From 6b30580f36b59ea856f1b8a3de73bbc5eca35113 Mon Sep 17 00:00:00 2001 From: chan Date: Tue, 31 Mar 2026 17:51:53 +0900 Subject: [PATCH] fix(backend): force keto outbox sync on explicit tenant assignment to self-heal missing relations --- backend/internal/handler/user_handler.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/backend/internal/handler/user_handler.go b/backend/internal/handler/user_handler.go index 956b47ca..6045b8d8 100644 --- a/backend/internal/handler/user_handler.go +++ b/backend/internal/handler/user_handler.go @@ -1282,6 +1282,18 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error { } } } + + // [Self-Healing] If the UI explicitly assigned the tenant, force a Keto relation sync. + // This fixes issues where local DB had the tenant, but Keto failed to create the relation previously. + if req.CompanyCode != nil && h.KetoOutboxRepo != nil && updatedLocalUser.TenantID != nil { + _ = h.KetoOutboxRepo.Create(bgCtx, &domain.KetoOutbox{ + Namespace: "Tenant", + Object: *updatedLocalUser.TenantID, + Relation: "members", + Subject: "User:" + updatedLocalUser.ID, + Action: domain.KetoOutboxActionCreate, + }) + } }() }