From 791d90c6b71d94124a93fc85aaa8c5094f9b7613 Mon Sep 17 00:00:00 2001
From: Sojan Jose <sojan@pepalo.com>
Date: Mon, 22 Nov 2021 23:32:17 +0530
Subject: [PATCH] chore: Migrate PubSub Token to contact inbox (#3434)

At present, the websocket pubsub tokens are present at the contact objects in chatwoot. A better approach would be to have these tokens at the contact_inbox object instead. This helps chatwoot to deliver the websocket events targetted to the specific widget connection, stop contact events from leaking into other chat sessions from the same contact.

Fixes #1682
Fixes #1664

Co-authored-by: Pranav Raj S <pranav@chatwoot.com>
Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
---
 app/actions/contact_merge_action.rb           |  5 +-
 app/channels/room_channel.rb                  |  2 +-
 app/controllers/widgets_controller.rb         | 10 ++--
 app/finders/conversation_finder.rb            |  2 +-
 .../assets/scss/_utility-helpers.scss         |  8 +++
 .../conversation/ConversationHeader.vue       | 15 ++++--
 .../i18n/locale/en/conversation.json          |  1 +
 .../conversation/contact/ConversationForm.vue | 12 ++---
 app/javascript/widget/helpers/actionCable.js  | 17 +-----
 .../widget/helpers/campaignHelper.js          | 18 ++++---
 .../helpers/specs/campaignHelper.spec.js      | 54 +++++++++++++++++++
 .../widget/store/modules/contacts.js          |  7 +--
 .../store/modules/conversation/actions.js     |  7 +--
 .../widget/store/modules/message.js           |  6 +--
 app/listeners/action_cable_listener.rb        | 12 +++--
 app/models/concerns/pubsubable.rb             |  6 +++
 app/models/contact.rb                         |  2 +-
 app/models/contact_inbox.rb                   |  3 ++
 .../conversations/event_data_presenter.rb     |  6 ++-
 .../partials/_conversation.json.jbuilder      |  1 +
 .../v1/widget/configs/create.json.jbuilder    |  2 +-
 .../v1/inboxes/contacts/create.json.jbuilder  |  1 +
 .../v1/inboxes/contacts/show.json.jbuilder    |  1 +
 .../v1/inboxes/contacts/update.json.jbuilder  |  1 +
 .../api/v1/models/_contact.json.jbuilder      |  1 -
 app/views/widgets/show.html.erb               |  2 +-
 config/app.yml                                |  2 +-
 ...1012_add_pub_sub_token_to_contact_inbox.rb |  6 +++
 db/schema.rb                                  |  4 +-
 package.json                                  |  2 +-
 spec/channels/room_channel_spec.rb            |  6 +--
 .../api/v1/widget/configs_controller_spec.rb  |  2 +-
 .../api/v1/inbox/contacts_controller_spec.rb  |  2 +-
 spec/listeners/action_cable_listener_spec.rb  | 18 ++++++-
 spec/models/contact_inbox_spec.rb             | 40 ++++++++++++++
 spec/models/contact_spec.rb                   | 16 ------
 spec/models/conversation_spec.rb              |  3 +-
 .../event_data_presenter_spec.rb              |  3 +-
 38 files changed, 211 insertions(+), 95 deletions(-)
 create mode 100644 db/migrate/20211122061012_add_pub_sub_token_to_contact_inbox.rb
 create mode 100644 spec/models/contact_inbox_spec.rb

diff --git a/app/actions/contact_merge_action.rb b/app/actions/contact_merge_action.rb
index d31b6a3673e4..9d58ef2072a4 100644
--- a/app/actions/contact_merge_action.rb
+++ b/app/actions/contact_merge_action.rb
@@ -48,11 +48,10 @@ def merge_and_remove_mergee_contact
 
     # attributes in base contact are given preference
     merged_attributes = mergee_contact_attributes.deep_merge(base_contact_attributes)
-    # retaining old pubsub token to notify the contacts that are listening
-    mergee_pubsub_token = mergee_contact.pubsub_token
 
     @mergee_contact.destroy!
-    Rails.configuration.dispatcher.dispatch(CONTACT_MERGED, Time.zone.now, contact: @base_contact, tokens: [mergee_pubsub_token])
+    Rails.configuration.dispatcher.dispatch(CONTACT_MERGED, Time.zone.now, contact: @base_contact,
+                                                                           tokens: [@base_contact.contact_inboxes.filter_map(&:pubsub_token)])
     @base_contact.update!(merged_attributes)
   end
 end
diff --git a/app/channels/room_channel.rb b/app/channels/room_channel.rb
index ab3af0c92880..b3c5977709cc 100644
--- a/app/channels/room_channel.rb
+++ b/app/channels/room_channel.rb
@@ -31,7 +31,7 @@ def update_subscription
 
   def current_user
     @current_user ||= if params[:user_id].blank?
-                        Contact.find_by!(pubsub_token: @pubsub_token)
+                        ContactInbox.find_by!(pubsub_token: @pubsub_token).contact
                       else
                         User.find_by!(pubsub_token: @pubsub_token, id: params[:user_id])
                       end
diff --git a/app/controllers/widgets_controller.rb b/app/controllers/widgets_controller.rb
index f19a2488830b..29c1f97f9764 100644
--- a/app/controllers/widgets_controller.rb
+++ b/app/controllers/widgets_controller.rb
@@ -29,21 +29,21 @@ def set_token
   def set_contact
     return if @auth_token_params[:source_id].nil?
 
