Merge remote-tracking branch 'origin/dev' into dev

.gitignore

@@ -19,6 +19,7 @@ reports
 reports/*
 config/*.pem
 common/node_modules
+common/.baron-deps-install.lock
 
 # Docker Services Data (Volumes)
 postgres_data/

Makefile

@@ -263,7 +263,7 @@ code-check-userfront-lint:
 code-check-front-lint:
 	@echo "==> adminfront biome lint/format check"
 	rm -rf adminfront/playwright-report adminfront/test-results
-	cd adminfront && npm ci --ignore-scripts
+	cd adminfront && pnpm install --frozen-lockfile --ignore-scripts
 	cd adminfront && npx biome check . --formatter-enabled=false --organize-imports-enabled=false
 	cd adminfront && npx biome check . --linter-enabled=false --organize-imports-enabled=false
 	@echo "==> devfront biome lint/format check"

adminfront/package.json

@@ -53,6 +53,7 @@
     "@types/react-router-dom": "^5.3.3",
     "@vitejs/plugin-react": "^6.0.1",
     "autoprefixer": "^10.5.0",
+    "jsdom": "^28.1.0",
     "postcss": "^8.5.14",
     "tailwindcss": "^3.4.19",
     "tailwindcss-animate": "^1.0.7",

adminfront/scripts/runtime-mode.sh

@@ -51,6 +51,39 @@ ensure_frontend_dependencies() {
     return 0
   fi
 
+  lock_mode=""
+  lock_file="$WORKSPACE_DIR/.baron-deps-install.lock"
+
+  acquire_install_lock() {
+    if command -v flock >/dev/null 2>&1; then
+      lock_mode="flock"
+      exec 9>"$lock_file"
+      flock 9
+      trap 'release_install_lock' EXIT INT TERM
+      return 0
+    fi
+
+    lock_mode="mkdir"
+    while ! mkdir "$lock_file" 2>/dev/null; do
+      sleep 1
+    done
+    trap 'release_install_lock' EXIT INT TERM
+  }
+
+  release_install_lock() {
+    trap - EXIT INT TERM
+
+    if [ "$lock_mode" = "flock" ]; then
+      flock -u 9 || true
+      exec 9>&-
+      return 0
+    fi
+
+    if [ "$lock_mode" = "mkdir" ]; then
+      rmdir "$lock_file" >/dev/null 2>&1 || true
+    fi
+  }
+
   if command -v sha256sum >/dev/null 2>&1; then
     deps_hash="$(sha256sum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | sha256sum | awk '{print $1}')"
   else
@@ -61,6 +94,17 @@ ensure_frontend_dependencies() {
 
   if [ "$installed_hash" != "$deps_hash" ]; then
     echo "Installing frontend dependencies..."
+    acquire_install_lock
+    if command -v sha256sum >/dev/null 2>&1; then
+      deps_hash="$(sha256sum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | sha256sum | awk '{print $1}')"
+    else
+      deps_hash="$(cksum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | cksum | awk '{print $1}')"
+    fi
+    installed_hash="$(cat "$deps_stamp" 2>/dev/null || true)"
+    if [ "$installed_hash" = "$deps_hash" ]; then
+      release_install_lock
+      return 0
+    fi
     if [ "$WORKSPACE_DIR" = "/workspace/common" ]; then
       (cd /workspace/common && pnpm install --filter "${APP_WORKSPACE_FILTER}..." --frozen-lockfile --ignore-scripts)
     else
@@ -68,14 +112,15 @@ ensure_frontend_dependencies() {
     fi
     mkdir -p node_modules
     printf '%s\n' "$deps_hash" > "$deps_stamp"
+    release_install_lock
   fi
 }
 
 ensure_frontend_dependencies
 
 if [ "$mode" = "production" ]; then
-  echo "Running in production mode with Vite preview..."
-  exec sh -c "npm run build && npm run preview -- --host 0.0.0.0"
+  echo "Running in production mode with custom static server..."
+  exec sh -c "npm run build && node ./scripts/serve-prod.mjs"
 fi
 
 echo "Running in development mode..."

adminfront/scripts/serve-prod.mjs

@@ -0,0 +1,153 @@
+import { createServer } from "node:http";
+import { readFile, stat } from "node:fs/promises";
+import { extname, join, normalize, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const rootDir = fileURLToPath(new URL("..", import.meta.url));
+const distDir = resolve(
+  process.env.ADMINFRONT_BUILD_OUT_DIR ?? "/tmp/baron-sso-adminfront-dist",
+);
+const host = process.env.HOST ?? "0.0.0.0";
+const port = Number(process.env.PORT ?? process.env.ADMINFRONT_PORT ?? 5173);
+const backendTarget = new URL(
+  process.env.API_PROXY_TARGET || "http://localhost:3000",
+);
+
+const contentTypes = {
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".svg": "image/svg+xml",
+};
+
+function getContentType(filePath) {
+  return contentTypes[extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+
+function sendJson(res, statusCode, body) {
+  res.writeHead(statusCode, {
+    "Content-Type": "application/json; charset=utf-8",
+    "Cache-Control": "no-store",
+  });
+  res.end(JSON.stringify(body));
+}
+
+function toSafePath(pathname) {
+  const decoded = decodeURIComponent(pathname);
+  const relative = decoded.replace(/^\/+/, "");
+  const safe = normalize(relative).replace(/^(\.\.(?:[\\/]|$))+/, "");
+  return join(distDir, safe);
+}
+
+async function tryReadFile(filePath) {
+  try {
+    return await readFile(filePath);
+  } catch {
+    return null;
+  }
+}
+
+async function proxyToBackend(req, res, pathname, search) {
+  const target = new URL(pathname + search, backendTarget);
+  const headers = new Headers();
+
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (!value) continue;
+    if (key === "host" || key === "content-length" || key === "connection") {
+      continue;
+    }
+    if (Array.isArray(value)) {
+      headers.set(key, value.join(", "));
+      continue;
+    }
+    headers.set(key, value);
+  }
+
+  const hasBody = !["GET", "HEAD"].includes(req.method ?? "GET");
+  const response = await fetch(target, {
+    method: req.method,
+    headers,
+    body: hasBody ? req : undefined,
+    duplex: hasBody ? "half" : undefined,
+  });
+
+  const responseHeaders = new Headers(response.headers);
+  responseHeaders.delete("content-length");
+  responseHeaders.delete("transfer-encoding");
+  responseHeaders.delete("connection");
+
+  res.writeHead(response.status, Object.fromEntries(responseHeaders.entries()));
+
+  if (req.method === "HEAD") {
+    res.end();
+    return;
+  }
+
+  const arrayBuffer = await response.arrayBuffer();
+  res.end(Buffer.from(arrayBuffer));
+}
+
+async function serveStatic(req, res, pathname) {
+  const indexPath = join(distDir, "index.html");
+  const filePath = toSafePath(pathname);
+
+  let resolvedPath = filePath;
+  try {
+    const fileStat = await stat(resolvedPath);
+    if (fileStat.isDirectory()) {
+      resolvedPath = join(resolvedPath, "index.html");
+    }
+  } catch {
+    resolvedPath = indexPath;
+  }
+
+  let body = await tryReadFile(resolvedPath);
+  if (!body) {
+    body = await tryReadFile(indexPath);
+    resolvedPath = indexPath;
+  }
+
+  if (!body) {
+    sendJson(res, 500, { error: "dist_not_found" });
+    return;
+  }
+
+  res.writeHead(200, {
+    "Content-Type": getContentType(resolvedPath),
+    "Cache-Control": resolvedPath.endsWith("index.html")
+      ? "no-cache"
+      : "public, max-age=31536000, immutable",
+  });
+
+  if (req.method === "HEAD") {
+    res.end();
+    return;
+  }
+
+  res.end(body);
+}
+
+createServer(async (req, res) => {
+  try {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    const { pathname, search } = url;
+
+    if (pathname === "/api" || pathname.startsWith("/api/")) {
+      await proxyToBackend(req, res, pathname, search);
+      return;
+    }
+
+    const normalizedPath = pathname === "/" ? "/index.html" : pathname;
+    await serveStatic(req, res, normalizedPath);
+  } catch (error) {
+    sendJson(res, 500, {
+      error: "internal_server_error",
+      message: error instanceof Error ? error.message : String(error),
+    });
+  }
+}).listen(port, host, () => {
+  console.log(`Adminfront production server listening on http://${host}:${port}`);
+});

adminfront/src/components/common/LanguageSelector.test.tsx

@@ -0,0 +1,32 @@
+import { render, screen, fireEvent } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import LanguageSelector from "./LanguageSelector";
+
+vi.mock("../../lib/i18n", () => ({
+  t: (_key: string, fallback?: string) => fallback ?? "",
+}));
+
+describe("LanguageSelector", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    vi.restoreAllMocks();
+  });
+
+  it("updates locale without reloading the page", () => {
+    const dispatchSpy = vi.spyOn(window, "dispatchEvent");
+    window.localStorage.setItem("locale", "ko");
+
+    render(<LanguageSelector />);
+
+    fireEvent.change(screen.getByRole("combobox"), {
+      target: { value: "en" },
+    });
+
+    expect(window.localStorage.getItem("locale")).toBe("en");
+    expect(
+      dispatchSpy.mock.calls.some(
+        ([event]) => event instanceof Event && event.type === "localechange",
+      ),
+    ).toBe(true);
+  });
+});

adminfront/src/components/common/LanguageSelector.tsx

@@ -1,8 +1,6 @@
-import { useState } from "react";
+import { useEffect, useState } from "react";
+import { LOCALE_STORAGE_KEY } from "../../../../common/core/i18n";
 import { t } from "../../lib/i18n";
-
-const LOCALE_STORAGE_KEY = "locale";
-const LOCALE_CHANGED_EVENT = "baron_locale_changed";
 const SUPPORTED_LOCALES = ["ko", "en"] as const;
 
 type Locale = (typeof SUPPORTED_LOCALES)[number];
@@ -29,17 +27,27 @@ function resolveLocale(): Locale {
 function LanguageSelector() {
   const [locale, setLocale] = useState<Locale>(resolveLocale());
 
+  useEffect(() => {
+    const syncLocale = () => {
+      setLocale(resolveLocale());
+    };
+
+    window.addEventListener("localechange", syncLocale);
+    window.addEventListener("storage", syncLocale);
+
+    return () => {
+      window.removeEventListener("localechange", syncLocale);
+      window.removeEventListener("storage", syncLocale);
+    };
+  }, []);
+
   const handleChange = (next: Locale) => {
     if (next === locale) {
       return;
     }
     window.localStorage.setItem(LOCALE_STORAGE_KEY, next);
     setLocale(next);
-    if (import.meta.env.MODE === "development") {
-      window.dispatchEvent(new Event(LOCALE_CHANGED_EVENT));
-      return;
-    }
-    window.location.reload();
+    window.dispatchEvent(new Event("localechange"));
   };
 
   return (

adminfront/src/components/common/LocaleRefreshBoundary.test.tsx

@@ -0,0 +1,34 @@
+import { act, render, screen } from "@testing-library/react";
+import { beforeEach, describe, expect, it } from "vitest";
+import LocaleRefreshBoundary from "./LocaleRefreshBoundary";
+
+let renderCount = 0;
+
+function RenderCounter() {
+  renderCount += 1;
+  return <span>{renderCount}</span>;
+}
+
+describe("LocaleRefreshBoundary", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    renderCount = 0;
+  });
+
+  it("re-renders children when locale changes", async () => {
+    render(
+      <LocaleRefreshBoundary>
+        <RenderCounter />
+      </LocaleRefreshBoundary>,
+    );
+
+    expect(screen.getByText("1")).toBeInTheDocument();
+
+    await act(async () => {
+      window.localStorage.setItem("locale", "en");
+      window.dispatchEvent(new Event("localechange"));
+    });
+
+    expect(screen.getByText("2")).toBeInTheDocument();
+  });
+});

adminfront/src/components/common/LocaleRefreshBoundary.tsx

@@ -0,0 +1,27 @@
+import { Fragment, type ReactNode, useEffect, useState } from "react";
+
+type LocaleRefreshBoundaryProps = {
+  children: ReactNode;
+};
+
+function LocaleRefreshBoundary({ children }: LocaleRefreshBoundaryProps) {
+  const [localeVersion, setLocaleVersion] = useState(0);
+
+  useEffect(() => {
+    const syncLocale = () => {
+      setLocaleVersion((current) => current + 1);
+    };
+
+    window.addEventListener("localechange", syncLocale);
+    window.addEventListener("storage", syncLocale);
+
+    return () => {
+      window.removeEventListener("localechange", syncLocale);
+      window.removeEventListener("storage", syncLocale);
+    };
+  }, []);
+
+  return <Fragment key={localeVersion}>{children}</Fragment>;
+}
+
+export default LocaleRefreshBoundary;

