chore: consolidate local integration changes

backend/cmd/adminctl/main.go

@@ -56,6 +56,11 @@ func main() {
 			slog.Error("clear-orphan-user-tenant-memberships failed", "error", err)
 			os.Exit(1)
 		}
+	case "worksmobile-sync":
+		if err := runWorksmobileSync(os.Args[2:]); err != nil {
+			slog.Error("worksmobile-sync failed", "error", err)
+			os.Exit(1)
+		}
 	default:
 		printUsage()
 		os.Exit(2)
@@ -227,4 +232,5 @@ func printUsage() {
 	fmt.Fprintln(os.Stderr, "usage:")
 	fmt.Fprintln(os.Stderr, "  adminctl create-super-admin [--email EMAIL] [--password PASSWORD] [--name NAME] [--update-password]")
 	fmt.Fprintln(os.Stderr, "  adminctl clear-orphan-user-tenant-memberships [--dry-run]")
+	fmt.Fprintln(os.Stderr, "  adminctl worksmobile-sync [--orgunits] [--users-csv PATH] [--credential-batch-id ID] [--process] [--serialize-orgunits] [--serialize-users-batch ID] [--batch-size N] [--delay DURATION]")
 }

backend/cmd/adminctl/main_test.go

@@ -1,6 +1,11 @@
 package main
 
-import "testing"
+import (
+	"baron-sso-backend/internal/service"
+	"context"
+	"strings"
+	"testing"
+)
 
 func TestResolveCreateSuperAdminConfigUsesEnvDefaults(t *testing.T) {
 	t.Setenv("ADMIN_EMAIL", "admin@example.com")
@@ -71,3 +76,66 @@ func TestResolveClearOrphanUserTenantMembershipsConfig(t *testing.T) {
 		t.Fatal("dry-run flag was not set")
 	}
 }
+
+func TestAuditWorksmobileDuplicatePhoneCountryCodesReportsAndFixes(t *testing.T) {
+	client := &fakeWorksmobilePhoneAuditClient{
+		users: []service.WorksmobileRemoteUser{
+			{
+				ID:          "works-user-1",
+				ExternalID:  "baron-user-1",
+				Email:       "one@example.com",
+				DisplayName: "One",
+				CellPhone:   "+82 +821091917771",
+				DomainID:    1001,
+				DomainName:  "samaneng.com",
+			},
+			{
+				ID:        "works-user-2",
+				Email:     "two@example.com",
+				CellPhone: "+821012345678",
+				DomainID:  1001,
+			},
+		},
+	}
+	output := &strings.Builder{}
+
+	count, err := auditWorksmobileDuplicatePhoneCountryCodes(context.Background(), output, true, client)
+
+	if err != nil {
+		t.Fatalf("auditWorksmobileDuplicatePhoneCountryCodes returned error: %v", err)
+	}
+	if count != 1 {
+		t.Fatalf("count=%d, want 1", count)
+	}
+	if !strings.Contains(output.String(), "one@example.com") || !strings.Contains(output.String(), "+821091917771") {
+		t.Fatalf("audit output did not include normalized duplicate phone row: %s", output.String())
+	}
+	if len(client.patches) != 1 {
+		t.Fatalf("patch count=%d, want 1", len(client.patches))
+	}
+	if client.patches[0].identifier != "works-user-1" {
+		t.Fatalf("patch identifier=%q, want works-user-1", client.patches[0].identifier)
+	}
+	if client.patches[0].payload.CellPhone != "+821091917771" {
+		t.Fatalf("patch cellPhone=%q, want +821091917771", client.patches[0].payload.CellPhone)
+	}
+}
+
+type fakeWorksmobilePhoneAuditClient struct {
+	users   []service.WorksmobileRemoteUser
+	patches []fakeWorksmobilePhonePatch
+}
+
+type fakeWorksmobilePhonePatch struct {
+	identifier string
+	payload    service.WorksmobileUserPatchPayload
+}
+
+func (f *fakeWorksmobilePhoneAuditClient) ListUsers(ctx context.Context) ([]service.WorksmobileRemoteUser, error) {
+	return f.users, nil
+}
+
+func (f *fakeWorksmobilePhoneAuditClient) PatchUser(ctx context.Context, identifier string, payload service.WorksmobileUserPatchPayload) error {
+	f.patches = append(f.patches, fakeWorksmobilePhonePatch{identifier: identifier, payload: payload})
+	return nil
+}

backend/cmd/adminctl/worksmobile_sync_test.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"baron-sso-backend/internal/service"
+	"testing"
+)
+
+func TestClassifyWorksmobileAlignFromWorksAllowsDomainOnlyEmailMismatch(t *testing.T) {
+	item := service.WorksmobileComparisonItem{
+		BaronEmail:       "user@typo.example.com",
+		WorksmobileEmail: "user@example.com",
+	}
+
+	status, ok := classifyWorksmobileAlignFromWorks(item)
+
+	if !ok {
+		t.Fatalf("expected domain-only email mismatch to be alignable, status=%s", status)
+	}
+	if status != "updated" {
+		t.Fatalf("expected updated status, got %s", status)
+	}
+}
+
+func TestClassifyWorksmobileAlignFromWorksSkipsLocalPartChange(t *testing.T) {
+	item := service.WorksmobileComparisonItem{
+		BaronEmail:       "old@example.com",
+		WorksmobileEmail: "new@example.com",
+	}
+
+	status, ok := classifyWorksmobileAlignFromWorks(item)
+
+	if ok {
+		t.Fatalf("expected local-part change to be skipped")
+	}
+	if status != "skipped_email_local_part_changed" {
+		t.Fatalf("expected skipped_email_local_part_changed status, got %s", status)
+	}
+}