fix(support): anchor support identity to the tenant id and send diagnostics

[cihanalagoz]

Why

Comparing Console's handoff payload against Studio's and Pulse's turned up three real defects — Console was the outlier in every one.

Field	Studio	Pulse	Console (before)
externalInstallationId	workspace._id	workspace.id	tenantId ✅
context.organizationId	not sent	org UUID	tenant.slug ❌
context.userName	first + last name	user.name	email address ❌
Entry-point predicate	baseUrl && (onprem || crm && secret)	same	baseUrl only ❌

The unique id itself was right: tenantId is the tenant _id from the JWT, same class as the other two products.

What changed

organizationId: slug → null

The CRM derives the support organization key as context.organizationId ?? "${issuer}:${externalInstallationId}", and ticket visibility is organization-scoped (listExternalSupportTickets(userId, organizationId)). Sending the slug meant:

1. Renaming a slug would orphan the customer's entire ticket history — a new organization key produces a new organization, and the old tickets become invisible.
2. Cross-product collision risk — the key is not namespaced by issuer, so a human-readable slug could collide with another product's organizationId and merge two customers into one support organization.
3. The organization name never followed a company rename — the CRM skips the name refresh whenever a product supplies its own organizationId (organizationName ?? (organizationId ? null : workspaceName)).

A Console tenant is both the customer and the workspace, so null is the correct value: the CRM then derives an issuer-scoped key from the immutable tenant id, and all three problems go away.

userName: email → real name

The CRM writes this to externalUsers.fullName, so support staff and every notification greeted an email address. It now reads the name from the tenant database, guarded by assertTenantContext, and falls back to the email if the lookup fails — a display name must never block a handoff.

Entry-point predicate

isSupportReachable() only checks SUPPORT_BASE_URL, but issuing a handoff needs all three values. On SaaS with just the base URL set, the Help button appeared and every click ended in a 503. New isSupportEntryPointEnabled() matches the predicate Studio and Pulse already used, including the on-prem login fallback.

Diagnostics

openSupport() sent only { locale }, so the server-side diagnostic-draft path was unreachable from the UI — Studio has 3 contextual entry points, Pulse 2, Console had 0. Now:

• openSupport(locale, diagnostic?) sends summary + category, error name/message/stack/digest, page, environment and timestamp.
• The dashboard error boundary offers "Report to Support" with the error attached.
• /support/status — a dead endpoint nothing called — is what tells it whether to offer that, and now returns the entry-point predicate.

Shipping path

Console is not deployed as a chart: there is no deploy/ directory and build-deploy.yaml is entirely commented out. It ships as a self-hosted image, and docker-compose.yml passed no support variables, so there was no way to enable Support from the path Console actually uses. It now passes SUPPORT_BASE_URL, SUPPORT_CRM_API_URL, SUPPORT_HANDOFF_SECRET and DEPLOYMENT_MODE=onprem through. .env.example corrected to describe the real behaviour.

Tests

20 new tests, and the two support endpoints are now off the test:endpoints uncovered list:

• src/__tests__/unit/support-handoff.test.ts — identity contract (asserts organizationId is null and the tenant id is the anchor), name fallback, on-prem fallback, CRM reason never leaking to the caller.
• src/__tests__/api/support.test.ts — route validation, auth, diagnostics forwarding, cache headers.

Validation

tsc --noEmit shows only pre-existing errors (stale .next/types, pdf-to-img, agentService) · 3175 tests pass · lint clean on all touched files.

npm run build fails on Module not found: 'pdf-to-img' — a declared dependency missing from local node_modules, unrelated to this change.