feat(messenger): let workspace admins clone templates to their pages (#1123)

* style(broadcast): narrow the status sidebar

* feat(messenger): let workspace admins clone templates to their pages

---------

Co-authored-by: Hung Phan Viet <hungphan@ahachat.com>

Author: viethung0o0

apps/builder/__tests__/messenger-clone-template-components.test.ts

@@ -2,33 +2,35 @@
 import { beforeEach, describe, expect, test, vi } from "vitest"
 
 const resumableUploadImage = vi.fn(async () => "new-handle")
+const createPageMessageTemplate = vi.fn()
+const syncTemplates = vi.fn()
+const findByIdForWorkspace = vi.fn()
+const listCloneTargetsForUser = vi.fn()
+const findByIdForIntegration = vi.fn()
+
+// Captures the handler the safe-action chain wraps so the action's
+// authorization can be exercised directly.
+let cloneHandler: ((props: unknown) => Promise<unknown>) | null = null
 
 vi.mock("@chatbotx.io/integration-messenger/apis/upload", () => ({
   resumableUploadImage,
 }))
 
-vi.mock("@chatbotx.io/database/client", () => ({
-  db: {},
-  inArray: vi.fn(),
-}))
-
-vi.mock("@chatbotx.io/database/schema", () => ({
-  integrationMessengerModel: {},
-  messengerMessageTemplateModel: {},
-}))
-
 vi.mock("@chatbotx.io/business", () => ({
   messengerIntegrationService: {
-    findByIdForWorkspace: vi.fn(),
-    findByIds: vi.fn(),
+    findByIdForWorkspace: (...args: unknown[]) => findByIdForWorkspace(...args),
+    listCloneTargetsForUser: (...args: unknown[]) =>
+      listCloneTargetsForUser(...args),
   },
   messengerMessageTemplateService: {
-    findByIdForIntegration: vi.fn(),
+    findByIdForIntegration: (...args: unknown[]) =>
+      findByIdForIntegration(...args),
   },
 }))
 
 vi.mock("@chatbotx.io/integration-messenger/apis/message-templates", () => ({
-  createPageMessageTemplate: vi.fn(),
+  createPageMessageTemplate: (...args: unknown[]) =>
+    createPageMessageTemplate(...args),
 }))
 
 vi.mock("@chatbotx.io/redis", () => ({
@@ -38,21 +40,21 @@ vi.mock("@chatbotx.io/redis", () => ({
 vi.mock(
   "@/features/integration-messenger/message-templates/actions/sync-message-templates",
   () => ({
-    syncMessengerMessageTemplatesForIntegration: vi.fn(),
+    syncMessengerMessageTemplatesForIntegration: (...args: unknown[]) =>
+      syncTemplates(...args),
   }),
 )
 
-vi.mock("@/features/workspace-members/queries", () => ({
-  getAllWorkspaceMembers: vi.fn(),
-}))
-
 vi.mock("@/lib/safe-action", () => ({
   workspaceActionClient: {
-    bindArgsSchemas: vi.fn(() => ({
-      schema: vi.fn(() => ({
-        action: vi.fn(),
-      })),
-    })),
+    bindArgsSchemas: () => ({
+      schema: () => ({
+        action: (handler: (props: unknown) => Promise<unknown>) => {
+          cloneHandler = handler
+          return handler
+        },
+      }),
+    }),
   },
 }))
 
