = if permitted_params[:api_key_sid].present?
+               Twilio::REST::Client.new(permitted_params[:api_key_sid], permitted_params[:auth_token], permitted_params[:account_sid])
+             else
+               Twilio::REST::Client.new(permitted_params[:account_sid], permitted_params[:auth_token])
+             end
+    client.messages.list(limit: 1)
+  end
+
+  def setup_webhooks
+    ::Twilio::WebhookSetupService.new(inbox: @inbox).perform
+  end
+
+  def phone_number
+    return if permitted_params[:phone_number].blank?
+
+    medium == 'sms' ? permitted_params[:phone_number] : "whatsapp:#{permitted_params[:phone_number]}"
+  end
+
+  def medium
+    permitted_params[:medium]
+  end
+
+  def build_inbox
+    @twilio_channel = Current.account.twilio_sms.create!(
+      account_sid: permitted_params[:account_sid],
+      auth_token: permitted_params[:auth_token],
+      api_key_sid: permitted_params[:api_key_sid],
+      messaging_service_sid: permitted_params[:messaging_service_sid].presence,
+      phone_number: phone_number,
+      medium: medium
+    )
+    @inbox = Current.account.inboxes.create!(
+      name: permitted_params[:name],
+      channel: @twilio_channel
+    )
+  end
+
+  def permitted_params
+    params.require(:twilio_channel).permit(
+      :messaging_service_sid, :phone_number, :account_sid, :auth_token, :name, :medium, :api_key_sid
+    )
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/contact_inboxes_controller.rb

@@ -0,0 +1,21 @@
+class Api::V1::Accounts::ContactInboxesController < Api::V1::Accounts::BaseController
+  before_action :ensure_inbox
+
+  def filter
+    contact_inbox = @inbox.contact_inboxes.where(inbox_id: permitted_params[:inbox_id], source_id: permitted_params[:source_id])
+    return head :not_found if contact_inbox.empty?
+
+    @contact = contact_inbox.first.contact
+  end
+
+  private
+
+  def ensure_inbox
+    @inbox = Current.account.inboxes.find(permitted_params[:inbox_id])
+    authorize @inbox, :show?
+  end
+
+  def permitted_params
+    params.permit(:inbox_id, :source_id)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/contacts/base_controller.rb

@@ -0,0 +1,9 @@
+class Api::V1::Accounts::Contacts::BaseController < Api::V1::Accounts::BaseController
+  before_action :ensure_contact
+
+  private
+
+  def ensure_contact
+    @contact = Current.account.contacts.find(params[:contact_id])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/contacts/contact_inboxes_controller.rb

@@ -0,0 +1,20 @@
+class Api::V1::Accounts::Contacts::ContactInboxesController < Api::V1::Accounts::Contacts::BaseController
+  include HmacConcern
+  before_action :ensure_inbox, only: [:create]
+
+  def create
+    @contact_inbox = ContactInboxBuilder.new(
+      contact: @contact,
+      inbox: @inbox,
+      source_id: params[:source_id],
+      hmac_verified: hmac_verified?
+    ).perform
+  end
+
+  private
+
+  def ensure_inbox
+    @inbox = Current.account.inboxes.find(params[:inbox_id])
+    authorize @inbox, :show?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/contacts/conversations_controller.rb

@@ -0,0 +1,17 @@
+class Api::V1::Accounts::Contacts::ConversationsController < Api::V1::Accounts::Contacts::BaseController
+  def index
+    # Start with all conversations for this contact
+    conversations = Current.account.conversations.includes(
+      :assignee, :contact, :inbox, :taggings
+    ).where(contact_id: @contact.id)
+
+    # Apply permission-based filtering using the existing service
+    conversations = Conversations::PermissionFilterService.new(
+      conversations,
+      Current.user,
+      Current.account
+    ).perform
+
+    @conversations = conversations.order(last_activity_at: :desc).limit(20)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/contacts/labels_controller.rb

@@ -0,0 +1,13 @@
+class Api::V1::Accounts::Contacts::LabelsController < Api::V1::Accounts::Contacts::BaseController
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= @contact
+  end
+
+  def permitted_params
+    params.permit(labels: [])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/contacts/notes_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::Contacts::NotesController < Api::V1::Accounts::Contacts::BaseController
+  before_action :note, except: [:index, :create]
+
+  def index
+    @notes = @contact.notes.latest.includes(:user)
+  end
+
+  def show; end
+
+  def create
+    @note = @contact.notes.create!(note_params)
+  end
+
+  def update
+    @note.update(note_params)
+  end
+
+  def destroy
+    @note.destroy!
+    head :ok
+  end
+
+  private
+
+  def note
+    @note ||= @contact.notes.find(params[:id])
+  end
+
+  def note_params
+    params.require(:note).permit(:content).merge({ contact_id: @contact.id, user_id: Current.user.id })
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/contacts_controller.rb

@@ -0,0 +1,214 @@
+class Api::V1::Accounts::ContactsController < Api::V1::Accounts::BaseController
+  include Sift
+  sort_on :email, type: :string
+  sort_on :name, internal_name: :order_on_name, type: :scope, scope_params: [:direction]
+  sort_on :phone_number, type: :string
+  sort_on :last_activity_at, internal_name: :order_on_last_activity_at, type: :scope, scope_params: [:direction]
+  sort_on :created_at, internal_name: :order_on_created_at, type: :scope, scope_params: [:direction]
+  sort_on :company, internal_name: :order_on_company_name, type: :scope, scope_params: [:direction]
+  sort_on :city, internal_name: :order_on_city, type: :scope, scope_params: [:direction]
+  sort_on :country, internal_name: :order_on_country_name, type: :scope, scope_params: [:direction]
+
+  RESULTS_PER_PAGE = 15
+
+  before_action :check_authorization
+  before_action :set_current_page, only: [:index, :active, :search, :filter]
+  before_action :fetch_contact, only: [:show, :update, :destroy, :avatar, :contactable_inboxes, :destroy_custom_attributes]
+  before_action :set_include_contact_inboxes, only: [:index, :active, :search, :filter, :show, :update]
+
+  def index
+    @contacts = fetch_contacts(resolved_contacts)
+    @contacts_count = @contacts.total_count
+  end
+
+  def search
+    render json: { error: 'Specify search string with parameter q' }, status: :unprocessable_entity if params[:q].blank? && return
+
+    contacts = Current.account.contacts.where(
+      'name ILIKE :search OR email ILIKE :search OR phone_number ILIKE :search OR contacts.identifier LIKE :search',
+      search: "%#{params[:q].strip}%"
+    )
+    @contacts = fetch_contacts_with_has_more(contacts)
+  end
+
+  def import
+    render json: { error: I18n.t('errors.contacts.import.failed') }, status: :unprocessable_entity and return if params[:import_file].blank?
+
+    ActiveRecord::Base.transaction do
+      import = Current.account.data_imports.create!(data_type: 'contacts')
+      import.import_file.attach(params[:import_file])
+    end
+
+    head :ok
+  end
+
+  def export
+    column_names = params['column_names']
+    filter_params = { :payload => params.permit!['payload'], :label => params.permit!['label'] }
+    Account::ContactsExportJob.perform_later(Current.account.id, Current.user.id, column_names, filter_params)
+    head :ok, message: I18n.t('errors.contacts.export.success')
+  end
+
+  # returns online contacts
+  def active
+    contacts = Current.account.contacts.where(id: ::OnlineStatusTracker
+                  .get_available_contact_ids(Current.account.id))
+    @contacts = fetch_contacts(contacts)
+    @contacts_count = @contacts.total_count
+  end
+
+  def show; end
+
+  def filter
+    result = ::Contacts::FilterService.new(Current.account, Current.user, params.permit!).perform
+    contacts = result[:contacts]
+    @contacts_count = result[:count]
+    @contacts = fetch_contacts(contacts)
+  rescue CustomExceptions::CustomFilter::InvalidAttribute,
+         CustomExceptions::CustomFilter::InvalidOperator,
+         CustomExceptions::CustomFilter::InvalidQueryOperator,
+         CustomExceptions::CustomFilter::InvalidValue => e
+    render_could_not_create_error(e.message)
+  end
+
+  def contactable_inboxes
+    @all_contactable_inboxes = Contacts::ContactableInboxesService.new(contact: @contact).get
+    @contactable_inboxes = @all_contactable_inboxes.select { |contactable_inbox| policy(contactable_inbox[:inbox]).show? }
+  end
+
+  # TODO : refactor this method into dedicated contacts/custom_attributes controller class and routes
+  def destroy_custom_attributes
+    @contact.custom_attributes = @contact.custom_attributes.excluding(params[:custom_attributes])
+    @contact.save!
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      @contact = Current.account.contacts.new(permitted_params.except(:avatar_url))
+      @contact.save!
+      @contact_inbox = build_contact_inbox
+      process_avatar_from_url
+    end
+  end
+
+  def update
+    @contact.assign_attributes(contact_update_params)
+    @contact.save!
+    process_avatar_from_url
+  end
+
+  def destroy
+    if ::OnlineStatusTracker.get_presence(
+      @contact.account.id, 'Contact', @contact.id
+    )
+      return render_error({ message: I18n.t('contacts.online.delete', contact_name: @contact.name.capitalize) },
+                          :unprocessable_entity)
+    end
+
+    @contact.destroy!
+    head :ok
+  end
+
+  def avatar
+    @contact.avatar.purge if @contact.avatar.attached?
+    @contact
+  end
+
+  private
+
+  # TODO: Move this to a finder class
+  def resolved_contacts
+    return @resolved_contacts if @resolved_contacts
+
+    @resolved_contacts = Current.account.contacts.resolved_contacts(use_crm_v2: Current.account.feature_enabled?('crm_v2'))
+
+    @resolved_contacts = @resolved_contacts.tagged_with(params[:labels], any: true) if params[:labels].present?
+    @resolved_contacts
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def fetch_contacts(contacts)
+    # Build includes hash to avoid separate query when contact_inboxes are needed
+    includes_hash = { avatar_attachment: [:blob] }
+    includes_hash[:contact_inboxes] = { inbox: :channel } if @include_contact_inboxes
+
+    filtrate(contacts)
+      .includes(includes_hash)
+      .page(@current_page)
+      .per(RESULTS_PER_PAGE)
+  end
+
+  def fetch_contacts_with_has_more(contacts)
+    includes_hash = { avatar_attachment: [:blob] }
+    includes_hash[:contact_inboxes] = { inbox: :channel } if @include_contact_inboxes
+
+    # Calculate offset manually to fetch one extra record for has_more check
+    offset = (@current_page.to_i - 1) * RESULTS_PER_PAGE
+    results = filtrate(contacts)
+              .includes(includes_hash)
+              .offset(offset)
+              .limit(RESULTS_PER_PAGE + 1)
+              .to_a
+
+    @has_more = results.size > RESULTS_PER_PAGE
+    results = results.first(RESULTS_PER_PAGE) if @has_more
+    @contacts_count = results.size
+    results
+  end
+
+  def build_contact_inbox
+    return if params[:inbox_id].blank?
+
+    inbox = Current.account.inboxes.find(params[:inbox_id])
+    ContactInboxBuilder.new(
+      contact: @contact,
+      inbox: inbox,
+      source_id: params[:source_id]
+    ).perform
+  end
+
+  def permitted_params
+    params.permit(:name, :identifier, :email, :phone_number, :avatar, :blocked, :avatar_url, additional_attributes: {}, custom_attributes: {})
+  end
+
+  def contact_custom_attributes
+    return @contact.custom_attributes.merge(permitted_params[:custom_attributes]) if permitted_params[:custom_attributes]
+
+    @contact.custom_attributes
+  end
+
+  def contact_additional_attributes
+    return @contact.additional_attributes.merge(permitted_params[:additional_attributes]) if permitted_params[:additional_attributes]
+
+    @contact.additional_attributes
+  end
+
+  def contact_update_params
+    permitted_params.except(:custom_attributes, :avatar_url)
+                    .merge({ custom_attributes: contact_custom_attributes })
+                    .merge({ additional_attributes: contact_additional_attributes })
+  end
+
+  def set_include_contact_inboxes
+    @include_contact_inboxes = if params[:include_contact_inboxes].present?
+                                 params[:include_contact_inboxes] == 'true'
+                               else
+                                 true
+                               end
+  end
+
+  def fetch_contact
+    @contact = Current.account.contacts.includes(contact_inboxes: [:inbox]).find(params[:id])
+  end
+
+  def process_avatar_from_url
+    ::Avatar::AvatarFromUrlJob.perform_later(@contact, params[:avatar_url]) if params[:avatar_url].present?
+  end
+
+  def render_error(error, error_status)
+    render json: error, status: error_status
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations/assignments_controller.rb

@@ -0,0 +1,45 @@
+class Api::V1::Accounts::Conversations::AssignmentsController < Api::V1::Accounts::Conversations::BaseController
+  # assigns agent/team to a conversation
+  def create
+    if params.key?(:assignee_id) || agent_bot_assignment?
+      set_agent
+    elsif params.key?(:team_id)
+      set_team
+    else
+      render json: nil
+    end
+  end
+
+  private
+
+  def set_agent
+    resource = Conversations::AssignmentService.new(
+      conversation: @conversation,
+      assignee_id: params[:assignee_id],
+      assignee_type: params[:assignee_type]
+    ).perform
+
+    render_agent(resource)
+  end
+
+  def render_agent(resource)
+    case resource
+    when User
+      render partial: 'api/v1/models/agent', formats: [:json], locals: { resource: resource }
+    when AgentBot
+      render partial: 'api/v1/models/agent_bot_slim', formats: [:json], locals: { resource: resource }
+    else
+      render json: nil
+    end
+  end
+
+  def set_team
+    @team = Current.account.teams.find_by(id: params[:team_id])
+    @conversation.update!(team: @team)
+    render json: @team
+  end
+
+  def agent_bot_assignment?
+    params[:assignee_type].to_s == 'AgentBot'
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations/base_controller.rb

@@ -0,0 +1,10 @@
+class Api::V1::Accounts::Conversations::BaseController < Api::V1::Accounts::BaseController
+  before_action :conversation
+
+  private
+
+  def conversation
+    @conversation ||= Current.account.conversations.find_by!(display_id: params[:conversation_id])
+    authorize @conversation, :show?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations/direct_uploads_controller.rb

@@ -0,0 +1,17 @@
+class Api::V1::Accounts::Conversations::DirectUploadsController < ActiveStorage::DirectUploadsController
+  include EnsureCurrentAccountHelper
+  before_action :current_account
+  before_action :conversation
+
+  def create
+    return if @conversation.nil? || @current_account.nil?
+
+    super
+  end
+
+  private
+
+  def conversation
+    @conversation ||= Current.account.conversations.find_by(display_id: params[:conversation_id])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations/draft_messages_controller.rb

@@ -0,0 +1,28 @@
+class Api::V1::Accounts::Conversations::DraftMessagesController < Api::V1::Accounts::Conversations::BaseController
+  def show
+    render json: { has_draft: false } and return unless Redis::Alfred.exists?(draft_redis_key)
+
+    draft_message = Redis::Alfred.get(draft_redis_key)
+    render json: { has_draft: true, message: draft_message }
+  end
+
+  def update
+    Redis::Alfred.set(draft_redis_key, draft_message_params)
+    head :ok
+  end
+
+  def destroy
+    Redis::Alfred.delete(draft_redis_key)
+    head :ok
+  end
+
+  private
+
+  def draft_redis_key
+    format(Redis::Alfred::CONVERSATION_DRAFT_MESSAGE, id: @conversation.id)
+  end
+
+  def draft_message_params
+    params.dig(:draft_message, :message) || ''
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations/labels_controller.rb

@@ -0,0 +1,13 @@
+class Api::V1::Accounts::Conversations::LabelsController < Api::V1::Accounts::Conversations::BaseController
+  include LabelConcern
+
+  private
+
+  def model
+    @model ||= @conversation
+  end
+
+  def permitted_params
+    params.permit(:conversation_id, labels: [])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations/messages_controller.rb

@@ -0,0 +1,80 @@
+class Api::V1::Accounts::Conversations::MessagesController < Api::V1::Accounts::Conversations::BaseController
+  before_action :ensure_api_inbox, only: :update
+
+  def index
+    @messages = message_finder.perform
+  end
+
+  def create
+    user = Current.user || @resource
+    mb = Messages::MessageBuilder.new(user, @conversation, params)
+    @message = mb.perform
+  rescue StandardError => e
+    render_could_not_create_error(e.message)
+  end
+
+  def update
+    Messages::StatusUpdateService.new(message, permitted_params[:status], permitted_params[:external_error]).perform
+    @message = message
+  end
+
+  def destroy
+    ActiveRecord::Base.transaction do
+      message.update!(content: I18n.t('conversations.messages.deleted'), content_type: :text, content_attributes: { deleted: true })
+      message.attachments.destroy_all
+    end
+  end
+
+  def retry
+    return if message.blank?
+
+    service = Messages::StatusUpdateService.new(message, 'sent')
+    service.perform
+    message.update!(content_attributes: {})
+    ::SendReplyJob.perform_later(message.id)
+  rescue StandardError => e
+    render_could_not_create_error(e.message)
+  end
+
+  def translate
+    return head :ok if already_translated_content_available?
+
+    translated_content = Integrations::GoogleTranslate::ProcessorService.new(
+      message: message,
+      target_language: permitted_params[:target_language]
+    ).perform
+
+    if translated_content.present?
+      translations = {}
+      translations[permitted_params[:target_language]] = translated_content
+      translations = message.translations.merge!(translations) if message.translations.present?
+      message.update!(translations: translations)
+    end
+
+    render json: { content: translated_content }
+  end
+
+  private
+
+  def message
+    @message ||= @conversation.messages.find(permitted_params[:id])
+  end
+
+  def message_finder
+    @message_finder ||= MessageFinder.new(@conversation, params)
+  end
+
+  def permitted_params
+    params.permit(:id, :target_language, :status, :external_error)
+  end
+
+  def already_translated_content_available?
+    message.translations.present? && message.translations[permitted_params[:target_language]].present?
+  end
+
+  # API inbox check
+  def ensure_api_inbox
+    # Only API inboxes can update messages
+    render json: { error: 'Message status update is only allowed for API inboxes' }, status: :forbidden unless @conversation.inbox.api?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations/participants_controller.rb

@@ -0,0 +1,41 @@
+class Api::V1::Accounts::Conversations::ParticipantsController < Api::V1::Accounts::Conversations::BaseController
+  def show
+    @participants = @conversation.conversation_participants
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      @participants = participants_to_be_added_ids.map { |user_id| @conversation.conversation_participants.find_or_create_by(user_id: user_id) }
+    end
+  end
+
+  def update
+    ActiveRecord::Base.transaction do
+      participants_to_be_added_ids.each { |user_id| @conversation.conversation_participants.find_or_create_by(user_id: user_id) }
+      participants_to_be_removed_ids.each { |user_id| @conversation.conversation_participants.find_by(user_id: user_id)&.destroy }
+    end
+    @participants = @conversation.conversation_participants
+    render action: 'show'
+  end
+
+  def destroy
+    ActiveRecord::Base.transaction do
+      params[:user_ids].map { |user_id| @conversation.conversation_participants.find_by(user_id: user_id)&.destroy }
+    end
+    head :ok
+  end
+
+  private
+
+  def participants_to_be_added_ids
+    params[:user_ids] - current_participant_ids
+  end
+
+  def participants_to_be_removed_ids
+    current_participant_ids - params[:user_ids]
+  end
+
+  def current_participant_ids
+    @current_participant_ids ||= @conversation.conversation_participants.pluck(:user_id)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/conversations_controller.rb

@@ -0,0 +1,236 @@
+class Api::V1::Accounts::ConversationsController < Api::V1::Accounts::BaseController
+  include Events::Types
+  include DateRangeHelper
+  include HmacConcern
+
+  before_action :conversation, except: [:index, :meta, :search, :create, :filter]
+  before_action :inbox, :contact, :contact_inbox, only: [:create]
+
+  ATTACHMENT_RESULTS_PER_PAGE = 100
+
+  def index
+    result = conversation_finder.perform
+    @conversations = result[:conversations]
+    @conversations_count = result[:count]
+  end
+
+  def meta
+    result = conversation_finder.perform_meta_only
+    @conversations_count = result[:count]
+  end
+
+  def search
+    result = conversation_finder.perform
+    @conversations = result[:conversations]
+    @conversations_count = result[:count]
+  end
+
+  def attachments
+    @attachments_count = @conversation.attachments.count
+    @attachments = @conversation.attachments
+                                .includes(:message)
+                                .order(created_at: :desc)
+                                .page(attachment_params[:page])
+                                .per(ATTACHMENT_RESULTS_PER_PAGE)
+  end
+
+  def show; end
+
+  def create
+    ActiveRecord::Base.transaction do
+      @conversation = ConversationBuilder.new(params: params, contact_inbox: @contact_inbox).perform
+      Messages::MessageBuilder.new(Current.user, @conversation, params[:message]).perform if params[:message].present?
+    end
+  end
+
+  def update
+    @conversation.update!(permitted_update_params)
+  end
+
+  def filter
+    result = ::Conversations::FilterService.new(params.permit!, current_user, current_account).perform
+    @conversations = result[:conversations]
+    @conversations_count = result[:count]
+  rescue CustomExceptions::CustomFilter::InvalidAttribute,
+         CustomExceptions::CustomFilter::InvalidOperator,
+         CustomExceptions::CustomFilter::InvalidQueryOperator,
+         CustomExceptions::CustomFilter::InvalidValue => e
+    render_could_not_create_error(e.message)
+  end
+
+  def mute
+    @conversation.mute!
+    head :ok
+  end
+
+  def unmute
+    @conversation.unmute!
+    head :ok
+  end
+
+  def transcript
+    render json: { error: 'email param missing' }, status: :unprocessable_entity and return if params[:email].blank?
+    return render_payment_required('Email transcript is not available on your plan') unless @conversation.account.email_transcript_enabled?
+    return head :too_many_requests unless @conversation.account.within_email_rate_limit?
+
+    ConversationReplyMailer.with(account: @conversation.account).conversation_transcript(@conversation, params[:email])&.deliver_later
+    @conversation.account.increment_email_sent_count
+    head :ok
+  end
+
+  def toggle_status
+    # FIXME: move this logic into a service object
+    if pending_to_open_by_bot?
+      @conversation.bot_handoff!
+    elsif params[:status].present?
+      set_conversation_status
+      @status = @conversation.save!
+    else
+      @status = @conversation.toggle_status
+    end
+    assign_conversation if should_assign_conversation?
+  end
+
+  def pending_to_open_by_bot?
+    return false unless Current.user.is_a?(AgentBot)
+
+    @conversation.status == 'pending' && params[:status] == 'open'
+  end
+
+  def should_assign_conversation?
+    @conversation.status == 'open' && Current.user.is_a?(User) && Current.user&.agent?
+  end
+
+  def toggle_priority
+    @conversation.toggle_priority(params[:priority])
+    head :ok
+  end
+
+  def toggle_typing_status
+    typing_status_manager = ::Conversations::TypingStatusManager.new(@conversation, current_user, params)
+    typing_status_manager.toggle_typing_status
+    head :ok
+  end
+
+  def update_last_seen
+    # High-traffic accounts generate excessive DB writes when agents frequently switch between conversations.
+    # Throttle last_seen updates to once per hour when there are no unread messages to reduce DB load.
+    # Always update immediately if there are unread messages to maintain accurate read/unread state.
+    return update_last_seen_on_conversation(DateTime.now.utc, true) if assignee? && @conversation.assignee_unread_messages.any?
+    return update_last_seen_on_conversation(DateTime.now.utc, false) if !assignee? && @conversation.unread_messages.any?
+
+    # No unread messages - apply throttling to limit DB writes
+    return unless should_update_last_seen?
+
+    update_last_seen_on_conversation(DateTime.now.utc, assignee?)
+  end
+
+  def unread
+    last_incoming_message = @conversation.messages.incoming.last
+    last_seen_at = last_incoming_message.created_at - 1.second if last_incoming_message.present?
+    update_last_seen_on_conversation(last_seen_at, true)
+  end
+
+  def custom_attributes
+    @conversation.custom_attributes = params.permit(custom_attributes: {})[:custom_attributes]
+    @conversation.save!
+  end
+
+  def destroy
+    authorize @conversation, :destroy?
+    ::DeleteObjectJob.perform_later(@conversation, Current.user, request.ip)
+    head :ok
+  end
+
+  private
+
+  def permitted_update_params
+    # TODO: Move the other conversation attributes to this method and remove specific endpoints for each attribute
+    params.permit(:priority)
+  end
+
+  def attachment_params
+    params.permit(:page)
+  end
+
+  def update_last_seen_on_conversation(last_seen_at, update_assignee)
+    updates = { agent_last_seen_at: last_seen_at }
+    updates[:assignee_last_seen_at] = last_seen_at if update_assignee.present?
+
+    # rubocop:disable Rails/SkipsModelValidations
+    @conversation.update_columns(updates)
+    # rubocop:enable Rails/SkipsModelValidations
+  end
+
+  def should_update_last_seen?
+    # Update if at least one relevant timestamp is older than 1 hour or not set
+    # This prevents redundant DB writes when agents repeatedly view the same conversation
+    agent_needs_update = @conversation.agent_last_seen_at.blank? || @conversation.agent_last_seen_at < 1.hour.ago
+    return agent_needs_update unless assignee?
+
+    # For assignees, check both timestamps - update if either is old
+    assignee_needs_update = @conversation.assignee_last_seen_at.blank? || @conversation.assignee_last_seen_at < 1.hour.ago
+    agent_needs_update || assignee_needs_update
+  end
+
+  def set_conversation_status
+    @conversation.status = params[:status]
+    @conversation.snoozed_until = parse_date_time(params[:snoozed_until].to_s) if params[:snoozed_until]
+  end
+
+  def assign_conversation
+    @conversation.assignee = current_user
+    @conversation.save!
+  end
+
+  def conversation
+    @conversation ||= Current.account.conversations.find_by!(display_id: params[:id])
+    authorize @conversation, :show?
+  end
+
+  def inbox
+    return if params[:inbox_id].blank?
+
+    @inbox = Current.account.inboxes.find(params[:inbox_id])
+    authorize @inbox, :show?
+  end
+
+  def contact
+    return if params[:contact_id].blank?
+
+    @contact = Current.account.contacts.find(params[:contact_id])
+  end
+
+  def contact_inbox
+    @contact_inbox = build_contact_inbox
+
+    # fallback for the old case where we do look up only using source id
+    # In future we need to change this and make sure we do look up on combination of inbox_id and source_id
+    # and deprecate the support of passing only source_id as the param
+    @contact_inbox ||= ::ContactInbox.find_by!(source_id: params[:source_id])
+    authorize @contact_inbox.inbox, :show?
+  rescue ActiveRecord::RecordNotUnique
+    render json: { error: 'source_id should be unique' }, status: :unprocessable_entity
+  end
+
+  def build_contact_inbox
+    return if @inbox.blank? || @contact.blank?
+
+    ContactInboxBuilder.new(
+      contact: @contact,
+      inbox: @inbox,
+      source_id: params[:source_id],
+      hmac_verified: hmac_verified?
+    ).perform
+  end
+
+  def conversation_finder
+    @conversation_finder ||= ConversationFinder.new(Current.user, params)
+  end
+
+  def assignee?
+    @conversation.assignee_id? && Current.user == @conversation.assignee
+  end
+end
+
+Api::V1::Accounts::ConversationsController.prepend_mod_with('Api::V1::Accounts::ConversationsController')

research/chatwoot/app/controllers/api/v1/accounts/csat_survey_responses_controller.rb

@@ -0,0 +1,54 @@
+class Api::V1::Accounts::CsatSurveyResponsesController < Api::V1::Accounts::BaseController
+  include Sift
+  include DateRangeHelper
+
+  RESULTS_PER_PAGE = 25
+
+  before_action :check_authorization
+  before_action :set_csat_survey_responses, only: [:index, :metrics, :download]
+  before_action :set_current_page, only: [:index]
+  before_action :set_current_page_surveys, only: [:index]
+  before_action :set_total_sent_messages_count, only: [:metrics]
+
+  sort_on :created_at, type: :datetime
+
+  def index; end
+
+  def metrics
+    @total_count = @csat_survey_responses.count
+    @ratings_count = @csat_survey_responses.group(:rating).count
+  end
+
+  def download
+    response.headers['Content-Type'] = 'text/csv'
+    response.headers['Content-Disposition'] = 'attachment; filename=csat_report.csv'
+    render layout: false, template: 'api/v1/accounts/csat_survey_responses/download', formats: [:csv]
+  end
+
+  private
+
+  def set_total_sent_messages_count
+    @csat_messages = Current.account.messages.input_csat
+    @csat_messages = @csat_messages.where(created_at: range) if range.present?
+    @total_sent_messages_count = @csat_messages.count
+  end
+
+  def set_csat_survey_responses
+    base_query = Current.account.csat_survey_responses.includes([:conversation, :assigned_agent, :contact])
+    @csat_survey_responses = filtrate(base_query).filter_by_created_at(range)
+                                                 .filter_by_assigned_agent_id(params[:user_ids])
+                                                 .filter_by_inbox_id(params[:inbox_id])
+                                                 .filter_by_team_id(params[:team_id])
+                                                 .filter_by_rating(params[:rating])
+  end
+
+  def set_current_page_surveys
+    @csat_survey_responses = @csat_survey_responses.page(@current_page).per(RESULTS_PER_PAGE)
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+end
+
+Api::V1::Accounts::CsatSurveyResponsesController.prepend_mod_with('Api::V1::Accounts::CsatSurveyResponsesController')

research/chatwoot/app/controllers/api/v1/accounts/custom_attribute_definitions_controller.rb

