From 5f5b0c45bd0e57708fda88c2d7e9ce7014710a56 Mon Sep 17 00:00:00 2001 From: viettranx Date: Fri, 27 Mar 2026 20:44:27 +0700 Subject: [PATCH] fix(telegram): inject tenant_id into command handler context All Telegram bot commands (/writers, /addwriter, /removewriter, /reset, /tasks, /task_detail) and callback queries were missing tenant_id in context, causing "tenant_id required" errors from scopeClause() or silent fallback to MasterTenantID breaking multi-tenant isolation. --- internal/channels/telegram/commands.go | 3 +++ internal/channels/telegram/commands_tasks.go | 3 +++ 2 files changed, 6 insertions(+) diff --git a/internal/channels/telegram/commands.go b/internal/channels/telegram/commands.go index 5cfafe64..811a9923 100644 --- a/internal/channels/telegram/commands.go +++ b/internal/channels/telegram/commands.go @@ -58,6 +58,9 @@ func (c *Channel) handleBotCommand(ctx context.Context, message *telego.Message, cmd = strings.SplitN(cmd, "@", 2)[0] + // Inject tenant scope so all command handlers have tenant_id in context. + ctx = store.WithTenantID(ctx, c.TenantID()) + chatIDObj := tu.ID(chatID) // Helper: set MessageThreadID on outgoing messages for forum topics. diff --git a/internal/channels/telegram/commands_tasks.go b/internal/channels/telegram/commands_tasks.go index fa9883a1..02c0dfde 100644 --- a/internal/channels/telegram/commands_tasks.go +++ b/internal/channels/telegram/commands_tasks.go @@ -196,6 +196,9 @@ func (c *Channel) handleTaskDetail(ctx context.Context, chatID int64, text strin // handleCallbackQuery handles inline keyboard button presses. func (c *Channel) handleCallbackQuery(ctx context.Context, query *telego.CallbackQuery) { // Always answer to dismiss the loading indicator. + // Inject tenant scope (callback queries bypass handleBotCommand). + ctx = store.WithTenantID(ctx, c.TenantID()) + c.bot.AnswerCallbackQuery(ctx, &telego.AnswerCallbackQueryParams{ CallbackQueryID: query.ID, })