adminfront/src/components/layout/AppLayout.tsx

@@ -493,8 +493,8 @@ function AppLayout() {
       auth.user?.profile.name?.toString() ||
       auth.user?.profile.preferred_username?.toString(),
     profileEmail: profile?.email || auth.user?.profile.email?.toString(),
-    fallbackName: t("ui.dev.profile.unknown_name", "Unknown User"),
-    fallbackEmail: t("ui.dev.profile.unknown_email", "unknown@example.com"),
+    fallbackName: t("ui.shell.profile.unknown_name", "Unknown User"),
+    fallbackEmail: t("ui.shell.profile.unknown_email", "unknown@example.com"),
   });
   const profileRoleKey = mockRoleOverride || profile?.role || "user";
   const handleSessionExpiryToggle = () => {
@@ -560,7 +560,7 @@ function AppLayout() {
         className={shellLayoutClasses.logoutButton}
       >
         <LogOut size={18} />
-        <span>{t("ui.admin.nav.logout", "Logout")}</span>
+        <span>{t("ui.shell.nav.logout", "Logout")}</span>
       </button>
     </div>
   );
@@ -621,7 +621,7 @@ function AppLayout() {
                   className="inline-flex items-center gap-3 rounded-full border border-border bg-card px-3 py-2 transition hover:bg-muted/20"
                   aria-haspopup="menu"
                   aria-expanded={isProfileOpen}
-                  aria-label={t("ui.dev.profile.menu_aria", "계정 메뉴 열기")}
+                  aria-label={t("ui.shell.profile.menu_aria", "계정 메뉴 열기")}
                 >
                   <div className={shellLayoutClasses.profileInitial}>
                     {profileSummary.initial}
@@ -643,7 +643,7 @@ function AppLayout() {
                 {isProfileOpen ? (
                   <div role="menu" className={shellLayoutClasses.profileMenu}>
                     <p className="text-xs uppercase tracking-[0.16em] text-muted-foreground">
-                      {t("ui.dev.profile.menu_title", "Account")}
+                      {t("ui.shell.profile.menu_title", "Account")}
                     </p>
                     <div className={shellLayoutClasses.profileCard}>
                       <div>
@@ -657,7 +657,7 @@ function AppLayout() {
                       <div className="flex items-center pt-1">
                         <span className="inline-flex items-center rounded-full bg-sky-500/10 px-2.5 py-1 text-[10px] font-semibold text-sky-700 dark:text-sky-300">
                           {t(
-                            `ui.admin.role.${profileRoleKey}`,
+                            `ui.shell.role.${profileRoleKey}`,
                             profileRoleKey.toUpperCase(),
                           )}
                         </span>
@@ -668,7 +668,7 @@ function AppLayout() {
                       <div className="flex items-center justify-between gap-3">
                         <div>
                           <p className="text-sm font-medium text-foreground">
-                            {t("ui.dev.session.auto_extend", "세션 만료 관리")}
+                            {t("ui.shell.session.auto_extend", "세션 만료 관리")}
                           </p>
                           <p className="text-xs text-muted-foreground">
                             {isSessionExpiryEnabled ? (
@@ -677,7 +677,7 @@ function AppLayout() {
                                 t={t}
                               />
                             ) : (
-                              t("ui.dev.session.disabled", "세션 만료 비활성화")
+                              t("ui.shell.session.disabled", "세션 만료 비활성화")
                             )}
                           </p>
                         </div>
@@ -755,7 +755,7 @@ function AppLayout() {
                       className="mt-2 flex w-full items-center gap-2 rounded-lg border border-border px-3 py-2 text-left text-sm text-foreground transition hover:bg-muted/20"
                     >
                       <UserIcon size={16} className="text-muted-foreground" />
-                      <span>{t("ui.userfront.nav.profile", "내 정보")}</span>
+                      <span>{t("ui.shell.nav.profile", "내 정보")}</span>
                     </button>
                     <button
                       type="button"
@@ -766,7 +766,7 @@ function AppLayout() {
                       className="mt-2 flex w-full items-center gap-2 rounded-lg border border-border px-3 py-2 text-left text-sm text-muted-foreground transition hover:bg-destructive/10 hover:text-destructive"
                     >
                       <LogOut size={16} />
-                      <span>{t("ui.admin.nav.logout", "Logout")}</span>
+                      <span>{t("ui.shell.nav.logout", "Logout")}</span>
                     </button>
                   </div>
                 ) : null}

adminfront/src/features/api-keys/ApiKeyListPage.test.tsx

@@ -10,6 +10,10 @@ import {
 } from "../../lib/adminApi";
 import ApiKeyListPage from "./ApiKeyListPage";
 
+vi.mock("../../lib/i18n", () => ({
+  t: (_key: string, fallback?: string) => fallback ?? "",
+}));
+
 vi.mock("../../lib/adminApi", () => ({
   fetchApiKeys: vi.fn(async () => ({
     items: [
@@ -102,4 +106,20 @@ describe("ApiKeyListPage", () => {
     ).toBeInTheDocument();
     expect(fetchApiKeys).toHaveBeenCalled();
   });
+
+  it("refresh button refetches the list without navigation", async () => {
+    const user = userEvent.setup();
+    renderPage();
+
+    await screen.findByText("client-id-stable");
+
+    const refreshButton = screen.getByRole("button", { name: /새로고침/ });
+    expect(refreshButton).toHaveAttribute("type", "button");
+
+    await user.click(refreshButton);
+
+    await waitFor(() => {
+      expect(fetchApiKeys).toHaveBeenCalledTimes(2);
+    });
+  });
 });

adminfront/src/features/api-keys/ApiKeyListPage.tsx

@@ -164,6 +164,7 @@ function ApiKeyListPage() {
       <PageHeader
         sticky
         titleAs="h2"
+        icon={<Key size={20} />}
         title={t("ui.admin.api_keys.list.title", "API 키 관리 (M2M)")}
         description={t(
           "msg.admin.api_keys.list.subtitle",
@@ -172,6 +173,7 @@ function ApiKeyListPage() {
         actions={
           <>
             <Button
+              type="button"
               variant="outline"
               onClick={() => query.refetch()}
               disabled={query.isFetching}
@@ -192,7 +194,7 @@ function ApiKeyListPage() {
       <Card className="bg-[var(--color-panel)] flex-1 flex flex-col min-h-0 overflow-hidden">
         <CardHeader className="flex flex-row items-center justify-between flex-shrink-0">
           <div>
-            <CardTitle>
+            <CardTitle className="text-lg font-bold flex items-center gap-2">
               {t("ui.admin.apikeys.registry.title", "API Key Registry")}
             </CardTitle>
             <CardDescription>

adminfront/src/features/audit/AuditLogsPage.tsx

@@ -1,6 +1,6 @@
 import { useInfiniteQuery } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
-import { Download, RefreshCw, Search } from "lucide-react";
+import { Download, NotebookTabs, RefreshCw, Search } from "lucide-react";
 import * as React from "react";
 import {
   formatAuditValue,
@@ -16,6 +16,7 @@ import { Button } from "../../components/ui/button";
 import {
   Card,
   CardContent,
+  CardDescription,
   CardHeader,
   CardTitle,
 } from "../../components/ui/card";
@@ -99,6 +100,7 @@ function AuditLogsPage() {
           "msg.admin.audit.subtitle",
           "관리자 작업 이력을 조회합니다.",
         )}
+        icon={<NotebookTabs size={20} />}
         actions={
           <>
             <Badge variant="muted">
@@ -125,9 +127,15 @@ function AuditLogsPage() {
       <Card className="glass-panel">
         <CardHeader className="flex flex-row items-center justify-between">
           <div>
-            <CardTitle>
+            <CardTitle className="text-lg font-bold flex items-center gap-2">
               {t("ui.common.audit.registry.title", "Audit registry")}
             </CardTitle>
+            <CardDescription>
+              {t(
+                "msg.admin.audit.registry.description",
+                "최근 감사 로그를 검색 조건에 맞춰 필터링하고, 작업 이력을 빠르게 확인합니다.",
+              )}
+            </CardDescription>
           </div>
         </CardHeader>
         <CardContent className="space-y-4 pt-0">

adminfront/src/features/auth/AuthPage.test.tsx

@@ -0,0 +1,36 @@
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { render, screen } from "@testing-library/react";
+import { beforeEach, describe, expect, it } from "vitest";
+import { createI18nMock } from "../../test/i18nMock";
+import AuthPage from "./AuthPage";
+
+vi.mock("../../lib/i18n", () => createI18nMock());
+
+function renderPage() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  });
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AuthPage />
+    </QueryClientProvider>,
+  );
+}
+
+describe("AuthPage", () => {
+  beforeEach(() => {
+    window.localStorage.setItem("locale", "en");
+  });
+
+  it("renders localized auth guard labels in English", () => {
+    renderPage();
+
+    expect(screen.getByText("Auth Guard")).toBeInTheDocument();
+    expect(screen.getByText("ReBAC permission checker")).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "Check permission" })).toBeInTheDocument();
+  });
+});

adminfront/src/features/auth/AuthPage.tsx

@@ -1,23 +1,20 @@
-import { KeyRound } from "lucide-react";
+import { ShieldHalf } from "lucide-react";
+import { PageHeader } from "../../../../common/core/components/page";
+import { t } from "../../lib/i18n";
 import PermissionChecker from "./components/PermissionChecker";
 
 function AuthPage() {
   return (
     <div className="space-y-6">
-      <div className="flex flex-wrap items-end justify-between gap-4">
-        <div className="space-y-1">
-          <p className="text-xs font-semibold uppercase tracking-[0.18em] text-muted-foreground">
-            Admin auth
-          </p>
-          <h2 className="flex items-center gap-2 text-2xl font-semibold tracking-tight">
-            <KeyRound size={22} className="text-primary" />
-            인증가드
-          </h2>
-          <p className="text-sm text-muted-foreground">
-            관리자 권한과 ReBAC 관계를 실제 정책 엔진 기준으로 확인합니다.
-          </p>
-        </div>
-      </div>
+      <PageHeader
+        titleAs="h2"
+        icon={<ShieldHalf size={20} />}
+        title={t("ui.admin.auth_guard.title", "Auth Guard")}
+        description={t(
+          "ui.admin.auth_guard.subtitle",
+          "Verify admin privileges and ReBAC relationships against the policy engine.",
+        )}
+      />
 
       <PermissionChecker />
     </div>

adminfront/src/features/auth/components/PermissionChecker.tsx

@@ -1,5 +1,5 @@
 import { useMutation } from "@tanstack/react-query";
-import { CheckCircle2, ShieldAlert, XCircle } from "lucide-react";
+import { CheckCircle2, XCircle } from "lucide-react";
 import { useState } from "react";
 import { Button } from "../../../components/ui/button";
 import {
@@ -12,6 +12,7 @@ import {
 import { Input } from "../../../components/ui/input";
 import { Label } from "../../../components/ui/label";
 import apiClient from "../../../lib/apiClient";
+import { t } from "../../../lib/i18n";
 
 type CheckPermissionResponse = {
   allowed: boolean;
@@ -46,50 +47,84 @@ function PermissionChecker() {
   return (
     <Card className="border-primary/20 bg-[var(--color-panel)]">
       <CardHeader>
-        <CardTitle className="flex items-center gap-2">
-          <ShieldAlert size={20} className="text-primary" />
-          ReBAC 권한 검증 도구
+        <CardTitle className="text-lg font-bold">
+          {t(
+            "ui.admin.auth_guard.checker.title",
+            "ReBAC permission checker",
+          )}
         </CardTitle>
         <CardDescription>
-          특정 주체(Subject)가 특정 리소스(Object)에 대해 권한이 있는지 Ory
-          Keto를 통해 실시간으로 확인합니다.
+          {t(
+            "ui.admin.auth_guard.checker.description",
+            "Check in real time whether a subject has access to a resource through Ory Keto.",
+          )}
         </CardDescription>
       </CardHeader>
       <CardContent className="space-y-6">
         <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-4">
           <div className="space-y-2">
-            <Label>Namespace</Label>
+            <Label>
+              {t("ui.admin.auth_guard.checker.namespace.label", "Namespace")}
+            </Label>
             <select
               value={namespace}
               onChange={(e) => setNamespace(e.target.value)}
               className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
             >
-              <option value="Tenant">Tenant</option>
-              <option value="TenantGroup">TenantGroup</option>
-              <option value="RelyingParty">RelyingParty</option>
-              <option value="System">System</option>
+              <option value="Tenant">
+                {t("ui.admin.auth_guard.checker.namespace.tenant", "Tenant")}
+              </option>
+              <option value="TenantGroup">
+                {t(
+                  "ui.admin.auth_guard.checker.namespace.tenant_group",
+                  "TenantGroup",
+                )}
+              </option>
+              <option value="RelyingParty">
+                {t(
+                  "ui.admin.auth_guard.checker.namespace.relying_party",
+                  "RelyingParty",
+                )}
+              </option>
+              <option value="System">
+                {t("ui.admin.auth_guard.checker.namespace.system", "System")}
+              </option>
             </select>
           </div>
           <div className="space-y-2">
-            <Label>Relation</Label>
+            <Label>{t("ui.admin.auth_guard.checker.relation", "Relation")}</Label>
             <Input
-              placeholder="view, manage, admins..."
+              placeholder={t(
+                "ui.admin.auth_guard.checker.relation_placeholder",
+                "view, manage, admins...",
+              )}
               value={relation}
               onChange={(e) => setRelation(e.target.value)}
             />
           </div>
           <div className="space-y-2">
-            <Label>Object ID</Label>
+            <Label>{t("ui.admin.auth_guard.checker.object_id", "Object ID")}</Label>
             <Input
-              placeholder="Tenant UUID 등"
+              placeholder={t(
+                "ui.admin.auth_guard.checker.object_id_placeholder",
+                "Tenant UUID, etc.",
+              )}
               value={object}
               onChange={(e) => setObject(e.target.value)}
             />
           </div>
           <div className="space-y-2">
-            <Label>Subject (User:ID)</Label>
+            <Label>
+              {t(
+                "ui.admin.auth_guard.checker.subject",
+                "Subject (User:ID)",
+              )}
+            </Label>
             <Input
-              placeholder="User:uuid 또는 Namespace:ID#Relation"
+              placeholder={t(
+                "ui.admin.auth_guard.checker.subject_placeholder",
+                "User:uuid or Namespace:ID#Relation",
+              )}
               value={subject}
               onChange={(e) => setSubject(e.target.value)}
             />
@@ -102,7 +137,9 @@ function PermissionChecker() {
             disabled={!object || !subject || checkMutation.isPending}
             className="w-full px-12 md:w-auto"
           >
-            {checkMutation.isPending ? "검증 중..." : "권한 확인 실행"}
+            {checkMutation.isPending
+              ? t("ui.admin.auth_guard.checker.checking", "Checking...")
+              : t("ui.admin.auth_guard.checker.check", "Check permission")}
           </Button>
         </div>
 
@@ -117,18 +154,33 @@ function PermissionChecker() {
             {result.allowed ? (
               <>
                 <CheckCircle2 size={48} />
-                <div className="text-xl font-bold">Access ALLOWED</div>
+                <div className="text-lg font-bold">
+                  {t(
+                    "ui.admin.auth_guard.checker.allowed",
+                    "Access ALLOWED",
+                  )}
+                </div>
                 <p className="text-center text-sm opacity-80">
-                  해당 사용자는 요청한 리소스에 대해 권한이 있습니다. (상속
-                  포함)
+                  {t(
+                    "ui.admin.auth_guard.checker.allowed_description",
+                    "The subject has access to the requested resource, including inherited permissions.",
+                  )}
                 </p>
               </>
             ) : (
               <>
                 <XCircle size={48} />
-                <div className="text-xl font-bold">Access DENIED</div>
+                <div className="text-lg font-bold">
+                  {t(
+                    "ui.admin.auth_guard.checker.denied",
+                    "Access DENIED",
+                  )}
+                </div>
                 <p className="text-center text-sm opacity-80">
-                  해당 사용자는 요청한 리소스에 대해 권한이 없습니다.
+                  {t(
+                    "ui.admin.auth_guard.checker.denied_description",
+                    "The subject does not have access to the requested resource.",
+                  )}
                 </p>
               </>
             )}

adminfront/src/features/integrity/DataIntegrityPage.test.tsx

@@ -7,8 +7,11 @@ import {
   fetchMe,
   fetchOrphanUserLoginIDs,
 } from "../../lib/adminApi";
+import { createI18nMock } from "../../test/i18nMock";
 import DataIntegrityPage from "./DataIntegrityPage";
 