-    contact_inbox = ::ContactInbox.find_by(
+    @contact_inbox = ::ContactInbox.find_by(
       inbox_id: @web_widget.inbox.id,
       source_id: @auth_token_params[:source_id]
     )
 
-    @contact = contact_inbox ? contact_inbox.contact : nil
+    @contact = @contact_inbox ? @contact_inbox.contact : nil
   end
 
   def build_contact
     return if @contact.present?
 
-    contact_inbox = @web_widget.create_contact_inbox(additional_attributes)
-    @contact = contact_inbox.contact
+    @contact_inbox = @web_widget.create_contact_inbox(additional_attributes)
+    @contact = @contact_inbox.contact
 
-    payload = { source_id: contact_inbox.source_id, inbox_id: @web_widget.inbox.id }
+    payload = { source_id: @contact_inbox.source_id, inbox_id: @web_widget.inbox.id }
     @token = ::Widget::TokenService.new(payload: payload).generate_token
   end
 
diff --git a/app/finders/conversation_finder.rb b/app/finders/conversation_finder.rb
index a0dda66eab65..f2641dde0caa 100644
--- a/app/finders/conversation_finder.rb
+++ b/app/finders/conversation_finder.rb
@@ -121,7 +121,7 @@ def current_page
 
   def conversations
     @conversations = @conversations.includes(
-      :taggings, :inbox, { assignee: { avatar_attachment: [:blob] } }, { contact: { avatar_attachment: [:blob] } }, :team
+      :taggings, :inbox, { assignee: { avatar_attachment: [:blob] } }, { contact: { avatar_attachment: [:blob] } }, :team, :contact_inbox
     )
     @conversations.latest.page(current_page)
   end
diff --git a/app/javascript/dashboard/assets/scss/_utility-helpers.scss b/app/javascript/dashboard/assets/scss/_utility-helpers.scss
index 8785f1313951..1072a0878f9b 100644
--- a/app/javascript/dashboard/assets/scss/_utility-helpers.scss
+++ b/app/javascript/dashboard/assets/scss/_utility-helpers.scss
@@ -2,6 +2,10 @@
   margin-right: var(--space-small);
 }
 
+.margin-right-smaller {
+  margin-right: var(--space-smaller);
+}
+
 .fs-small {
   font-size: var(--font-size-small);
 }
@@ -42,3 +46,7 @@
 .bg-white {
   background-color: var(--white);
 }
+
+.text-y-800 {
+  color: var(--y-800);
+}
diff --git a/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue b/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue
index bdb917695efc..22989f36f552 100644
--- a/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue
+++ b/app/javascript/dashboard/components/widgets/conversation/ConversationHeader.vue
@@ -10,7 +10,12 @@
       />
       <div class="user--profile__meta">
         <h3 class="user--name text-truncate">
-          {{ currentContact.name }}
+          <span class="margin-right-smaller">{{ currentContact.name }}</span>
+          <i
+            v-if="!isHMACVerified"
+            v-tooltip="$t('CONVERSATION.UNVERIFIED_SESSION')"
+            class="ion-android-alert text-y-800 fs-default"
+          />
         </h3>
         <div class="conversation--header--actions">
           <inbox-name :inbox="inbox" class="margin-right-small" />
@@ -73,11 +78,15 @@ export default {
       uiFlags: 'inboxAssignableAgents/getUIFlags',
       currentChat: 'getSelectedChat',
     }),
-
     chatMetadata() {
       return this.chat.meta;
     },
-
+    isHMACVerified() {
+      if (!this.isAWebWidgetInbox) {
+        return true;
+      }
+      return this.chatMetadata.hmac_verified;
+    },
     currentContact() {
       return this.$store.getters['contacts/getContact'](
         this.chat.meta.sender.id
diff --git a/app/javascript/dashboard/i18n/locale/en/conversation.json b/app/javascript/dashboard/i18n/locale/en/conversation.json
index a50e8cb16cf3..9e2e3ea08353 100644
--- a/app/javascript/dashboard/i18n/locale/en/conversation.json
+++ b/app/javascript/dashboard/i18n/locale/en/conversation.json
@@ -1,6 +1,7 @@
 {
   "CONVERSATION": {
     "404": "Please select a conversation from left pane",
+    "UNVERIFIED_SESSION": "The identity of this user is not verified",
     "NO_MESSAGE_1": "Uh oh! Looks like there are no messages from customers in your inbox.",
     "NO_MESSAGE_2": " to send a message to your page!",
     "NO_INBOX_1": "Hola! Looks like you haven't added any inboxes yet.",
diff --git a/app/javascript/dashboard/routes/dashboard/conversation/contact/ConversationForm.vue b/app/javascript/dashboard/routes/dashboard/conversation/contact/ConversationForm.vue
index 22acd84e5362..b0251df18652 100644
--- a/app/javascript/dashboard/routes/dashboard/conversation/contact/ConversationForm.vue
+++ b/app/javascript/dashboard/routes/dashboard/conversation/contact/ConversationForm.vue
@@ -41,17 +41,17 @@
           </label>
         </div>
       </div>
-      <div class="row" v-if="isAnEmailInbox">
+      <div v-if="isAnEmailInbox" class="row">
         <div class="columns">
-          <label :class="{ error: $v.message.$error }">
+          <label :class="{ error: $v.subject.$error }">
             {{ $t('NEW_CONVERSATION.FORM.SUBJECT.LABEL') }}
             <input
               v-model="subject"
               type="text"
               :placeholder="$t('NEW_CONVERSATION.FORM.SUBJECT.PLACEHOLDER')"
-              @input="$v.message.$touch"
+              @input="$v.subject.$touch"
             />
-            <span v-if="$v.message.$error" class="message">
+            <span v-if="$v.subject.$error" class="message">
               {{ $t('NEW_CONVERSATION.FORM.SUBJECT.ERROR') }}
             </span>
           </label>
@@ -93,7 +93,7 @@ import Thumbnail from 'dashboard/components/widgets/Thumbnail';
 import alertMixin from 'shared/mixins/alertMixin';
 import { INBOX_TYPES } from 'shared/mixins/inboxMixin';
 import { ExceptionWithMessage } from 'shared/helpers/CustomErrors';
-import { required } from 'vuelidate/lib/validators';
+import { required, requiredIf } from 'vuelidate/lib/validators';
 
 export default {
   components: {
@@ -120,7 +120,7 @@ export default {
   },
   validations: {
     subject: {
-      required,
+      required: requiredIf('isAnEmailInbox'),
     },
     message: {
       required,
diff --git a/app/javascript/widget/helpers/actionCable.js b/app/javascript/widget/helpers/actionCable.js
index a8c3f5d40f9a..728e607b5f94 100644
--- a/app/javascript/widget/helpers/actionCable.js
+++ b/app/javascript/widget/helpers/actionCable.js
@@ -15,18 +15,6 @@ class ActionCableConnector extends BaseActionCableConnector {
     };
   }
 
-  static refreshConnector = pubsubToken => {
-    if (!pubsubToken || window.chatwootPubsubToken === pubsubToken) {
-      return;
-    }
-    window.chatwootPubsubToken = pubsubToken;
-    window.actionCable.disconnect();
-    window.actionCable = new ActionCableConnector(
-      window.WOOT_WIDGET,
-      window.chatwootPubsubToken
-    );
-  };
-
   onStatusChange = data => {
     this.app.$store.dispatch('conversationAttributes/update', data);
   };
@@ -57,7 +45,7 @@ class ActionCableConnector extends BaseActionCableConnector {
 
   onTypingOn = data => {
     if (data.is_private) {
-      return
+      return;
     }
     this.clearTimer();
     this.app.$store.dispatch('conversation/toggleAgentTyping', {
@@ -88,7 +76,4 @@ class ActionCableConnector extends BaseActionCableConnector {
   };
 }
 
-export const refreshActionCableConnector =
-  ActionCableConnector.refreshConnector;
-
 export default ActionCableConnector;
diff --git a/app/javascript/widget/helpers/campaignHelper.js b/app/javascript/widget/helpers/campaignHelper.js
index 4e527c853cf9..e11a84f58941 100644
--- a/app/javascript/widget/helpers/campaignHelper.js
+++ b/app/javascript/widget/helpers/campaignHelper.js
@@ -21,10 +21,16 @@ export const filterCampaigns = ({
   currentURL,
   isInBusinessHours,
 }) => {
-  return campaigns.filter(item =>
-    item.triggerOnlyDuringBusinessHours
-      ? isInBusinessHours
-      : stripTrailingSlash({ URL: item.url }) ===
-        stripTrailingSlash({ URL: currentURL })
-  );
+  return campaigns.filter(campaign => {
+    const hasMatchingURL =
+      stripTrailingSlash({ URL: campaign.url }) ===
+      stripTrailingSlash({ URL: currentURL });
+    if (!hasMatchingURL) {
+      return false;
+    }
+    if (campaign.triggerOnlyDuringBusinessHours) {
+      return isInBusinessHours;
+    }
+    return true;
+  });
 };
diff --git a/app/javascript/widget/helpers/specs/campaignHelper.spec.js b/app/javascript/widget/helpers/specs/campaignHelper.spec.js
index f0107465d367..0037f4c8bce4 100644
--- a/app/javascript/widget/helpers/specs/campaignHelper.spec.js
+++ b/app/javascript/widget/helpers/specs/campaignHelper.spec.js
@@ -44,11 +44,13 @@ describe('#Campaigns Helper', () => {
               id: 1,
               timeOnPage: 3,
               url: 'https://www.chatwoot.com/pricing',
+              triggerOnlyDuringBusinessHours: false,
             },
             {
               id: 2,
               timeOnPage: 6,
               url: 'https://www.chatwoot.com/about',
+              triggerOnlyDuringBusinessHours: false,
             },
           ],
           currentURL: 'https://www.chatwoot.com/about/',
@@ -58,8 +60,60 @@ describe('#Campaigns Helper', () => {
           id: 2,
           timeOnPage: 6,
           url: 'https://www.chatwoot.com/about',
+          triggerOnlyDuringBusinessHours: false,
+        },
+      ]);
+    });
+    it('should return filtered campaigns if formatted campaigns are passed and business hours enabled', () => {
+      expect(
+        filterCampaigns({
+          campaigns: [
+            {
+              id: 1,
+              timeOnPage: 3,
+              url: 'https://www.chatwoot.com/pricing',
+              triggerOnlyDuringBusinessHours: false,
+            },
+            {
+              id: 2,
+              timeOnPage: 6,
+              url: 'https://www.chatwoot.com/about',
+              triggerOnlyDuringBusinessHours: true,
+            },
+          ],
+          currentURL: 'https://www.chatwoot.com/about/',
+          isInBusinessHours: true,
+        })
+      ).toStrictEqual([
+        {
+          id: 2,
+          timeOnPage: 6,
+          url: 'https://www.chatwoot.com/about',
+          triggerOnlyDuringBusinessHours: true,
         },
       ]);
     });
+    it('should return empty campaigns if formatted campaigns are passed and business hours disabled', () => {
+      expect(
+        filterCampaigns({
+          campaigns: [
+            {
+              id: 1,
+              timeOnPage: 3,
+              url: 'https://www.chatwoot.com/pricing',
+              triggerOnlyDuringBusinessHours: true,
+            },
+            {
+              id: 2,
+              timeOnPage: 6,
+              url: 'https://www.chatwoot.com/about',
+              triggerOnlyDuringBusinessHours: true,
+            },
+          ],
+          currentURL: 'https://www.chatwoot.com/about/',
+          isInBusinessHours: false,
+        })
+      ).toStrictEqual([]);
+    });
   });
 });
diff --git a/app/javascript/widget/store/modules/contacts.js b/app/javascript/widget/store/modules/contacts.js
index f02083873464..051061fc57a2 100644
--- a/app/javascript/widget/store/modules/contacts.js
+++ b/app/javascript/widget/store/modules/contacts.js
@@ -1,5 +1,4 @@
 import ContactsAPI from '../../api/contacts';
-import { refreshActionCableConnector } from '../../helpers/actionCable';
 
 const state = {
   currentUser: {},
@@ -31,17 +30,13 @@ export const actions = {
         identifier_hash: userObject.identifier_hash,
         phone_number: userObject.phone_number,
       };
-      const {
-        data: { pubsub_token: pubsubToken },
-      } = await ContactsAPI.update(identifier, user);
+      await ContactsAPI.update(identifier, user);
 
       dispatch('get');
       if (userObject.identifier_hash) {
         dispatch('conversation/clearConversations', {}, { root: true });
         dispatch('conversation/fetchOldConversations', {}, { root: true });
       }
-
-      refreshActionCableConnector(pubsubToken);
     } catch (error) {
       // Ignore error
     }
diff --git a/app/javascript/widget/store/modules/conversation/actions.js b/app/javascript/widget/store/modules/conversation/actions.js
index 42c915521b0f..c163cc1a16b8 100644
--- a/app/javascript/widget/store/modules/conversation/actions.js
+++ b/app/javascript/widget/store/modules/conversation/actions.js
@@ -6,7 +6,6 @@ import {
   toggleTyping,
   setUserLastSeenAt,
 } from 'widget/api/conversation';
-import { refreshActionCableConnector } from '../../../helpers/actionCable';
 
 import { createTemporaryMessage, getNonDeletedMessages } from './helpers';
 
@@ -15,13 +14,9 @@ export const actions = {
     commit('setConversationUIFlag', { isCreating: true });
     try {
       const { data } = await createConversationAPI(params);
-      const {
-        contact: { pubsub_token: pubsubToken },
-        messages,
-      } = data;
+      const { messages } = data;
       const [message = {}] = messages;
       commit('pushMessageToConversation', message);
-      refreshActionCableConnector(pubsubToken);
       dispatch('conversationAttributes/getAttributes', {}, { root: true });
     } catch (error) {
       // Ignore error
diff --git a/app/javascript/widget/store/modules/message.js b/app/javascript/widget/store/modules/message.js
index b11c5cdd4f01..99c284e1f6ce 100644
--- a/app/javascript/widget/store/modules/message.js
+++ b/app/javascript/widget/store/modules/message.js
@@ -1,5 +1,4 @@
 import MessageAPI from '../../api/message';
-import { refreshActionCableConnector } from '../../helpers/actionCable';
 
