chore: snapshot local state before dev merge

2026-06-17 21:25:42 +09:00
parent b2808759d2
commit 49560e8a8c
107 changed files with 8958 additions and 939 deletions
--- a/backend/internal/service/worksmobile_sync_service_test.go
+++ b/backend/internal/service/worksmobile_sync_service_test.go
@@ -1200,7 +1200,7 @@ func TestWorksmobileSyncServiceEnqueuesExternalKeyPresentWorksOnlyOrgUnitDelete(
 	require.Equal(t, "baron-tenant-1", outboxRepo.created[0].Payload["externalKey"])
 }

-func TestWorksmobileSyncServiceReconcilesWorksOnlyOrgUnitBySlugLocalPart(t *testing.T) {
+func TestWorksmobileSyncServiceDeletesWorksOrgUnitEvenWhenSlugLocalPartMatches(t *testing.T) {
 	t.Setenv("GPDTDC_DOMAIN_ID", "1001")
 	rootID := "root-tenant"
 	orgID := "baron-org-1"
@@ -1244,11 +1244,10 @@ func TestWorksmobileSyncServiceReconcilesWorksOnlyOrgUnitBySlugLocalPart(t *test
 	require.NoError(t, err)
 	require.NotNil(t, item)
 	require.Len(t, outboxRepo.created, 1)
-	require.Equal(t, domain.WorksmobileActionUpsert, outboxRepo.created[0].Action)
-	require.Equal(t, orgID, outboxRepo.created[0].ResourceID)
-	request := outboxRepo.created[0].Payload["request"].(WorksmobileOrgUnitPayload)
-	require.Equal(t, orgID, request.OrgUnitExternalKey)
-	require.Equal(t, "tech-dev-center", outboxRepo.created[0].Payload["matchLocalPart"])
+	require.Equal(t, domain.WorksmobileActionDelete, outboxRepo.created[0].Action)
+	require.Equal(t, "works-org-1", outboxRepo.created[0].ResourceID)
+	require.Equal(t, "works-org-1", outboxRepo.created[0].Payload["worksmobileId"])
+	require.Equal(t, "legacy-external-key", outboxRepo.created[0].Payload["externalKey"])
 }

 func TestCompareWorksmobileGroupsFillsParentDisplayFromBaronParentMatch(t *testing.T) {
@@ -1342,11 +1341,10 @@ func TestWorksmobileSyncServiceReconcilesTopLevelWorksOnlyOrgUnitBeforeProtected
 	require.NoError(t, err)
 	require.NotNil(t, item)
 	require.Len(t, outboxRepo.created, 1)
-	require.Equal(t, domain.WorksmobileActionUpsert, outboxRepo.created[0].Action)
-	require.Equal(t, orgID, outboxRepo.created[0].ResourceID)
-	request := outboxRepo.created[0].Payload["request"].(WorksmobileOrgUnitPayload)
-	require.Equal(t, orgID, request.OrgUnitExternalKey)
-	require.Equal(t, "operations", outboxRepo.created[0].Payload["matchLocalPart"])
+	require.Equal(t, domain.WorksmobileActionDelete, outboxRepo.created[0].Action)
+	require.Equal(t, "works-operations", outboxRepo.created[0].ResourceID)
+	require.Equal(t, "works-operations", outboxRepo.created[0].Payload["worksmobileId"])
+	require.Equal(t, "legacy-operations-id", outboxRepo.created[0].Payload["externalKey"])
 }

 func TestWorksmobileSyncServiceRejectsProtectedDomainRootOrgUnitDelete(t *testing.T) {
@@ -2172,6 +2170,403 @@ func TestCompareWorksmobileUsersMarksManagerChangeNeedsUpdate(t *testing.T) {
 	require.Equal(t, "needs_update", items[0].Status)
 }

+func TestCompareWorksmobileUsersMarksTenantLinkedGradeChangeNeedsUpdate(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "1001")
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	gpdtdcID := "tenant-gpdtdc"
+	tenantID := "tenant-gpdtdc-leaf"
+	user := domain.User{
+		ID:       "user-grade",
+		Email:    "grade@samaneng.com",
+		Name:     "Grade User",
+		TenantID: &tenantID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  tenantID,
+					"isPrimary": true,
+					"grade":     "책임",
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:               "works-user-grade",
+			ExternalID:       user.ID,
+			Email:            user.Email,
+			DisplayName:      user.Name,
+			LevelName:        "",
+			PrimaryOrgUnitID: "externalKey:" + tenantID,
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID: 1003,
+					Email:    user.Email,
+					Primary:  true,
+					OrgUnits: []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + tenantID, Primary: true}},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:   {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			gpdtdcID: {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompanyGroup, ParentID: &rootID},
+			tenantID: {ID: tenantID, Name: "Leaf", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "needs_update", items[0].Status)
+	require.Contains(t, items[0].UpdateReasons, "grade")
+	require.Equal(t, "책임 연구원", items[0].BaronGrade)
+}
+
+func TestCompareWorksmobileUsersIncludesMembershipMatchForGradeUpdate(t *testing.T) {
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	gpdtdcID := "tenant-gpdtdc"
+	hmegID := "1d74bebb-c5a1-49d4-bec4-90f0c89ad21f"
+	user := domain.User{
+		ID:       "user-hmeg-researcher",
+		Email:    "hmeg-researcher@baroncs.co.kr",
+		Name:     "HMEG Researcher",
+		TenantID: &hmegID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  hmegID,
+					"isPrimary": true,
+					"grade":     "책임연구원",
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsersWithRemoteGroups(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:               "works-user-hmeg-researcher",
+			ExternalID:       user.ID,
+			Email:            user.Email,
+			DisplayName:      user.Name,
+			DomainID:         1003,
+			PrimaryOrgUnitID: "works-hmeg",
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID: 1003,
+					Email:    user.Email,
+					Primary:  true,
+					OrgUnits: []WorksmobileUserOrgUnit{{OrgUnitID: "works-hmeg", Primary: true}},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:   {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			gpdtdcID: {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompanyGroup, ParentID: &rootID},
+			hmegID:   {ID: hmegID, Slug: "hmeg", Name: "HmEG", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+		[]WorksmobileRemoteGroup{{
+			ID:          "works-hmeg",
+			ExternalID:  hmegID,
+			DisplayName: "WORKS HmEG",
+			DomainID:    1003,
+			DomainName:  "baroncs.co.kr",
+		}},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "needs_update", items[0].Status)
+	require.Contains(t, items[0].UpdateReasons, "grade")
+	require.Len(t, items[0].UserMemberships, 1)
+	require.Equal(t, hmegID, items[0].UserMemberships[0].BaronOrgID)
+	require.Equal(t, "HmEG", items[0].UserMemberships[0].BaronOrgName)
+	require.Equal(t, "hmeg", items[0].UserMemberships[0].BaronOrgSlug)
+	require.Equal(t, "책임 연구원", items[0].UserMemberships[0].BaronGrade)
+	require.Equal(t, "works-hmeg", items[0].UserMemberships[0].WorksmobileOrgID)
+	require.Equal(t, "WORKS HmEG", items[0].UserMemberships[0].WorksmobileOrgName)
+	require.True(t, items[0].UserMemberships[0].GradeNeedsUpdate)
+}
+
+func TestCompareWorksmobileUsersDoesNotUpdateWhenWORKSMembershipIsBaronSubset(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "1001")
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	companyID := "tenant-saman"
+	tenantID := "tenant-saman-leaf"
+	gpdtdcID := "tenant-gpdtdc"
+	gpdtdcTenantID := "tenant-is-3"
+	user := domain.User{
+		ID:       "user-gpdtdc-grade-with-saman-works-org",
+		Email:    "gpdtdc-grade@samaneng.com",
+		Name:     "Research Grade User",
+		TenantID: &gpdtdcTenantID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  tenantID,
+					"isPrimary": true,
+					"grade":     "팀장",
+				},
+				map[string]any{
+					"tenantId": gpdtdcTenantID,
+					"grade":    "책임",
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:               "works-user-gpdtdc-grade",
+			ExternalID:       user.ID,
+			Email:            user.Email,
+			DisplayName:      user.Name,
+			LevelName:        "팀장",
+			PrimaryOrgUnitID: "externalKey:" + tenantID,
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID: 1001,
+					Email:    user.Email,
+					Primary:  true,