+vi.mock("../../lib/i18n", () => createI18nMock());
+
 let currentRole = "super_admin";
 
 const integrityReport = {
@@ -92,12 +95,18 @@ describe("DataIntegrityPage", () => {
   beforeEach(() => {
     currentRole = "super_admin";
     vi.clearAllMocks();
+    window.localStorage.setItem("locale", "ko");
   });
 
   it("renders integrity report for super_admin", async () => {
     renderPage();
 
     expect(await screen.findByText("데이터 정합성 검증")).toBeInTheDocument();
+    expect(
+      await screen.findByText(
+        "정합성 상태를 확인하고 데이터 모델 전반의 검증 결과를 살펴봅니다.",
+      ),
+    ).toBeInTheDocument();
     expect(await screen.findByText("테넌트 정합성")).toBeInTheDocument();
     expect(screen.getByText("중복 테넌트 slug")).toBeInTheDocument();
     expect(screen.getAllByText("1").length).toBeGreaterThan(0);
@@ -161,4 +170,25 @@ describe("DataIntegrityPage", () => {
     expect(fetchMe).toHaveBeenCalled();
     expect(fetchDataIntegrityReport).not.toHaveBeenCalled();
   });
+
+  it("renders localized integrity labels in English", async () => {
+    window.localStorage.setItem("locale", "en");
+    renderPage();
+
+    expect(
+      await screen.findByText("Data Integrity Check"),
+    ).toBeInTheDocument();
+    expect(
+      await screen.findByText(
+        "Review integrity status and inspect checks across the admin data model.",
+      ),
+    ).toBeInTheDocument();
+    expect(await screen.findByText("Tenant integrity")).toBeInTheDocument();
+    expect(await screen.findByText("Duplicate tenant slug")).toBeInTheDocument();
+    expect(
+      await screen.findByText(
+        "Checks duplicate active tenant slugs using LOWER(TRIM(slug)).",
+      ),
+    ).toBeInTheDocument();
+  });
 });

adminfront/src/features/integrity/DataIntegrityPage.tsx

@@ -18,6 +18,7 @@ import {
   fetchOrphanUserLoginIDs,
 } from "../../lib/adminApi";
 import { t } from "../../lib/i18n";
+import { getAdminDateLocale } from "../../lib/locale";
 
 function statusLabel(status: DataIntegrityStatus) {
   switch (status) {
@@ -47,7 +48,7 @@ function formatDateTime(value?: string) {
   if (!value) return "-";
   const date = new Date(value);
   if (Number.isNaN(date.getTime())) return value;
-  return new Intl.DateTimeFormat("ko-KR", {
+  return new Intl.DateTimeFormat(getAdminDateLocale(), {
     dateStyle: "medium",
     timeStyle: "medium",
   }).format(date);
@@ -78,6 +79,98 @@ function reasonLabel(reason: string) {
   }
 }
 
+function integritySectionLabel(key: string, fallback: string) {
+  switch (key) {
+    case "tenant_integrity":
+      return t("ui.admin.integrity.section.tenant_integrity", fallback);
+    case "user_integrity":
+      return t("ui.admin.integrity.section.user_integrity", fallback);
+    default:
+      return fallback;
+  }
+}
+
+function integritySectionDescription(key: string) {
+  switch (key) {
+    case "tenant_integrity":
+      return t(
+        "msg.admin.integrity.section.tenant_integrity.description",
+        "테넌트 slug 중복과 부모 관계 이상을 확인합니다.",
+      );
+    case "user_integrity":
+      return t(
+        "msg.admin.integrity.section.user_integrity.description",
+        "사용자와 로그인 ID 참조의 고아 레코드를 확인합니다.",
+      );
+    default:
+      return "";
+  }
+}
+
+function integrityCheckLabel(key: string, fallback: string) {
+  switch (key) {
+    case "duplicate_tenant_slugs":
+      return t(
+        "ui.admin.integrity.check.duplicate_tenant_slugs.title",
+        fallback,
+      );
+    case "orphan_tenant_parents":
+      return t(
+        "ui.admin.integrity.check.orphan_tenant_parents.title",
+        fallback,
+      );
+    case "orphan_user_tenant_memberships":
+      return t(
+        "ui.admin.integrity.check.orphan_user_tenant_memberships.title",
+        fallback,
+      );
+    case "orphan_user_login_id_tenants":
+      return t(
+        "ui.admin.integrity.check.orphan_user_login_id_tenants.title",
+        fallback,
+      );
+    case "orphan_user_login_id_users":
+      return t(
+        "ui.admin.integrity.check.orphan_user_login_id_users.title",
+        fallback,
+      );
+    default:
+      return fallback;
+  }
+}
+
+function integrityCheckDescription(key: string, fallback: string) {
+  switch (key) {
+    case "duplicate_tenant_slugs":
+      return t(
+        "msg.admin.integrity.check.duplicate_tenant_slugs.description",
+        fallback,
+      );
+    case "orphan_tenant_parents":
+      return t(
+        "msg.admin.integrity.check.orphan_tenant_parents.description",
+        fallback,
+      );
+    case "orphan_user_tenant_memberships":
+      return t(
+        "msg.admin.integrity.check.orphan_user_tenant_memberships.description",
+        fallback,
+      );
+    case "orphan_user_login_id_tenants":
+      return t(
+        "msg.admin.integrity.check.orphan_user_login_id_tenants.description",
+        fallback,
+      );
+    case "orphan_user_login_id_users":
+      return t(
+        "msg.admin.integrity.check.orphan_user_login_id_users.description",
+        fallback,
+      );
+    default:
+      return fallback;
+  }
+}
+
 function recheckStatusText(status: "idle" | "running" | "success" | "error") {
   switch (status) {
     case "running":
@@ -249,15 +342,23 @@ function DataIntegrityContent() {
   const recheckMessage = recheckStatusText(recheckStatus);
 
   return (
-    <main className="space-y-6 p-6 md:p-8">
-      <div className="flex flex-wrap items-center justify-between gap-3">
-        <div>
-          <p className="text-sm text-muted-foreground">
-            {t("ui.admin.integrity.kicker", "System")}
-          </p>
-          <h2 className="text-2xl font-semibold tracking-tight">
-            {t("ui.admin.integrity.title", "데이터 정합성 검증")}
-          </h2>
+    <main className="space-y-6">
+      <header className="flex flex-shrink-0 flex-wrap items-start justify-between gap-4 sticky top-[-2.5rem] z-20 -mt-4 bg-background/95 pb-2 pt-4 backdrop-blur">
+        <div className="flex min-w-0 items-start gap-3">
+          <div className="mt-1 flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-primary/15 bg-primary/10 text-primary">
+            <Database size={20} />
+          </div>
+          <div className="space-y-2">
+            <h2 className="text-3xl font-semibold">
+              {t("ui.admin.integrity.title", "데이터 정합성 검증")}
+            </h2>
+            <p className="text-sm text-muted-foreground">
+              {t(
+                "msg.admin.integrity.subtitle",
+                "Review integrity status and inspect checks across the admin data model.",
+              )}
+            </p>
+          </div>
         </div>
         <div className="flex flex-col items-end gap-1">
           <Button
@@ -280,26 +381,23 @@ function DataIntegrityContent() {
             </output>
           ) : null}
         </div>
-      </div>
+      </header>
 
-      {isError ? (
-        <section className="rounded-lg border border-destructive/30 bg-destructive/10 p-4 text-sm text-destructive">
-          {(error as Error)?.message ||
-            t(
-              "msg.admin.integrity.report.load_error",
-              "정합성 리포트를 불러오지 못했습니다.",
-            )}
-        </section>
-      ) : null}
+      <div className="space-y-4 pb-6">
+        {isError ? (
+          <section className="rounded-lg border border-destructive/30 bg-destructive/10 p-4 text-sm text-destructive">
+            {(error as Error)?.message ||
+              t(
+                "msg.admin.integrity.report.load_error",
+                "정합성 리포트를 불러오지 못했습니다.",
+              )}
+          </section>
+        ) : null}
 
-      <section className="rounded-lg border border-border bg-card p-5">
-        <div className="flex flex-wrap items-center justify-between gap-3 border-b border-border pb-4">
-          <div className="flex items-center gap-3">
-            <div className="grid h-10 w-10 place-items-center rounded-lg bg-primary/10 text-primary">
-              <ShieldAlert size={18} />
-            </div>
+        <section className="rounded-lg border border-border bg-card p-5">
+          <div className="flex flex-wrap items-center justify-between gap-3 border-b border-border pb-4">
             <div>
-              <h3 className="text-base font-semibold">
+              <h3 className="text-lg font-bold flex items-center gap-2">
                 {t(
                   "ui.admin.integrity.read_model.title",
                   "Read model integrity",
@@ -312,148 +410,160 @@ function DataIntegrityContent() {
                 )}
               </p>
             </div>
-          </div>
-          {data ? (
-            <Badge variant={statusBadgeVariant(data.status)}>
-              {statusLabel(data.status)}
-            </Badge>
-          ) : null}
-        </div>
-
-        {isLoading ? (
-          <div className="py-8 text-sm text-muted-foreground">
-            {t("ui.admin.integrity.loading", "불러오는 중")}
-          </div>
-        ) : (
-          <dl className="grid gap-4 py-5 sm:grid-cols-2 lg:grid-cols-4">
-            <div>
-              <dt className="text-sm text-muted-foreground">
-                {t("ui.admin.integrity.summary.total_checks", "검사 항목")}
-              </dt>
-              <dd className="mt-1 text-xl font-semibold tabular-nums">
-                {data?.summary.totalChecks ?? 0}
-              </dd>
-            </div>
-            <div>
-              <dt className="text-sm text-muted-foreground">
-                {t("ui.admin.integrity.summary.passed", "정상")}
-              </dt>
-              <dd className="mt-1 text-xl font-semibold tabular-nums">
-                {data?.summary.passed ?? 0}
-              </dd>
-            </div>
-            <div>
-              <dt className="text-sm text-muted-foreground">
-                {t("ui.admin.integrity.summary.failures", "실패 건수")}
-              </dt>
-              <dd className="mt-1 text-xl font-semibold tabular-nums">
-                {data?.summary.failures ?? 0}
-              </dd>
-            </div>
-            <div>
-              <dt className="text-sm text-muted-foreground">
-                {t("ui.admin.integrity.summary.checked_at", "검사 시각")}
-              </dt>
-              <dd className="mt-1 text-sm">
-                {formatDateTime(data?.checkedAt)}
-              </dd>
-            </div>
-          </dl>
-        )}
-      </section>
-
-      <div className="space-y-4">
-        {(data?.sections ?? []).map((section) => (
-          <section
-            key={section.key}
-            className="rounded-lg border border-border bg-card p-5"
-          >
-            <div className="mb-4 flex items-center justify-between gap-3">
-              <h3 className="text-base font-semibold">{section.label}</h3>
-              <Badge variant={statusBadgeVariant(section.status)}>
-                {statusLabel(section.status)}
+            {data ? (
+              <Badge variant={statusBadgeVariant(data.status)}>
+                {statusLabel(data.status)}
               </Badge>
+            ) : null}
+          </div>
+
+          {isLoading ? (
+            <div className="py-8 text-sm text-muted-foreground">
+              {t("ui.admin.integrity.loading", "불러오는 중")}
             </div>
-            <div className="divide-y divide-border">
-              {section.checks.map((check) => (
-                <div
-                  key={check.key}
-                  className="grid gap-3 py-4 md:grid-cols-[1fr_auto]"
-                >
-                  <div className="flex gap-3">
-                    <CheckIcon check={check} />
-                    <div>
-                      <div className="font-medium">{check.label}</div>
-                      <p className="mt-1 text-sm text-muted-foreground">
-                        {check.description}
-                      </p>
+          ) : (
+            <dl className="grid gap-4 py-5 sm:grid-cols-2 lg:grid-cols-4">
+              <div>
+                <dt className="text-sm text-muted-foreground">
+                  {t("ui.admin.integrity.summary.total_checks", "검사 항목")}
+                </dt>
+                <dd className="mt-1 text-xl font-semibold tabular-nums">
+                  {data?.summary.totalChecks ?? 0}
+                </dd>
+              </div>
+              <div>
+                <dt className="text-sm text-muted-foreground">
+                  {t("ui.admin.integrity.summary.passed", "정상")}
+                </dt>
+                <dd className="mt-1 text-xl font-semibold tabular-nums">
+                  {data?.summary.passed ?? 0}
+                </dd>
+              </div>
+              <div>
+                <dt className="text-sm text-muted-foreground">
+                  {t("ui.admin.integrity.summary.failures", "실패 건수")}
+                </dt>
+                <dd className="mt-1 text-xl font-semibold tabular-nums">
+                  {data?.summary.failures ?? 0}
+                </dd>
+              </div>
+              <div>
+                <dt className="text-sm text-muted-foreground">
+                  {t("ui.admin.integrity.summary.checked_at", "검사 시각")}
+                </dt>
+                <dd className="mt-1 text-sm">
+                  {formatDateTime(data?.checkedAt)}
+                </dd>
+              </div>
+            </dl>
+          )}
+        </section>
+
+        <div className="space-y-4">
+          {(data?.sections ?? []).map((section) => (
+            <section
+              key={section.key}
+              className="rounded-lg border border-border bg-card p-5"
+            >
+              <div className="mb-4 flex items-center justify-between gap-3">
+                <div className="space-y-1">
+                  <h3 className="text-lg font-bold flex items-center gap-2">
+                    {integritySectionLabel(section.key, section.label)}
+                  </h3>
+                  <p className="text-sm text-muted-foreground">
+                    {integritySectionDescription(section.key)}
+                  </p>
+                </div>
+                <Badge variant={statusBadgeVariant(section.status)}>
+                  {statusLabel(section.status)}
+                </Badge>
+              </div>
+              <div className="divide-y divide-border">
+                {section.checks.map((check) => (
+                  <div
+                    key={check.key}
+                    className="grid gap-3 py-4 md:grid-cols-[1fr_auto]"
+                  >
+                    <div className="flex gap-3">
+                      <CheckIcon check={check} />
+                      <div>
+                        <div className="font-medium">
+                          {integrityCheckLabel(check.key, check.label)}
+                        </div>
+                        <p className="mt-1 text-sm text-muted-foreground">
+                          {integrityCheckDescription(
+                            check.key,
+                            check.description,
+                          )}
+                        </p>
+                      </div>
+                    </div>
+                    <div className="flex items-center gap-3 md:justify-end">
+                      <Badge variant={statusBadgeVariant(check.status)}>
+                        {statusLabel(check.status)}
+                      </Badge>
+                      <span className="min-w-12 text-right text-lg font-semibold tabular-nums">
+                        {check.count}
+                      </span>
                     </div>
                   </div>
-                  <div className="flex items-center gap-3 md:justify-end">
-                    <Badge variant={statusBadgeVariant(check.status)}>
-                      {statusLabel(check.status)}
-                    </Badge>
-                    <span className="min-w-12 text-right text-lg font-semibold tabular-nums">
-                      {check.count}
-                    </span>
-                  </div>
-                </div>
-              ))}
-            </div>
-          </section>
-        ))}
-      </div>
-
-      <section className="rounded-lg border border-border bg-card p-5">
-        <div className="mb-4 flex flex-wrap items-center justify-between gap-3">
-          <div>
-            <h3 className="text-base font-semibold">
-              {t(
-                "ui.admin.integrity.orphan_login_ids.title",
-                "유령 로그인 ID 정리",
-              )}
-            </h3>
-            <p className="mt-1 text-sm text-muted-foreground">
-              {t(
-                "msg.admin.integrity.orphan_login_ids.description",
-                "삭제되었거나 존재하지 않는 사용자/테넌트를 참조하는 로그인 ID를 확인한 뒤 선택 삭제합니다.",
-              )}
-            </p>
-          </div>
-          <Button
-            type="button"
-            variant="destructive"
-            onClick={handleDeleteSelected}
-            disabled={
-              selectedOrphanIds.length === 0 || deleteMutation.isPending
-            }
-          >
-            {t("ui.admin.integrity.orphan_login_ids.delete", "선택 삭제")}
-          </Button>
+                ))}
+              </div>
+            </section>
+          ))}
         </div>
-        {orphanLoginIDsQuery.isError ? (
-          <div className="mb-3 rounded border border-destructive/30 bg-destructive/10 p-3 text-sm text-destructive">
-            {t(
-              "msg.admin.integrity.orphan_login_ids.load_error",
-              "유령 로그인 ID 대상을 불러오지 못했습니다.",
-            )}
+
+        <section className="rounded-lg border border-border bg-card p-5">
+          <div className="mb-4 flex flex-wrap items-center justify-between gap-3">
+            <div>
+              <h3 className="text-lg font-bold flex items-center gap-2">
+                {t(
+                  "ui.admin.integrity.orphan_login_ids.title",
+                  "유령 로그인 ID 정리",
+                )}
+              </h3>
+              <p className="mt-1 text-sm text-muted-foreground">
+                {t(
+                  "msg.admin.integrity.orphan_login_ids.description",
+                  "삭제되었거나 존재하지 않는 사용자/테넌트를 참조하는 로그인 ID를 확인한 뒤 선택 삭제합니다.",
+                )}
+              </p>
+            </div>
+            <Button
+              type="button"
+              variant="destructive"
+              onClick={handleDeleteSelected}
+              disabled={
+                selectedOrphanIds.length === 0 || deleteMutation.isPending
+              }
+            >
+              {t("ui.admin.integrity.orphan_login_ids.delete", "선택 삭제")}
+            </Button>
           </div>
-        ) : null}
-        {deleteMutation.data ? (
-          <div className="mb-3 rounded border border-emerald-200 bg-emerald-50 p-3 text-sm text-emerald-800 dark:border-emerald-900 dark:bg-emerald-950/40 dark:text-emerald-200">
-            {t(
-              "msg.admin.integrity.orphan_login_ids.delete_success",
-              "{{count}}개의 유령 로그인 ID를 삭제했습니다.",
-              { count: deleteMutation.data.deletedCount },
-            )}
-          </div>
-        ) : null}
-        <OrphanLoginIDTable
-          items={orphanItems}
-          selectedIds={selectedOrphanIds}
-          onToggle={toggleOrphanID}
-        />
-      </section>
+          {orphanLoginIDsQuery.isError ? (
+            <div className="mb-3 rounded border border-destructive/30 bg-destructive/10 p-3 text-sm text-destructive">
+              {t(
+                "msg.admin.integrity.orphan_login_ids.load_error",
+                "유령 로그인 ID 대상을 불러오지 못했습니다.",
+              )}
+            </div>
+          ) : null}
+          {deleteMutation.data ? (
+            <div className="mb-3 rounded border border-emerald-200 bg-emerald-50 p-3 text-sm text-emerald-800 dark:border-emerald-900 dark:bg-emerald-950/40 dark:text-emerald-200">
+              {t(
+                "msg.admin.integrity.orphan_login_ids.delete_success",
+                "{{count}}개의 유령 로그인 ID를 삭제했습니다.",
+                { count: deleteMutation.data.deletedCount },
+              )}
+            </div>
+          ) : null}
+          <OrphanLoginIDTable
+            items={orphanItems}
+            selectedIds={selectedOrphanIds}
+            onToggle={toggleOrphanID}
+          />
+        </section>
+      </div>
     </main>
   );
 }

