- Shipped
- 10 ஆகஸ்ட், 2026 அன்று 11:53 PM UTC
- Author
- Kamo
- Commit
- ebaa1db
assignToAgent and reassignAgent checked only that the id resolved to a member. Assignment adds that member to the ticket's chat session, so an id from another organization would have been given a customer conversation it has no business seeing, and an off-boarded member could be made responsible for live work. Both now go through requireAssignableAgent: same organization as the ticket, and eligible for live sessions — the predicate the automatic paths already apply in assignToPreferredAgent. A non-numeric id becomes a 400 rather than an uncaught NumberFormatException. The agent picker only ever offers the caller's own org, so this was not reachable from the UI; it was the endpoint that was open.