 const state = {
   uiFlags: {
@@ -18,9 +17,7 @@ export const actions = {
   ) => {
     commit('toggleUpdateStatus', true);
     try {
-      const {
-        data: { contact: { pubsub_token: pubsubToken } = {} },
-      } = await MessageAPI.update({
+      await MessageAPI.update({
         email,
         messageId,
         values: submittedValues,
@@ -37,7 +34,6 @@ export const actions = {
         { root: true }
       );
       dispatch('contacts/get', {}, { root: true });
-      refreshActionCableConnector(pubsubToken);
     } catch (error) {
       // Ignore error
     }
diff --git a/app/listeners/action_cable_listener.rb b/app/listeners/action_cable_listener.rb
index 04c930e7d93b..a81c74976a46 100644
--- a/app/listeners/action_cable_listener.rb
+++ b/app/listeners/action_cable_listener.rb
@@ -18,7 +18,7 @@ def conversation_read(event)
   def message_created(event)
     message, account = extract_message_and_account(event)
     conversation = message.conversation
-    tokens = user_tokens(account, conversation.inbox.members) + contact_token(conversation.contact, message)
+    tokens = user_tokens(account, conversation.inbox.members) + contact_tokens(conversation.contact_inbox, message)
 
     broadcast(account, tokens, MESSAGE_CREATED, message.push_event_data)
   end
@@ -27,7 +27,7 @@ def message_updated(event)
     message, account = extract_message_and_account(event)
     conversation = message.conversation
     contact = conversation.contact
-    tokens = user_tokens(account, conversation.inbox.members) + contact_token(conversation.contact, message)
+    tokens = user_tokens(account, conversation.inbox.members) + contact_tokens(conversation.contact_inbox, message)
 
     broadcast(account, tokens, MESSAGE_UPDATED, message.push_event_data)
   end
@@ -132,12 +132,14 @@ def user_tokens(account, agents)
     (agent_tokens + admin_tokens).uniq
   end
 
-  def contact_token(contact, message)
+  def contact_tokens(contact_inbox, message)
     return [] if message.private?
     return [] if message.activity?
-    return [] if contact.nil?
+    return [] if contact_inbox.nil?
 
-    [contact.pubsub_token]
+    contact = contact_inbox.contact
+
+    contact_inbox.hmac_verified? ? contact.contact_inboxes.where(hmac_verified: true).filter_map(&:pubsub_token) : [contact_inbox.pubsub_token]
   end
 
   def broadcast(account, tokens, event_name, data)
diff --git a/app/models/concerns/pubsubable.rb b/app/models/concerns/pubsubable.rb
index 2e8abb9dabca..21b42899c1f0 100644
--- a/app/models/concerns/pubsubable.rb
+++ b/app/models/concerns/pubsubable.rb
@@ -7,4 +7,10 @@ module Pubsubable
     # Used by the actionCable/PubSub Service we use for real time communications
     has_secure_token :pubsub_token
   end
+
+  def pubsub_token
+    # backfills tokens for existing records
+    regenerate_pubsub_token if self[:pubsub_token].blank?
+    self[:pubsub_token]
+  end
 end
diff --git a/app/models/contact.rb b/app/models/contact.rb
index ec0b27d70833..c676573d88d7 100644
--- a/app/models/contact.rb
+++ b/app/models/contact.rb
@@ -25,7 +25,7 @@
 #
 
 class Contact < ApplicationRecord
-  include Pubsubable
+  # TODO: remove the pubsub_token attribute from this model in future.
   include Avatarable
   include AvailabilityStatusable
   include Labelable
diff --git a/app/models/contact_inbox.rb b/app/models/contact_inbox.rb
index 6f36b8735391..4c73438dd115 100644
--- a/app/models/contact_inbox.rb
+++ b/app/models/contact_inbox.rb
@@ -4,6 +4,7 @@
 #
 #  id            :bigint           not null, primary key
 #  hmac_verified :boolean          default(FALSE)
+#  pubsub_token  :string
 #  created_at    :datetime         not null
 #  updated_at    :datetime         not null
 #  contact_id    :bigint
@@ -15,6 +16,7 @@
 #  index_contact_inboxes_on_contact_id              (contact_id)
 #  index_contact_inboxes_on_inbox_id                (inbox_id)
 #  index_contact_inboxes_on_inbox_id_and_source_id  (inbox_id,source_id) UNIQUE
+#  index_contact_inboxes_on_pubsub_token            (pubsub_token) UNIQUE
 #  index_contact_inboxes_on_source_id               (source_id)
 #
 # Foreign Keys
@@ -24,6 +26,7 @@
 #
 
 class ContactInbox < ApplicationRecord
+  include Pubsubable
   validates :inbox_id, presence: true
   validates :contact_id, presence: true
   validates :source_id, presence: true
diff --git a/app/presenters/conversations/event_data_presenter.rb b/app/presenters/conversations/event_data_presenter.rb
index 306fda78c9ea..b4a443f35018 100644
--- a/app/presenters/conversations/event_data_presenter.rb
+++ b/app/presenters/conversations/event_data_presenter.rb
@@ -23,7 +23,11 @@ def push_messages
   end
 
   def push_meta
-    { sender: contact.push_event_data, assignee: assignee&.push_event_data }
+    {
+      sender: contact.push_event_data,
+      assignee: assignee&.push_event_data,
+      hmac_verified: contact_inbox&.hmac_verified
+    }
   end
 
   def push_timestamps
diff --git a/app/views/api/v1/conversations/partials/_conversation.json.jbuilder b/app/views/api/v1/conversations/partials/_conversation.json.jbuilder
index d08672e77581..3c645e0933ee 100644
--- a/app/views/api/v1/conversations/partials/_conversation.json.jbuilder
+++ b/app/views/api/v1/conversations/partials/_conversation.json.jbuilder
@@ -13,6 +13,7 @@ json.meta do
       json.partial! 'api/v1/models/team.json.jbuilder', resource: conversation.team
     end
   end
+  json.hmac_verified conversation.contact_inbox&.hmac_verified
 end
 
 json.id conversation.display_id
diff --git a/app/views/api/v1/widget/configs/create.json.jbuilder b/app/views/api/v1/widget/configs/create.json.jbuilder
index 8fbd5a502b5f..2a7cf30b1630 100644
--- a/app/views/api/v1/widget/configs/create.json.jbuilder
+++ b/app/views/api/v1/widget/configs/create.json.jbuilder
@@ -22,7 +22,7 @@ json.chatwoot_widget_defaults do
   json.use_inbox_avatar_for_bot ActiveModel::Type::Boolean.new.cast(ENV.fetch('USE_INBOX_AVATAR_FOR_BOT', false))
 end
 json.contact do
-  json.pubsub_token @contact.pubsub_token
+  json.pubsub_token @contact_inbox.pubsub_token
 end
 json.auth_token @token
 json.global_config @global_config
diff --git a/app/views/public/api/v1/inboxes/contacts/create.json.jbuilder b/app/views/public/api/v1/inboxes/contacts/create.json.jbuilder
index 256b588a5118..4a635bb5a723 100644
--- a/app/views/public/api/v1/inboxes/contacts/create.json.jbuilder
+++ b/app/views/public/api/v1/inboxes/contacts/create.json.jbuilder
@@ -1,2 +1,3 @@
 json.source_id @contact_inbox.source_id
+json.pubsub_token @contact_inbox.pubsub_token
 json.partial! 'public/api/v1/models/contact.json.jbuilder', resource: @contact_inbox.contact
diff --git a/app/views/public/api/v1/inboxes/contacts/show.json.jbuilder b/app/views/public/api/v1/inboxes/contacts/show.json.jbuilder
index 256b588a5118..4a635bb5a723 100644
--- a/app/views/public/api/v1/inboxes/contacts/show.json.jbuilder
+++ b/app/views/public/api/v1/inboxes/contacts/show.json.jbuilder
@@ -1,2 +1,3 @@
 json.source_id @contact_inbox.source_id
+json.pubsub_token @contact_inbox.pubsub_token
 json.partial! 'public/api/v1/models/contact.json.jbuilder', resource: @contact_inbox.contact
diff --git a/app/views/public/api/v1/inboxes/contacts/update.json.jbuilder b/app/views/public/api/v1/inboxes/contacts/update.json.jbuilder
index 256b588a5118..4a635bb5a723 100644
--- a/app/views/public/api/v1/inboxes/contacts/update.json.jbuilder
+++ b/app/views/public/api/v1/inboxes/contacts/update.json.jbuilder
@@ -1,2 +1,3 @@
 json.source_id @contact_inbox.source_id
+json.pubsub_token @contact_inbox.pubsub_token
 json.partial! 'public/api/v1/models/contact.json.jbuilder', resource: @contact_inbox.contact
diff --git a/app/views/public/api/v1/models/_contact.json.jbuilder b/app/views/public/api/v1/models/_contact.json.jbuilder
index aa8abf2e2641..c35705c6ca2d 100644
--- a/app/views/public/api/v1/models/_contact.json.jbuilder
+++ b/app/views/public/api/v1/models/_contact.json.jbuilder
@@ -1,4 +1,3 @@
 json.id resource.id
 json.name resource.name
 json.email resource.email
-json.pubsub_token resource.pubsub_token
diff --git a/app/views/widgets/show.html.erb b/app/views/widgets/show.html.erb
index 6c4d38f8854c..0cd60c453d1d 100644
--- a/app/views/widgets/show.html.erb
+++ b/app/views/widgets/show.html.erb
@@ -28,7 +28,7 @@
       window.chatwootWidgetDefaults = {
         useInboxAvatarForBot: <%= ActiveModel::Type::Boolean.new.cast(ENV.fetch('USE_INBOX_AVATAR_FOR_BOT', false)) %>,
       }
-      window.chatwootPubsubToken = '<%= @contact.pubsub_token %>'
+      window.chatwootPubsubToken = '<%= @contact_inbox.pubsub_token %>'
       window.authToken = '<%= @token %>'
       window.globalConfig = <%= raw @global_config.to_json %>
     </script>
diff --git a/config/app.yml b/config/app.yml
index 8aa5d22ad6d6..b883f6deb4bd 100644
--- a/config/app.yml
+++ b/config/app.yml
@@ -1,5 +1,5 @@
 shared: &shared
-  version: '1.22.0'
+  version: '1.22.1'
 