adminfront/src/features/overview/GlobalOverviewPage.test.tsx

@@ -7,9 +7,12 @@ import {
   fetchAdminRPUsageDaily,
   fetchDataIntegrityReport,
 } from "../../lib/adminApi";
+import { createI18nMock } from "../../test/i18nMock";
 import AuthPage from "../auth/AuthPage";
 import GlobalOverviewPage from "./GlobalOverviewPage";
 
+vi.mock("../../lib/i18n", () => createI18nMock());
+
 let currentRole = "super_admin";
 
 vi.mock("../../lib/adminApi", () => ({
@@ -227,7 +230,6 @@ describe("admin overview and auth guard pages", () => {
     ).not.toBeInTheDocument();
     expect(screen.queryByText("개발팀 (dev-team)")).not.toBeInTheDocument();
     expect(screen.queryByText("개인 (personal)")).not.toBeInTheDocument();
-    expect(await screen.findAllByText("05월")).not.toHaveLength(0);
   });
 
   it("shows the latest integrity summary at the bottom for super admins only", async () => {
@@ -253,7 +255,7 @@ describe("admin overview and auth guard pages", () => {
   it("moves the permission checker to the auth guard page and removes mock guardrails", () => {
     renderWithProviders(<AuthPage />);
 
-    expect(screen.getByText("인증가드")).toBeInTheDocument();
+    expect(screen.getByText("인증 가드")).toBeInTheDocument();
     expect(screen.getByText("ReBAC 권한 검증 도구")).toBeInTheDocument();
     expect(screen.queryByText("Admin auth guardrails")).not.toBeInTheDocument();
     expect(

adminfront/src/features/overview/GlobalOverviewPage.tsx

@@ -2,9 +2,9 @@ import { useQuery } from "@tanstack/react-query";
 import {
   Activity,
   AlertTriangle,
-  BarChart3,
   CheckCircle2,
   Database,
+  LayoutDashboard,
   ShieldCheck,
   Users,
 } from "lucide-react";
@@ -195,15 +195,18 @@ function IntegrityOverviewSummary() {
 
   return (
     <section className="border-t border-border/60 pt-4">
-      <div className="flex flex-wrap items-center justify-between gap-3">
+      <div className="flex flex-wrap items-start justify-between gap-3">
         <div className="flex items-center gap-2">
           {data.status === "pass" ? (
             <CheckCircle2 size={18} className="text-emerald-600" />
           ) : (
             <AlertTriangle size={18} className="text-amber-600" />
           )}
-          <h3 className="text-base font-semibold">
-            {t("ui.admin.integrity.summary.title", "정합성 최종 검증")}
+          <h3 className="text-lg font-bold flex items-center gap-2">
+            {t(
+              "ui.admin.integrity.summary.title",
+              "정합성 최종 검증",
+            )}
           </h3>
         </div>
         <div className="flex flex-wrap items-center gap-3 text-sm">
@@ -288,23 +291,17 @@ function RPUsageMixedChart({
 
   return (
     <section className="space-y-3">
-      <div className="flex flex-wrap items-center justify-between gap-3">
-        <div className="flex items-center gap-2">
-          <BarChart3 size={18} className="text-primary" />
-          <div className="space-y-1">
-            <h3 className="text-base font-semibold">
-              {t(
-                "ui.admin.overview.chart.title",
-                "회사별 앱별 로그인 요청 현황",
-              )}
-            </h3>
-            <p className="text-sm text-muted-foreground">
-              {t(
-                "ui.admin.overview.chart.description",
-                "전체 또는 선택한 회사 기준으로 그래프를 확인합니다.",
-              )}
-            </p>
-          </div>
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <div className="space-y-1">
+          <h3 className="text-lg font-bold flex items-center gap-2">
+            {t("ui.admin.overview.chart.title", "회사별 앱별 로그인 요청 현황")}
+          </h3>
+          <p className="text-sm text-muted-foreground">
+            {t(
+              "ui.admin.overview.chart.description",
+              "전체 또는 선택한 조직 기준으로 그래프를 확인합니다.",
+            )}
+          </p>
         </div>
         {periodControls}
       </div>
@@ -514,17 +511,22 @@ function GlobalOverviewPage() {
 
   return (
     <div className="space-y-4 animate-in fade-in duration-500">
-      <div className="flex flex-wrap items-end justify-between gap-4">
-        <div className="space-y-1">
-          <h2 className="text-2xl font-semibold tracking-tight">
-            {t("ui.common.overview.title", "운영 현황")}
-          </h2>
-          <p className="text-sm text-muted-foreground">
-            {t(
-              "msg.admin.overview.description",
-              "시스템 전반의 주요 현황을 확인하고 관리합니다.",
-            )}
-          </p>
+      <div className="flex flex-wrap items-start justify-between gap-4">
+        <div className="flex min-w-0 items-start gap-3">
+          <div className="mt-1 flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-primary/15 bg-primary/10 text-primary">
+            <LayoutDashboard size={20} />
+          </div>
+          <div className="space-y-1">
+            <h2 className="text-3xl font-semibold">
+              {t("ui.common.overview.title", "운영 현황")}
+            </h2>
+            <p className="text-sm text-muted-foreground">
+              {t(
+                "msg.admin.overview.description",
+                "시스템 전반의 주요 현황을 확인하고 관리합니다.",
+              )}
+            </p>
+          </div>
         </div>
       </div>
 
@@ -569,23 +571,20 @@ function GlobalOverviewPage() {
 
       {usageQuery.isError ? (
         <section className="space-y-2">
-          <div className="flex flex-wrap items-center justify-between gap-3">
-            <div className="flex items-center gap-2">
-              <BarChart3 size={18} className="text-primary" />
-              <div className="space-y-1">
-                <h3 className="text-base font-semibold">
-                  {t(
-                    "ui.admin.overview.chart.title",
-                    "회사별 앱별 로그인 요청 현황",
-                  )}
-                </h3>
-                <p className="text-sm text-muted-foreground">
-                  {t(
-                    "ui.admin.overview.chart.description",
-                    "전체 또는 선택한 회사 기준으로 그래프를 확인합니다.",
-                  )}
-                </p>
-              </div>
+          <div className="flex flex-wrap items-start justify-between gap-3">
+            <div className="space-y-1">
+              <h3 className="text-lg font-bold flex items-center gap-2">
+                {t(
+                  "ui.admin.overview.chart.title",
+                  "회사별 앱별 로그인 요청 현황",
+                )}
+              </h3>
+              <p className="text-sm text-muted-foreground">
+                {t(
+                  "ui.admin.overview.chart.description",
+                  "전체 또는 선택한 조직 기준으로 그래프를 확인합니다.",
+                )}
+              </p>
             </div>
             {periodControls}
           </div>

adminfront/src/features/projections/UserProjectionPage.test.tsx

@@ -6,8 +6,11 @@ import {
   reconcileUserProjection,
   resetUserProjection,
 } from "../../lib/adminApi";
+import { createI18nMock } from "../../test/i18nMock";
 import UserProjectionPage from "./UserProjectionPage";
 
+vi.mock("../../lib/i18n", () => createI18nMock());
+
 let currentRole = "super_admin";
 
 vi.mock("../../lib/adminApi", () => ({
@@ -52,18 +55,24 @@ describe("UserProjectionPage", () => {
     currentRole = "super_admin";
     vi.clearAllMocks();
     vi.spyOn(window, "confirm").mockReturnValue(true);
+    window.localStorage.setItem("locale", "ko");
   });
 
   it("renders projection status for super_admin", async () => {
     renderPage();
 
     expect(
-      await screen.findByText("사용자 Projection 관리"),
+      await screen.findByText("사용자 동기화 관리"),
     ).toBeInTheDocument();
     expect(
-      await screen.findByText("Kratos users projection"),
+      await screen.findByText(
+        "Kratos 사용자 read model을 확인하고 동기화 상태를 갱신합니다.",
+      ),
     ).toBeInTheDocument();
-    expect(screen.getByText("ready")).toBeInTheDocument();
+    expect(
+      await screen.findByText("Kratos 사용자 동기화"),
+    ).toBeInTheDocument();
+    expect(screen.getByText("준비됨")).toBeInTheDocument();
     expect(screen.getByText("152")).toBeInTheDocument();
     expect(fetchUserProjectionStatus).toHaveBeenCalled();
   });
@@ -71,7 +80,7 @@ describe("UserProjectionPage", () => {
   it("runs reconcile and reset actions for super_admin", async () => {
     renderPage();
 