@@ -148,3 +150,105 @@ describe("prepareComponentsForClone", () => {
     })
   })
 })
+
+type CloneResult = {
+  succeeded: { channel: string }[]
+  failed: { channel: string; error: string }[]
+}
+
+const sourceTemplate = {
+  id: "tpl-src",
+  integrationMessengerId: "im-source",
+  name: "promo",
+  language: "vi",
+  category: "MARKETING",
+  parameterFormat: "POSITIONAL",
+  components: [{ type: "BODY", text: "Hi" }],
+}
+const target = (id: string, workspaceId = "ws-other") => ({
+  id,
+  name: `Page ${id}`,
+  workspaceId,
+  pageId: `page-${id}`,
+  auth: { accessToken: "token" },
+})
+
+const run = (targetIntegrationMessengerIds: string[]) => {
+  if (!cloneHandler) {
+    throw new Error("clone action handler was not captured")
+  }
+  return cloneHandler({
+    bindArgsParsedInputs: ["ws-source", "im-source", "tpl-src"],
+    parsedInput: { targetIntegrationMessengerIds },
+    ctx: { user: { id: "user-1" } },
+  }) as Promise<CloneResult>
+}
+
+describe("cloneMessengerMessageTemplateAction authorization", () => {
+  beforeEach(() => {
+    findByIdForIntegration.mockReset().mockResolvedValue(sourceTemplate)
+    findByIdForWorkspace
+      .mockReset()
+      .mockResolvedValue({ id: "im-source", pageId: "page-source" })
+    listCloneTargetsForUser.mockReset()
+    createPageMessageTemplate.mockReset().mockResolvedValue({
+      id: "meta-new",
+      status: "APPROVED",
+    })
+    syncTemplates.mockReset().mockResolvedValue(undefined)
+    resumableUploadImage.mockClear()
+  })
+
+  test("clones onto the requested pages the user administers, read uncached", async () => {
+    listCloneTargetsForUser.mockResolvedValue([
+      target("im-admin"),
+      target("im-owner", "ws-owner"),
+    ])
+
+    const result = await run(["im-admin", "im-owner"])
+
+    expect(listCloneTargetsForUser).toHaveBeenCalledWith({
+      userId: "user-1",
+      excludePageId: "page-source",
+      authoritative: true,
+    })
+    expect(createPageMessageTemplate).toHaveBeenCalledTimes(2)
+    expect(result.succeeded).toEqual([
+      { channel: "Page im-admin" },
+      { channel: "Page im-owner" },
+    ])
+    expect(result.failed).toEqual([])
+  })
+
+  test("drops requested pages outside the user's admin workspaces", async () => {
+    listCloneTargetsForUser.mockResolvedValue([target("im-admin")])
+
+    const result = await run(["im-admin", "im-foreign"])
+
+    expect(createPageMessageTemplate).toHaveBeenCalledTimes(1)
+    expect(result.succeeded).toEqual([{ channel: "Page im-admin" }])
+  })
+
+  test("fails when none of the requested pages is authorized", async () => {
+    listCloneTargetsForUser.mockResolvedValue([target("im-admin")])
+
+    await expect(run(["im-foreign"])).rejects.toThrow(
+      "No authorized target channels found",
+    )
+    expect(createPageMessageTemplate).not.toHaveBeenCalled()
+  })
+
+  test("reports a page whose Meta create fails without blocking the others", async () => {
+    listCloneTargetsForUser.mockResolvedValue([target("im-a"), target("im-b")])
+    createPageMessageTemplate
+      .mockRejectedValueOnce(new Error("rate limited"))
+      .mockResolvedValueOnce({ id: "meta-b", status: "APPROVED" })
+
+    const result = await run(["im-a", "im-b"])
+
+    expect(result.failed).toEqual([
+      { channel: "Page im-a", error: "rate limited" },
+    ])
+    expect(result.succeeded).toEqual([{ channel: "Page im-b" }])
+  })
+})

apps/builder/src/app/space/[workspaceId]/messengers/[id]/message-templates/page.tsx

@@ -1,12 +1,10 @@
-import { db, inArray } from "@chatbotx.io/database/client"
-import { integrationMessengerModel } from "@chatbotx.io/database/schema"
+import { messengerIntegrationService } from "@chatbotx.io/business"
 import { notFound } from "next/navigation"
 import { Suspense } from "react"
 import { MessengerMessageTemplatesTable } from "@/features/integration-messenger/message-templates/message-templates-table"
 import { messengerMessageTemplateService } from "@/features/integration-messenger/message-templates/queries"
 import { listMessengerMessageTemplatesSearchParamsCache } from "@/features/integration-messenger/message-templates/schema/query"
 import { findIntegrationMessenger } from "@/features/integration-messenger/queries"
-import { getAllWorkspaceMembers } from "@/features/workspace-members/queries"
 import { withWorkspaceIdAndIdSchema } from "@/features/workspaces/schema/resource"
 import { getCurrentUserId } from "@/lib/auth/utils"
 
@@ -32,36 +30,19 @@ export default async function MessengerMessageTemplatesPage(props: {
   }
 
   // Clone targets = every Messenger channel across all workspaces where the
-  // current user is an owner ("admin"), excluding the current channel.
+  // current user is an admin (owner or superAdmin), excluding the current
+  // Facebook Page. The clone action authorizes against the same list.
   const userId = await getCurrentUserId()
-  let channels: { id: string; name: string }[] = []
-  if (userId) {
-    const { workspaceMembers } = await getAllWorkspaceMembers(userId)
-    const ownerWorkspaceIds = Array.from(
-      new Set(
-        workspaceMembers
-          .filter((member) => member.role === "owner")
-          .map((member) => member.workspaceId),
-      ),
-    )
-    if (ownerWorkspaceIds.length > 0) {
-      const rows = await db
-        .select({
-          id: integrationMessengerModel.id,
-          name: integrationMessengerModel.name,
-          pageId: integrationMessengerModel.pageId,
-        })
-        .from(integrationMessengerModel)
-        .where(
-          inArray(integrationMessengerModel.workspaceId, ownerWorkspaceIds),
-        )
-      // Exclude the current Facebook Page (by pageId) — it may be connected in
-      // more than one workspace, so filtering by integration id alone is not enough.
-      channels = rows
-        .filter((channel) => channel.pageId !== integrationMessenger.pageId)
-        .map((channel) => ({ id: channel.id, name: channel.name }))
-    }
-  }
+  const cloneTargets = userId
+    ? await messengerIntegrationService.listCloneTargetsForUser({
+        userId,
+        excludePageId: integrationMessenger.pageId,
+      })
+    : []
+  const channels = cloneTargets.map((channel) => ({
+    id: channel.id,
+    name: channel.name,
+  }))
 
