- Ya
- 10 Agosti 2026, 23:53 UTC
- Mwandishi
- Kamo
- Ahadi ya
- ebaa1db
assignToAgent and reassignAgent checked only that the id resolved to a member. Assignment adds that member to the ticket's chat session, so an id from another organization would have been given a customer conversation it has no business seeing, and an off-boarded member could be made responsible for live work. Both now go through requireAssignableAgent: same organization as the ticket, and eligible for live sessions — the predicate the automatic paths already apply in assignToPreferredAgent. A non-numeric id becomes a 400 rather than an uncaught NumberFormatException. The agent picker only ever offers the caller's own org, so this was not reachable from the UI; it was the endpoint that was open.