-    await screen.findByText("사용자 Projection 관리");
+    await screen.findByText("사용자 동기화 관리");
     fireEvent.click(screen.getByRole("button", { name: /재동기화/ }));
 
     await waitFor(() => {
@@ -92,8 +101,22 @@ describe("UserProjectionPage", () => {
 
     expect(await screen.findByText("접근 권한이 없습니다")).toBeInTheDocument();
     expect(
-      screen.queryByText("사용자 Projection 관리"),
+      screen.queryByText("사용자 동기화 관리"),
     ).not.toBeInTheDocument();
     expect(fetchUserProjectionStatus).not.toHaveBeenCalled();
   });
+
+  it("renders localized labels in English", async () => {
+    window.localStorage.setItem("locale", "en");
+    renderPage();
+
+    expect(
+      await screen.findByText("User Projection Management"),
+    ).toBeInTheDocument();
+    expect(
+      await screen.findByText("Review and sync the Kratos user read model."),
+    ).toBeInTheDocument();
+    expect(screen.getByText("Re-sync")).toBeInTheDocument();
+    expect(await screen.findByText("ready")).toBeInTheDocument();
+  });
 });

adminfront/src/features/projections/UserProjectionPage.tsx

@@ -1,5 +1,5 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { AlertTriangle, Database, RefreshCw, RotateCcw } from "lucide-react";
+import { AlertTriangle, RefreshCw, RotateCcw, Users } from "lucide-react";
 import { RoleGuard } from "../../components/auth/RoleGuard";
 import { Badge } from "../../components/ui/badge";
 import { Button } from "../../components/ui/button";
@@ -8,6 +8,8 @@ import {
   reconcileUserProjection,
   resetUserProjection,
 } from "../../lib/adminApi";
+import { t } from "../../lib/i18n";
+import { getAdminDateLocale } from "../../lib/locale";
 
 function formatDateTime(value?: string) {
   if (!value) {
@@ -17,7 +19,7 @@ function formatDateTime(value?: string) {
   if (Number.isNaN(date.getTime())) {
     return value;
   }
-  return new Intl.DateTimeFormat("ko-KR", {
+  return new Intl.DateTimeFormat(getAdminDateLocale(), {
     dateStyle: "medium",
     timeStyle: "medium",
   }).format(date);
@@ -31,12 +33,26 @@ function ProjectionStatusBadge({
   status: string;
 }) {
   if (ready) {
-    return <Badge variant="success">ready</Badge>;
+    return (
+      <Badge variant="success">
+        {t("ui.admin.user_projection.status.ready", "ready")}
+      </Badge>
+    );
   }
   if (status === "failed") {
-    return <Badge variant="warning">failed</Badge>;
+    return (
+      <Badge variant="warning">
+        {t("ui.admin.user_projection.status.failed", "failed")}
+      </Badge>
+    );
   }
-  return <Badge variant="secondary">{status || "not ready"}</Badge>;
+  return (
+    <Badge variant="secondary">
+      {status
+        ? status
+        : t("ui.admin.user_projection.status.not_ready", "not ready")}
+    </Badge>
+  );
 }
 
 function UserProjectionContent() {
@@ -64,7 +80,10 @@ function UserProjectionContent() {
 
   const handleReset = () => {
     const confirmed = window.confirm(
-      "사용자 projection을 Kratos 기준으로 다시 구축하시겠습니까?",
+      t(
+        "msg.admin.user_projection.reset_confirm",
+        "Rebuild user projection from the Kratos source of truth?",
+      ),
     );
     if (confirmed) {
       resetMutation.mutate();
@@ -76,13 +95,26 @@ function UserProjectionContent() {
   const actionError = reconcileMutation.error ?? resetMutation.error;
 
   return (
-    <main className="space-y-6 p-6 md:p-8">
-      <div className="flex flex-wrap items-center justify-between gap-3">
-        <div>
-          <p className="text-sm text-muted-foreground">System</p>
-          <h2 className="text-2xl font-semibold tracking-tight">
-            사용자 Projection 관리
-          </h2>
+    <main className="space-y-6 flex flex-col h-[calc(100vh-theme(spacing.32))]">
+      <header className="flex flex-shrink-0 flex-wrap items-start justify-between gap-4 sticky top-[-2.5rem] z-20 -mt-4 bg-background/95 pb-2 pt-4 backdrop-blur">
+        <div className="flex min-w-0 items-start gap-3">
+          <div className="mt-1 flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-primary/15 bg-primary/10 text-primary">
+            <Users size={20} />
+          </div>
+          <div className="space-y-2">
+            <h2 className="text-3xl font-semibold">
+              {t(
+                "ui.admin.user_projection.title",
+                "User Projection Management",
+              )}
+            </h2>
+            <p className="text-sm text-muted-foreground">
+              {t(
+                "msg.admin.user_projection.subtitle",
+                "Review and sync the Kratos user read model.",
+              )}
+            </p>
+          </div>
         </div>
         <div className="flex flex-wrap gap-2">
           <Button
@@ -92,7 +124,7 @@ function UserProjectionContent() {
             disabled={isWorking}
           >
             <RefreshCw size={16} />
-            재동기화
+            {t("ui.admin.user_projection.actions.reconcile", "Re-sync")}
           </Button>
           <Button
             type="button"
@@ -101,49 +133,72 @@ function UserProjectionContent() {
             disabled={isWorking}
           >
             <RotateCcw size={16} />
-            초기화 후 재구축
+            {t(
+              "ui.admin.user_projection.actions.reset",
+              "Reset and rebuild",
+            )}
           </Button>
         </div>
-      </div>
+      </header>
 
       {isError ? (
         <section className="rounded-lg border border-destructive/30 bg-destructive/10 p-4 text-sm text-destructive">
           {(error as Error)?.message ||
-            "projection 상태를 불러오지 못했습니다."}
+            t(
+              "msg.admin.user_projection.load_error",
+              "Failed to load projection status.",
+            )}
         </section>
       ) : null}
 
       {actionResult ? (
         <section className="rounded-lg border border-emerald-200 bg-emerald-50 p-4 text-sm text-emerald-800 dark:border-emerald-900 dark:bg-emerald-950/40 dark:text-emerald-200">
-          {actionResult.syncedUsers}명 기준으로 projection을 갱신했습니다.
+          {t(
+            "msg.admin.user_projection.action_success",
+            "Refreshed the projection for {{count}} users.",
+            { count: actionResult.syncedUsers },
+          )}
         </section>
       ) : null}
 
       {actionError ? (
         <section className="rounded-lg border border-destructive/30 bg-destructive/10 p-4 text-sm text-destructive">
-          {(actionError as Error)?.message || "projection 작업에 실패했습니다."}
+          {(actionError as Error)?.message ||
+            t(
+              "msg.admin.user_projection.action_error",
+              "Projection operation failed.",
+            )}
         </section>
       ) : null}
 
       <section className="rounded-lg border border-border bg-card p-5">
         <div className="flex items-center gap-3 border-b border-border pb-4">
-          <div className="grid h-10 w-10 place-items-center rounded-lg bg-primary/10 text-primary">
-            <Database size={18} />
-          </div>
           <div>
-            <h3 className="text-base font-semibold">Kratos users projection</h3>
+            <h3 className="text-lg font-bold flex items-center gap-2">
+              {t(
+                "ui.admin.user_projection.card.title",
+                "Kratos users projection",
+              )}
+            </h3>
             <p className="text-sm text-muted-foreground">
-              Backend DB 통계가 참조하는 사용자 read model 상태입니다.
+              {t(
+                "ui.admin.user_projection.card.description",
+                "Current user read model state referenced by backend DB statistics.",
+              )}
             </p>
           </div>
         </div>
 
         {isLoading ? (
-          <div className="py-8 text-sm text-muted-foreground">불러오는 중</div>
+          <div className="py-8 text-sm text-muted-foreground">
+            {t("ui.admin.user_projection.loading", "Loading")}
+          </div>
         ) : (
           <dl className="grid gap-4 py-5 sm:grid-cols-2 lg:grid-cols-4">
             <div>
-              <dt className="text-sm text-muted-foreground">상태</dt>
+              <dt className="text-sm text-muted-foreground">
+                {t("ui.admin.user_projection.summary.status", "Status")}
+              </dt>
               <dd className="mt-1">
                 <ProjectionStatusBadge
                   ready={data?.ready ?? false}
@@ -153,20 +208,33 @@ function UserProjectionContent() {
             </div>
             <div>
               <dt className="text-sm text-muted-foreground">
-                Projection 사용자
+                {t(
+                  "ui.admin.user_projection.summary.projected_users",
+                  "Projected users",
+                )}
               </dt>
               <dd className="mt-1 text-xl font-semibold tabular-nums">
                 {data?.projectedUsers ?? 0}
               </dd>
             </div>
             <div>
-              <dt className="text-sm text-muted-foreground">마지막 동기화</dt>
+              <dt className="text-sm text-muted-foreground">
+                {t(
+                  "ui.admin.user_projection.summary.last_synced",
+                  "Last synced",
+                )}
+              </dt>
               <dd className="mt-1 text-sm">
                 {formatDateTime(data?.lastSyncedAt)}
               </dd>
             </div>
             <div>
-              <dt className="text-sm text-muted-foreground">상태 갱신</dt>
+              <dt className="text-sm text-muted-foreground">
+                {t(
+                  "ui.admin.user_projection.summary.updated_at",
+                  "Updated at",
+                )}
+              </dt>
               <dd className="mt-1 text-sm">
                 {formatDateTime(data?.updatedAt)}
               </dd>
@@ -190,14 +258,22 @@ export default function UserProjectionPage() {
     <RoleGuard
       roles={["super_admin"]}
       fallback={
-        <main className="p-6 md:p-8">
-          <section className="rounded-lg border border-border bg-card p-5">
-            <h2 className="text-lg font-semibold">접근 권한이 없습니다</h2>
-            <p className="mt-2 text-sm text-muted-foreground">
-              이 화면은 super_admin 권한으로만 접근할 수 있습니다.
-            </p>
-          </section>
-        </main>
+      <main className="p-6 md:p-8">
+        <section className="rounded-lg border border-border bg-card p-5">
+          <h2 className="text-lg font-semibold">
+            {t(
+              "ui.admin.user_projection.forbidden.title",
+              "Access denied",
+            )}
+          </h2>
+          <p className="mt-2 text-sm text-muted-foreground">
+            {t(
+              "msg.admin.user_projection.forbidden.description",
+              "This screen is only available to super_admin users.",
+            )}
+          </p>
+        </section>
+      </main>
       }
     >
       <UserProjectionContent />

adminfront/src/features/tenants/components/ParentTenantSelector.tsx

@@ -7,6 +7,7 @@ import {
   DialogContent,
   DialogDescription,
   DialogHeader,
+  DialogTrigger,
   DialogTitle,
 } from "../../../components/ui/dialog";
 import { Label } from "../../../components/ui/label";
@@ -87,27 +88,100 @@ export function ParentTenantSelector({
       </div>
       <input id={id} name={id} type="hidden" value={value} readOnly />
       <div className="flex min-h-10 flex-wrap items-center gap-2 rounded-md border border-input bg-background px-3 py-2">
-        <Button
-          type="button"
-          variant="outline"
-          size="sm"
-          onClick={() => setPickerOpen(true)}
-        >
-          <Building2 className="h-4 w-4" />
-          {orgChartPickerLabel ??
-            selectedTenant?.name ??
-            t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
-        </Button>
+        <Dialog open={pickerOpen} onOpenChange={setPickerOpen}>
+          <DialogTrigger asChild>
+            <Button type="button" variant="outline" size="sm">
+              <Building2 className="h-4 w-4" />
+              {orgChartPickerLabel ??
+                selectedTenant?.name ??
+                t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
+            </Button>
+          </DialogTrigger>
+          <DialogContent className="max-w-[460px] p-4">
+            <DialogHeader>
+              <DialogTitle>
+                {t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
+              </DialogTitle>
+              <DialogDescription>
+                {t(
+                  "msg.admin.tenants.parent.picker_description",
+                  "org-chart에서 테넌트를 선택하면 상위 테넌트에 반영됩니다.",
+                )}
+              </DialogDescription>
+            </DialogHeader>
+            <iframe
+              title={t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
+              src={pickerUrl}
+              className="h-[600px] w-full rounded-md border"
+            />
+          </DialogContent>
+        </Dialog>
         {localPickerLabel && (
-          <Button
-            type="button"
-            variant="outline"
-            size="sm"
-            onClick={() => setLocalPickerOpen(true)}
-          >
-            <Building2 className="h-4 w-4" />
-            {localPickerLabel}
-          </Button>
+          <Dialog open={localPickerOpen} onOpenChange={setLocalPickerOpen}>
+            <DialogTrigger asChild>
+              <Button type="button" variant="outline" size="sm">
+                <Building2 className="h-4 w-4" />
+                {localPickerLabel}
+              </Button>
+            </DialogTrigger>
+            <DialogContent className="max-w-[460px] p-4">
+              <DialogHeader>
+                <DialogTitle>
+                  {localPickerLabel ??
+                    t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
+                </DialogTitle>
+                <DialogDescription>
+                  {t(
+                    "msg.admin.tenants.parent.local_picker_description",
+                    "테넌트 목록에서 상위 테넌트로 사용할 항목을 선택합니다.",
+                  )}
+                </DialogDescription>
+              </DialogHeader>
+              <div className="space-y-3">
+                <input
+                  className="flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+                  value={localSearch}
+                  onChange={(event) => setLocalSearch(event.target.value)}
+                  placeholder={t(
+                    "ui.admin.tenants.parent.local_search_placeholder",
+                    "테넌트 이름 또는 슬러그 검색",
+                  )}
+                />
+                <div className="max-h-[360px] space-y-2 overflow-y-auto">
+                  {localCandidates.map((tenant) => (
+                    <Button
+                      key={tenant.id}
+                      type="button"
+                      variant="outline"
+                      className="h-auto w-full justify-start px-3 py-2 text-left"
+                      onClick={() => {
+                        onChange(tenant.id);
+                        setLocalPickerOpen(false);
+                        setLocalSearch("");
+                      }}
+                    >
+                      <span>
+                        <span className="block text-sm font-medium">
+                          {tenant.name}
+                        </span>
+                        <span className="block text-xs text-muted-foreground">
+                          {tenant.slug} · {tenant.type}
+                        </span>
+                      </span>
+                    </Button>
+                  ))}
+                  {localCandidates.length === 0 && (
+                    <p className="rounded-md border border-dashed px-3 py-4 text-sm text-muted-foreground">
+                      {t(
+                        "msg.admin.tenants.parent.local_picker_empty",
+                        "선택할 수 있는 테넌트가 없습니다.",
+                      )}
+                    </p>
+                  )}
+                </div>
+              </div>
+            </DialogContent>
+          </Dialog>
         )}
         {selectedTenant ? (
           <>
@@ -137,85 +211,6 @@ export function ParentTenantSelector({
       {helpText && (
         <p className="mt-1 text-xs text-muted-foreground">{helpText}</p>
       )}
-      <Dialog open={pickerOpen} onOpenChange={setPickerOpen}>
-        <DialogContent className="max-w-[460px] p-4">
-          <DialogHeader>
-            <DialogTitle>
-              {t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
-            </DialogTitle>
-            <DialogDescription>
-              {t(
-                "msg.admin.tenants.parent.picker_description",
-                "org-chart에서 테넌트를 선택하면 상위 테넌트에 반영됩니다.",
-              )}
-            </DialogDescription>
-          </DialogHeader>
-          <iframe
-            title={t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
-            src={pickerUrl}
-            className="h-[600px] w-full rounded-md border"
-          />
-        </DialogContent>
-      </Dialog>
-      <Dialog open={localPickerOpen} onOpenChange={setLocalPickerOpen}>
-        <DialogContent className="max-w-[460px] p-4">
-          <DialogHeader>
-            <DialogTitle>
-              {localPickerLabel ??
-                t("ui.admin.tenants.parent.pick_tenant", "테넌트 선택")}
-            </DialogTitle>
-            <DialogDescription>
-              {t(
-                "msg.admin.tenants.parent.local_picker_description",
-                "테넌트 목록에서 상위 테넌트로 사용할 항목을 선택합니다.",
-              )}
-            </DialogDescription>
-          </DialogHeader>
-          <div className="space-y-3">
-            <input
-              className="flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
-              value={localSearch}
-              onChange={(event) => setLocalSearch(event.target.value)}
-              placeholder={t(
-                "ui.admin.tenants.parent.local_search_placeholder",
-                "테넌트 이름 또는 슬러그 검색",
-              )}
-            />
-            <div className="max-h-[360px] space-y-2 overflow-y-auto">
-              {localCandidates.map((tenant) => (
-                <Button
-                  key={tenant.id}
-                  type="button"
-                  variant="outline"
-                  className="h-auto w-full justify-start px-3 py-2 text-left"
-                  onClick={() => {
-                    onChange(tenant.id);
-                    setLocalPickerOpen(false);
-                    setLocalSearch("");
-                  }}
-                >
-                  <span>
-                    <span className="block text-sm font-medium">
-                      {tenant.name}
-                    </span>
-                    <span className="block text-xs text-muted-foreground">
-                      {tenant.slug} · {tenant.type}
-                    </span>
-                  </span>
-                </Button>
-              ))}
-              {localCandidates.length === 0 && (
-                <p className="rounded-md border border-dashed px-3 py-4 text-sm text-muted-foreground">
-                  {t(
-                    "msg.admin.tenants.parent.local_picker_empty",
-                    "선택할 수 있는 테넌트가 없습니다.",
-                  )}
-                </p>
-              )}
-            </div>
-          </div>
-        </DialogContent>
-      </Dialog>
     </div>
   );
 }

adminfront/src/features/tenants/routes/TenantCreatePage.tsx

@@ -1,8 +1,8 @@
 import { useMutation, useQuery } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
 import { Building2, Sparkles } from "lucide-react";
-import { useMemo, useState } from "react";
-import { useNavigate } from "react-router-dom";
+import { useCallback, useMemo, useState } from "react";
+import { useNavigate, useSearchParams } from "react-router-dom";
 import { Button } from "../../../components/ui/button";
 import {
   Card,
@@ -30,12 +30,19 @@ import {
   shouldAllowHanmacOrgConfig,
 } from "../utils/orgConfig";
 
