@@ -153,6 +153,11 @@ public async Task<ActionResult> IncomingMessage([FromQuery] TwilioMessage reques
153153 }
154154 }
155155
156+ // Carry the resolved department onto the inbound message event so chatbot-routed events
157+ // retain the same department context the text-command path records.
158+ if ( departmentId . HasValue )
159+ messageEvent . CustomerId = departmentId . Value . ToString ( ) ;
160+
156161 // Feature-flagged rollout: the chatbot ingress is the new path. When the flag is off
157162 // (globally or for this department) fall back to the original text-command handling so
158163 // existing behavior is preserved.
@@ -443,6 +448,14 @@ private async System.Threading.Tasks.Task ProcessTextCommandsAsync(TextMessage t
443448
444449 var call = await _callsService . GetCallByIdAsync ( int . Parse ( payload . Data ) ) ;
445450
451+ // Guard against a missing call (NRE) and against reading a call that belongs
452+ // to another department (cross-department data leakage).
453+ if ( call == null || call . DepartmentId != department . DepartmentId )
454+ {
455+ response . Message ( "Resgrid could not find that call." ) ;
456+ break ;
457+ }
458+
446459 var callText = new StringBuilder ( ) ;
447460 callText . Append ( $ "Call Information for { call . Name } " + Environment . NewLine ) ;
448461 callText . Append ( "---------------------" + Environment . NewLine ) ;
@@ -505,6 +518,13 @@ private async System.Threading.Tasks.Task ProcessTextCommandsAsync(TextMessage t
505518 break ;
506519 case TextCommandTypes . Stop :
507520 messageEvent . Processed = true ;
521+
522+ if ( profile == null )
523+ {
524+ response . Message ( "Unable to locate your profile. Please log in to Resgrid to manage your text message settings." ) ;
525+ break ;
526+ }
527+
508528 await _userProfileService . DisableTextMessagesForUserAsync ( profile . UserId ) ;
509529 response . Message ( "Text messages are now turned off for this user, to enable again log in to Resgrid and update your profile." ) ;
510530 break ;
0 commit comments