From 8b1819b98effdd43b9b54804caaeeb97f09f5462 Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Thu, 14 May 2026 15:23:40 +0200
Subject: [PATCH] Fix migration script infer primary domain logic

---
 resources/scripts/migrate_v016.py | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/resources/scripts/migrate_v016.py b/resources/scripts/migrate_v016.py
index f3f26733..ad71ed8f 100644
--- a/resources/scripts/migrate_v016.py
+++ b/resources/scripts/migrate_v016.py
@@ -876,6 +876,7 @@ class Converter:
             if parts and parts[1]:
                 return parts[1]
 
+        fallback: str | None = None
         for addr in pv_list(p.get("emails")):
             if not isinstance(addr, str):
                 continue
@@ -883,9 +884,30 @@ class Converter:
             if parts is None:
                 continue
             local, dom = parts
-            if local and local == nm and dom:
+            if not dom:
+                continue
+            if local and local == nm:
                 return dom
-        return None
+            if fallback is None:
+                fallback = dom
+        return fallback
+
+    def _tenant_default_domain_cid(self, p: dict[str, Any]) -> str | None:
+        tname = pv_string(p.get("tenant"))
+        if not tname:
+            return None
+        t_cid = self.tenant_name_to_cid.get(tname)
+        if t_cid is None:
+            return None
+        candidates = [
+            (self.domain_cid_to_name.get(cid, ""), cid)
+            for cid, owner in self.domain_cid_to_tenant_cid.items()
+            if owner == t_cid
+        ]
+        if not candidates:
+            return None
+        candidates.sort()
+        return candidates[0][1]
 
     def _resolve_name_and_domain(self, p: dict[str, Any]) -> tuple[str, str]:
         nm = pv_string(p.get("name"))
@@ -905,6 +927,10 @@ class Converter:
                 raise ConvertError(f"domain {dom!r} missing from domain index")
             return (nm, self.domain_name_to_cid[dom])
 
+        tenant_default = self._tenant_default_domain_cid(p)
+        if tenant_default is not None:
+            return (nm, tenant_default)
+
         if self.default_domain_cid is None:
             raise ConvertError(
                 f"principal {nm!r} has no domain and no default domain is set"