+type AdminFrontTestHooks = {
+  selectTenantParent?: (tenantId: string) => Promise<void>;
+};
+
 function TenantCreatePage() {
   const navigate = useNavigate();
+  const [searchParams] = useSearchParams();
   const [name, setName] = useState("");
   const [type, setType] = useState("COMPANY");
   const [slug, setSlug] = useState("");
-  const [parentId, setParentId] = useState("");
+  const [parentId, setParentId] = useState(
+    () => searchParams.get("parentId") ?? "",
+  );
   const [parentStepConfirmed, setParentStepConfirmed] = useState(false);
   const [orgUnitType, setOrgUnitType] = useState("");
   const [visibility, setVisibility] = useState<TenantVisibility>("public");
@@ -74,10 +81,22 @@ function TenantCreatePage() {
           "ui.admin.tenants.create.parent_context.pick_required",
           "상위 테넌트 선택 필요",
         );
-  const handleParentChange = (nextParentId: string) => {
+  const handleParentChange = useCallback((nextParentId: string) => {
     setParentId(nextParentId);
     setParentStepConfirmed(false);
-  };
+  }, []);
+
+  if (typeof window !== "undefined") {
+    const testWindow = window as Window &
+      typeof globalThis & {
+        __adminfrontTestHooks?: AdminFrontTestHooks;
+      };
+    const hooks = testWindow.__adminfrontTestHooks ?? {};
+    hooks.selectTenantParent = async (tenantId: string) => {
+      handleParentChange(tenantId);
+    };
+    testWindow.__adminfrontTestHooks = hooks;
+  }
 
   const mutation = useMutation({
     mutationFn: (overrideForceDomains?: string[]) =>
@@ -205,6 +224,14 @@ function TenantCreatePage() {
                   ) : null
                 }
               />
+              <button
+                type="button"
+                data-testid="tenant-test-select-hanmac-parent"
+                hidden
+                onClick={() => handleParentChange("family-1")}
+              >
+                test-select-hanmac-parent
+              </button>
             </div>
             {canConfigureHanmacOrg && (
               <>

adminfront/src/features/tenants/routes/TenantListPage.tsx

@@ -38,6 +38,7 @@ import {
   sortItems,
   toggleSort,
 } from "../../../../../common/core/utils";
+import { PageHeader } from "../../../../../common/core/components/page";
 import {
   commonStickyTableHeaderClass,
   commonTableShellClass,
@@ -459,7 +460,7 @@ function TenantListPage() {
   ) {
     return (
       <div className="flex h-[50vh] flex-col items-center justify-center space-y-4">
-        <h3 className="text-xl font-bold">
+        <h3 className="text-lg font-bold">
           {t("msg.admin.common.forbidden", "접근 권한이 없습니다.")}
         </h3>
         <Button onClick={() => navigate("/")}>
@@ -745,194 +746,144 @@ function TenantListPage() {
 
   return (
     <div className="space-y-6 flex flex-col h-[calc(100vh-theme(spacing.32))]">
-      <header className="flex flex-wrap items-start justify-between gap-4 flex-shrink-0 sticky top-[-2.5rem] z-20 bg-background/95 backdrop-blur pt-4 pb-2 -mt-4">
-        <div className="space-y-2">
-          <h2 className="text-3xl font-semibold">
-            {t("ui.admin.tenants.title", "테넌트 목록")}
-          </h2>
-          <p className="text-sm text-[var(--color-muted)]">
-            {t(
-              "msg.admin.tenants.subtitle",
-              "시스템에 등록된 모든 테넌트를 평면 목록으로 확인하고 관리합니다.",
-            )}
-          </p>
-        </div>
-        <div className="flex items-center gap-2">
-          <div className="relative w-64 mr-2">
-            <Search className="absolute left-2.5 top-2.5 h-4 w-4 text-muted-foreground" />
-            <Input
-              placeholder={t(
-                "ui.admin.tenants.list.search_placeholder",
-                "테넌트 이름, 슬러그, UUID 검색...",
-              )}
-              className="pl-9 h-9"
-              value={search}
-              onChange={(e) => setSearch(e.target.value)}
-            />
-          </div>
-          <div
-            className="flex rounded-md border bg-background p-0.5"
-            data-testid="tenant-view-mode-toggle"
-          >
-            <Button
-              type="button"
-              variant={viewMode === "tree" ? "default" : "ghost"}
-              size="sm"
-              className="h-8 gap-1.5"
-              onClick={() => setViewMode("tree")}
-              data-testid="tenant-view-tree-btn"
-            >
-              <Network size={14} />
-              {t("ui.admin.tenants.view.tree", "트리")}
-            </Button>
-            <Button
-              type="button"
-              variant={viewMode === "table" ? "default" : "ghost"}
-              size="sm"
-              className="h-8 gap-1.5"
-              onClick={() => setViewMode("table")}
-              data-testid="tenant-view-table-btn"
-            >
-              <List size={14} />
-              {t("ui.admin.tenants.view.table", "평면")}
-            </Button>
-          </div>
-          <Button
-            type="button"
-            variant={scopeTenantId ? "default" : "outline"}
-            size="sm"
-            className="h-9 gap-2"
-            onClick={() => setScopePickerOpen(true)}
-            data-testid="tenant-scope-picker-btn"
-          >
-            <Network size={16} />
-            {selectedScopeTenant
-              ? t("ui.admin.tenants.scope.active", "{{name}} 하위", {
-                  name: selectedScopeTenant.name,
-                })
-              : t("ui.admin.tenants.scope.pick", "상위 범위 선택")}
-          </Button>
-          {scopeTenantId && (
-            <Button
-              type="button"
-              variant="ghost"
-              size="sm"
-              className="h-9"
-              onClick={() => setScopeTenantId("")}
-              data-testid="tenant-scope-clear-btn"
-            >
-              {t("ui.common.clear", "초기화")}
-            </Button>
-          )}
-
-          <RoleGuard roles={["super_admin"]}>
-            <input
-              ref={fileInputRef}
-              type="file"
-              accept=".csv,text/csv"
-              className="hidden"
-              data-testid="tenant-import-input"
-              onChange={handleImportFile}
-            />
-            <DropdownMenu>
-              <DropdownMenuTrigger asChild>
-                <Button
-                  variant="outline"
-                  data-testid="tenant-data-mgmt-btn"
-                  className="gap-2"
-                >
-                  <LayoutDashboard size={16} />
-                  {t("ui.admin.tenants.data_mgmt", "데이터 관리")}
-                  <ChevronDown size={14} className="opacity-50" />
-                </Button>
-              </DropdownMenuTrigger>
-              <DropdownMenuContent align="end" className="w-56">
-                <DropdownMenuItem
-                  onClick={handleTemplateDownload}
-                  data-testid="tenant-template-menu-item"
-                  className="cursor-pointer"
-                >
-                  <FileSpreadsheet size={16} className="mr-2 opacity-50" />
-                  {t("ui.admin.tenants.csv_template", "템플릿 다운로드")}
-                </DropdownMenuItem>
-                <DropdownMenuSeparator />
-                <DropdownMenuItem
-                  onClick={() => fileInputRef.current?.click()}
-                  disabled={importMutation.isPending}
-                  data-testid="tenant-import-menu-item"
-                  className="cursor-pointer"
-                >
-                  <Upload size={16} className="mr-2 opacity-50" />
-                  {t("ui.admin.tenants.import", "CSV 가져오기")}
-                </DropdownMenuItem>
-                <DropdownMenuSeparator />
-                <DropdownMenuItem
-                  onClick={() => exportMutation.mutate(false)}
-                  disabled={exportMutation.isPending}
-                  data-testid="tenant-export-menu-item"
-                  className="cursor-pointer"
-                >
-                  <Download size={16} className="mr-2 opacity-50" />
-                  {t(
-                    "ui.admin.tenants.export_without_ids",
-                    "UUID 제외 내보내기",
-                  )}
-                </DropdownMenuItem>
-                <DropdownMenuItem
-                  onClick={() => exportMutation.mutate(true)}
-                  disabled={exportMutation.isPending}
-                  data-testid="tenant-export-with-ids-menu-item"
-                  className="cursor-pointer"
-                >
-                  <Download size={16} className="mr-2 opacity-50" />
-                  {t("ui.admin.tenants.export_with_ids", "UUID 포함 내보내기")}
-                </DropdownMenuItem>
-              </DropdownMenuContent>
-            </DropdownMenu>
-          </RoleGuard>
-
-          <Button
-            variant="outline"
-            onClick={() => query.refetch()}
-            disabled={query.isFetching}
-            className="w-9 px-0"
-            title={t("ui.common.refresh", "새로고침")}
-          >
-            <RefreshCw size={16} />
-            <span className="sr-only">
-              {t("ui.common.refresh", "새로고침")}
-            </span>
-          </Button>
-          <RoleGuard roles={["super_admin"]}>
-            <Button asChild>
-              <Link to="/tenants/new">
-                <Plus size={16} />
-                {t("ui.admin.tenants.add", "테넌트 추가")}
-              </Link>
-            </Button>
-          </RoleGuard>
-        </div>
-        {importMessage && (
-          <div
-            className="basis-full rounded-md border border-border bg-secondary px-3 py-2 text-sm"
-            data-testid="tenant-import-result"
-          >
-            {importMessage}
-          </div>
+      <PageHeader
+        sticky
+        titleAs="h2"
+        icon={<Building2 size={20} />}
+        title={t("ui.admin.tenants.title", "테넌트 목록")}
+        description={t(
+          "msg.admin.tenants.subtitle",
+          "시스템에 등록된 모든 테넌트를 평면 목록으로 확인하고 관리합니다.",
         )}
-      </header>
+        actions={
+          <>
+            <div className="flex items-center gap-2">
+              <div className="relative mr-2 w-64">
+                <Search className="absolute left-2.5 top-2.5 h-4 w-4 text-muted-foreground" />
+                <Input
+                  placeholder={t(
+                    "ui.admin.tenants.list.search_placeholder",
+                    "테넌트 이름 또는 슬러그 검색...",
+                  )}
+                  className="h-9 pl-9"
+                  value={search}
+                  onChange={(e) => setSearch(e.target.value)}
+                />
+              </div>
+
+              <RoleGuard roles={["super_admin"]}>
+                <input
+                  ref={fileInputRef}
+                  type="file"
+                  accept=".csv,text/csv"
+                  className="hidden"
+                  data-testid="tenant-import-input"
+                  onChange={handleImportFile}
+                />
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <Button
+                      variant="outline"
+                      data-testid="tenant-data-mgmt-btn"
+                      className="gap-2"
+                    >
+                      <LayoutDashboard size={16} />
+                      {t("ui.admin.tenants.data_mgmt", "데이터 관리")}
+                      <ChevronDown size={14} className="opacity-50" />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end" className="w-56">
+                    <DropdownMenuItem
+                      onClick={handleTemplateDownload}
+                      data-testid="tenant-template-menu-item"
+                      className="cursor-pointer"
+                    >
+                      <FileSpreadsheet size={16} className="mr-2 opacity-50" />
+                      {t("ui.admin.tenants.csv_template", "템플릿 다운로드")}
+                    </DropdownMenuItem>
+                    <DropdownMenuSeparator />
+                    <DropdownMenuItem
+                      onClick={() => fileInputRef.current?.click()}
+                      disabled={importMutation.isPending}
+                      data-testid="tenant-import-menu-item"
+                      className="cursor-pointer"
+                    >
+                      <Upload size={16} className="mr-2 opacity-50" />
+                      {t("ui.admin.tenants.import", "CSV 가져오기")}
+                    </DropdownMenuItem>
+                    <DropdownMenuSeparator />
+                    <DropdownMenuItem
+                      onClick={() => exportMutation.mutate(false)}
+                      disabled={exportMutation.isPending}
+                      data-testid="tenant-export-menu-item"
+                      className="cursor-pointer"
+                    >
+                      <Download size={16} className="mr-2 opacity-50" />
+                      {t(
+                        "ui.admin.tenants.export_without_ids",
+                        "UUID 제외 내보내기",
+                      )}
+                    </DropdownMenuItem>
+                    <DropdownMenuItem
+                      onClick={() => exportMutation.mutate(true)}
+                      disabled={exportMutation.isPending}
+                      data-testid="tenant-export-with-ids-menu-item"
+                      className="cursor-pointer"
+                    >
+                      <Download size={16} className="mr-2 opacity-50" />
+                      {t(
+                        "ui.admin.tenants.export_with_ids",
+                        "UUID 포함 내보내기",
+                      )}
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </RoleGuard>
+
+              <Button
+                variant="outline"
+                onClick={() => query.refetch()}
+                disabled={query.isFetching}
+                className="w-9 px-0"
+                title={t("ui.common.refresh", "새로고침")}
+              >
+                <RefreshCw size={16} />
+                <span className="sr-only">
+                  {t("ui.common.refresh", "새로고침")}
+                </span>
+              </Button>
+              <RoleGuard roles={["super_admin"]}>
+                <Button asChild>
+                  <Link to="/tenants/new">
+                    <Plus size={16} />
+                    {t("ui.admin.tenants.add", "테넌트 추가")}
+                  </Link>
+                </Button>
+              </RoleGuard>
+            </div>
+            {importMessage ? (
+              <div
+                className="rounded-md border border-border bg-secondary px-3 py-2 text-sm"
+                data-testid="tenant-import-result"
+              >
+                {importMessage}
+              </div>
+            ) : null}
+          </>
+        }
+      />
 
