It should have 2, one for each case.
In the client create-message-changeset-function, it should cast and require customer id, and refuse user id.
In the agent side, it should cast and require user_id and refuse customer_id.
As it is, a crafted message sent from the client is written and propagated as if it were from the Agent.
Describe the bug There is one changeset function to create messages, used by both conversation and notification channels.
It should have 2, one for each case. In the client create-message-changeset-function, it should cast and require customer id, and refuse user id. In the agent side, it should cast and require user_id and refuse customer_id.
As it is, a crafted message sent from the client is written and propagated as if it were from the Agent.