 development:
   <<: *shared
diff --git a/db/migrate/20211122061012_add_pub_sub_token_to_contact_inbox.rb b/db/migrate/20211122061012_add_pub_sub_token_to_contact_inbox.rb
new file mode 100644
index 000000000000..7ba816efc621
--- /dev/null
+++ b/db/migrate/20211122061012_add_pub_sub_token_to_contact_inbox.rb
@@ -0,0 +1,6 @@
+class AddPubSubTokenToContactInbox < ActiveRecord::Migration[6.1]
+  def change
+    add_column :contact_inboxes, :pubsub_token, :string
+    add_index :contact_inboxes, :pubsub_token, unique: true
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 9ad249a389c4..aba36d130f91 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2021_09_29_150415) do
+ActiveRecord::Schema.define(version: 2021_11_22_061012) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_stat_statements"
@@ -273,9 +273,11 @@
     t.datetime "created_at", precision: 6, null: false
     t.datetime "updated_at", precision: 6, null: false
     t.boolean "hmac_verified", default: false
+    t.string "pubsub_token"
     t.index ["contact_id"], name: "index_contact_inboxes_on_contact_id"
     t.index ["inbox_id", "source_id"], name: "index_contact_inboxes_on_inbox_id_and_source_id", unique: true
     t.index ["inbox_id"], name: "index_contact_inboxes_on_inbox_id"
+    t.index ["pubsub_token"], name: "index_contact_inboxes_on_pubsub_token", unique: true
     t.index ["source_id"], name: "index_contact_inboxes_on_source_id"
   end
 
diff --git a/package.json b/package.json
index 96a40d8de5f4..ea76748df044 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@chatwoot/chatwoot",
-  "version": "1.22.0",
+  "version": "1.22.1",
   "license": "MIT",
   "scripts": {
     "eslint": "eslint app/javascript --fix",
diff --git a/spec/channels/room_channel_spec.rb b/spec/channels/room_channel_spec.rb
index 8cac85ce6649..8db8c0a7c693 100644
--- a/spec/channels/room_channel_spec.rb
+++ b/spec/channels/room_channel_spec.rb
@@ -1,15 +1,15 @@
 require 'rails_helper'
 
 RSpec.describe RoomChannel, type: :channel do
-  let!(:contact) { create(:contact) }
+  let!(:contact_inbox) { create(:contact_inbox) }
 
   before do
     stub_connection
   end
 
   it 'subscribes to a stream when pubsub_token is provided' do
-    subscribe(pubsub_token: contact.pubsub_token)
+    subscribe(pubsub_token: contact_inbox.pubsub_token)
     expect(subscription).to be_confirmed
-    expect(subscription).to have_stream_for(contact.pubsub_token)
+    expect(subscription).to have_stream_for(contact_inbox.pubsub_token)
   end
 end
diff --git a/spec/controllers/api/v1/widget/configs_controller_spec.rb b/spec/controllers/api/v1/widget/configs_controller_spec.rb
index b6bc0fba3396..773e8310232a 100644
--- a/spec/controllers/api/v1/widget/configs_controller_spec.rb
+++ b/spec/controllers/api/v1/widget/configs_controller_spec.rb
@@ -45,7 +45,7 @@
         expect(response).to have_http_status(:success)
         response_data = JSON.parse(response.body)
         expect(response_data.keys).to include(*response_keys)
-        expect(response_data['contact']['pubsub_token']).to eq(contact.pubsub_token)
+        expect(response_data['contact']['pubsub_token']).to eq(contact_inbox.pubsub_token)
       end
     end
 
diff --git a/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb b/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb
index 284d21c8303c..151a2eec5343 100644
--- a/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb
+++ b/spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb
@@ -23,7 +23,7 @@
       expect(response).to have_http_status(:success)
       data = JSON.parse(response.body)
       expect(data['source_id']).to eq contact_inbox.source_id
-      expect(data['pubsub_token']).to eq contact.pubsub_token
+      expect(data['pubsub_token']).to eq contact_inbox.pubsub_token
     end
   end
 
diff --git a/spec/listeners/action_cable_listener_spec.rb b/spec/listeners/action_cable_listener_spec.rb
index ea7327e5b405..16367848f368 100644
--- a/spec/listeners/action_cable_listener_spec.rb
+++ b/spec/listeners/action_cable_listener_spec.rb
@@ -24,7 +24,23 @@
       expect(conversation.inbox.reload.inbox_members.count).to eq(1)
 