+					OrgUnits: []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + tenantID, Primary: true}},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:         {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			companyID:      {ID: companyID, Slug: "saman", Name: "삼안", Type: domain.TenantTypeCompany, ParentID: &rootID, Domains: []domain.TenantDomain{{Domain: "samaneng.com"}}},
+			tenantID:       {ID: tenantID, Slug: "saman-leaf", Name: "삼안 조직", Type: domain.TenantTypeOrganization, ParentID: &companyID},
+			gpdtdcID:       {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompanyGroup, ParentID: &rootID},
+			gpdtdcTenantID: {ID: gpdtdcTenantID, Slug: "is-3", Name: "기술기획", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "matched", items[0].Status)
+	require.NotContains(t, items[0].UpdateReasons, "grade")
+	require.NotContains(t, items[0].UpdateReasons, "organization")
+}
+
+func TestCompareWorksmobileUsersDoesNotCompareGPDTDCGradeAgainstSamanOrgChartLevel(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "300285955")
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	samanID := "045e0b22-fae7-4229-1724-039c5af16849"
+	samanOrgChartID := "97a7e34d-2042-4793-27dc-03ffd68db801"
+	gpdtdcID := "tenant-gpdtdc"
+	infraBIM1ID := "432b5261-421b-4e5f-914f-32d7d22fd01f"
+	user := domain.User{
+		ID:       "abaf0788-2d68-4b7d-b40a-c0251f38ae21",
+		Email:    "hwan@samaneng.com",
+		Name:     "안효원",
+		TenantID: &infraBIM1ID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId": samanOrgChartID,
+					"grade":    "선임연구원",
+				},
+				map[string]any{
+					"tenantId":  infraBIM1ID,
+					"isPrimary": true,
+					"grade":     "선임연구원",
+				},
+			},
+		},
+	}
+	remoteManager := false
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:                         "045e0b22-fae7-4229-1724-039c5af16849",
+			ExternalID:                 user.ID,
+			Email:                      user.Email,
+			DisplayName:                user.Name,
+			DomainID:                   300285955,
+			PrimaryOrgUnitID:           "externalKey:" + samanOrgChartID,
+			PrimaryOrgUnitName:         "삼안기술개발센터(조직도용)",
+			PrimaryOrgUnitIsManager:    &remoteManager,
+			PrimaryOrgUnitPositionName: "조직장 아님",
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID: 300285955,
+					Email:    user.Email,
+					Primary:  true,
+					OrgUnits: []WorksmobileUserOrgUnit{{
+						OrgUnitID: "externalKey:" + samanOrgChartID,
+						Primary:   true,
+						IsManager: &remoteManager,
+					}},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:          {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			samanID:         {ID: samanID, Slug: "saman", Name: "삼안", Type: domain.TenantTypeCompany, ParentID: &rootID, Domains: []domain.TenantDomain{{Domain: "samaneng.com"}}},
+			samanOrgChartID: {ID: samanOrgChartID, Slug: "rnd-saman", Name: "삼안기술개발센터(조직도용)", Type: domain.TenantTypeOrganization, ParentID: &samanID},
+			gpdtdcID:        {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompanyGroup, ParentID: &rootID},
+			infraBIM1ID:     {ID: infraBIM1ID, Slug: "infra-bim1", Name: "인프라 BIM1", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "matched", items[0].Status)
+	require.NotContains(t, items[0].UpdateReasons, "grade")
+}
+
+func TestCompareWorksmobileUsersUsesPrimaryAppointmentForGPDTDCGrade(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "1001")
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	companyID := "tenant-saman"
+	orgChartTenantID := "tenant-rnd-saman"
+	gpdtdcID := "tenant-gpdtdc"
+	gpdtdcTenantID := "tenant-is-3"
+	user := domain.User{
+		ID:       "user-orgchart-grade",
+		Email:    "orgchart-grade@samaneng.com",
+		Name:     "Orgchart Grade User",
+		TenantID: &gpdtdcTenantID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId": orgChartTenantID,
+				},
+				map[string]any{
+					"tenantId":  gpdtdcTenantID,
+					"isPrimary": true,
+					"grade":     "수석연구원",
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:               "works-user-orgchart-grade",