@@ -0,0 +1,51 @@
+class Api::V1::Accounts::CustomAttributeDefinitionsController < Api::V1::Accounts::BaseController
+  before_action :fetch_custom_attributes_definitions, except: [:create]
+  before_action :fetch_custom_attribute_definition, only: [:show, :update, :destroy]
+  DEFAULT_ATTRIBUTE_MODEL = 'conversation_attribute'.freeze
+
+  def index; end
+
+  def show; end
+
+  def create
+    @custom_attribute_definition = Current.account.custom_attribute_definitions.create!(
+      permitted_payload
+    )
+  end
+
+  def update
+    @custom_attribute_definition.update!(permitted_payload)
+  end
+
+  def destroy
+    @custom_attribute_definition.destroy!
+    head :no_content
+  end
+
+  private
+
+  def fetch_custom_attributes_definitions
+    @custom_attribute_definitions = Current.account.custom_attribute_definitions.with_attribute_model(permitted_params[:attribute_model])
+  end
+
+  def fetch_custom_attribute_definition
+    @custom_attribute_definition = Current.account.custom_attribute_definitions.find(permitted_params[:id])
+  end
+
+  def permitted_payload
+    params.require(:custom_attribute_definition).permit(
+      :attribute_display_name,
+      :attribute_description,
+      :attribute_display_type,
+      :attribute_key,
+      :attribute_model,
+      :regex_pattern,
+      :regex_cue,
+      attribute_values: []
+    )
+  end
+
+  def permitted_params
+    params.permit(:id, :filter_type, :attribute_model)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/custom_filters_controller.rb

@@ -0,0 +1,53 @@
+class Api::V1::Accounts::CustomFiltersController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+  before_action :fetch_custom_filters, only: [:index]
+  before_action :fetch_custom_filter, only: [:show, :update, :destroy]
+  DEFAULT_FILTER_TYPE = 'conversation'.freeze
+
+  def index; end
+
+  def show; end
+
+  def create
+    @custom_filter = Current.account.custom_filters.create!(
+      permitted_payload.merge(user: Current.user)
+    )
+    render json: { error: @custom_filter.errors.messages }, status: :unprocessable_entity and return unless @custom_filter.valid?
+  end
+
+  def update
+    @custom_filter.update!(permitted_payload)
+  end
+
+  def destroy
+    @custom_filter.destroy!
+    head :no_content
+  end
+
+  private
+
+  def fetch_custom_filters
+    @custom_filters = Current.account.custom_filters.where(
+      user: Current.user,
+      filter_type: permitted_params[:filter_type] || DEFAULT_FILTER_TYPE
+    )
+  end
+
+  def fetch_custom_filter
+    @custom_filter = Current.account.custom_filters.where(
+      user: Current.user
+    ).find(permitted_params[:id])
+  end
+
+  def permitted_payload
+    params.require(:custom_filter).permit(
+      :name,
+      :filter_type,
+      query: {}
+    )
+  end
+
+  def permitted_params
+    params.permit(:id, :filter_type)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/dashboard_apps_controller.rb

@@ -0,0 +1,44 @@
+class Api::V1::Accounts::DashboardAppsController < Api::V1::Accounts::BaseController
+  before_action :fetch_dashboard_apps, except: [:create]
+  before_action :fetch_dashboard_app, only: [:show, :update, :destroy]
+
+  def index; end
+
+  def show; end
+
+  def create
+    @dashboard_app = Current.account.dashboard_apps.create!(
+      permitted_payload.merge(user_id: Current.user.id)
+    )
+  end
+
+  def update
+    @dashboard_app.update!(permitted_payload)
+  end
+
+  def destroy
+    @dashboard_app.destroy!
+    head :no_content
+  end
+
+  private
+
+  def fetch_dashboard_apps
+    @dashboard_apps = Current.account.dashboard_apps
+  end
+
+  def fetch_dashboard_app
+    @dashboard_app = @dashboard_apps.find(permitted_params[:id])
+  end
+
+  def permitted_payload
+    params.require(:dashboard_app).permit(
+      :title,
+      content: [:url, :type]
+    )
+  end
+
+  def permitted_params
+    params.permit(:id)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/google/authorizations_controller.rb

@@ -0,0 +1,23 @@
+class Api::V1::Accounts::Google::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+  include GoogleConcern
+
+  def create
+    redirect_url = google_client.auth_code.authorize_url(
+      {
+        redirect_uri: "#{base_url}/google/callback",
+        scope: scope,
+        response_type: 'code',
+        prompt: 'consent', # the oauth flow does not return a refresh token, this is supposed to fix it
+        access_type: 'offline', # the default is 'online'
+        state: state,
+        client_id: GlobalConfigService.load('GOOGLE_OAUTH_CLIENT_ID', nil)
+      }
+    )
+
+    if redirect_url
+      render json: { success: true, url: redirect_url }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/inbox_csat_templates_controller.rb

@@ -0,0 +1,111 @@
+class Api::V1::Accounts::InboxCsatTemplatesController < Api::V1::Accounts::BaseController
+  before_action :fetch_inbox
+  before_action :validate_whatsapp_channel
+
+  def show
+    service = CsatTemplateManagementService.new(@inbox)
+    result = service.template_status
+
+    if result[:service_error]
+      render json: { error: result[:service_error] }, status: :internal_server_error
+    else
+      render json: result
+    end
+  end
+
+  def create
+    template_params = extract_template_params
+    return render_missing_message_error if template_params[:message].blank?
+
+    service = CsatTemplateManagementService.new(@inbox)
+    result = service.create_template(template_params)
+    render_template_creation_result(result)
+  rescue ActionController::ParameterMissing
+    render json: { error: 'Template parameters are required' }, status: :unprocessable_entity
+  end
+
+  private
+
+  def fetch_inbox
+    @inbox = Current.account.inboxes.find(params[:inbox_id])
+    authorize @inbox, :show?
+  end
+
+  def validate_whatsapp_channel
+    return if @inbox.whatsapp? || @inbox.twilio_whatsapp?
+
+    render json: { error: 'CSAT template operations only available for WhatsApp and Twilio WhatsApp channels' },
+           status: :bad_request
+  end
+
+  def extract_template_params
+    params.require(:template).permit(:message, :button_text, :language)
+  end
+
+  def render_missing_message_error
+    render json: { error: 'Message is required' }, status: :unprocessable_entity
+  end
+
+  def render_template_creation_result(result)
+    if result[:success]
+      render_successful_template_creation(result)
+    elsif result[:service_error]
+      render json: { error: result[:service_error] }, status: :internal_server_error
+    else
+      render_failed_template_creation(result)
+    end
+  end
+
+  def render_successful_template_creation(result)
+    if @inbox.twilio_whatsapp?
+      render json: {
+        template: {
+          friendly_name: result[:friendly_name],
+          content_sid: result[:content_sid],
+          status: result[:status] || 'pending',
+          language: result[:language] || 'en'
+        }
+      }, status: :created
+    else
+      render json: {
+        template: {
+          name: result[:template_name],
+          template_id: result[:template_id],
+          status: 'PENDING',
+          language: result[:language] || 'en'
+        }
+      }, status: :created
+    end
+  end
+
+  def render_failed_template_creation(result)
+    whatsapp_error = parse_whatsapp_error(result[:response_body])
+    error_message = whatsapp_error[:user_message] || result[:error]
+
+    render json: {
+      error: error_message,
+      details: whatsapp_error[:technical_details]
+    }, status: :unprocessable_entity
+  end
+
+  def parse_whatsapp_error(response_body)
+    return { user_message: nil, technical_details: nil } if response_body.blank?
+
+    begin
+      error_data = JSON.parse(response_body)
+      whatsapp_error = error_data['error'] || {}
+
+      user_message = whatsapp_error['error_user_msg'] || whatsapp_error['message']
+      technical_details = {
+        code: whatsapp_error['code'],
+        subcode: whatsapp_error['error_subcode'],
+        type: whatsapp_error['type'],
+        title: whatsapp_error['error_user_title']
+      }.compact
+
+      { user_message: user_message, technical_details: technical_details }
+    rescue JSON::ParserError
+      { user_message: nil, technical_details: response_body }
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/inbox_members_controller.rb

@@ -0,0 +1,64 @@
+class Api::V1::Accounts::InboxMembersController < Api::V1::Accounts::BaseController
+  before_action :fetch_inbox
+  before_action :current_agents_ids, only: [:create, :update]
+
+  def show
+    authorize @inbox, :show?
+    fetch_updated_agents
+  end
+
+  def create
+    authorize @inbox, :create?
+    ActiveRecord::Base.transaction do
+      @inbox.add_members(agents_to_be_added_ids)
+    end
+    fetch_updated_agents
+  end
+
+  def update
+    authorize @inbox, :update?
+    update_agents_list
+    fetch_updated_agents
+  end
+
+  def destroy
+    authorize @inbox, :destroy?
+    ActiveRecord::Base.transaction do
+      @inbox.remove_members(params[:user_ids])
+    end
+    head :ok
+  end
+
+  private
+
+  def fetch_updated_agents
+    @agents = Current.account.users.where(id: @inbox.members.select(:user_id))
+  end
+
+  def update_agents_list
+    # get all the user_ids which the inbox currently has as members.
+    # get the list of  user_ids from params
+    # the missing ones are the agents which are to be deleted from the inbox
+    # the new ones are the agents which are to be added to the inbox
+    ActiveRecord::Base.transaction do
+      @inbox.add_members(agents_to_be_added_ids)
+      @inbox.remove_members(agents_to_be_removed_ids)
+    end
+  end
+
+  def agents_to_be_added_ids
+    params[:user_ids] - @current_agents_ids
+  end
+
+  def agents_to_be_removed_ids
+    @current_agents_ids - params[:user_ids]
+  end
+
+  def current_agents_ids
+    @current_agents_ids = @inbox.members.pluck(:id)
+  end
+
+  def fetch_inbox
+    @inbox = Current.account.inboxes.find(params[:inbox_id])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/inboxes/assignment_policies_controller.rb

@@ -0,0 +1,46 @@
+class Api::V1::Accounts::Inboxes::AssignmentPoliciesController < Api::V1::Accounts::BaseController
+  before_action :fetch_inbox
+  before_action :fetch_assignment_policy, only: [:create]
+  before_action -> { check_authorization(AssignmentPolicy) }
+  before_action :validate_assignment_policy, only: [:show, :destroy]
+
+  def show
+    @assignment_policy = @inbox.assignment_policy
+  end
+
+  def create
+    # There should be only one assignment policy for an inbox.
+    # If there is a new request to add an assignment policy, we will
+    # delete the old one and attach the new policy
+    remove_inbox_assignment_policy
+    @inbox_assignment_policy = @inbox.create_inbox_assignment_policy!(assignment_policy: @assignment_policy)
+    @assignment_policy = @inbox.assignment_policy
+  end
+
+  def destroy
+    remove_inbox_assignment_policy
+    head :ok
+  end
+
+  private
+
+  def remove_inbox_assignment_policy
+    @inbox.inbox_assignment_policy&.destroy
+  end
+
+  def fetch_inbox
+    @inbox = Current.account.inboxes.find(permitted_params[:inbox_id])
+  end
+
+  def fetch_assignment_policy
+    @assignment_policy = Current.account.assignment_policies.find(permitted_params[:assignment_policy_id])
+  end
+
+  def permitted_params
+    params.permit(:assignment_policy_id, :inbox_id)
+  end
+
+  def validate_assignment_policy
+    return render_not_found_error(I18n.t('errors.assignment_policy.not_found')) unless @inbox.assignment_policy
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/inboxes_controller.rb

@@ -0,0 +1,217 @@
+class Api::V1::Accounts::InboxesController < Api::V1::Accounts::BaseController
+  include Api::V1::InboxesHelper
+  before_action :fetch_inbox, except: [:index, :create]
+  before_action :fetch_agent_bot, only: [:set_agent_bot]
+  before_action :validate_limit, only: [:create]
+  # we are already handling the authorization in fetch inbox
+  before_action :check_authorization, except: [:show, :health]
+  before_action :validate_whatsapp_cloud_channel, only: [:health]
+
+  def index
+    @inboxes = policy_scope(Current.account.inboxes.order_by_name.includes(:channel, { avatar_attachment: [:blob] }))
+  end
+
+  def show; end
+
+  # Deprecated: This API will be removed in 2.7.0
+  def assignable_agents
+    @assignable_agents = @inbox.assignable_agents
+  end
+
+  def campaigns
+    @campaigns = @inbox.campaigns
+  end
+
+  def avatar
+    @inbox.avatar.attachment.destroy! if @inbox.avatar.attached?
+    head :ok
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      channel = create_channel
+      @inbox = Current.account.inboxes.build(
+        {
+          name: inbox_name(channel),
+          channel: channel
+        }.merge(
+          permitted_params.except(:channel)
+        )
+      )
+      @inbox.save!
+    end
+  end
+
+  def update
+    inbox_params = permitted_params.except(:channel, :csat_config)
+    inbox_params[:csat_config] = format_csat_config(permitted_params[:csat_config]) if permitted_params[:csat_config].present?
+    @inbox.update!(inbox_params)
+    update_inbox_working_hours
+    update_channel if channel_update_required?
+  end
+
+  def agent_bot
+    @agent_bot = @inbox.agent_bot
+  end
+
+  def set_agent_bot
+    if @agent_bot
+      agent_bot_inbox = @inbox.agent_bot_inbox || AgentBotInbox.new(inbox: @inbox)
+      agent_bot_inbox.agent_bot = @agent_bot
+      agent_bot_inbox.save!
+    elsif @inbox.agent_bot_inbox.present?
+      @inbox.agent_bot_inbox.destroy!
+    end
+    head :ok
+  end
+
+  def destroy
+    ::DeleteObjectJob.perform_later(@inbox, Current.user, request.ip) if @inbox.present?
+    render status: :ok, json: { message: I18n.t('messages.inbox_deletetion_response') }
+  end
+
+  def sync_templates
+    return render status: :unprocessable_entity, json: { error: 'Template sync is only available for WhatsApp channels' } unless whatsapp_channel?
+
+    trigger_template_sync
+    render status: :ok, json: { message: 'Template sync initiated successfully' }
+  rescue StandardError => e
+    render status: :internal_server_error, json: { error: e.message }
+  end
+
+  def health
+    health_data = Whatsapp::HealthService.new(@inbox.channel).fetch_health_status
+    render json: health_data
+  rescue StandardError => e
+    Rails.logger.error "[INBOX HEALTH] Error fetching health data: #{e.message}"
+    render json: { error: e.message }, status: :unprocessable_entity
+  end
+
+  private
+
+  def fetch_inbox
+    @inbox = Current.account.inboxes.find(params[:id])
+    authorize @inbox, :show?
+  end
+
+  def fetch_agent_bot
+    @agent_bot = AgentBot.find(params[:agent_bot]) if params[:agent_bot]
+  end
+
+  def validate_whatsapp_cloud_channel
+    return if @inbox.channel.is_a?(Channel::Whatsapp) && @inbox.channel.provider == 'whatsapp_cloud'
+
+    render json: { error: 'Health data only available for WhatsApp Cloud API channels' }, status: :bad_request
+  end
+
+  def create_channel
+    return unless allowed_channel_types.include?(permitted_params[:channel][:type])
+
+    account_channels_method.create!(permitted_params(channel_type_from_params::EDITABLE_ATTRS)[:channel].except(:type))
+  end
+
+  def allowed_channel_types
+    %w[web_widget api email line telegram whatsapp sms]
+  end
+
+  def update_inbox_working_hours
+    @inbox.update_working_hours(params.permit(working_hours: Inbox::OFFISABLE_ATTRS)[:working_hours]) if params[:working_hours]
+  end
+
+  def update_channel
+    channel_attributes = get_channel_attributes(@inbox.channel_type)
+    return if permitted_params(channel_attributes)[:channel].blank?
+
+    validate_and_update_email_channel(channel_attributes) if @inbox.inbox_type == 'Email'
+
+    reauthorize_and_update_channel(channel_attributes)
+    update_channel_feature_flags
+  end
+
+  def channel_update_required?
+    permitted_params(get_channel_attributes(@inbox.channel_type))[:channel].present?
+  end
+
+  def validate_and_update_email_channel(channel_attributes)
+    validate_email_channel(channel_attributes)
+  rescue StandardError => e
+    render json: { message: e }, status: :unprocessable_entity and return
+  end
+
+  def reauthorize_and_update_channel(channel_attributes)
+    @inbox.channel.reauthorized! if @inbox.channel.respond_to?(:reauthorized!)
+    @inbox.channel.update!(permitted_params(channel_attributes)[:channel])
+  end
+
+  def update_channel_feature_flags
+    return unless @inbox.web_widget?
+    return unless permitted_params(Channel::WebWidget::EDITABLE_ATTRS)[:channel].key? :selected_feature_flags
+
+    @inbox.channel.selected_feature_flags = permitted_params(Channel::WebWidget::EDITABLE_ATTRS)[:channel][:selected_feature_flags]
+    @inbox.channel.save!
+  end
+
+  def format_csat_config(config)
+    formatted = {
+      'display_type' => config['display_type'] || 'emoji',
+      'message' => config['message'] || '',
+      :survey_rules => {
+        'operator' => config.dig('survey_rules', 'operator') || 'contains',
+        'values' => config.dig('survey_rules', 'values') || []
+      },
+      'button_text' => config['button_text'] || 'Please rate us',
+      'language' => config['language'] || 'en'
+    }
+    format_template_config(config, formatted)
+    formatted
+  end
+
+  def format_template_config(config, formatted)
+    formatted['template'] = config['template'] if config['template'].present?
+  end
+
+  def inbox_attributes
+    [:name, :avatar, :greeting_enabled, :greeting_message, :enable_email_collect, :csat_survey_enabled,
+     :enable_auto_assignment, :working_hours_enabled, :out_of_office_message, :timezone, :allow_messages_after_resolved,
+     :lock_to_single_conversation, :portal_id, :sender_name_type, :business_name,
+     { csat_config: [:display_type, :message, :button_text, :language,
+                     { survey_rules: [:operator, { values: [] }],
+                       template: [:name, :template_id, :friendly_name, :content_sid, :approval_sid, :created_at, :language, :status] }] }]
+  end
+
+  def permitted_params(channel_attributes = [])
+    # We will remove this line after fixing https://linear.app/chatwoot/issue/CW-1567/null-value-passed-as-null-string-to-backend
+    params.each { |k, v| params[k] = params[k] == 'null' ? nil : v }
+    params.permit(*inbox_attributes, channel: [:type, *channel_attributes])
+  end
+
+  def channel_type_from_params
+    {
+      'web_widget' => Channel::WebWidget,
+      'api' => Channel::Api,
+      'email' => Channel::Email,
+      'line' => Channel::Line,
+      'telegram' => Channel::Telegram,
+      'whatsapp' => Channel::Whatsapp,
+      'sms' => Channel::Sms
+    }[permitted_params[:channel][:type]]
+  end
+
+  def get_channel_attributes(channel_type)
+    channel_type.constantize.const_defined?(:EDITABLE_ATTRS) ? channel_type.constantize::EDITABLE_ATTRS.presence : []
+  end
+
+  def whatsapp_channel?
+    @inbox.whatsapp? || (@inbox.twilio? && @inbox.channel.whatsapp?)
+  end
+
+  def trigger_template_sync
+    if @inbox.whatsapp?
+      Channels::Whatsapp::TemplatesSyncJob.perform_later(@inbox.channel)
+    elsif @inbox.twilio? && @inbox.channel.whatsapp?
+      Channels::Twilio::TemplatesSyncJob.perform_later(@inbox.channel)
+    end
+  end
+end
+
+Api::V1::Accounts::InboxesController.prepend_mod_with('Api::V1::Accounts::InboxesController')

