chore: consolidate local integration changes

backend/cmd/fix_kratos_roles.go

@@ -4,11 +4,21 @@ import (
 	"baron-sso-backend/internal/domain"
 	"baron-sso-backend/internal/service"
 	"context"
+	"flag"
 	"fmt"
 	"log"
 )
 
 func main() {
+	dryRun := flag.Bool("dry-run", true, "변경 대상만 출력하고 Kratos identity를 수정하지 않습니다")
+	maintenanceWindow := flag.Bool("maintenance-window", false, "승인된 정비 시간에만 실제 변경을 허용합니다")
+	markMirrorStale := flag.Bool("mark-mirror-stale", false, "실행 전 Redis identity mirror를 stale로 표시했음을 확인합니다")
+	flag.Parse()
+
+	if !*dryRun && (!*maintenanceWindow || !*markMirrorStale) {
+		log.Fatal("refusing to update Kratos identities: pass --dry-run=false --maintenance-window --mark-mirror-stale after marking identity mirror stale")
+	}
+
 	kratosAdmin := service.NewKratosAdminService()
 	ctx := context.Background()
 
@@ -37,6 +47,11 @@ func main() {
 		}
 
 		if changed {
+			if *dryRun {
+				count++
+				fmt.Printf("Would update %s\n", id.ID)
+				continue
+			}
 			_, err := kratosAdmin.UpdateIdentity(ctx, id.ID, traits, id.State)
 			if err != nil {
 				log.Printf("Failed to update %s: %v", id.ID, err)
@@ -46,5 +61,10 @@ func main() {
 			}
 		}
 	}
-	fmt.Printf("Total updated: %d\n", count)
+	if *dryRun {
+		fmt.Printf("Total candidates: %d\n", count)
+	} else {
+		fmt.Printf("Total updated: %d\n", count)
+		fmt.Println("Identity mirror was marked stale before maintenance; run full mirror refresh and drift report before trusting cached user lists.")
+	}
 }