+			ExternalID:       user.ID,
+			Email:            user.Email,
+			DisplayName:      user.Name,
+			LevelName:        "수석 연구원",
+			PrimaryOrgUnitID: "externalKey:" + gpdtdcTenantID,
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID: 1001,
+					Email:    user.Email,
+					Primary:  false,
+					OrgUnits: []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + orgChartTenantID, Primary: true}},
+				},
+				{
+					DomainID: 1003,
+					Email:    user.Email,
+					Primary:  true,
+					OrgUnits: []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + gpdtdcTenantID, Primary: true}},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:           {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			companyID:        {ID: companyID, Slug: "saman", Name: "삼안", Type: domain.TenantTypeCompany, ParentID: &rootID, Domains: []domain.TenantDomain{{Domain: "samaneng.com"}}},
+			orgChartTenantID: {ID: orgChartTenantID, Slug: "rnd-saman", Name: "삼안기술개발센터(조직도용)", Type: domain.TenantTypeOrganization, ParentID: &companyID},
+			gpdtdcID:         {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompanyGroup, ParentID: &rootID},
+			gpdtdcTenantID:   {ID: gpdtdcTenantID, Slug: "is-3", Name: "기술기획", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "matched", items[0].Status)
+	require.NotContains(t, items[0].UpdateReasons, "grade")
+	require.Equal(t, "수석 연구원", items[0].BaronGrade)
+}
+
+func TestCompareWorksmobileUsersMarksConcurrentTenantGradeChangeNeedsUpdate(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "1001")
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	companyID := "tenant-saman"
+	primaryTenantID := "tenant-saman-leaf"
+	gpdtdcID := "tenant-gpdtdc"
+	gpdtdcTenantID := "tenant-is-3"
+	user := domain.User{
+		ID:       "user-concurrent-grade",
+		Email:    "concurrent-grade@samaneng.com",
+		Name:     "Concurrent Grade User",
+		TenantID: &primaryTenantID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  primaryTenantID,
+					"isPrimary": true,
+					"grade":     "팀장",
+				},
+				map[string]any{
+					"tenantId": gpdtdcTenantID,
+					"grade":    "책임",
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:               "works-user-concurrent-grade",
+			ExternalID:       user.ID,
+			Email:            user.Email,
+			DisplayName:      user.Name,
+			LevelName:        "팀장",
+			PrimaryOrgUnitID: "externalKey:" + primaryTenantID,
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID:  1001,
+					Email:     user.Email,
+					Primary:   true,
+					LevelName: "팀장",
+					OrgUnits:  []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + primaryTenantID, Primary: true}},
+				},
+				{
+					DomainID:  1003,
+					Email:     user.Email,
+					Primary:   false,
+					LevelName: "선임",
+					OrgUnits:  []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + gpdtdcTenantID, Primary: true}},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:          {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			companyID:       {ID: companyID, Slug: "saman", Name: "삼안", Type: domain.TenantTypeCompany, ParentID: &rootID, Domains: []domain.TenantDomain{{Domain: "samaneng.com"}}},
+			primaryTenantID: {ID: primaryTenantID, Slug: "saman-leaf", Name: "삼안 조직", Type: domain.TenantTypeOrganization, ParentID: &companyID},
+			gpdtdcID:        {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompanyGroup, ParentID: &rootID},
+			gpdtdcTenantID:  {ID: gpdtdcTenantID, Slug: "is-3", Name: "기술기획", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "needs_update", items[0].Status)
+	require.Contains(t, items[0].UpdateReasons, "grade")
+	require.NotContains(t, items[0].UpdateReasons, "organization")
+	require.Equal(t, "책임 연구원", items[0].BaronGrade)
+	require.Equal(t, "선임", items[0].WorksmobileLevelName)
+}
+
 func TestCompareWorksmobileUsersMarksSecondaryManagerChangeNeedsUpdate(t *testing.T) {
 	t.Setenv("SAMAN_DOMAIN_ID", "1001")
 	rootID := "tenant-saman"
@@ -2307,6 +2702,134 @@ func TestCompareWorksmobileUsersMarksMissingSecondaryOrganizationNeedsUpdate(t *
 	require.Equal(t, "needs_update", items[0].Status)
 }

+func TestCompareWorksmobileUsersIgnoresPrimaryPriorityWhenMembershipsMatch(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "1001")
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	companyID := "tenant-saman"
+	orgChartTenantID := "tenant-rnd-saman"
+	gpdtdcID := "tenant-gpdtdc"
+	gpdtdcTenantID := "tenant-gpdtdc-leaf"
+	user := domain.User{
+		ID:       "user-dual-membership",
+		Email:    "dual-membership@samaneng.com",
+		Name:     "Dual Membership User",
+		TenantID: &gpdtdcTenantID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  orgChartTenantID,
+					"isPrimary": false,
+				},
+				map[string]any{
+					"tenantId":  gpdtdcTenantID,
+					"isPrimary": true,
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:               "works-user-dual-membership",
+			ExternalID:       user.ID,
+			Email:            user.Email,
+			DisplayName:      user.Name,
+			PrimaryOrgUnitID: "externalKey:" + orgChartTenantID,
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID: 1001,
+					Email:    user.Email,
+					Primary:  true,
+					OrgUnits: []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + orgChartTenantID, Primary: true}},
+				},
+				{
+					DomainID: 1003,
+					Email:    user.Email,
+					Primary:  false,
+					OrgUnits: []WorksmobileUserOrgUnit{{OrgUnitID: "externalKey:" + gpdtdcTenantID, Primary: true}},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:           {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			companyID:        {ID: companyID, Slug: "saman", Name: "삼안", Type: domain.TenantTypeCompany, ParentID: &rootID, Domains: []domain.TenantDomain{{Domain: "samaneng.com"}}},
+			orgChartTenantID: {ID: orgChartTenantID, Slug: "rnd-saman", Name: "삼안기술개발센터(조직도용)", Type: domain.TenantTypeOrganization, ParentID: &companyID},
+			gpdtdcID:         {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompany, ParentID: &rootID},
+			gpdtdcTenantID:   {ID: gpdtdcTenantID, Slug: "people-growth", Name: "인재성장", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "matched", items[0].Status)
+	require.NotContains(t, items[0].UpdateReasons, "organization")
+}
+
+func TestCompareWorksmobileUsersIgnoresBaronMembershipSuperset(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "1001")
+	rootID := "tenant-root"
+	companyID := "tenant-saman"
+	primaryTenantID := "tenant-primary"
+	secondaryTenantID := "tenant-secondary"
+	user := domain.User{
+		ID:       "user-baron-membership-superset",
+		Email:    "membership-superset@samaneng.com",
+		Name:     "Membership Superset User",
+		TenantID: &primaryTenantID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  primaryTenantID,
+					"isPrimary": true,
+				},
+				map[string]any{
+					"tenantId": secondaryTenantID,
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		[]WorksmobileRemoteUser{{
+			ID:               "works-user-membership-superset",
+			ExternalID:       user.ID,
+			Email:            user.Email,
+			DisplayName:      user.Name,
+			DomainID:         1001,
+			PrimaryOrgUnitID: "externalKey:" + primaryTenantID,
+			Organizations: []WorksmobileUserOrganization{
+				{
+					DomainID: 1001,
+					Email:    user.Email,
+					Primary:  true,
+					OrgUnits: []WorksmobileUserOrgUnit{
+						{
+							OrgUnitID: "externalKey:" + primaryTenantID,
+							Primary:   true,
+						},
+					},
+				},
+			},
+		}},
+		true,
+		map[string]domain.Tenant{
+			rootID:            {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			companyID:         {ID: companyID, Slug: "saman", Name: "삼안", Type: domain.TenantTypeCompany, ParentID: &rootID, Domains: []domain.TenantDomain{{Domain: "samaneng.com"}}},