       expect(ActionCableBroadcastJob).to receive(:perform_later).with(
-        [agent.pubsub_token, admin.pubsub_token, conversation.contact.pubsub_token],
+        [agent.pubsub_token, admin.pubsub_token, conversation.contact_inbox.pubsub_token],
+        'message.created',
+        message.push_event_data.merge(account_id: account.id)
+      )
+      listener.message_created(event)
+    end
+
+    it 'sends message to all hmac verified contact inboxes' do
+      # HACK: to reload conversation inbox members
+      expect(conversation.inbox.reload.inbox_members.count).to eq(1)
+      conversation.contact_inbox.update(hmac_verified: true)
+      # creating a non verified contact inbox to ensure the events are not sent to it
+      create(:contact_inbox, contact: conversation.contact, inbox: inbox)
+      verified_contact_inbox = create(:contact_inbox, contact: conversation.contact, inbox: inbox, hmac_verified: true)
+
+      expect(ActionCableBroadcastJob).to receive(:perform_later).with(
+        [agent.pubsub_token, admin.pubsub_token, conversation.contact_inbox.pubsub_token, verified_contact_inbox.pubsub_token],
         'message.created',
         message.push_event_data.merge(account_id: account.id)
       )
diff --git a/spec/models/contact_inbox_spec.rb b/spec/models/contact_inbox_spec.rb
new file mode 100644
index 000000000000..a162d6e7b0b0
--- /dev/null
+++ b/spec/models/contact_inbox_spec.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ContactInbox do
+  describe 'pubsub_token' do
+    let(:contact_inbox) { create(:contact_inbox) }
+
+    it 'gets created on object create' do
+      obj = contact_inbox
+      expect(obj.pubsub_token).not_to eq(nil)
+    end
+
+    it 'does not get updated on object update' do
+      obj = contact_inbox
+      old_token = obj.pubsub_token
+      obj.update(source_id: '234234323')
+      expect(obj.pubsub_token).to eq(old_token)
+    end
+
+    it 'backfills pubsub_token on call for older objects' do
+      obj = create(:contact_inbox)
+      # to replicate an object with out pubsub_token
+      # rubocop:disable Rails/SkipsModelValidations
+      obj.update_column(:pubsub_token, nil)
+      # rubocop:enable Rails/SkipsModelValidations
+
+      obj.reload
+
+      # ensure the column is nil in database
+      results = ActiveRecord::Base.connection.execute('Select * from contact_inboxes;')
+      expect(results.first['pubsub_token']).to eq(nil)
+
+      new_token = obj.pubsub_token
+      obj.update(source_id: '234234323')
+      # the generated token shoul be persisted in db
+      expect(obj.pubsub_token).to eq(new_token)
+    end
+  end
+end
diff --git a/spec/models/contact_spec.rb b/spec/models/contact_spec.rb
index d296907ccc84..4d51017142f8 100644
--- a/spec/models/contact_spec.rb
+++ b/spec/models/contact_spec.rb
@@ -11,20 +11,4 @@
     it { is_expected.to belong_to(:account) }
     it { is_expected.to have_many(:conversations).dependent(:destroy) }
   end
-
-  describe 'pubsub_token' do
-    let(:user) { create(:user) }
-
-    it 'gets created on object create' do
-      obj = user
-      expect(obj.pubsub_token).not_to eq(nil)
-    end
-
-    it 'does not get updated on object update' do
-      obj = user
-      old_token = obj.pubsub_token
-      obj.update(name: 'test')
-      expect(obj.pubsub_token).to eq(old_token)
-    end
-  end
 end
diff --git a/spec/models/conversation_spec.rb b/spec/models/conversation_spec.rb
index 9d7fa2c8cb36..ad2f44839da9 100644
--- a/spec/models/conversation_spec.rb
+++ b/spec/models/conversation_spec.rb
@@ -375,7 +375,8 @@
         additional_attributes: {},
         meta: {
           sender: conversation.contact.push_event_data,
-          assignee: conversation.assignee
+          assignee: conversation.assignee,
+          hmac_verified: conversation.contact_inbox.hmac_verified
         },
         id: conversation.display_id,
         messages: [],
diff --git a/spec/presenters/conversations/event_data_presenter_spec.rb b/spec/presenters/conversations/event_data_presenter_spec.rb
index f3ba9e140868..88cd89f0a997 100644
--- a/spec/presenters/conversations/event_data_presenter_spec.rb
+++ b/spec/presenters/conversations/event_data_presenter_spec.rb
@@ -12,7 +12,8 @@
         additional_attributes: {},
         meta: {
           sender: conversation.contact.push_event_data,
-          assignee: conversation.assignee
+          assignee: conversation.assignee,
+          hmac_verified: conversation.contact_inbox.hmac_verified
         },
         id: conversation.display_id,
         messages: [],