On Jira Server/DC, GET /rest/api/2/user?username= matches only the login (#998)

name, not email address. When an email identifier is given, _determine_user_api_params
    now calls _lookup_user_directly first (GET /rest/api/2/user/search?username=),
    which searches by email, display name, and login, and then uses the resolved
    username or key for the actual profile fetch. A fallback to passing the email
    directly as username is kept for cases where the login name is the email itself.
    Regression tests for the Server/DC email flow are added.

Author: kalabj

src/mcp_atlassian/jira/users.py

@@ -259,10 +259,27 @@ def _determine_user_api_params(self, identifier: str) -> dict[str, str]:
         # Server/DC: username, key, or email
         elif not self.config.is_cloud:
             if "@" in identifier:
-                api_kwargs["username"] = identifier
-                logger.debug(
-                    f"Determined param: username='{identifier}' (Server/DC email - might not work)"
-                )
+                # /rest/api/2/user?username=email won't match by email on Server/DC.
+                # Use /rest/api/2/user/search first to resolve email → actual username/key.
+                resolved = self._lookup_user_directly(identifier)
+                if resolved:
+                    if "-" in resolved and any(c.isdigit() for c in resolved):
+                        api_kwargs["key"] = resolved
+                        logger.debug(
+                            f"Resolved email '{identifier}' to key '{resolved}' (Server/DC)"
+                        )
+                    else:
+                        api_kwargs["username"] = resolved
+                        logger.debug(
+                            f"Resolved email '{identifier}' to username '{resolved}' (Server/DC)"
+                        )
+                else:
+                    # Fallback: try email as username directly (works if login name IS the email)
+                    api_kwargs["username"] = identifier
+                    logger.debug(
+                        f"Could not resolve email '{identifier}' via search, "
+                        f"trying as username directly (Server/DC)"
+                    )
             elif "-" in identifier and any(c.isdigit() for c in identifier):
                 api_kwargs["key"] = identifier
                 logger.debug(f"Determined param: key='{identifier}' (Server/DC)")

tests/unit/jira/test_users.py

@@ -504,6 +504,71 @@ def test_lookup_user_by_permissions_jira_data_center_name_only(self, users_mixin
                 "permissions": "BROWSE",
             }
 
+    def test_determine_user_api_params_server_dc_email_resolved_to_username(
+        self, users_mixin
+    ):
+        """Test Server/DC email is resolved via search, not passed directly as username."""
+        users_mixin.config = MagicMock(spec=JiraConfig)
+        users_mixin.config.is_cloud = False
+        users_mixin._lookup_user_directly = MagicMock(return_value="jnovak")
+
+        params = users_mixin._determine_user_api_params("jnovak@firma.cz")
+
+        assert params == {"username": "jnovak"}
+        users_mixin._lookup_user_directly.assert_called_once_with("jnovak@firma.cz")
+
+    def test_determine_user_api_params_server_dc_email_resolved_to_key(
+        self, users_mixin
+    ):
+        """Test Server/DC email resolving to a key-style identifier."""
+        users_mixin.config = MagicMock(spec=JiraConfig)
+        users_mixin.config.is_cloud = False
+        users_mixin._lookup_user_directly = MagicMock(return_value="JIRAUSER-12345")
+
+        params = users_mixin._determine_user_api_params("jnovak@firma.cz")
+
+        assert params == {"key": "JIRAUSER-12345"}
+
+    def test_determine_user_api_params_server_dc_email_lookup_fails_fallback(
+        self, users_mixin
+    ):
+        """Test Server/DC email falls back to direct username when lookup returns None."""
+        users_mixin.config = MagicMock(spec=JiraConfig)
+        users_mixin.config.is_cloud = False
+        users_mixin._lookup_user_directly = MagicMock(return_value=None)
+
+        params = users_mixin._determine_user_api_params("login@example.com")
+
+        # Fallback: email used as username directly (e.g., when login IS the email)
+        assert params == {"username": "login@example.com"}
+
+    def test_get_user_profile_by_identifier_server_dc_email(self, users_mixin):
+        """Regression: Server/DC email lookup must search first, not pass email as username."""
+        users_mixin.config = MagicMock(spec=JiraConfig)
+        users_mixin.config.is_cloud = False
+        users_mixin._lookup_user_directly = MagicMock(return_value="jnovak")
+
+        with patch(
+            "src.mcp_atlassian.jira.users.JiraUser.from_api_response"
+        ) as mock_from_api_response:
+            mock_user_instance = MagicMock()
+            mock_from_api_response.return_value = mock_user_instance
+            mock_response_data = {
+                "name": "jnovak",
+                "displayName": "Jan Novák",
+                "emailAddress": "jnovak@firma.cz",
+                "active": True,
+            }
+            users_mixin.jira.user = MagicMock(return_value=mock_response_data)
+
+            user = users_mixin.get_user_profile_by_identifier("jnovak@firma.cz")
+
+            assert user == mock_user_instance
+            # Must resolve email to username first
+            users_mixin._lookup_user_directly.assert_called_once_with("jnovak@firma.cz")
+            # Must call user() with resolved username, NOT the raw email
+            users_mixin.jira.user.assert_called_once_with(username="jnovak")
+
     def test_get_user_profile_by_identifier_cloud_account_id(self, users_mixin):
         """Test get_user_profile_by_identifier with Cloud and accountId."""
         users_mixin.config = MagicMock(spec=JiraConfig)