Match subscriptions to exact email users

scripts/reconcile_subscription_by_email.py

@@ -15,6 +15,7 @@ if PROJECT_ROOT not in sys.path:
 def _lookup_user_id_by_email(email: str) -> str:
     from src.payments.contract_checkout import PAYMENT_CHECKOUT, PaymentCheckoutError
 
+    normalized_email = str(email or "").strip().lower()
     payload = PAYMENT_CHECKOUT._auth_admin_request(  # noqa: SLF001
         "GET",
         f"/admin/users?email={email}",
@@ -23,11 +24,29 @@ def _lookup_user_id_by_email(email: str) -> str:
     users = payload.get("users") if isinstance(payload, dict) else None
     if not isinstance(users, list) or not users:
         raise PaymentCheckoutError(404, f"supabase user not found for email={email}")
-    user = users[0] if isinstance(users[0], dict) else {}
-    user_id = str(user.get("id") or "").strip()
-    if not user_id:
-        raise PaymentCheckoutError(404, f"supabase user id missing for email={email}")
-    return user_id
+
+    matches = []
+    for user in users:
+        if not isinstance(user, dict):
+            continue
+        row_email = str(user.get("email") or "").strip().lower()
+        user_id = str(user.get("id") or "").strip()
+        if row_email == normalized_email and user_id:
+            matches.append(user_id)
+
+    unique_matches = []
+    for user_id in matches:
+        if user_id not in unique_matches:
+            unique_matches.append(user_id)
+
+    if len(unique_matches) == 1:
+        return unique_matches[0]
+    if len(unique_matches) > 1:
+        raise PaymentCheckoutError(
+            409,
+            f"multiple exact supabase users matched email={email}: {unique_matches}",
+        )
+    raise PaymentCheckoutError(404, f"exact supabase user not found for email={email}")
 
 
 def main() -> int: