Skip to content

Fix session isolation when prechat fields are absent#50

Open
andrea-sdl wants to merge 8 commits intotrunkfrom
fix/cmp-session-isolation-without-prechat
Open

Fix session isolation when prechat fields are absent#50
andrea-sdl wants to merge 8 commits intotrunkfrom
fix/cmp-session-isolation-without-prechat

Conversation

@andrea-sdl
Copy link
Contributor

Description

This fixes a regression introduced in the messaging channel session-isolation change. Sites without configured prechat fields were exiting early and never applying restrictSessionOnMessagingChannel, so channels could still share a session unexpectedly.

The root cause was coupling two unrelated behaviors in the same early-return branch: session isolation and prechat field injection. This update keeps prechat field injection conditional, but always applies session isolation when embedded messaging is ready.

Pre-review checklist

Please make sure the items below have been covered before requesting a review:

  • This change works and has been tested locally or in Codespaces (or has an appropriate fallback).
  • This change has relevant unit tests (if applicable).
  • This change has relevant documentation additions / updates (if applicable).
  • I've created a changelog description that aligns with the provided examples.

Pre-deploy checklist

  • VIP staff: Ensure any alerts added/updated conform to internal standards (see internal documentation).

Steps to Test

  1. Configure Agentforce with CMP enabled and no prechat fields configured.
  2. Load a page where embedded messaging initializes.
  3. Verify channel changes do not reuse a shared session unexpectedly.
  4. Repeat with prechat fields configured and verify hidden prechat fields are still applied.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a regression where session isolation for Embedded Messaging wasn’t applied when prechatFields are absent, allowing sessions to be unexpectedly shared across channels.

Changes:

  • Removes the early return that prevented restrictSessionOnMessagingChannel from being applied when no prechat fields are configured.
  • Makes hidden prechat field injection conditional (hasPrechatFields) while always applying session isolation on onEmbeddedMessagingReady.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pandah3
Copy link
Contributor

pandah3 commented Mar 26, 2026

@andrea-sdl Can you clarify the testing steps? Is this correct?

  • Local dev env, have VIP_AGENTFORCE_CONFIGS set up
  • Add add_filter( 'vip_agentforce_prechat_fields', '__return_empty_array' ); in a client-mu-plugins file (e.g client-mu-plugins/test-no-prechat.php)
  • Set CMP setting to "Custom" in WP Admin
  • Browser devtools: window.AgentforceCMP.loadSDK();
  • Wait for the SDK to load then check: window.embeddedservice_bootstrap.settings.restrictSessionOnMessagingChannel
  • Repeat test without the mu-plugins file

@andrea-sdl
Copy link
Contributor Author

Local dev env, have VIP_AGENTFORCE_CONFIGS set up
Add add_filter( 'vip_agentforce_prechat_fields', '__return_empty_array' ); in a client-mu-plugins file (e.g client-mu-plugins/test-no-prechat.php)
Set CMP setting to "Custom" in WP Admin
Browser devtools: window.AgentforceCMP.loadSDK();
Wait for the SDK to load then check: window.embeddedservice_bootstrap.settings.restrictSessionOnMessagingChannel
Repeat test without the mu-plugins file

Yes, sorry for not including a full test since this was an edge case.

The testing steps you included look good. To make testing easier I would put the filter inside the env.php instead.
An alternative that requires no extra filter would be to run window.vipAgentforceConsentData?.prechatFields = [] instead of adding the filter. What we want to confirm is that we restrict the messaging channel session if we don't have prechat fields.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants