fix: select support identity by IM tenant

internal/support/service.go

@@ -20,7 +20,7 @@ import (
 
 type Repository interface {
 	CustomerServiceByID(context.Context, int64, int64) (*store.CustomerService, error)
-	MemberIMIdentity(context.Context, int64, int64) (*store.MemberIMIdentity, error)
+	MemberIMIdentityForTenant(context.Context, int64, int64, string) (*store.MemberIMIdentity, error)
 	MemberIMProfile(context.Context, int64, int64) (*store.MemberIMProfile, error)
 	SaveMemberIMIdentity(context.Context, *store.MemberIMIdentity) (*store.MemberIMIdentity, error)
 }
@@ -188,14 +188,8 @@ func (s *Service) OpenSession(ctx context.Context, tenantID, memberID, serviceID
 }
 
 func (s *Service) ensureIdentity(ctx context.Context, tenantID, memberID int64, imTenantCode string) (*store.MemberIMIdentity, error) {
-	identity, err := s.repository.MemberIMIdentity(ctx, tenantID, memberID)
+	identity, err := s.repository.MemberIMIdentityForTenant(ctx, tenantID, memberID, imTenantCode)
 	if err == nil {
-		if !strings.EqualFold(identity.IMTenantCode, imTenantCode) {
-			// A tenant switch creates a distinct IM user. Keep the old tenant's IM
-			// account intact, but replace this member's local mapping with a newly
-			// provisioned account in the active tenant.
-			return s.createIdentity(ctx, tenantID, memberID, imTenantCode)
-		}
 		if identity.IMUserID == "" || identity.IMUsername == "" {
 			return nil, ErrIMUnavailable
 		}

internal/support/service_test.go

@@ -13,15 +13,20 @@ import (
 )
 
 type repositoryStub struct {
-	agent    *store.CustomerService
-	identity *store.MemberIMIdentity
-	profile  *store.MemberIMProfile
+	agent                 *store.CustomerService
+	identity              *store.MemberIMIdentity
+	profile               *store.MemberIMProfile
+	requestedIMTenantCode string
 }
 
 func (r *repositoryStub) CustomerServiceByID(context.Context, int64, int64) (*store.CustomerService, error) {
 	return r.agent, nil
 }
-func (r *repositoryStub) MemberIMIdentity(context.Context, int64, int64) (*store.MemberIMIdentity, error) {
+func (r *repositoryStub) MemberIMIdentityForTenant(_ context.Context, _, _ int64, imTenantCode string) (*store.MemberIMIdentity, error) {
+	r.requestedIMTenantCode = imTenantCode
+	if r.identity == nil || !strings.EqualFold(r.identity.IMTenantCode, imTenantCode) {
+		return nil, store.ErrResourceNotFound
+	}
 	return r.identity, nil
 }
 func (r *repositoryStub) MemberIMProfile(context.Context, int64, int64) (*store.MemberIMProfile, error) {
@@ -207,3 +212,22 @@ func TestEnsureIdentityReprovisionsMemberWhenIMTenantChanges(t *testing.T) {
 		t.Fatalf("provisioning login attempts = %d, want 1", im.loginAttempts)
 	}
 }
+
+func TestEnsureIdentityQueriesTheActiveIMTenantMapping(t *testing.T) {
+	repository := &repositoryStub{
+		identity: &store.MemberIMIdentity{TenantID: 0, MemberID: 9, IMTenantCode: "allrich", IMUserID: "usr_old", IMUsername: "olduser"},
+		profile:  &store.MemberIMProfile{MemberID: 9, Username: "member01"},
+	}
+	im := &imStub{}
+	service := New(repository, im, config.AuthConfig{FinanceMasterKey: strings.Repeat("k", 32)})
+	identity, err := service.ensureIdentity(context.Background(), 0, 9, "default")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if repository.requestedIMTenantCode != "default" {
+		t.Fatalf("queried IM tenant = %q, want default", repository.requestedIMTenantCode)
+	}
+	if identity.IMTenantCode != "default" {
+		t.Fatalf("identity tenant = %q, want default", identity.IMTenantCode)
+	}
+}