Dev Log: August 06 Wrap-up

Overview

Today was a mix of environment-specific plumbing and tightening up user scoping. I spent a good chunk of time making sure our dashboard doesn't just look right for different user levels, but actually stays secure under the hood.

What I Worked On

Tightening Helpdesk Scoping

I had to address a bit of a gap in how our helpdesk dashboard handles different user roles. It’s one thing to hide a dropdown in the UI, but it’s another to ensure the backend actually enforces those boundaries.

On the frontend, I updated the logic to check if a user is an Account User. If they are, we're now stripping away the global account and assignee filters. It doesn't make sense for a client-level user to see a list of every account in the system.

But the real fix was in the backend decorator. I added a manual override to the match criteria. Even if a request tries to sneak in a different account_id, the system now force-injects the user's actual account ID from their session context if they are restricted to that scope.

// Sanitized snippet of the scoping logic
private void applyUserScope(Context ctx, Document query) {
    if ("account_user".equalsIgnoreCase(ctx.getUserType())) {
        // Don't trust the filter from the request; use the session's ID
        query.append("account_id", ctx.getAccountId());
    }
}

Cleaning up the Decorators

Found a hardcoded production URL sitting in one of our core flow decorators. It’s one of those things that probably got added for a quick "emergency" test and never left. I nuked that hardcoded string and let the environment-based logic take back control.

I also switched a module code configuration from a legacy CRM tag to our newer workflow service. It’s a small change, but it ensures that bot-filtering thresholds are being pulled from the correct configuration block.

Handling Environment Routing

Our API interceptor needed a bit of love to handle our staging and demo environments better. We have specific hostnames for the demo stage that weren't being mapped correctly to the right origin, which was causing some cross-origin headaches. I added a check for the demo hostname so it now correctly routes to the enterprise-level stage origin instead of defaulting to the current window's origin, which doesn't always play nice with our auth setup.

Wrapping Up

Nothing feels quite as good as deleting a hardcoded URL that shouldn't have been there in the first place. Tomorrow I'll probably double-check the other decorators to make sure no other "temporary" URLs are lurking in the shadows. Catch you then.