feat(agents): align delete scope

internal/handler/api/v1/agent_handler_test.go

@@ -322,6 +322,27 @@ func (s *AgentHandlerTestSuite) TestDeleteAgent() {
 	assert.Equal(s.T(), http.StatusNotFound, w3.Code)
 }
 
+func (s *AgentHandlerTestSuite) TestDeleteAgentNotInAccountReturnsNotFound() {
+	otherAccount := &model.Account{Name: "Other Account", Locale: "en", Active: true}
+	s.Require().NoError(s.db.Create(otherAccount).Error)
+	otherUser := &model.User{Name: "Other Agent", Email: "other-agent@test.com", Provider: "email", Active: true}
+	s.Require().NoError(s.db.Create(otherUser).Error)
+	s.Require().NoError(s.db.Create(&model.AccountUser{AccountID: otherAccount.ID, UserID: otherUser.ID, Role: "agent", Availability: "offline", AutoOffline: true}).Error)
+
+	w, c := s.makeRequest("DELETE", fmt.Sprintf("/api/v1/accounts/%d/agents/%d", s.account.ID, otherUser.ID), nil, s.account.ID, s.user.ID)
+	s.handler.Delete(c)
+
+	assert.Equal(s.T(), http.StatusNotFound, w.Code, w.Body.String())
+
+	var userCount int64
+	s.Require().NoError(s.db.Model(&model.User{}).Where("id = ?", otherUser.ID).Count(&userCount).Error)
+	assert.Equal(s.T(), int64(1), userCount)
+
+	var membershipCount int64
+	s.Require().NoError(s.db.Model(&model.AccountUser{}).Where("account_id = ? AND user_id = ?", otherAccount.ID, otherUser.ID).Count(&membershipCount).Error)
+	assert.Equal(s.T(), int64(1), membershipCount)
+}
+
 func (s *AgentHandlerTestSuite) TestBulkCreate() {
 	req := service.BulkCreateAgentRequest{
 		Emails: []string{"bulk1@test.com", "bulk2@test.com", "bulk3@test.com"},

internal/repository/agent_repo.go

@@ -245,10 +245,15 @@ func (r *AgentRepo) UpdateAgent(ctx context.Context, userID, accountID uint, nam
 // Reference: Chatwoot agents_controller.rb#destroy → current_account_user.destroy!
 // If the user has no other account memberships, deletes the user record too.
 func (r *AgentRepo) DeleteAgent(ctx context.Context, userID, accountID uint) error {
-	// Delete the AccountUser
+	var accountUser model.AccountUser
 	if err := r.db.WithContext(ctx).
 		Where("account_id = ? AND user_id = ?", accountID, userID).
-		Delete(&model.AccountUser{}).Error; err != nil {
+		First(&accountUser).Error; err != nil {
+		return err
+	}
+
+	// Delete the AccountUser after the scoped lookup succeeds.
+	if err := r.db.WithContext(ctx).Delete(&accountUser).Error; err != nil {
 		return err
 	}