research/chatwoot/app/controllers/api/v1/accounts/instagram/authorizations_controller.rb

@@ -0,0 +1,23 @@
+class Api::V1::Accounts::Instagram::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+  include InstagramConcern
+  include Instagram::IntegrationHelper
+
+  def create
+    # https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/business-login#step-1--get-authorization
+    redirect_url = instagram_client.auth_code.authorize_url(
+      {
+        redirect_uri: "#{base_url}/instagram/callback",
+        scope: REQUIRED_SCOPES.join(','),
+        enable_fb_login: '0',
+        force_authentication: '1',
+        response_type: 'code',
+        state: generate_instagram_token(Current.account.id)
+      }
+    )
+    if redirect_url
+      render json: { success: true, url: redirect_url }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/integrations/apps_controller.rb

@@ -0,0 +1,19 @@
+class Api::V1::Accounts::Integrations::AppsController < Api::V1::Accounts::BaseController
+  before_action :check_admin_authorization?, except: [:index, :show]
+  before_action :fetch_apps, only: [:index]
+  before_action :fetch_app, only: [:show]
+
+  def index; end
+
+  def show; end
+
+  private
+
+  def fetch_apps
+    @apps = Integrations::App.all.select { |app| app.active?(Current.account) }
+  end
+
+  def fetch_app
+    @app = Integrations::App.find(id: params[:id])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/integrations/dyte_controller.rb

@@ -0,0 +1,48 @@
+class Api::V1::Accounts::Integrations::DyteController < Api::V1::Accounts::BaseController
+  before_action :fetch_conversation, only: [:create_a_meeting]
+  before_action :fetch_message, only: [:add_participant_to_meeting]
+  before_action :authorize_request
+
+  def create_a_meeting
+    render_response(dyte_processor_service.create_a_meeting(Current.user))
+  end
+
+  def add_participant_to_meeting
+    if @message.content_type != 'integrations'
+      return render json: {
+        error: I18n.t('errors.dyte.invalid_message_type')
+      }, status: :unprocessable_entity
+    end
+
+    render_response(
+      dyte_processor_service.add_participant_to_meeting(@message.content_attributes['data']['meeting_id'], Current.user)
+    )
+  end
+
+  private
+
+  def authorize_request
+    authorize @conversation, :show?
+  end
+
+  def render_response(response)
+    render json: response, status: response[:error].blank? ? :ok : :unprocessable_entity
+  end
+
+  def dyte_processor_service
+    Integrations::Dyte::ProcessorService.new(account: Current.account, conversation: @conversation)
+  end
+
+  def permitted_params
+    params.permit(:conversation_id, :message_id)
+  end
+
+  def fetch_conversation
+    @conversation = Current.account.conversations.find_by!(display_id: permitted_params[:conversation_id])
+  end
+
+  def fetch_message
+    @message = Current.account.messages.find(permitted_params[:message_id])
+    @conversation = @message.conversation
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/integrations/hooks_controller.rb

@@ -0,0 +1,45 @@
+class Api::V1::Accounts::Integrations::HooksController < Api::V1::Accounts::BaseController
+  before_action :fetch_hook, except: [:create]
+  before_action :check_authorization
+
+  def create
+    @hook = Current.account.hooks.create!(permitted_params)
+  end
+
+  def update
+    @hook.update!(permitted_params.slice(:status, :settings))
+  end
+
+  def process_event
+    response = @hook.process_event(params[:event])
+
+    # for cases like an invalid event, or when conversation does not have enough messages
+    # for a label suggestion, the response is nil
+    if response.nil?
+      render json: { message: nil }
+    elsif response[:error]
+      render json: { error: response[:error] }, status: :unprocessable_entity
+    else
+      render json: { message: response[:message] }
+    end
+  end
+
+  def destroy
+    @hook.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_hook
+    @hook = Current.account.hooks.find(params[:id])
+  end
+
+  def check_authorization
+    authorize(:hook)
+  end
+
+  def permitted_params
+    params.require(:hook).permit(:app_id, :inbox_id, :status, settings: {})
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/integrations/linear_controller.rb

@@ -0,0 +1,135 @@
+class Api::V1::Accounts::Integrations::LinearController < Api::V1::Accounts::BaseController
+  before_action :fetch_conversation, only: [:create_issue, :link_issue, :unlink_issue, :linked_issues]
+  before_action :fetch_hook, only: [:destroy]
+
+  def destroy
+    revoke_linear_token
+    @hook.destroy!
+    head :ok
+  end
+
+  def teams
+    teams = linear_processor_service.teams
+    if teams[:error]
+      render json: { error: teams[:error] }, status: :unprocessable_entity
+    else
+      render json: teams[:data], status: :ok
+    end
+  end
+
+  def team_entities
+    team_id = permitted_params[:team_id]
+    team_entities = linear_processor_service.team_entities(team_id)
+    if team_entities[:error]
+      render json: { error: team_entities[:error] }, status: :unprocessable_entity
+    else
+      render json: team_entities[:data], status: :ok
+    end
+  end
+
+  def create_issue
+    issue = linear_processor_service.create_issue(permitted_params, Current.user)
+    if issue[:error]
+      render json: { error: issue[:error] }, status: :unprocessable_entity
+    else
+      Linear::ActivityMessageService.new(
+        conversation: @conversation,
+        action_type: :issue_created,
+        issue_data: { id: issue[:data][:identifier] },
+        user: Current.user
+      ).perform
+      render json: issue[:data], status: :ok
+    end
+  end
+
+  def link_issue
+    issue_id = permitted_params[:issue_id]
+    title = permitted_params[:title]
+    issue = linear_processor_service.link_issue(conversation_link, issue_id, title, Current.user)
+    if issue[:error]
+      render json: { error: issue[:error] }, status: :unprocessable_entity
+    else
+      Linear::ActivityMessageService.new(
+        conversation: @conversation,
+        action_type: :issue_linked,
+        issue_data: { id: issue_id },
+        user: Current.user
+      ).perform
+      render json: issue[:data], status: :ok
+    end
+  end
+
+  def unlink_issue
+    link_id = permitted_params[:link_id]
+    issue_id = permitted_params[:issue_id]
+    issue = linear_processor_service.unlink_issue(link_id)
+
+    if issue[:error]
+      render json: { error: issue[:error] }, status: :unprocessable_entity
+    else
+      Linear::ActivityMessageService.new(
+        conversation: @conversation,
+        action_type: :issue_unlinked,
+        issue_data: { id: issue_id },
+        user: Current.user
+      ).perform
+      render json: issue[:data], status: :ok
+    end
+  end
+
+  def linked_issues
+    issues = linear_processor_service.linked_issues(conversation_link)
+
+    if issues[:error]
+      render json: { error: issues[:error] }, status: :unprocessable_entity
+    else
+      render json: issues[:data], status: :ok
+    end
+  end
+
+  def search_issue
+    render json: { error: 'Specify search string with parameter q' }, status: :unprocessable_entity if params[:q].blank? && return
+
+    term = params[:q]
+    issues = linear_processor_service.search_issue(term)
+    if issues[:error]
+      render json: { error: issues[:error] }, status: :unprocessable_entity
+    else
+      render json: issues[:data], status: :ok
+    end
+  end
+
+  private
+
+  def conversation_link
+    "#{ENV.fetch('FRONTEND_URL', nil)}/app/accounts/#{Current.account.id}/conversations/#{@conversation.display_id}"
+  end
+
+  def fetch_conversation
+    @conversation = Current.account.conversations.find_by!(display_id: permitted_params[:conversation_id])
+  end
+
+  def linear_processor_service
+    Integrations::Linear::ProcessorService.new(account: Current.account)
+  end
+
+  def permitted_params
+    params.permit(:team_id, :project_id, :conversation_id, :issue_id, :link_id, :title, :description, :assignee_id, :priority, :state_id,
+                  label_ids: [])
+  end
+
+  def fetch_hook
+    @hook = Integrations::Hook.where(account: Current.account).find_by(app_id: 'linear')
+  end
+
+  def revoke_linear_token
+    return unless @hook&.access_token
+
+    begin
+      linear_client = Linear.new(@hook.access_token)
+      linear_client.revoke_token
+    rescue StandardError => e
+      Rails.logger.error "Failed to revoke Linear token: #{e.message}"
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/integrations/notion_controller.rb

@@ -0,0 +1,14 @@
+class Api::V1::Accounts::Integrations::NotionController < Api::V1::Accounts::BaseController
+  before_action :fetch_hook, only: [:destroy]
+
+  def destroy
+    @hook.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_hook
+    @hook = Integrations::Hook.where(account: Current.account).find_by(app_id: 'notion')
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/integrations/shopify_controller.rb

@@ -0,0 +1,111 @@
+class Api::V1::Accounts::Integrations::ShopifyController < Api::V1::Accounts::BaseController
+  include Shopify::IntegrationHelper
+  before_action :setup_shopify_context, only: [:orders]
+  before_action :fetch_hook, except: [:auth]
+  before_action :validate_contact, only: [:orders]
+
+  def auth
+    shop_domain = params[:shop_domain]
+    return render json: { error: 'Shop domain is required' }, status: :unprocessable_entity if shop_domain.blank?
+
+    state = generate_shopify_token(Current.account.id)
+
+    auth_url = "https://#{shop_domain}/admin/oauth/authorize?"
+    auth_url += URI.encode_www_form(
+      client_id: client_id,
+      scope: REQUIRED_SCOPES.join(','),
+      redirect_uri: redirect_uri,
+      state: state
+    )
+
+    render json: { redirect_url: auth_url }
+  end
+
+  def orders
+    customers = fetch_customers
+    return render json: { orders: [] } if customers.empty?
+
+    orders = fetch_orders(customers.first['id'])
+    render json: { orders: orders }
+  rescue ShopifyAPI::Errors::HttpResponseError => e
+    render json: { error: e.message }, status: :unprocessable_entity
+  end
+
+  def destroy
+    @hook.destroy!
+    head :ok
+  rescue StandardError => e
+    render json: { error: e.message }, status: :unprocessable_entity
+  end
+
+  private
+
+  def redirect_uri
+    "#{ENV.fetch('FRONTEND_URL', '')}/shopify/callback"
+  end
+
+  def contact
+    @contact ||= Current.account.contacts.find_by(id: params[:contact_id])
+  end
+
+  def fetch_hook
+    @hook = Integrations::Hook.find_by!(account: Current.account, app_id: 'shopify')
+  end
+
+  def fetch_customers
+    query = []
+    query << "email:#{contact.email}" if contact.email.present?
+    query << "phone:#{contact.phone_number}" if contact.phone_number.present?
+
+    shopify_client.get(
+      path: 'customers/search.json',
+      query: {
+        query: query.join(' OR '),
+        fields: 'id,email,phone'
+      }
+    ).body['customers'] || []
+  end
+
+  def fetch_orders(customer_id)
+    orders = shopify_client.get(
+      path: 'orders.json',
+      query: {
+        customer_id: customer_id,
+        status: 'any',
+        fields: 'id,email,created_at,total_price,currency,fulfillment_status,financial_status'
+      }
+    ).body['orders'] || []
+
+    orders.map do |order|
+      order.merge('admin_url' => "https://#{@hook.reference_id}/admin/orders/#{order['id']}")
+    end
+  end
+
+  def setup_shopify_context
+    return if client_id.blank? || client_secret.blank?
+
+    ShopifyAPI::Context.setup(
+      api_key: client_id,
+      api_secret_key: client_secret,
+      api_version: '2025-01'.freeze,
+      scope: REQUIRED_SCOPES.join(','),
+      is_embedded: true,
+      is_private: false
+    )
+  end
+
+  def shopify_session
+    ShopifyAPI::Auth::Session.new(shop: @hook.reference_id, access_token: @hook.access_token)
+  end
+
+  def shopify_client
+    @shopify_client ||= ShopifyAPI::Clients::Rest::Admin.new(session: shopify_session)
+  end
+
+  def validate_contact
+    return unless contact.blank? || (contact.email.blank? && contact.phone_number.blank?)
+
+    render json: { error: 'Contact information missing' },
+           status: :unprocessable_entity
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/integrations/slack_controller.rb

@@ -0,0 +1,41 @@
+class Api::V1::Accounts::Integrations::SlackController < Api::V1::Accounts::BaseController
+  before_action :check_admin_authorization?
+  before_action :fetch_hook, only: [:update, :destroy, :list_all_channels]
+
+  def list_all_channels
+    @channels = channel_builder.fetch_channels
+  end
+
+  def create
+    hook_builder = Integrations::Slack::HookBuilder.new(
+      account: Current.account,
+      code: params[:code],
+      inbox_id: params[:inbox_id]
+    )
+    @hook = hook_builder.perform
+  end
+
+  def update
+    @hook = channel_builder.update(permitted_params[:reference_id])
+    render json: { error: I18n.t('errors.slack.invalid_channel_id') }, status: :unprocessable_entity if @hook.blank?
+  end
+
+  def destroy
+    @hook.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_hook
+    @hook = Integrations::Hook.where(account: Current.account).find_by(app_id: 'slack')
+  end
+
+  def channel_builder
+    Integrations::Slack::ChannelBuilder.new(hook: @hook)
+  end
+
+  def permitted_params
+    params.permit(:reference_id)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/labels_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::LabelsController < Api::V1::Accounts::BaseController
+  before_action :current_account
+  before_action :fetch_label, except: [:index, :create]
+  before_action :check_authorization
+
+  def index
+    @labels = policy_scope(Current.account.labels)
+  end
+
+  def show; end
+
+  def create
+    @label = Current.account.labels.create!(permitted_params)
+  end
+
+  def update
+    @label.update!(permitted_params)
+  end
+
+  def destroy
+    @label.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_label
+    @label = Current.account.labels.find(params[:id])
+  end
+
+  def permitted_params
+    params.require(:label).permit(:title, :description, :color, :show_on_sidebar)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/macros_controller.rb

@@ -0,0 +1,76 @@
+class Api::V1::Accounts::MacrosController < Api::V1::Accounts::BaseController
+  include AttachmentConcern
+
+  before_action :fetch_macro, only: [:show, :update, :destroy, :execute]
+  before_action :check_authorization, only: [:show, :update, :destroy, :execute]
+
+  def index
+    @macros = Macro.with_visibility(current_user, params)
+  end
+
+  def show
+    head :not_found if @macro.nil?
+  end
+
+  def create
+    blobs, actions, error = validate_and_prepare_attachments(params[:actions])
+    return render_could_not_create_error(error) if error
+
+    @macro = Current.account.macros.new(macros_with_user.merge(created_by_id: current_user.id))
+    @macro.set_visibility(current_user, permitted_params)
+    @macro.actions = actions
+
+    return render_could_not_create_error(@macro.errors.messages) unless @macro.valid?
+
+    @macro.save!
+    blobs.each { |blob| @macro.files.attach(blob) }
+  end
+
+  def update
+    blobs, actions, error = validate_and_prepare_attachments(params[:actions], @macro)
+    return render_could_not_create_error(error) if error
+
+    ActiveRecord::Base.transaction do
+      @macro.assign_attributes(macros_with_user)
+      @macro.set_visibility(current_user, permitted_params)
+      @macro.actions = actions if params[:actions]
+      @macro.save!
+      blobs.each { |blob| @macro.files.attach(blob) }
+    rescue StandardError => e
+      Rails.logger.error e
+      render_could_not_create_error(@macro.errors.messages)
+    end
+  end
+
+  def destroy
+    @macro.destroy!
+    head :ok
+  end
+
+  def execute
+    ::MacrosExecutionJob.perform_later(@macro, conversation_ids: params[:conversation_ids], user: Current.user)
+
+    head :ok
+  end
+
+  private
+
+  def permitted_params
+    params.permit(
+      :name, :visibility,
+      actions: [:action_name, { action_params: [] }]
+    )
+  end
+
+  def macros_with_user
+    permitted_params.merge(updated_by_id: current_user.id)
+  end
+
+  def fetch_macro
+    @macro = Current.account.macros.find_by(id: params[:id])
+  end
+
+  def check_authorization
+    authorize(@macro) if @macro.present?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/microsoft/authorizations_controller.rb

@@ -0,0 +1,19 @@
+class Api::V1::Accounts::Microsoft::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+  include MicrosoftConcern
+
+  def create
+    redirect_url = microsoft_client.auth_code.authorize_url(
+      {
+        redirect_uri: "#{base_url}/microsoft/callback",
+        scope: scope,
+        state: state,
+        prompt: 'consent'
+      }
+    )
+    if redirect_url
+      render json: { success: true, url: redirect_url }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/notification_settings_controller.rb

@@ -0,0 +1,30 @@
+class Api::V1::Accounts::NotificationSettingsController < Api::V1::Accounts::BaseController
+  before_action :set_user, :load_notification_setting
+
+  def show; end
+
+  def update
+    update_flags
+    @notification_setting.save!
+    render action: 'show'
+  end
+
+  private
+
+  def set_user
+    @user = current_user
+  end
+
+  def load_notification_setting
+    @notification_setting = @user.notification_settings.find_by(account_id: Current.account.id)
+  end
+
+  def notification_setting_params
+    params.require(:notification_settings).permit(selected_email_flags: [], selected_push_flags: [])
+  end
+
+  def update_flags
+    @notification_setting.selected_email_flags = notification_setting_params[:selected_email_flags]
+    @notification_setting.selected_push_flags = notification_setting_params[:selected_push_flags]
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/notifications_controller.rb

@@ -0,0 +1,82 @@
+class Api::V1::Accounts::NotificationsController < Api::V1::Accounts::BaseController
+  RESULTS_PER_PAGE = 15
+  include DateRangeHelper
+
+  before_action :fetch_notification, only: [:update, :destroy, :snooze, :unread]
+  before_action :set_primary_actor, only: [:read_all]
+  before_action :set_current_page, only: [:index]
+
+  def index
+    @notifications = notification_finder.notifications
+    @unread_count = notification_finder.unread_count
+    @count = notification_finder.count
+  end
+
+  def read_all
+    # rubocop:disable Rails/SkipsModelValidations
+    if @primary_actor
+      current_user.notifications.where(account_id: current_account.id, primary_actor: @primary_actor, read_at: nil)
+                  .update_all(read_at: DateTime.now.utc)
+    else
+      current_user.notifications.where(account_id: current_account.id, read_at: nil).update_all(read_at: DateTime.now.utc)
+    end
+    # rubocop:enable Rails/SkipsModelValidations
+    head :ok
+  end
+
+  def update
+    @notification.update(read_at: DateTime.now.utc)
+    render json: @notification
+  end
+
+  def unread
+    @notification.update(read_at: nil)
+    render json: @notification
+  end
+
+  def destroy
+    @notification.destroy
+    head :ok
+  end
+
+  def destroy_all
+    if params[:type] == 'read'
+      ::Notification::DeleteNotificationJob.perform_later(Current.user, type: :read)
+    else
+      ::Notification::DeleteNotificationJob.perform_later(Current.user, type: :all)
+    end
+    head :ok
+  end
+
+  def unread_count
+    @unread_count = notification_finder.unread_count
+    render json: @unread_count
+  end
+
+  def snooze
+    updated_meta = (@notification.meta || {}).merge('last_snoozed_at' => nil)
+    @notification.update(snoozed_until: parse_date_time(params[:snoozed_until].to_s), meta: updated_meta) if params[:snoozed_until]
+    render json: @notification
+  end
+
+  private
+
+  def set_primary_actor
+    return unless params[:primary_actor_type]
+    return unless Notification::PRIMARY_ACTORS.include?(params[:primary_actor_type])
+
+    @primary_actor = params[:primary_actor_type].safe_constantize.find_by(id: params[:primary_actor_id])
+  end
+
+  def fetch_notification
+    @notification = current_user.notifications.find(params[:id])
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def notification_finder
+    @notification_finder ||= NotificationFinder.new(Current.user, Current.account, params)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/notion/authorizations_controller.rb

@@ -0,0 +1,21 @@
+class Api::V1::Accounts::Notion::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+  include NotionConcern
+
+  def create
+    redirect_url = notion_client.auth_code.authorize_url(
+      {
+        redirect_uri: "#{base_url}/notion/callback",
+        response_type: 'code',
+        owner: 'user',
+        state: state,
+        client_id: GlobalConfigService.load('NOTION_CLIENT_ID', nil)
+      }
+    )
+
+    if redirect_url
+      render json: { success: true, url: redirect_url }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/oauth_authorization_controller.rb

@@ -0,0 +1,23 @@
+class Api::V1::Accounts::OauthAuthorizationController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+
+  protected
+
+  def scope
+    ''
+  end
+
+  def state
+    Current.account.to_sgid(expires_in: 15.minutes).to_s
+  end
+
+  def base_url
+    ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
+  end
+
+  private
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/portals_controller.rb

@@ -0,0 +1,111 @@
+class Api::V1::Accounts::PortalsController < Api::V1::Accounts::BaseController
+  include ::FileTypeHelper
+
+  before_action :fetch_portal, except: [:index, :create]
+  before_action :check_authorization
+  before_action :set_current_page, only: [:index]
+
+  def index
+    @portals = Current.account.portals
+  end
+
+  def show
+    @all_articles = @portal.articles
+    @articles = @all_articles.search(locale: params[:locale])
+  end
+
+  def create
+    @portal = Current.account.portals.build(portal_params.merge(live_chat_widget_params))
+    @portal.custom_domain = parsed_custom_domain
+    @portal.save!
+    process_attached_logo
+  end
+
+  def update
+    ActiveRecord::Base.transaction do
+      @portal.update!(portal_params.merge(live_chat_widget_params)) if params[:portal].present?
+      # @portal.custom_domain = parsed_custom_domain
+      process_attached_logo if params[:blob_id].present?
+    rescue ActiveRecord::RecordInvalid => e
+      render_record_invalid(e)
+    end
+  end
+
+  def destroy
+    @portal.destroy!
+    head :ok
+  end
+
+  def archive
+    @portal.update(archive: true)
+    head :ok
+  end
+
+  def logo
+    @portal.logo.purge if @portal.logo.attached?
+    head :ok
+  end
+
+  def send_instructions
+    email = permitted_params[:email]
+    return render_could_not_create_error(I18n.t('portals.send_instructions.email_required')) if email.blank?
+    return render_could_not_create_error(I18n.t('portals.send_instructions.invalid_email_format')) unless valid_email?(email)
+    return render_could_not_create_error(I18n.t('portals.send_instructions.custom_domain_not_configured')) if @portal.custom_domain.blank?
+
+    PortalInstructionsMailer.send_cname_instructions(
+      portal: @portal,
+      recipient_email: email
+    ).deliver_later
+
+    render json: { message: I18n.t('portals.send_instructions.instructions_sent_successfully') }, status: :ok
+  end
+
+  def process_attached_logo
+    blob_id = params[:blob_id]
+    blob = ActiveStorage::Blob.find_signed(blob_id)
+    @portal.logo.attach(blob)
+  end
+
+  private
+
+  def fetch_portal
+    @portal = Current.account.portals.find_by(slug: permitted_params[:id])
+  end
+
+  def permitted_params
+    params.permit(:id, :email)
+  end
+
+  def portal_params
+    params.require(:portal).permit(
+      :id, :color, :custom_domain, :header_text, :homepage_link,
+      :name, :page_title, :slug, :archived, { config: [:default_locale, { allowed_locales: [] }] }
+    )
+  end
+
+  def live_chat_widget_params
+    permitted_params = params.permit(:inbox_id)
+    return {} unless permitted_params.key?(:inbox_id)
+    return { channel_web_widget_id: nil } if permitted_params[:inbox_id].blank?
+
+    inbox = Inbox.find(permitted_params[:inbox_id])
+    return {} unless inbox.web_widget?
+
+    { channel_web_widget_id: inbox.channel.id }
+  end
+
+  def set_current_page
+    @current_page = params[:page] || 1
+  end
+
+  def parsed_custom_domain
+    domain = URI.parse(@portal.custom_domain)
+    domain.is_a?(URI::HTTP) ? domain.host : @portal.custom_domain
+  end
+
+  def valid_email?(email)
+    ValidEmail2::Address.new(email).valid?
+  end
+end
+
+Api::V1::Accounts::PortalsController.prepend_mod_with('Api::V1::Accounts::PortalsController')

research/chatwoot/app/controllers/api/v1/accounts/search_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::SearchController < Api::V1::Accounts::BaseController
+  def index
+    @result = search('all')
+  end
+
+  def conversations
+    @result = search('Conversation')
+  end
+
+  def contacts
+    @result = search('Contact')
+  end
+
+  def messages
+    @result = search('Message')
+  end
+
+  def articles
+    @result = search('Article')
+  end
+
+  private
+
+  def search(search_type)
+    SearchService.new(
+      current_user: Current.user,
+      current_account: Current.account,
+      search_type: search_type,
+      params: params
+    ).perform
+  rescue ArgumentError => e
+    render json: { error: e.message }, status: :unprocessable_entity
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/team_members_controller.rb

@@ -0,0 +1,55 @@
+class Api::V1::Accounts::TeamMembersController < Api::V1::Accounts::BaseController
+  before_action :fetch_team
+  before_action :check_authorization
+  before_action :validate_member_id_params, only: [:create, :update, :destroy]
+
+  def index
+    @team_members = @team.team_members.map(&:user)
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      @team_members = @team.add_members(members_to_be_added_ids)
+    end
+  end
+
+  def update
+    ActiveRecord::Base.transaction do
+      @team.add_members(members_to_be_added_ids)
+      @team.remove_members(members_to_be_removed_ids)
+    end
+    @team_members = @team.members
+    render action: 'create'
+  end
+
+  def destroy
+    ActiveRecord::Base.transaction do
+      @team.remove_members(params[:user_ids])
+    end
+    head :ok
+  end
+
+  private
+
+  def members_to_be_added_ids
+    params[:user_ids] - current_members_ids
+  end
+
+  def members_to_be_removed_ids
+    current_members_ids - params[:user_ids]
+  end
+
+  def current_members_ids
+    @current_members_ids ||= @team.members.pluck(:id)
+  end
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:team_id])
+  end
+
+  def validate_member_id_params
+    invalid_ids = params[:user_ids].map(&:to_i) - @team.account.user_ids
+
+    render json: { error: 'Invalid User IDs' }, status: :unauthorized and return if invalid_ids.present?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/teams_controller.rb

@@ -0,0 +1,34 @@
+class Api::V1::Accounts::TeamsController < Api::V1::Accounts::BaseController
+  before_action :fetch_team, only: [:show, :update, :destroy]
+  before_action :check_authorization
+
+  def index
+    @teams = Current.account.teams
+  end
+
+  def show; end
+
+  def create
+    @team = Current.account.teams.new(team_params)
+    @team.save!
+  end
+
+  def update
+    @team.update!(team_params)
+  end
+
+  def destroy
+    @team.destroy!
+    head :ok
+  end
+
+  private
+
+  def fetch_team
+    @team = Current.account.teams.find(params[:id])
+  end
+
+  def team_params
+    params.require(:team).permit(:name, :description, :allow_auto_assign)
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/tiktok/authorizations_controller.rb