+			primaryTenantID:   {ID: primaryTenantID, Slug: "primary", Name: "Primary", Type: domain.TenantTypeOrganization, ParentID: &companyID},
+			secondaryTenantID: {ID: secondaryTenantID, Slug: "secondary", Name: "Secondary", Type: domain.TenantTypeOrganization, ParentID: &companyID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "matched", items[0].Status)
+	require.NotContains(t, items[0].UpdateReasons, "organization")
+}
+
 func TestCompareWorksmobileUsersIgnoresOrganizationEmailWhenMembershipMatches(t *testing.T) {
 	t.Setenv("SAMAN_DOMAIN_ID", "1001")
 	rootID := "tenant-root"
@@ -2357,6 +2880,32 @@ func TestCompareWorksmobileUsersIgnoresOrganizationEmailWhenMembershipMatches(t
 	require.Equal(t, "matched", items[0].Status)
 }

+func TestWorksmobileUsersFromIdentityMirrorIncludesAdditionalAppointmentMembership(t *testing.T) {
+	tenantID := "tenant-gpdtdc-leaf"
+	identity := KratosIdentity{
+		ID: "64d4a839-ee04-4c47-b7b3-4ac6428c56b1",
+		Traits: map[string]any{
+			"email": "researcher@samaneng.com",
+			"name":  "Researcher User",
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  tenantID,
+					"isPrimary": true,
+					"grade":     "책임",
+				},
+			},
+		},
+	}
+
+	users := worksmobileUsersFromIdentityMirror([]KratosIdentity{identity}, []string{tenantID})
+
+	require.Len(t, users, 1)
+	require.Equal(t, identity.ID, users[0].ID)
+	require.NotNil(t, users[0].TenantID)
+	require.Equal(t, tenantID, *users[0].TenantID)
+	require.Equal(t, "책임", worksmobileUserGrade(users[0]))
+}
+
 func TestCompareWorksmobileUsersUsesRemoteUserDomainWhenOrganizationDomainIsMissing(t *testing.T) {
 	t.Setenv("SAMAN_DOMAIN_ID", "1001")
 	rootID := "tenant-root"
@@ -2517,6 +3066,54 @@ func TestCompareWorksmobileUsersMatchesRemoteOrganizationExternalKey(t *testing.
 	require.Equal(t, "matched", items[0].Status)
 }

+func TestCompareWorksmobileUsersDisplaysPrimaryAppointmentAsBaronPrimaryOrg(t *testing.T) {
+	t.Setenv("HANMAC_DOMAIN_ID", "1002")
+	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
+	rootID := "tenant-root"
+	hanmacCompanyID := "tenant-hanmac"
+	hanmacOrgID := "tenant-hanmac-org"
+	gpdtdcID := "tenant-gpdtdc"
+	gsimID := "tenant-gsim-dev"
+	user := domain.User{
+		ID:       "user-gsim-primary",
+		Email:    "gsim-primary@hanmaceng.co.kr",
+		Name:     "GSIM Primary User",
+		TenantID: &hanmacOrgID,
+		Status:   domain.UserStatusActive,
+		Metadata: domain.JSONMap{
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":  hanmacOrgID,
+					"isPrimary": false,
+				},
+				map[string]any{
+					"tenantId":  gsimID,
+					"isPrimary": true,
+				},
+			},
+		},
+	}
+
+	items := compareWorksmobileUsers(
+		[]domain.User{user},
+		nil,
+		true,
+		map[string]domain.Tenant{
+			rootID:          {ID: rootID, Slug: HanmacFamilyTenantSlug, Name: "한맥가족", Type: domain.TenantTypeCompanyGroup},
+			hanmacCompanyID: {ID: hanmacCompanyID, Slug: "hanmac", Name: "한맥기술", Type: domain.TenantTypeCompany, ParentID: &rootID, Domains: []domain.TenantDomain{{Domain: "hanmaceng.co.kr"}}},
+			hanmacOrgID:     {ID: hanmacOrgID, Slug: "rnd-hanmac", Name: "한맥기술개발센터(조직도용)", Type: domain.TenantTypeOrganization, ParentID: &hanmacCompanyID},
+			gpdtdcID:        {ID: gpdtdcID, Slug: "gpdtdc", Name: "총괄기획&기술개발센터", Type: domain.TenantTypeCompany, ParentID: &rootID},
+			gsimID:          {ID: gsimID, Slug: "gsim-dev", Name: "GSIM개발", Type: domain.TenantTypeOrganization, ParentID: &gpdtdcID},
+		},
+	)
+
+	require.Len(t, items, 1)
+	require.Equal(t, "missing_in_worksmobile", items[0].Status)
+	require.Equal(t, gsimID, items[0].BaronPrimaryOrgID)
+	require.Equal(t, "gsim-dev", items[0].BaronPrimaryOrgSlug)
+	require.Equal(t, "GSIM개발", items[0].BaronPrimaryOrgName)
+}
+
 func TestCompareWorksmobileUsersMarksMissingPrimaryOrganizationNeedsUpdate(t *testing.T) {
 	t.Setenv("GPDTDC_DOMAIN_ID", "1003")
 	rootID := "tenant-root"