   const promises = messengerMessageTemplateService.listPaginated({
     where: {

apps/builder/src/features/broadcasts/components/broadcast-status-panel.tsx

@@ -53,9 +53,9 @@ export function BroadcastStatusPanel({
   }
 
   return (
-    <aside className="flex w-[280px] shrink-0 flex-col border-e bg-sidebar">
-      <div className="flex h-16 items-center justify-between ps-6 pe-4">
-        <h2 className="font-bold text-xl">{t("broadcasts.title")}</h2>
+    <aside className="flex w-[220px] shrink-0 flex-col border-e bg-sidebar">
+      <div className="flex h-14 items-center justify-between ps-4 pe-2">
+        <h2 className="font-bold text-lg">{t("broadcasts.title")}</h2>
         <Button
           aria-label={t("broadcasts.panel.collapse")}
           onClick={() => onOpenChange(false)}
@@ -65,14 +65,14 @@ export function BroadcastStatusPanel({
           <PanelLeftCloseIcon aria-hidden="true" />
         </Button>
       </div>
-      <nav className="flex flex-col gap-1 px-4 py-2">
+      <nav className="flex flex-col gap-0.5 px-2 py-1">
         {PANEL_ITEMS.map((item) => {
           const isActive = status === item.value
           return (
             <button
               aria-pressed={isActive}
               className={cn(
-                "flex h-11 items-center gap-3.5 rounded-md px-4 text-[15px] transition-colors",
+                "flex h-9 items-center gap-2.5 rounded-md px-3 text-sm transition-colors",
                 isActive
                   ? "bg-primary/10 font-medium text-foreground"
                   : "text-muted-foreground hover:bg-accent hover:text-foreground",
@@ -88,7 +88,7 @@ export function BroadcastStatusPanel({
               <span
                 aria-hidden="true"
                 className={cn(
-                  "size-3 shrink-0 rounded-full",
+                  "size-2.5 shrink-0 rounded-full",
                   item.dotClassName,
                 )}
               />

apps/builder/src/features/integration-messenger/message-templates/actions/clone-message-templates.ts

@@ -12,7 +12,6 @@ import { SdkException } from "@chatbotx.io/sdk"
 import { zodBigintAsString } from "@chatbotx.io/utils"
 import { chunk } from "remeda"
 import { z } from "zod"
-import { getAllWorkspaceMembers } from "@/features/workspace-members/queries"
 import { workspaceActionClient } from "@/lib/safe-action"
 import { syncMessengerMessageTemplatesForIntegration } from "./sync-message-templates"
 
@@ -159,24 +158,18 @@ export const cloneMessengerMessageTemplateAction = workspaceActionClient
         workspaceId,
       })
 
-    // Resolve target rows by id (targets may live in OTHER workspaces).
-    const candidateTargets = await messengerIntegrationService.findByIds(
-      targetIntegrationMessengerIds,
-    )
-
-    // Authorize per target: the user must be an owner of the target's workspace,
-    // and the target must not be the source's own Facebook Page.
-    const { workspaceMembers } = await getAllWorkspaceMembers(user.id)
-    const ownerWorkspaceIds = new Set(
-      workspaceMembers
-        .filter((member) => member.role === "owner")
-        .map((member) => member.workspaceId),
-    )
-    const targets = candidateTargets.filter(
-      (target) =>
-        ownerWorkspaceIds.has(target.workspaceId) &&
-        target.pageId !== sourceIntegration?.pageId,
-    )
+    // Authorize per target: the user must be an admin (owner or superAdmin)
+    // of the target's workspace, and the target must not be the source's own
+    // Facebook Page. Memberships are read uncached so a just-revoked admin
+    // cannot clone across a workspace boundary.
+    const requested = new Set(targetIntegrationMessengerIds)
+    const cloneTargets =
+      await messengerIntegrationService.listCloneTargetsForUser({
+        userId: user.id,
+        excludePageId: sourceIntegration?.pageId,
+        authoritative: true,
+      })
+    const targets = cloneTargets.filter((target) => requested.has(target.id))
 
     if (targets.length === 0) {
       throw new Error("No authorized target channels found")