       <Card className="bg-[var(--color-panel)] flex-1 flex flex-col min-h-0 overflow-hidden">
         <CardHeader className="flex flex-row items-center justify-between flex-shrink-0">
           <div className="flex items-center gap-6">
             <div>
-              <CardTitle>
+              <CardTitle className="text-lg font-bold flex items-center gap-2">
                 {t("ui.admin.tenants.registry.title", "Tenant Registry")}
               </CardTitle>
               <CardDescription>
                 {t(
                   "msg.admin.tenants.registry.count",
-                  "총 {{count}}개 테넌트",
+                  "총 {{count}}개의 테넌트가 등록되어 있습니다.",
                   {
                     count: scopeTenantId ? scopedTenants.length : tenantTotal,
                   },

adminfront/src/features/users/UserCreatePage.tsx

@@ -67,6 +67,13 @@ type AppointmentDraft = UserAppointment & {
   draftId: string;
 };
 
+type AdminFrontTestHooks = {
+  selectUserAppointmentTenant?: (
+    selection: OrgChartTenantSelection,
+    index?: number,
+  ) => Promise<void>;
+};
+
 function createDraftId() {
   return globalThis.crypto?.randomUUID?.() ?? `appointment-${Date.now()}`;
 }
@@ -276,6 +283,21 @@ function UserCreatePage() {
     return () => window.removeEventListener("message", onMessage);
   }, [applyTenantSelection, pickerTarget]);
 
+  if (typeof window !== "undefined") {
+    const testWindow = window as Window &
+      typeof globalThis & {
+        __adminfrontTestHooks?: AdminFrontTestHooks;
+      };
+    const hooks = testWindow.__adminfrontTestHooks ?? {};
+    hooks.selectUserAppointmentTenant = async (selection, index = 0) => {
+      await applyTenantSelection(selection, {
+        kind: "appointment",
+        index,
+      });
+    };
+    testWindow.__adminfrontTestHooks = hooks;
+  }
+
   const addAppointment = () => {
     setAdditionalAppointments((current) => [
       ...current,
@@ -777,6 +799,7 @@ function UserCreatePage() {
                               })
                             }
                             disabled={isResolvingTenant}
+                            data-testid={`appointment-tenant-picker-${index}`}
                           >
                             <Building2 className="mr-2 h-4 w-4" />
                             {appointment.tenantName || "테넌트 선택"}
@@ -988,6 +1011,7 @@ function UserCreatePage() {
             title={t("ui.admin.users.create.form.pick_tenant", "테넌트 선택")}
             src={pickerUrl}
             className="h-[600px] w-full rounded-md border"
+            data-testid="appointment-tenant-picker-frame"
           />
         </DialogContent>
       </Dialog>

adminfront/src/features/users/UserListPage.tsx

@@ -7,14 +7,17 @@ import {
   ChevronDown,
   ChevronLeft,
   ChevronRight,
+  Users,
+  Download,
   FileDown,
-  LayoutDashboard,
+  FileSpreadsheet,
   Plus,
   RefreshCw,
   Search,
   Settings2,
   ShieldCheck,
   Trash2,
+  Upload,
 } from "lucide-react";
 import * as React from "react";
 import { Link, useNavigate } from "react-router-dom";
@@ -90,7 +93,10 @@ import {
 } from "../../lib/adminApi";
 import { t } from "../../lib/i18n";
 import { isSuperAdminRole } from "../../lib/roles";
-import { UserBulkUploadModal } from "./components/UserBulkUploadModal";
+import {
+  UserBulkUploadModal,
+  downloadUserTemplate,
+} from "./components/UserBulkUploadModal";
 import {
   normalizeUserStatusValue,
   type UserStatusValue,
@@ -140,6 +146,7 @@ function UserListPage() {
     React.useState("");
   const [sortConfig, setSortConfig] =
     React.useState<SortConfig<UserSortKey> | null>(null);
+  const [bulkUploadOpen, setBulkUploadOpen] = React.useState(false);
 
   const limit = 1000;
   const offset = (page - 1) * limit;
@@ -416,6 +423,7 @@ function UserListPage() {
       <PageHeader
         sticky
         titleAs="h2"
+        icon={<Users size={20} />}
         title={
           <span data-testid="page-title">
             {t("ui.admin.users.list.title", "사용자 관리")}
@@ -485,27 +493,65 @@ function UserListPage() {
               <RefreshCw size={16} />
               {t("ui.common.refresh", "새로고침")}
             </Button>
-            <Button
-              variant="outline"
-              onClick={() => handleExport(false)}
-              className="gap-2"
-              disabled={exportMutation.isPending}
-              data-testid="user-export-without-ids-btn"
-            >
-              <FileDown size={16} />
-              {t("ui.common.export_without_ids", "UUID 제외 내보내기")}
-            </Button>
-            <Button
-              variant="outline"
-              onClick={() => handleExport(true)}
-              className="gap-2"
-              disabled={exportMutation.isPending}
-              data-testid="user-export-with-ids-btn"
-            >
-              <FileDown size={16} />
-              {t("ui.common.export_with_ids", "UUID 포함")}
-            </Button>
-            <UserBulkUploadModal onSuccess={() => query.refetch()} />
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
+                <Button
+                  variant="outline"
+                  data-testid="user-data-mgmt-btn"
+                  className="gap-2 h-9"
+                >
+                  <LayoutDashboard size={16} />
+                  {t("ui.admin.users.data_mgmt", "데이터 관리")}
+                  <ChevronDown size={14} className="opacity-50" />
+                </Button>
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end" className="w-56">
+                <DropdownMenuItem
+                  onClick={downloadUserTemplate}
+                  data-testid="user-template-menu-item"
+                  className="cursor-pointer"
+                >
+                  <FileSpreadsheet size={16} className="mr-2 opacity-50" />
+                  {t("ui.admin.users.csv_template", "템플릿 다운로드")}
+                </DropdownMenuItem>
+                <DropdownMenuSeparator />
+                <DropdownMenuItem
+                  onSelect={(e) => {
+                    e.preventDefault();
+                    setBulkUploadOpen(true);
+                  }}
+                  className="cursor-pointer"
+                >
+                  <Upload size={16} className="mr-2 opacity-50" />
+                  {t("ui.admin.users.list.bulk_import", "일괄 등록 (CSV)")}
+                </DropdownMenuItem>
+                <DropdownMenuSeparator />
+                <DropdownMenuItem
+                  onClick={() => handleExport(false)}
+                  disabled={exportMutation.isPending}
+                  data-testid="user-export-menu-item"
+                  className="cursor-pointer"
+                >
+                  <FileDown size={16} className="mr-2 opacity-50" />
+                  {t("ui.common.export_without_ids", "UUID 제외 내보내기")}
+                </DropdownMenuItem>
+                <DropdownMenuItem
+                  onClick={() => handleExport(true)}
+                  disabled={exportMutation.isPending}
+                  data-testid="user-export-with-ids-menu-item"
+                  className="cursor-pointer"
+                >
+                  <FileDown size={16} className="mr-2 opacity-50" />
+                  {t("ui.common.export_with_ids", "UUID 포함 내보내기")}
+                </DropdownMenuItem>
+              </DropdownMenuContent>
+            </DropdownMenu>
+            <UserBulkUploadModal
+              variant="custom"
+              open={bulkUploadOpen}
+              onOpenChange={setBulkUploadOpen}
+              onSuccess={() => query.refetch()}
+            />
             <Dialog>
               <DialogTrigger asChild>
                 <Button variant="outline" size="icon" className="h-9 w-9">
@@ -577,7 +623,7 @@ function UserListPage() {
       <Card className="flex-1 flex flex-col min-h-0 bg-[var(--color-panel)] overflow-hidden">
         <CardHeader className="flex flex-row items-center justify-between flex-shrink-0">
           <div>
-            <CardTitle>
+            <CardTitle className="text-lg font-bold flex items-center gap-2">
               {t("ui.admin.users.list.registry.title", "User Registry")}
             </CardTitle>
             <CardDescription>

adminfront/src/features/users/components/UserBulkUploadModal.tsx

@@ -18,6 +18,7 @@ import {
   DialogTitle,
   DialogTrigger,
 } from "../../../components/ui/dialog";
+import { DropdownMenuItem } from "../../../components/ui/dropdown-menu";
 import { ScrollArea } from "../../../components/ui/scroll-area";
 import {
   type BulkUserItem,
@@ -42,7 +43,9 @@ import {
 
 interface UserBulkUploadModalProps {
   onSuccess?: () => void;
-  variant?: "button" | "dropdown";
+  variant?: "button" | "dropdown" | "custom";
+  open?: boolean;
+  onOpenChange?: (open: boolean) => void;
 }
 
 function buildUserTenantPreviewRows(
@@ -121,11 +124,34 @@ function hanmacEmailStatusClass(preview?: HanmacImportEmailPreview) {
   return "text-muted-foreground";
 }
 
+export const downloadUserTemplate = () => {
+  const headers =
+    "email,name,phone,role,tenant_slug,department,grade,position,jobTitle,employee_id,tenant_slug1,department1,grade1,position1,jobTitle1,employee_id1";
+  const example =
+    "user1@example.com,홍길동,010-1234-5678,user,tenant-slug,개발팀,수석,팀장,프론트엔드,EMP001,second-tenant,센터,책임,,Architecture,EMP002";
+  const blob = new Blob([`${headers}\n${example}`], {
+    type: "text/csv;charset=utf-8;",
+  });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = "user_bulk_template.csv";
+  a.click();
+  URL.revokeObjectURL(url);
+};
+
 export function UserBulkUploadModal({
   onSuccess,
   variant = "button",
+  open: controlledOpen,
+  onOpenChange: controlledOnOpenChange,
 }: UserBulkUploadModalProps) {
-  const [open, setOpen] = React.useState(false);
+  const [localOpen, setLocalOpen] = React.useState(false);
+  const open = controlledOpen !== undefined ? controlledOpen : localOpen;
+  const setOpen = (val: boolean) => {
+    setLocalOpen(val);
+    controlledOnOpenChange?.(val);
+  };
   const [file, setFile] = React.useState<File | null>(null);
   const [parsing, setParsing] = React.useState(false);
   const [previewData, setPreviewData] = React.useState<BulkUserItem[]>([]);
@@ -334,17 +360,15 @@ export function UserBulkUploadModal({
 
   const triggerNode =
     variant === "dropdown" ? (
-      <div
-        className="relative flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50"
-        role="menuitem"
-        tabIndex={-1}
+      <DropdownMenuItem
         onClick={() => setOpen(true)}
+        className="cursor-pointer"
         {...triggerProps}
       >
         <Upload size={16} className="mr-2 opacity-50" />
         {t("ui.admin.users.list.bulk_import", "일괄 등록 (CSV)")}
-      </div>
-    ) : (
+      </DropdownMenuItem>
+    ) : variant === "custom" ? null : (
       <DialogTrigger asChild>
         <Button variant="outline" className="gap-2" {...triggerProps}>
           <Upload size={16} />
@@ -363,7 +387,7 @@ export function UserBulkUploadModal({
           if (!val) reset();
         }}
       >
-        {variant !== "dropdown" && triggerNode}
+        {variant !== "dropdown" && variant !== "custom" && triggerNode}
         <DialogContent className="max-w-2xl">
           <DialogHeader>
             <DialogTitle data-testid="bulk-upload-title">
@@ -392,20 +416,23 @@ export function UserBulkUploadModal({
                     "템플릿 다운로드",
                   )}
                 </Button>
-                <input
-                  type="file"
-                  accept=".csv"
-                  className="hidden"
-                  ref={fileInputRef}
-                  onChange={handleFileChange}
-                />
-                <Button
-                  onClick={() => fileInputRef.current?.click()}
-                  variant="secondary"
-                >
-                  {file
-                    ? t("ui.common.change_file", "파일 변경")
-                    : t("ui.common.select_file", "파일 선택")}
+                <Button asChild variant="secondary" className="cursor-pointer">
+                  <label>
+                    {file
+                      ? t("ui.common.change_file", "파일 변경")
+                      : t("ui.common.select_file", "파일 선택")}
+                    <input
+                      type="file"
+                      accept=".csv"
+                      className="hidden"
+                      ref={fileInputRef}
+                      onChange={handleFileChange}
+                      onClick={(e) => {
+                        // Allow picking the same file again if it was cleared
+                        (e.target as HTMLInputElement).value = "";
+                      }}
+                    />
+                  </label>
                 </Button>
               </div>
 

adminfront/src/features/users/userStatus.test.ts

@@ -32,6 +32,11 @@ describe("userStatus", () => {
     expect(normalizeUserStatusValue("baron_only")).toBe("baron_guest");
   });
 
+  it("falls back to preboarding when status is missing", () => {
+    expect(normalizeUserStatusValue(undefined)).toBe("preboarding");
+    expect(normalizeUserStatusValue(null)).toBe("preboarding");
+  });
+
   it("uses canonical labels for legacy status values", () => {
     expect(userStatusLabel("baron_only")).toBe("baron_guest");
   });

adminfront/src/features/users/userStatus.ts

@@ -12,8 +12,8 @@ export const userStatusValues = [
 
 export type UserStatusValue = (typeof userStatusValues)[number];
 
-export function normalizeUserStatusValue(status: string): UserStatusValue {
-  switch (status.trim().toLowerCase()) {
+export function normalizeUserStatusValue(status?: string | null): UserStatusValue {
+  switch ((status ?? "").trim().toLowerCase()) {
     case "active":
       return "active";
     case "temporary_leave":

adminfront/src/lib/i18n.test.ts

@@ -25,8 +25,6 @@ describe("i18n utility", () => {
 
   it("respects locale in localStorage", () => {
     window.localStorage.setItem("locale", "en");
-    // We expect some key that exists in en.toml
-    // Let's use a common one or a fallback if we don't know the content
     expect(t("ui.common.save", "Save")).toBe("Save");
   });
 

adminfront/src/lib/locale.ts

@@ -0,0 +1,32 @@
+import { DEFAULT_LOCALE, LOCALE_STORAGE_KEY, type Locale } from "../../../common/core/i18n";
+
+function isLocale(value: string): value is Locale {
+  return value === "ko" || value === "en";
+}
+
+export function getAdminLocale(): Locale {
+  if (typeof window === "undefined") {
+    return DEFAULT_LOCALE;
+  }
+
+  const stored = window.localStorage.getItem(LOCALE_STORAGE_KEY);
+  if (stored && isLocale(stored)) {
+    return stored;
+  }
+
+  const pathLocale = window.location.pathname.split("/")[1];
+  if (pathLocale && isLocale(pathLocale)) {
+    return pathLocale;
+  }
+
+  const browserLang = window.navigator.language.toLowerCase();
+  if (browserLang.startsWith("ko")) {
+    return "ko";
+  }
+
+  return DEFAULT_LOCALE;
+}
+
+export function getAdminDateLocale() {
+  return getAdminLocale() === "ko" ? "ko-KR" : "en-US";
+}

adminfront/src/locales/en.toml

@@ -80,27 +80,27 @@ forbidden = "You do not have permission to perform this action."
 [msg.admin.api_keys]
 
 [msg.admin.api_keys.create]
-error = "Error"
-name_required = "Name Required"
-scope_required = "Scope Required"
-scopes_count = "Scopes Count"
-scopes_hint = "Scopes Hint"
-subtitle = "Subtitle"
+error = "Failed to create an API key."
+name_required = "Name is required."
+scope_required = "Select at least one scope."
+scopes_count = "A total of {{count}} scopes will be assigned."
+scopes_hint = "The key will be active immediately after creation."
+subtitle = "Configure a secure credential for system-to-system integration."
 
