fix: handle private pending support relationships

internal/support/service_test.go

@@ -2,6 +2,7 @@ package support
 
 import (
 	"context"
+	"errors"
 	"strings"
 	"testing"
 	"time"
@@ -40,6 +41,9 @@ type imStub struct {
 	loginAttempts  int
 	resetPasswords int
 	loginError     error
+	profileError   error
+	conversation   *imclient.Conversation
+	ensureP2PCalls int
 }
 
 func (i *imStub) Ready() bool { return true }
@@ -67,6 +71,9 @@ func (i *imStub) ResetPassword(context.Context, string, string) error {
 	return nil
 }
 func (i *imStub) UserProfile(context.Context, string, string) (*imclient.UserProfile, error) {
+	if i.profileError != nil {
+		return nil, i.profileError
+	}
 	return &imclient.UserProfile{UserID: "usr_agent", Relationship: "none"}, nil
 }
 func (i *imStub) CreateFriendRequest(context.Context, string, string, string) (*imclient.FriendRequest, error) {
@@ -74,6 +81,10 @@ func (i *imStub) CreateFriendRequest(context.Context, string, string, string) (*
 	return &imclient.FriendRequest{RequestID: "frq_1", Status: "accepted"}, nil
 }
 func (i *imStub) EnsureP2P(context.Context, string, string, string) (*imclient.Conversation, error) {
+	i.ensureP2PCalls++
+	if i.conversation != nil {
+		return i.conversation, nil
+	}
 	return &imclient.Conversation{Topic: "p2p-topic", Relationship: "friend", CanSend: true}, nil
 }
 
@@ -115,6 +126,27 @@ func TestOpenSessionReturnsSameOriginEndpoints(t *testing.T) {
 	}
 }
 
+func TestOpenSessionReturnsPendingWhenPrivateProfileHidesPendingRelationship(t *testing.T) {
+	repository := &repositoryStub{
+		agent:    &store.CustomerService{ID: 3, Name: "客服01", IMTenantCode: "allrich", IMUserID: "usr_agent", OnlineStatus: 1},
+		identity: &store.MemberIMIdentity{TenantID: 0, MemberID: 9, IMTenantCode: "allrich", IMUserID: "usr_member", IMUsername: "member01"},
+	}
+	im := &imStub{
+		profileError: &imclient.Error{Status: 403, Reason: "PERMISSION_DENIED"},
+		conversation: &imclient.Conversation{Topic: "p2p-topic", Relationship: "pending_outbound", CanSend: false},
+	}
+	service := New(repository, im, config.AuthConfig{FinanceMasterKey: strings.Repeat("k", 32)})
+	repository.identity.IMPasswordCipher, _ = service.encryptCredential("password")
+
+	_, err := service.OpenSession(context.Background(), 0, 9, 3, SessionRequest{DeviceID: "web-1", Platform: "web"})
+	if !errors.Is(err, ErrRelationPending) {
+		t.Fatalf("error = %v, want ErrRelationPending", err)
+	}
+	if im.ensureP2PCalls != 1 || im.friendRequests != 0 {
+		t.Fatalf("ensure p2p calls=%d friend requests=%d, want 1 and 0", im.ensureP2PCalls, im.friendRequests)
+	}
+}
+
 func TestOpenSessionRepairsDriftedIMCredential(t *testing.T) {
 	repository := &repositoryStub{
 		agent:    &store.CustomerService{ID: 3, Name: "客服01", IMTenantCode: "allrich", IMUserID: "usr_agent", OnlineStatus: 1},