@@ -0,0 +1,15 @@
+class Api::V1::Accounts::Tiktok::AuthorizationsController < Api::V1::Accounts::OauthAuthorizationController
+  include Tiktok::IntegrationHelper
+
+  def create
+    redirect_url = Tiktok::AuthClient.authorize_url(
+      state: generate_tiktok_token(Current.account.id)
+    )
+
+    if redirect_url
+      render json: { success: true, url: redirect_url }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/twitter/authorizations_controller.rb

@@ -0,0 +1,29 @@
+class Api::V1::Accounts::Twitter::AuthorizationsController < Api::V1::Accounts::BaseController
+  include TwitterConcern
+
+  before_action :check_authorization
+
+  def create
+    @response = twitter_client.request_oauth_token(url: twitter_callback_url)
+    if @response.status == '200'
+      ::Redis::Alfred.setex(oauth_token, Current.account.id)
+      render json: { success: true, url: oauth_authorize_endpoint(oauth_token) }
+    else
+      render json: { success: false }, status: :unprocessable_entity
+    end
+  end
+
+  private
+
+  def oauth_token
+    parsed_body['oauth_token']
+  end
+
+  def oauth_authorize_endpoint(oauth_token)
+    "#{twitter_api_base_url}/oauth/authorize?oauth_token=#{oauth_token}"
+  end
+
+  def check_authorization
+    raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/upload_controller.rb

@@ -0,0 +1,68 @@
+class Api::V1::Accounts::UploadController < Api::V1::Accounts::BaseController
+  def create
+    result = if params[:attachment].present?
+               create_from_file
+             elsif params[:external_url].present?
+               create_from_url
+             else
+               render_error('No file or URL provided', :unprocessable_entity)
+             end
+
+    render_success(result) if result.is_a?(ActiveStorage::Blob)
+  end
+
+  private
+
+  def create_from_file
+    attachment = params[:attachment]
+    create_and_save_blob(attachment.tempfile, attachment.original_filename, attachment.content_type)
+  end
+
+  def create_from_url
+    uri = parse_uri(params[:external_url])
+    return if performed?
+
+    fetch_and_process_file_from_uri(uri)
+  end
+
+  def parse_uri(url)
+    uri = URI.parse(url)
+    validate_uri(uri)
+    uri
+  rescue URI::InvalidURIError, SocketError
+    render_error('Invalid URL provided', :unprocessable_entity)
+    nil
+  end
+
+  def validate_uri(uri)
+    raise URI::InvalidURIError unless uri.is_a?(URI::HTTP) || uri.is_a?(URI::HTTPS)
+  end
+
+  def fetch_and_process_file_from_uri(uri)
+    uri.open do |file|
+      create_and_save_blob(file, File.basename(uri.path), file.content_type)
+    end
+  rescue OpenURI::HTTPError => e
+    render_error("Failed to fetch file from URL: #{e.message}", :unprocessable_entity)
+  rescue SocketError
+    render_error('Invalid URL provided', :unprocessable_entity)
+  rescue StandardError
+    render_error('An unexpected error occurred', :internal_server_error)
+  end
+
+  def create_and_save_blob(io, filename, content_type)
+    ActiveStorage::Blob.create_and_upload!(
+      io: io,
+      filename: filename,
+      content_type: content_type
+    )
+  end
+
+  def render_success(file_blob)
+    render json: { file_url: url_for(file_blob), blob_id: file_blob.signed_id }
+  end
+
+  def render_error(message, status)
+    render json: { error: message }, status: status
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/webhooks_controller.rb

@@ -0,0 +1,32 @@
+class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+  before_action :fetch_webhook, only: [:update, :destroy]
+
+  def index
+    @webhooks = Current.account.webhooks
+  end
+
+  def create
+    @webhook = Current.account.webhooks.new(webhook_params)
+    @webhook.save!
+  end
+
+  def update
+    @webhook.update!(webhook_params)
+  end
+
+  def destroy
+    @webhook.destroy!
+    head :ok
+  end
+
+  private
+
+  def webhook_params
+    params.require(:webhook).permit(:inbox_id, :name, :url, subscriptions: [])
+  end
+
+  def fetch_webhook
+    @webhook = Current.account.webhooks.find(params[:id])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/whatsapp/authorizations_controller.rb

@@ -0,0 +1,77 @@
+class Api::V1::Accounts::Whatsapp::AuthorizationsController < Api::V1::Accounts::BaseController
+  before_action :fetch_and_validate_inbox, if: -> { params[:inbox_id].present? }
+
+  # POST /api/v1/accounts/:account_id/whatsapp/authorization
+  # Handles both initial authorization and reauthorization
+  # If inbox_id is present in params, it performs reauthorization
+  def create
+    validate_embedded_signup_params!
+    channel = process_embedded_signup
+    render_success_response(channel.inbox)
+  rescue StandardError => e
+    render_error_response(e)
+  end
+
+  private
+
+  def process_embedded_signup
+    service = Whatsapp::EmbeddedSignupService.new(
+      account: Current.account,
+      params: params.permit(:code, :business_id, :waba_id, :phone_number_id).to_h.symbolize_keys,
+      inbox_id: params[:inbox_id]
+    )
+    service.perform
+  end
+
+  def fetch_and_validate_inbox
+    @inbox = Current.account.inboxes.find(params[:inbox_id])
+    validate_reauthorization_required
+  end
+
+  def validate_reauthorization_required
+    return if @inbox.channel.reauthorization_required? || can_upgrade_to_embedded_signup?
+
+    render json: {
+      success: false,
+      message: I18n.t('inbox.reauthorization.not_required')
+    }, status: :unprocessable_entity
+  end
+
+  def can_upgrade_to_embedded_signup?
+    channel = @inbox.channel
+    return false unless channel.provider == 'whatsapp_cloud'
+
+    true
+  end
+
+  def render_success_response(inbox)
+    response = {
+      success: true,
+      id: inbox.id,
+      name: inbox.name,
+      channel_type: 'whatsapp'
+    }
+    response[:message] = I18n.t('inbox.reauthorization.success') if params[:inbox_id].present?
+    render json: response
+  end
+
+  def render_error_response(error)
+    Rails.logger.error "[WHATSAPP AUTHORIZATION] Embedded signup error: #{error.message}"
+    Rails.logger.error error.backtrace.join("\n")
+    render json: {
+      success: false,
+      error: error.message
+    }, status: :unprocessable_entity
+  end
+
+  def validate_embedded_signup_params!
+    missing_params = []
+    missing_params << 'code' if params[:code].blank?
+    missing_params << 'business_id' if params[:business_id].blank?
+    missing_params << 'waba_id' if params[:waba_id].blank?
+
+    return if missing_params.empty?
+
+    raise ArgumentError, "Required parameters are missing: #{missing_params.join(', ')}"
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts/working_hours_controller.rb

@@ -0,0 +1,18 @@
+class Api::V1::Accounts::WorkingHoursController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+  before_action :fetch_webhook, only: [:update]
+
+  def update
+    @working_hour.update!(working_hour_params)
+  end
+
+  private
+
+  def working_hour_params
+    params.require(:working_hour).permit(:inbox_id, :open_hour, :open_minutes, :close_hour, :close_minutes, :closed_all_day)
+  end
+
+  def fetch_working_hour
+    @working_hour = Current.account.working_hours.find(params[:id])
+  end
+end

research/chatwoot/app/controllers/api/v1/accounts_controller.rb

@@ -0,0 +1,119 @@
+class Api::V1::AccountsController < Api::BaseController
+  include AuthHelper
+  include CacheKeysHelper
+
+  skip_before_action :authenticate_user!, :set_current_user, :handle_with_exception,
+                     only: [:create], raise: false
+  before_action :check_signup_enabled, only: [:create]
+  before_action :ensure_account_name, only: [:create]
+  before_action :validate_captcha, only: [:create]
+  before_action :fetch_account, except: [:create]
+  before_action :check_authorization, except: [:create]
+
+  rescue_from CustomExceptions::Account::InvalidEmail,
+              CustomExceptions::Account::InvalidParams,
+              CustomExceptions::Account::UserExists,
+              CustomExceptions::Account::UserErrors,
+              with: :render_error_response
+
+  def show
+    @latest_chatwoot_version = ::Redis::Alfred.get(::Redis::Alfred::LATEST_CHATWOOT_VERSION)
+    render 'api/v1/accounts/show', format: :json
+  end
+
+  def create
+    @user, @account = AccountBuilder.new(
+      account_name: account_params[:account_name],
+      user_full_name: account_params[:user_full_name],
+      email: account_params[:email],
+      user_password: account_params[:password],
+      locale: account_params[:locale],
+      user: current_user
+    ).perform
+    if @user
+      send_auth_headers(@user)
+      render 'api/v1/accounts/create', format: :json, locals: { resource: @user }
+    else
+      render_error_response(CustomExceptions::Account::SignupFailed.new({}))
+    end
+  end
+
+  def cache_keys
+    expires_in 10.seconds, public: false, stale_while_revalidate: 5.minutes
+    render json: { cache_keys: cache_keys_for_account }, status: :ok
+  end
+
+  def update
+    @account.assign_attributes(account_params.slice(:name, :locale, :domain, :support_email))
+    @account.custom_attributes.merge!(custom_attributes_params)
+    @account.settings.merge!(settings_params)
+    @account.custom_attributes['onboarding_step'] = 'invite_team' if @account.custom_attributes['onboarding_step'] == 'account_update'
+    @account.save!
+  end
+
+  def update_active_at
+    @current_account_user.active_at = Time.now.utc
+    @current_account_user.save!
+    head :ok
+  end
+
+  private
+
+  def ensure_account_name
+    # ensure that account_name and user_full_name is present
+    # this is becuase the account builder and the models validations are not triggered
+    # this change is to align the behaviour with the v2 accounts controller
+    # since these values are not required directly there
+    return if account_params[:account_name].present?
+    return if account_params[:user_full_name].present?
+
+    raise CustomExceptions::Account::InvalidParams.new({})
+  end
+
+  def cache_keys_for_account
+    {
+      label: fetch_value_for_key(params[:id], Label.name.underscore),
+      inbox: fetch_value_for_key(params[:id], Inbox.name.underscore),
+      team: fetch_value_for_key(params[:id], Team.name.underscore)
+    }
+  end
+
+  def fetch_account
+    @account = current_user.accounts.find(params[:id])
+    @current_account_user = @account.account_users.find_by(user_id: current_user.id)
+  end
+
+  def account_params
+    params.permit(:account_name, :email, :name, :password, :locale, :domain, :support_email, :user_full_name)
+  end
+
+  def custom_attributes_params
+    params.permit(:industry, :company_size, :timezone)
+  end
+
+  def settings_params
+    params.permit(*permitted_settings_attributes)
+  end
+
+  def permitted_settings_attributes
+    [:auto_resolve_after, :auto_resolve_message, :auto_resolve_ignore_waiting, :audio_transcriptions, :auto_resolve_label]
+  end
+
+  def check_signup_enabled
+    raise ActionController::RoutingError, 'Not Found' if GlobalConfigService.load('ENABLE_ACCOUNT_SIGNUP', 'false') == 'false'
+  end
+
+  def validate_captcha
+    raise ActionController::InvalidAuthenticityToken, 'Invalid Captcha' unless ChatwootCaptcha.new(params[:h_captcha_client_response]).valid?
+  end
+
+  def pundit_user
+    {
+      user: current_user,
+      account: @account,
+      account_user: @current_account_user
+    }
+  end
+end
+
+Api::V1::AccountsController.prepend_mod_with('Api::V1::AccountsSettings')

research/chatwoot/app/controllers/api/v1/integrations/webhooks_controller.rb

@@ -0,0 +1,15 @@
+class Api::V1::Integrations::WebhooksController < ApplicationController
+  def create
+    builder = Integrations::Slack::IncomingMessageBuilder.new(permitted_params)
+    response = builder.perform
+    render json: response
+  end
+
+  private
+
+  # TODO: This is a temporary solution to permit all params for slack unfurling job.
+  # We should only permit the params that we use. Handle all the params based on events and send it to the respective services.
+  def permitted_params
+    params.permit!
+  end
+end

research/chatwoot/app/controllers/api/v1/notification_subscriptions_controller.rb

@@ -0,0 +1,25 @@
+class Api::V1::NotificationSubscriptionsController < Api::BaseController
+  before_action :set_user
+
+  def create
+    notification_subscription = NotificationSubscriptionBuilder.new(user: @user, params: notification_subscription_params).perform
+
+    render json: notification_subscription
+  end
+
+  def destroy
+    notification_subscription = NotificationSubscription.where(["subscription_attributes->>'push_token' = ?", params[:push_token]]).first
+    notification_subscription.destroy! if notification_subscription.present?
+    head :ok
+  end
+
+  private
+
+  def set_user
+    @user = current_user
+  end
+
+  def notification_subscription_params
+    params.require(:notification_subscription).permit(:subscription_type, subscription_attributes: {})
+  end
+end

research/chatwoot/app/controllers/api/v1/profile/mfa_controller.rb

@@ -0,0 +1,68 @@
+class Api::V1::Profile::MfaController < Api::BaseController
+  before_action :check_mfa_feature_available
+  before_action :check_mfa_enabled, only: [:destroy, :backup_codes]
+  before_action :check_mfa_disabled, only: [:create, :verify]
+  before_action :validate_otp, only: [:verify, :backup_codes, :destroy]
+  before_action :validate_password, only: [:destroy]
+
+  def show; end
+
+  def create
+    mfa_service.enable_two_factor!
+  end
+
+  def verify
+    @backup_codes = mfa_service.verify_and_activate!
+  end
+
+  def destroy
+    mfa_service.disable_two_factor!
+  end
+
+  def backup_codes
+    @backup_codes = mfa_service.generate_backup_codes!
+  end
+
+  private
+
+  def mfa_service
+    @mfa_service ||= Mfa::ManagementService.new(user: current_user)
+  end
+
+  def check_mfa_enabled
+    render_could_not_create_error(I18n.t('errors.mfa.not_enabled')) unless current_user.mfa_enabled?
+  end
+
+  def check_mfa_feature_available
+    return if Chatwoot.mfa_enabled?
+
+    render json: {
+      error: I18n.t('errors.mfa.feature_unavailable')
+    }, status: :forbidden
+  end
+
+  def check_mfa_disabled
+    render_could_not_create_error(I18n.t('errors.mfa.already_enabled')) if current_user.mfa_enabled?
+  end
+
+  def validate_otp
+    authenticated = Mfa::AuthenticationService.new(
+      user: current_user,
+      otp_code: mfa_params[:otp_code]
+    ).authenticate
+
+    return if authenticated
+
+    render_could_not_create_error(I18n.t('errors.mfa.invalid_code'))
+  end
+
+  def validate_password
+    return if current_user.valid_password?(mfa_params[:password])
+
+    render_could_not_create_error(I18n.t('errors.mfa.invalid_credentials'))
+  end
+
+  def mfa_params
+    params.permit(:otp_code, :password)
+  end
+end

research/chatwoot/app/controllers/api/v1/profiles_controller.rb

@@ -0,0 +1,83 @@
+class Api::V1::ProfilesController < Api::BaseController
+  before_action :set_user
+
+  def show; end
+
+  def update
+    if password_params[:password].present?
+      render_could_not_create_error('Invalid current password') and return unless @user.valid_password?(password_params[:current_password])
+
+      @user.update!(password_params.except(:current_password))
+    end
+
+    @user.assign_attributes(profile_params)
+    @user.custom_attributes.merge!(custom_attributes_params)
+    @user.save!
+  end
+
+  def avatar
+    @user.avatar.attachment.destroy! if @user.avatar.attached?
+    @user.reload
+  end
+
+  def auto_offline
+    @user.account_users.find_by!(account_id: auto_offline_params[:account_id]).update!(auto_offline: auto_offline_params[:auto_offline] || false)
+  end
+
+  def availability
+    @user.account_users.find_by!(account_id: availability_params[:account_id]).update!(availability: availability_params[:availability])
+  end
+
+  def set_active_account
+    @user.account_users.find_by(account_id: profile_params[:account_id]).update(active_at: Time.now.utc)
+    head :ok
+  end
+
+  def resend_confirmation
+    @user.send_confirmation_instructions unless @user.confirmed?
+    head :ok
+  end
+
+  def reset_access_token
+    @user.access_token.regenerate_token
+    @user.reload
+  end
+
+  private
+
+  def set_user
+    @user = current_user
+  end
+
+  def availability_params
+    params.require(:profile).permit(:account_id, :availability)
+  end
+
+  def auto_offline_params
+    params.require(:profile).permit(:account_id, :auto_offline)
+  end
+
+  def profile_params
+    params.require(:profile).permit(
+      :email,
+      :name,
+      :display_name,
+      :avatar,
+      :message_signature,
+      :account_id,
+      ui_settings: {}
+    )
+  end
+
+  def custom_attributes_params
+    params.require(:profile).permit(:phone_number)
+  end
+
+  def password_params
+    params.require(:profile).permit(
+      :current_password,
+      :password,
+      :password_confirmation
+    )
+  end
+end

research/chatwoot/app/controllers/api/v1/webhooks_controller.rb

@@ -0,0 +1,28 @@
+class Api::V1::WebhooksController < ApplicationController
+  skip_before_action :authenticate_user!, raise: false
+  skip_before_action :set_current_user
+
+  def twitter_crc
+    render json: { response_token: "sha256=#{twitter_client.generate_crc(params[:crc_token])}" }
+  end
+
+  def twitter_events
+    twitter_consumer.consume
+    head :ok
+  rescue StandardError => e
+    ChatwootExceptionTracker.new(e).capture_exception
+    head :ok
+  end
+
+  private
+
+  def twitter_client
+    Twitty::Facade.new do |config|
+      config.consumer_secret = ENV.fetch('TWITTER_CONSUMER_SECRET', nil)
+    end
+  end
+
+  def twitter_consumer
+    @twitter_consumer ||= ::Webhooks::Twitter.new(params)
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/base_controller.rb

@@ -0,0 +1,89 @@
+class Api::V1::Widget::BaseController < ApplicationController
+  include SwitchLocale
+  include WebsiteTokenHelper
+
+  before_action :set_web_widget
+  before_action :set_contact
+
+  private
+
+  def conversations
+    if @contact_inbox.hmac_verified?
+      verified_contact_inbox_ids = @contact.contact_inboxes.where(inbox_id: auth_token_params[:inbox_id], hmac_verified: true).map(&:id)
+      @conversations = @contact.conversations.where(contact_inbox_id: verified_contact_inbox_ids)
+    else
+      @conversations = @contact_inbox.conversations.where(inbox_id: auth_token_params[:inbox_id])
+    end
+  end
+
+  def conversation
+    @conversation ||= conversations.last
+  end
+
+  def create_conversation
+    ::Conversation.create!(conversation_params)
+  end
+
+  def inbox
+    @inbox ||= ::Inbox.find_by(id: auth_token_params[:inbox_id])
+  end
+
+  def conversation_params
+    # FIXME: typo referrer in additional attributes, will probably require a migration.
+    {
+      account_id: inbox.account_id,
+      inbox_id: inbox.id,
+      contact_id: @contact.id,
+      contact_inbox_id: @contact_inbox.id,
+      additional_attributes: {
+        browser_language: browser.accept_language&.first&.code,
+        browser: browser_params,
+        initiated_at: timestamp_params,
+        referer: permitted_params[:message][:referer_url]
+      },
+      custom_attributes: permitted_params[:custom_attributes].presence || {}
+    }
+  end
+
+  def contact_email
+    permitted_params.dig(:contact, :email)&.downcase
+  end
+
+  def contact_name
+    return if @contact.email.present? || @contact.phone_number.present? || @contact.identifier.present?
+
+    permitted_params.dig(:contact, :name) || (contact_email.split('@')[0] if contact_email.present?)
+  end
+
+  def contact_phone_number
+    permitted_params.dig(:contact, :phone_number)
+  end
+
+  def browser_params
+    {
+      browser_name: browser.name,
+      browser_version: browser.full_version,
+      device_name: browser.device.name,
+      platform_name: browser.platform.name,
+      platform_version: browser.platform.version
+    }
+  end
+
+  def timestamp_params
+    { timestamp: permitted_params[:message][:timestamp] }
+  end
+
+  def message_params
+    {
+      account_id: conversation.account_id,
+      sender: @contact,
+      content: permitted_params[:message][:content],
+      inbox_id: conversation.inbox_id,
+      content_attributes: {
+        in_reply_to: permitted_params[:message][:reply_to]
+      },
+      echo_id: permitted_params[:message][:echo_id],
+      message_type: :incoming
+    }
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/campaigns_controller.rb

@@ -0,0 +1,16 @@
+class Api::V1::Widget::CampaignsController < Api::V1::Widget::BaseController
+  skip_before_action :set_contact
+
+  def index
+    account = @web_widget.inbox.account
+    @campaigns = if account.feature_enabled?('campaigns')
+                   @web_widget
+                     .inbox
+                     .campaigns
+                     .where(enabled: true, account_id: account.id)
+                     .includes(:sender)
+                 else
+                   []
+                 end
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/configs_controller.rb

@@ -0,0 +1,47 @@
+class Api::V1::Widget::ConfigsController < Api::V1::Widget::BaseController
+  before_action :set_global_config
+
+  def create
+    build_contact
+    set_token
+  end
+
+  private
+
+  def set_global_config
+    @global_config = GlobalConfig.get(
+      'LOGO_THUMBNAIL',
+      'BRAND_NAME',
+      'WIDGET_BRAND_URL',
+      'MAXIMUM_FILE_UPLOAD_SIZE',
+      'INSTALLATION_NAME'
+    )
+  end
+
+  def set_contact
+    @contact_inbox = @web_widget.inbox.contact_inboxes.find_by(
+      source_id: auth_token_params[:source_id]
+    )
+    @contact = @contact_inbox&.contact
+  end
+
+  def build_contact
+    return if @contact.present?
+
+    @contact_inbox = @web_widget.create_contact_inbox(additional_attributes)
+    @contact = @contact_inbox.contact
+  end
+
+  def set_token
+    payload = { source_id: @contact_inbox.source_id, inbox_id: @web_widget.inbox.id }
+    @token = ::Widget::TokenService.new(payload: payload).generate_token
+  end
+
+  def additional_attributes
+    if @web_widget.inbox.account.feature_enabled?('ip_lookup')
+      { created_at_ip: request.remote_ip }
+    else
+      {}
+    end
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/contacts_controller.rb

@@ -0,0 +1,76 @@
+class Api::V1::Widget::ContactsController < Api::V1::Widget::BaseController
+  include WidgetHelper
+
+  before_action :validate_hmac, only: [:set_user]
+
+  def show; end
+
+  def update
+    identify_contact(@contact)
+  end
+
+  def set_user
+    contact = nil
+
+    if a_different_contact?
+      @contact_inbox, @widget_auth_token = build_contact_inbox_with_token(@web_widget)
+      contact = @contact_inbox.contact
+    else
+      contact = @contact
+    end
+
+    @contact_inbox.update(hmac_verified: true) if should_verify_hmac? && valid_hmac?
+
+    identify_contact(contact)
+  end
+
+  # TODO : clean up this with proper routes delete contacts/custom_attributes
+  def destroy_custom_attributes
+    @contact.custom_attributes = @contact.custom_attributes.excluding(params[:custom_attributes])
+    @contact.save!
+    render json: @contact
+  end
+
+  private
+
+  def identify_contact(contact)
+    contact_identify_action = ContactIdentifyAction.new(
+      contact: contact,
+      params: permitted_params.to_h.deep_symbolize_keys,
+      discard_invalid_attrs: true
+    )
+    @contact = contact_identify_action.perform
+  end
+
+  def a_different_contact?
+    @contact.identifier.present? && @contact.identifier != permitted_params[:identifier]
+  end
+
+  def validate_hmac
+    return unless should_verify_hmac?
+
+    render json: { error: 'HMAC failed: Invalid Identifier Hash Provided' }, status: :unauthorized unless valid_hmac?
+  end
+
+  def should_verify_hmac?
+    return false if params[:identifier_hash].blank? && !@web_widget.hmac_mandatory
+
+    # Taking an extra caution that the hmac is triggered whenever identifier is present
+    return false if params[:custom_attributes].present? && params[:identifier].blank?
+
+    true
+  end
+
+  def valid_hmac?
+    params[:identifier_hash] == OpenSSL::HMAC.hexdigest(
+      'sha256',
+      @web_widget.hmac_token,
+      params[:identifier].to_s
+    )
+  end
+
+  def permitted_params
+    params.permit(:website_token, :identifier, :identifier_hash, :email, :name, :avatar_url, :phone_number, custom_attributes: {},
+                                                                                                            additional_attributes: {})
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/conversations_controller.rb

@@ -0,0 +1,102 @@
+class Api::V1::Widget::ConversationsController < Api::V1::Widget::BaseController
+  include Events::Types
+  before_action :render_not_found_if_empty, only: [:toggle_typing, :toggle_status, :set_custom_attributes, :destroy_custom_attributes]
+
+  def index
+    @conversation = conversation
+  end
+
+  def create
+    ActiveRecord::Base.transaction do
+      process_update_contact
+      @conversation = create_conversation
+      conversation.messages.create!(message_params)
+      # TODO: Temporary fix for message type cast issue, since message_type is returning as string instead of integer
+      conversation.reload
+    end
+  end
+
+  def process_update_contact
+    @contact = ContactIdentifyAction.new(
+      contact: @contact,
+      params: { email: contact_email, phone_number: contact_phone_number, name: contact_name },
+      retain_original_contact_name: true,
+      discard_invalid_attrs: true
+    ).perform
+  end
+
+  def update_last_seen
+    head :ok && return if conversation.nil?
+
+    conversation.contact_last_seen_at = DateTime.now.utc
+    conversation.save!
+    ::Conversations::UpdateMessageStatusJob.perform_later(conversation.id, conversation.contact_last_seen_at)
+    head :ok
+  end
+
+  def transcript
+    return head :too_many_requests if conversation.blank?
+    return head :payment_required unless conversation.account.email_transcript_enabled?
+    return head :too_many_requests unless conversation.account.within_email_rate_limit?
+
+    send_transcript_email
+    head :ok
+  end
+
+  def toggle_typing
+    case permitted_params[:typing_status]
+    when 'on'
+      trigger_typing_event(CONVERSATION_TYPING_ON)
+    when 'off'
+      trigger_typing_event(CONVERSATION_TYPING_OFF)
+    end
+
+    head :ok
+  end
+
+  def toggle_status
+    return head :forbidden unless @web_widget.end_conversation?
+
+    unless conversation.resolved?
+      conversation.status = :resolved
+      conversation.save!
+    end
+    head :ok
+  end
+
+  def set_custom_attributes
+    conversation.update!(custom_attributes: permitted_params[:custom_attributes])
+  end
+
+  def destroy_custom_attributes
+    conversation.custom_attributes = conversation.custom_attributes.excluding(params[:custom_attribute])
+    conversation.save!
+    render json: conversation
+  end
+
+  private
+
+  def send_transcript_email
+    return if conversation.contact&.email.blank?
+
+    ConversationReplyMailer.with(account: conversation.account).conversation_transcript(
+      conversation,
+      conversation.contact.email
+    )&.deliver_later
+    conversation.account.increment_email_sent_count
+  end
+
+  def trigger_typing_event(event)
+    Rails.configuration.dispatcher.dispatch(event, Time.zone.now, conversation: conversation, user: @contact)
+  end
+
+  def render_not_found_if_empty
+    return head :not_found if conversation.nil?
+  end
+
+  def permitted_params
+    params.permit(:id, :typing_status, :website_token, :email, contact: [:name, :email, :phone_number],
+                                                               message: [:content, :referer_url, :timestamp, :echo_id],
+                                                               custom_attributes: {})
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/direct_uploads_controller.rb

@@ -0,0 +1,11 @@
+class Api::V1::Widget::DirectUploadsController < ActiveStorage::DirectUploadsController
+  include WebsiteTokenHelper
+  before_action :set_web_widget
+  before_action :set_contact
+
+  def create
+    return if @contact.nil? || @current_account.nil?
+
+    super
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/events_controller.rb

@@ -0,0 +1,23 @@
+class Api::V1::Widget::EventsController < Api::V1::Widget::BaseController
+  include Events::Types
+
+  def create
+    Rails.configuration.dispatcher.dispatch(permitted_params[:name], Time.zone.now, contact_inbox: @contact_inbox,
+                                                                                    event_info: permitted_params[:event_info].to_h.merge(event_info))
+    head :no_content
+  end
+
+  private
+
+  def event_info
+    {
+      widget_language: params[:locale],
+      browser_language: browser.accept_language.first&.code,
+      browser: browser_params
+    }
+  end
+
+  def permitted_params
+    params.permit(:name, :website_token, event_info: {})
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/inbox_members_controller.rb

@@ -0,0 +1,7 @@
+class Api::V1::Widget::InboxMembersController < Api::V1::Widget::BaseController
+  skip_before_action :set_contact
+
+  def index
+    @inbox_members = @web_widget.inbox.inbox_members.includes(user: { avatar_attachment: :blob })
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/integrations/dyte_controller.rb

@@ -0,0 +1,36 @@
+class Api::V1::Widget::Integrations::DyteController < Api::V1::Widget::BaseController
+  before_action :set_message
+
+  def add_participant_to_meeting
+    if @message.content_type != 'integrations'
+      return render json: {
+        error: I18n.t('errors.dyte.invalid_message_type')
+      }, status: :unprocessable_entity
+    end
+
+    response = dyte_processor_service.add_participant_to_meeting(
+      @message.content_attributes['data']['meeting_id'],
+      @conversation.contact
+    )
+    render_response(response)
+  end
+
+  private
+
+  def render_response(response)
+    render json: response, status: response[:error].blank? ? :ok : :unprocessable_entity
+  end
+
+  def dyte_processor_service
+    Integrations::Dyte::ProcessorService.new(account: @web_widget.inbox.account, conversation: @conversation)
+  end
+
+  def set_message
+    @message = @web_widget.inbox.messages.find(permitted_params[:message_id])
+    @conversation = @message.conversation
+  end
+
+  def permitted_params
+    params.permit(:website_token, :message_id)
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/labels_controller.rb

@@ -0,0 +1,30 @@
+class Api::V1::Widget::LabelsController < Api::V1::Widget::BaseController
+  def create
+    if conversation.present? && label_defined_in_account?
+      conversation.label_list.add(permitted_params[:label])
+      conversation.save!
+    end
+
+    head :no_content
+  end
+
+  def destroy
+    if conversation.present?
+      conversation.label_list.remove(permitted_params[:id])
+      conversation.save!
+    end
+
+    head :no_content
+  end
+
+  private
+
+  def label_defined_in_account?
+    label = @current_account.labels&.find_by(title: permitted_params[:label])
+    label.present?
+  end
+
+  def permitted_params
+    params.permit(:id, :label, :website_token)
+  end
+end

research/chatwoot/app/controllers/api/v1/widget/messages_controller.rb

@@ -0,0 +1,73 @@
+class Api::V1::Widget::MessagesController < Api::V1::Widget::BaseController
+  before_action :set_conversation, only: [:create]
+  before_action :set_message, only: [:update]
+
+  def index
+    @messages = conversation.nil? ? [] : message_finder.perform
+  end
+
+  def create
+    @message = conversation.messages.new(message_params)
+    build_attachment
+    @message.save!
+  end
+
+  def update
+    if @message.content_type == 'input_email'
+      @message.update!(submitted_email: contact_email)
+      ContactIdentifyAction.new(
+        contact: @contact,
+        params: { email: contact_email, name: contact_name },
+        retain_original_contact_name: true
+      ).perform
+    else
+      @message.update!(message_update_params[:message])
+    end
+  rescue StandardError => e
+    render json: { error: @contact.errors, message: e.message }.to_json, status: :internal_server_error
+  end
+
+  private
+
+  def build_attachment
+    return if params[:message][:attachments].blank?
+
+    params[:message][:attachments].each do |uploaded_attachment|
+      attachment = @message.attachments.new(
+        account_id: @message.account_id,
+        file: uploaded_attachment
+      )
+
+      attachment.file_type = helpers.file_type(uploaded_attachment&.content_type) if uploaded_attachment.is_a?(ActionDispatch::Http::UploadedFile)
+    end
+  end
+
+  def set_conversation
+    @conversation = create_conversation if conversation.nil?
+  end
+
+  def message_finder_params
+    {
+      filter_internal_messages: true,
+      before: permitted_params[:before],
+      after: permitted_params[:after]
+    }
+  end
+
+  def message_finder
+    @message_finder ||= MessageFinder.new(conversation, message_finder_params)
+  end
+
+  def message_update_params
+    params.permit(message: [{ submitted_values: [:name, :title, :value, { csat_survey_response: [:feedback_message, :rating] }] }])
+  end
+
+  def permitted_params
+    # timestamp parameter is used in create conversation method
+    params.permit(:id, :before, :after, :website_token, contact: [:name, :email], message: [:content, :referer_url, :timestamp, :echo_id, :reply_to])
+  end
+
+  def set_message
+    @message = @web_widget.inbox.messages.find(permitted_params[:id])
+  end
+end

research/chatwoot/app/controllers/api/v2/accounts/live_reports_controller.rb

@@ -0,0 +1,64 @@
+class Api::V2::Accounts::LiveReportsController < Api::V1::Accounts::BaseController
+  before_action :load_conversations, only: [:conversation_metrics, :grouped_conversation_metrics]
+  before_action :set_group_scope, only: [:grouped_conversation_metrics]
+
+  before_action :check_authorization
+
+  def conversation_metrics
+    render json: {
+      open: @conversations.open.count,
+      unattended: @conversations.open.unattended.count,
+      unassigned: @conversations.open.unassigned.count,
+      pending: @conversations.pending.count
+    }
+  end
+
+  def grouped_conversation_metrics
+    count_by_group = @conversations.open.group(@group_scope).count
+    unattended_by_group = @conversations.open.unattended.group(@group_scope).count
+    unassigned_by_group = @conversations.open.unassigned.group(@group_scope).count
+
+    group_metrics = count_by_group.map do |group_id, count|
+      metric = {
+        open: count,
+        unattended: unattended_by_group[group_id] || 0,
+        unassigned: unassigned_by_group[group_id] || 0
+      }
+      metric[@group_scope] = group_id
+      metric
+    end
+
+    render json: group_metrics
+  end
+
+  private
+
+  def check_authorization
+    authorize :report, :view?
+  end
+
+  def set_group_scope
+    render json: { error: 'invalid group_by' }, status: :unprocessable_entity and return unless %w[
+      team_id
+      assignee_id
+    ].include?(permitted_params[:group_by])
+
+    @group_scope = permitted_params[:group_by]
+  end
+
+  def team
+    return unless permitted_params[:team_id]
+
+    @team ||= Current.account.teams.find(permitted_params[:team_id])
+  end
+
+  def load_conversations
+    scope = Current.account.conversations
+    scope = scope.where(team_id: team.id) if team.present?
+    @conversations = scope
+  end
+
+  def permitted_params
+    params.permit(:team_id, :group_by)
+  end
+end

research/chatwoot/app/controllers/api/v2/accounts/reports_controller.rb

@@ -0,0 +1,191 @@
+class Api::V2::Accounts::ReportsController < Api::V1::Accounts::BaseController
+  include Api::V2::Accounts::ReportsHelper
+  include Api::V2::Accounts::HeatmapHelper
+
+  before_action :check_authorization
+
+  def index
+    builder = V2::Reports::Conversations::ReportBuilder.new(Current.account, report_params)
+    data = builder.timeseries
+    render json: data
+  end
+
+  def summary
+    render json: build_summary(:summary)
+  end
+
+  def bot_summary
+    render json: build_summary(:bot_summary)
+  end
+
+  def agents
+    @report_data = generate_agents_report
+    generate_csv('agents_report', 'api/v2/accounts/reports/agents')
+  end
+
+  def inboxes
+    @report_data = generate_inboxes_report
+    generate_csv('inboxes_report', 'api/v2/accounts/reports/inboxes')
+  end
+
+  def labels
+    @report_data = generate_labels_report
+    generate_csv('labels_report', 'api/v2/accounts/reports/labels')
+  end
+
+  def teams
+    @report_data = generate_teams_report
+    generate_csv('teams_report', 'api/v2/accounts/reports/teams')
+  end
+
+  def conversations_summary
+    @report_data = generate_conversations_report
+    generate_csv('conversations_summary_report', 'api/v2/accounts/reports/conversations_summary')
+  end
+
+  def conversation_traffic
+    @report_data = generate_conversations_heatmap_report
+    timezone_offset = (params[:timezone_offset] || 0).to_f
+    @timezone = ActiveSupport::TimeZone[timezone_offset]
+
+    generate_csv('conversation_traffic_reports', 'api/v2/accounts/reports/conversation_traffic')
+  end
+
+  def conversations
+    return head :unprocessable_entity if params[:type].blank?
+
+    render json: conversation_metrics
+  end
+
+  def bot_metrics
+    bot_metrics = V2::Reports::BotMetricsBuilder.new(Current.account, params).metrics
+    render json: bot_metrics
+  end
+
+  def inbox_label_matrix
+    builder = V2::Reports::InboxLabelMatrixBuilder.new(
+      account: Current.account,
+      params: inbox_label_matrix_params
+    )
+    render json: builder.build
+  end
+
+  def first_response_time_distribution
+    builder = V2::Reports::FirstResponseTimeDistributionBuilder.new(
+      account: Current.account,
+      params: first_response_time_distribution_params
+    )
+    render json: builder.build
+  end
+
+  OUTGOING_MESSAGES_ALLOWED_GROUP_BY = %w[agent team inbox label].freeze
+
+  def outgoing_messages_count
+    return head :unprocessable_entity unless OUTGOING_MESSAGES_ALLOWED_GROUP_BY.include?(params[:group_by])
+
+    builder = V2::Reports::OutgoingMessagesCountBuilder.new(Current.account, outgoing_messages_count_params)
+    render json: builder.build
+  end
+
+  private
+
+  def generate_csv(filename, template)
+    response.headers['Content-Type'] = 'text/csv'
+    response.headers['Content-Disposition'] = "attachment; filename=#{filename}.csv"
+    render layout: false, template: template, formats: [:csv]
+  end
+
+  def check_authorization
+    authorize :report, :view?
+  end
+
+  def common_params
+    {
+      type: params[:type].to_sym,
+      id: params[:id],
+      group_by: params[:group_by],
+      business_hours: ActiveModel::Type::Boolean.new.cast(params[:business_hours])
+    }
+  end
+
+  def current_summary_params
+    common_params.merge({
+                          since: range[:current][:since],
+                          until: range[:current][:until],
+                          timezone_offset: params[:timezone_offset]
+                        })
+  end
+
+  def previous_summary_params
+    common_params.merge({
+                          since: range[:previous][:since],
+                          until: range[:previous][:until],
+                          timezone_offset: params[:timezone_offset]
+                        })
+  end
+
+  def report_params
+    common_params.merge({
+                          metric: params[:metric],
+                          since: params[:since],
+                          until: params[:until],
+                          timezone_offset: params[:timezone_offset]
+                        })
+  end
+
+  def conversation_params
+    {
+      type: params[:type].to_sym,
+      user_id: params[:user_id],
+      page: params[:page].presence || 1
+    }
+  end
+
+  def range
+    {
+      current: {
+        since: params[:since],
+        until: params[:until]
+      },
+      previous: {
+        since: (params[:since].to_i - (params[:until].to_i - params[:since].to_i)).to_s,
+        until: params[:since]
+      }
+    }
+  end
+
+  def build_summary(method)
+    builder = V2::Reports::Conversations::MetricBuilder
+    current_summary = builder.new(Current.account, current_summary_params).send(method)
+    previous_summary = builder.new(Current.account, previous_summary_params).send(method)
+    current_summary.merge(previous: previous_summary)
+  end
+
+  def conversation_metrics
+    V2::ReportBuilder.new(Current.account, conversation_params).conversation_metrics
+  end
+
+  def inbox_label_matrix_params
+    {
+      since: params[:since],
+      until: params[:until],
+      inbox_ids: params[:inbox_ids],
+      label_ids: params[:label_ids]
+    }
+  end
+
+  def first_response_time_distribution_params
+    {
+      since: params[:since],
+      until: params[:until]
+    }
+  end
+
+  def outgoing_messages_count_params
+    {
+      group_by: params[:group_by],
+      since: params[:since],
+      until: params[:until]
+    }
+  end
+end

research/chatwoot/app/controllers/api/v2/accounts/summary_reports_controller.rb

@@ -0,0 +1,57 @@
+class Api::V2::Accounts::SummaryReportsController < Api::V1::Accounts::BaseController
+  before_action :check_authorization
+  before_action :prepare_builder_params, only: [:agent, :team, :inbox, :label, :channel]
+
+  def agent
+    render_report_with(V2::Reports::AgentSummaryBuilder)
+  end
+
+  def team
+    render_report_with(V2::Reports::TeamSummaryBuilder)
+  end
+
+  def inbox
+    render_report_with(V2::Reports::InboxSummaryBuilder)
+  end
+
+  def label
+    render_report_with(V2::Reports::LabelSummaryBuilder)
+  end
+
+  def channel
+    return render_could_not_create_error(I18n.t('errors.reports.date_range_too_long')) if date_range_too_long?
+
+    render_report_with(V2::Reports::ChannelSummaryBuilder)
+  end
+
+  private
+
+  def check_authorization
+    authorize :report, :view?
+  end
+
+  def prepare_builder_params
+    @builder_params = {
+      since: permitted_params[:since],
+      until: permitted_params[:until],
+      business_hours: ActiveModel::Type::Boolean.new.cast(permitted_params[:business_hours])
+    }
+  end
+
+  def render_report_with(builder_class)
+    builder = builder_class.new(account: Current.account, params: @builder_params)
+    render json: builder.build
+  end
+
+  def permitted_params
+    params.permit(:since, :until, :business_hours)
+  end
+
+  def date_range_too_long?
+    return false if permitted_params[:since].blank? || permitted_params[:until].blank?
+
+    since_time = Time.zone.at(permitted_params[:since].to_i)
+    until_time = Time.zone.at(permitted_params[:until].to_i)
+    (until_time - since_time) > 6.months
+  end
+end

research/chatwoot/app/controllers/api/v2/accounts/year_in_reviews_controller.rb

@@ -0,0 +1,26 @@
+class Api::V2::Accounts::YearInReviewsController < Api::V1::Accounts::BaseController
+  def show
+    year = params[:year] || 2025
+    cache_key = "year_in_review_#{Current.account.id}_#{year}"
+
+    cached_data = Current.user.ui_settings&.dig(cache_key)
+
+    if cached_data.present?
+      render json: cached_data
+    else
+      builder = YearInReviewBuilder.new(
+        account: Current.account,
+        user_id: Current.user.id,
+        year: year
+      )
+
+      data = builder.build
+
+      ui_settings = Current.user.ui_settings || {}
+      ui_settings[cache_key] = data
+      Current.user.update(ui_settings: ui_settings)
+
+      render json: data
+    end
+  end
+end

research/chatwoot/app/controllers/api/v2/accounts_controller.rb

@@ -0,0 +1,69 @@
+class Api::V2::AccountsController < Api::BaseController
+  include AuthHelper
+
+  skip_before_action :authenticate_user!, :set_current_user, :handle_with_exception,
+                     only: [:create], raise: false
+  before_action :check_signup_enabled, only: [:create]
+  before_action :validate_captcha, only: [:create]
+  before_action :fetch_account, except: [:create]
+  before_action :check_authorization, except: [:create]
+
+  rescue_from CustomExceptions::Account::InvalidEmail,
+              CustomExceptions::Account::UserExists,
+              CustomExceptions::Account::UserErrors,
+              with: :render_error_response
+
+  def create
+    @user, @account = AccountBuilder.new(
+      email: account_params[:email],
+      user_password: account_params[:password],
+      locale: account_params[:locale],
+      user: current_user
+    ).perform
+
+    fetch_account_and_user_info
+    update_account_info if @account.present?
+
+    if @user
+      send_auth_headers(@user)
+      render 'api/v1/accounts/create', format: :json, locals: { resource: @user }
+    else
+      render_error_response(CustomExceptions::Account::SignupFailed.new({}))
+    end
+  end
+
+  private
+
+  def account_attributes
+    {
+      custom_attributes: @account.custom_attributes.merge({ 'onboarding_step' => 'profile_update' })
+    }
+  end
+
+  def update_account_info
+    @account.update!(
+      account_attributes
+    )
+  end
+
+  def fetch_account_and_user_info; end
+
+  def fetch_account
+    @account = current_user.accounts.find(params[:id])
+    @current_account_user = @account.account_users.find_by(user_id: current_user.id)
+  end
+
+  def account_params
+    params.permit(:account_name, :email, :name, :password, :locale, :domain, :support_email, :user_full_name)
+  end
+
+  def check_signup_enabled
+    raise ActionController::RoutingError, 'Not Found' if GlobalConfigService.load('ENABLE_ACCOUNT_SIGNUP', 'false') == 'false'
+  end
+
+  def validate_captcha
+    raise ActionController::InvalidAuthenticityToken, 'Invalid Captcha' unless ChatwootCaptcha.new(params[:h_captcha_client_response]).valid?
+  end
+end
+
+Api::V2::AccountsController.prepend_mod_with('Api::V2::AccountsController')