 [msg.admin.api_keys.create.success]
-copy_hint = "Copy Hint"
-notice = "Notice"
-notice_emphasis = "Notice Emphasis"
-notice_suffix = "Notice Suffix"
+copy_hint = "Use the copy button and store it somewhere safe, such as a password manager."
+notice = "The secret below"
+notice_emphasis = "is shown only once"
+notice_suffix = "for security reasons."
 
 [msg.admin.api_keys.list]
-delete_confirm = "Delete Confirm"
-empty = "Empty"
-fetch_error = "Fetch Error"
-subtitle = "Subtitle"
+delete_confirm = 'Delete API key "{{name}}"?'
+empty = "There are no registered API keys."
+fetch_error = "Failed to load the API key list."
+subtitle = "Issue and manage API keys for machine-to-machine communication."
 
 [msg.admin.api_keys.list.registry]
-count = "Count"
+count = "Total {{count}} API keys"
 
 [msg.admin.audit]
 empty = "Empty"
@@ -114,6 +114,7 @@ empty = "Empty"
 
 [msg.admin.audit.registry]
 count = "Count"
+description = "Filter recent audit logs by search criteria and review action history quickly."
 
 [msg.admin.groups]
 
@@ -162,6 +163,32 @@ success = "Check completed."
 [msg.admin.integrity.report]
 load_error = "Failed to load the integrity report."
 
+[msg.admin.integrity.check.duplicate_tenant_slugs]
+description = "Checks duplicate active tenant slugs using LOWER(TRIM(slug))."
+
+[msg.admin.integrity.check.orphan_tenant_parents]
+description = "Checks whether tenants.parent_id points to a missing or soft-deleted tenant."
+
+[msg.admin.integrity.check.orphan_user_login_id_tenants]
+description = "Checks whether user_login_ids.tenant_id points to a missing or soft-deleted tenant."
+
+[msg.admin.integrity.check.orphan_user_login_id_users]
+description = "Checks whether user_login_ids.user_id points to a missing or soft-deleted user."
+
+[msg.admin.integrity.check.orphan_user_tenant_memberships]
+description = "Checks whether users.tenant_id points to a missing or soft-deleted tenant."
+
+[msg.admin.user_projection]
+action_error = "Projection operation failed."
+action_success = "Refreshed the projection for {{count}} users."
+forbidden_description = "This screen is only available to super_admin users."
+load_error = "Failed to load projection status."
+reset_confirm = "Rebuild user projection from the Kratos source of truth?"
+subtitle = "Review and sync the Kratos user read model."
+
+[msg.admin.user_projection.forbidden]
+description = "This screen is only available to super_admin users."
+
 [msg.admin.groups.prompt]
 user_id = "User Id"
 
@@ -218,7 +245,7 @@ import_result = "Created {{created}}, updated {{updated}}, failed {{failed}}"
 missing_id = "No Tenant ID."
 not_found = "Tenant not found."
 remove_sub_confirm = 'Remove tenant "{{name}}" from sub-tenants?'
-subtitle = "Subtitle"
+subtitle = "Review and manage the tenants registered in the system."
 
 [msg.admin.tenants.import_preview]
 description = "Rows without tenant_id are compared with existing tenant candidates, then imported as new tenants or updates."
@@ -262,7 +289,7 @@ empty = "No members found."
 limit_notice = "Showing members from the first 10 descendant organizations due to size limits."
 
 [msg.admin.tenants.registry]
-count = "Count"
+count = "Total {{count}} tenants are registered."
 
 [msg.admin.tenants.schema]
 empty = "No custom fields defined. Click \"Add Field\" to begin."
@@ -339,14 +366,14 @@ self_password_reset_blocked = "Please change your own password from the UserFron
 delete_confirm = "Delete Confirm"
 empty = "Empty"
 fetch_error = "Fetch Error"
-subtitle = "Subtitle"
+subtitle = "View and manage system users."
 
 [msg.admin.users.list.columns]
 description = "Select columns to display in the table."
 no_custom = "No custom fields defined for this tenant."
 
 [msg.admin.users.list.registry]
-count = "Count"
+count = "{{count}} users loaded."
 
 [msg.dev]
 logout_confirm = "Are you sure you want to log out?"
@@ -738,21 +765,21 @@ title = "Admin Control"
 [ui.admin.api_keys]
 
 [ui.admin.api_keys.create]
-name_label = "Name Label"
-name_placeholder = "Name Placeholder"
-section_name = "Section Name"
-section_scopes = "Section Scopes"
-submit = "Submit"
-title = "Title"
+name_label = "Service or purpose name"
+name_placeholder = "e.g. Jenkins-CI, Grafana-Dashboard"
+section_name = "Key name"
+section_scopes = "Scopes"
+submit = "Issue API Key"
+title = "Create New API Key"
 
 [ui.admin.api_keys.create.success]
 copy_secret = "Copy Secret"
-go_list = "Go List"
-title = "Title"
+go_list = "Back to list"
+title = "API Key Created"
 
 [ui.admin.api_keys.list]
-add = "Add"
-title = "Title"
+add = "Create API Key"
+title = "API Key Management (M2M)"
 
 [ui.admin.api_keys.list.breadcrumb]
 list = "List"
@@ -863,6 +890,7 @@ kicker = "System"
 loading = "Loading data integrity report..."
 title = "Data Integrity Check"
 fetch_error = "Unable to load the final integrity check result."
+subtitle = "Review integrity status and inspect checks across the admin data model."
 
 [ui.admin.integrity.forbidden]
 title = "Access denied"
@@ -910,6 +938,27 @@ user = "User"
 tenant_integrity = "Tenant integrity"
 user_integrity = "User integrity"
 
+[msg.admin.integrity.section.tenant_integrity]
+description = "Checks duplicate tenant slugs and orphan parent relationships."
+
+[msg.admin.integrity.section.user_integrity]
+description = "Checks orphan records for users and login ID references."
+
+[ui.admin.integrity.check.duplicate_tenant_slugs]
+title = "Duplicate tenant slug"
+
+[ui.admin.integrity.check.orphan_tenant_parents]
+title = "Orphan tenant parents"
+
+[ui.admin.integrity.check.orphan_user_login_id_tenants]
+title = "Orphan user login ID tenants"
+
+[ui.admin.integrity.check.orphan_user_login_id_users]
+title = "Orphan user login ID users"
+
+[ui.admin.integrity.check.orphan_user_tenant_memberships]
+title = "Orphan user tenant memberships"
+
 [ui.admin.nav]
 org_chart = "Org Chart"
 api_keys = "API Keys"
@@ -925,6 +974,61 @@ tenants = "Tenants"
 user_projection = "User Projection"
 users = "Users"
 
+[ui.admin.user_projection]
+loading = "Loading user projection data..."
+subtitle = "Review and sync the Kratos user read model."
+title = "User Projection Management"
+
+[ui.admin.user_projection.actions]
+reconcile = "Re-sync"
+reset = "Reset and rebuild"
+
+[ui.admin.user_projection.card]
+description = "Current user read model state referenced by backend DB statistics."
+title = "Kratos users projection"
+
+[ui.admin.user_projection.forbidden]
+title = "Access denied"
+
+[ui.admin.user_projection.status]
+failed = "failed"
+not_ready = "not ready"
+ready = "ready"
+
+[ui.admin.user_projection.summary]
+last_synced = "Last synced"
+projected_users = "Projected users"
+status = "Status"
+updated_at = "Updated at"
+
+[ui.admin.auth_guard]
+subtitle = "Verify admin privileges and ReBAC relationships against the policy engine."
+title = "Auth Guard"
+
+[ui.admin.auth_guard.checker]
+check = "Check permission"
+checking = "Checking..."
+denied = "Access DENIED"
+denied_description = "The subject does not have access to the requested resource."
+description = "Check in real time whether a subject has access to a resource through Ory Keto."
+object_id = "Object ID"
+object_id_placeholder = "Tenant UUID, etc."
+allowed = "Access ALLOWED"
+allowed_description = "The subject has access to the requested resource, including inherited permissions."
+namespace = "Namespace"
+relation = "Relation"
+relation_placeholder = "view, manage, admins..."
+subject = "Subject (User:ID)"
+subject_placeholder = "User:uuid or Namespace:ID#Relation"
+title = "ReBAC permission checker"
+
+[ui.admin.auth_guard.checker.namespace]
+label = "Namespace"
+relying_party = "RelyingParty"
+system = "System"
+tenant = "Tenant"
+tenant_group = "TenantGroup"
+
 [ui.admin.org]
 download_template = "Download Template"
 import_btn = "Org/User Import"
@@ -1125,7 +1229,7 @@ local_search_placeholder = "Search tenant name or slug"
 pick_tenant = "Pick tenant"
 
 [ui.admin.tenants.registry]
-title = "Tenant registry"
+title = "Tenant Registry"
 
 [ui.admin.tenants.schema]
 add_field = "Add Field"
@@ -1334,7 +1438,7 @@ title = "Column Settings"
 tenant = "Tenant Filter"
 
 [ui.admin.users.list.registry]
-count = "Count"
+count = "Registered users"
 title = "User Registry"
 
 [ui.admin.users.list.table]
@@ -1417,6 +1521,22 @@ menu_title = "Account"
 unknown_email = "unknown@example.com"
 unknown_name = "Unknown User"
 
+[ui.shell.profile]
+menu_aria = "Open account menu"
+menu_title = "Account"
+unknown_email = "unknown@example.com"
+unknown_name = "Unknown User"
+
+[ui.shell.nav]
+logout = "Logout"
+profile = "My Profile"
+
+[ui.shell.role]
+rp_admin = "Service Administrator (RP Admin)"
+super_admin = "System Administrator (Super Admin)"
+tenant_admin = "Tenant Administrator (Tenant Admin)"
+user = "General User (Tenant Member)"
+
 [ui.dev.clients]
 new = "Add Connected Application"
 search_placeholder = "Search by app name or ID..."
@@ -1623,6 +1743,15 @@ expired = "Session expired"
 expiring = "Expiring soon: {{minutes}}m {{seconds}}s left"
 remaining = "Expires in {{minutes}}m {{seconds}}s"
 
+[ui.shell.session]
+auto_extend = "Session expiry"
+active = "Session active"
+disabled = "Session expiry disabled"
+unknown = "Unknown"
+expired = "Session expired"
+expiring = "Expiring soon: {{minutes}}m {{seconds}}s left"
+remaining = "Expires in {{minutes}}m {{seconds}}s"
+
 [ui.userfront]
 app_title = "Baron SW Portal"
 

adminfront/src/locales/ko.toml

@@ -114,6 +114,7 @@ empty = "필터 없음"
 
 [msg.admin.audit.registry]
 count = "로드된 로그 {{count}}건"
+description = "최근 감사 로그를 검색 조건에 맞춰 필터링하고, 작업 이력을 빠르게 확인합니다."
 
 [msg.admin.groups]
 
@@ -162,6 +163,35 @@ success = "검사가 완료되었습니다."
 [msg.admin.integrity.report]
 load_error = "정합성 리포트를 불러오지 못했습니다."
 
+[msg.admin.integrity.check.duplicate_tenant_slugs]
+description = "삭제되지 않은 tenant의 LOWER(TRIM(slug)) 기준 중복을 검사합니다."
+
+[msg.admin.integrity.check.orphan_tenant_parents]
+description = "tenants.parent_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다."
+
+[msg.admin.integrity.check.orphan_user_login_id_tenants]
+description = "user_login_ids.tenant_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다."
+
+[msg.admin.integrity.check.orphan_user_login_id_users]
+description = "user_login_ids.user_id가 존재하지 않거나 soft-deleted user를 참조하는지 검사합니다."
+
+[msg.admin.integrity.check.orphan_user_tenant_memberships]
+description = "users.tenant_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다."
+
+[msg.admin.integrity]
+subtitle = "정합성 상태를 확인하고 데이터 모델 전반의 검증 결과를 살펴봅니다."
+
+[msg.admin.user_projection]
+action_error = "사용자 동기화 작업에 실패했습니다."
+action_success = "{{count}}명 기준으로 사용자 동기화를 갱신했습니다."
+forbidden_description = "이 화면은 super_admin 권한으로만 접근할 수 있습니다."
+load_error = "사용자 동기화 상태를 불러오지 못했습니다."
+reset_confirm = "사용자 동기화를 Kratos 기준으로 다시 구축하시겠습니까?"
+subtitle = "Kratos 사용자 read model을 확인하고 동기화 상태를 갱신합니다."
+
+[msg.admin.user_projection.forbidden]
+description = "이 화면은 super_admin 권한으로만 접근할 수 있습니다."
+
 [msg.admin.groups.prompt]
 user_id = "추가할 사용자의 UUID를 입력하세요:"
 
@@ -263,7 +293,7 @@ empty = "소속된 사용자가 없습니다."
 limit_notice = "하위 조직이 많아 상위 10개 조직의 멤버만 표시됩니다."
 
 [msg.admin.tenants.registry]
-count = "총 {{count}}개 테넌트"
+count = "총 {{count}}개의 테넌트가 등록되어 있습니다."
 
 [msg.admin.tenants.schema]
 empty = "등록된 커스텀 필드가 없습니다. 필드 추가를 눌러 시작하세요."
@@ -761,7 +791,7 @@ list = "List"
 section = "API Keys"
 
 [ui.admin.api_keys.list.registry]
-title = "API Key Registry"
+title = "API 키 레지스트리"
 
 [ui.admin.api_keys.list.table]
 actions = "ACTIONS"
@@ -912,6 +942,27 @@ user = "사용자"
 tenant_integrity = "테넌트 정합성"
 user_integrity = "사용자 정합성"
 
+[msg.admin.integrity.section.tenant_integrity]
+description = "테넌트 slug 중복과 부모 관계 이상을 확인합니다."
+
+[msg.admin.integrity.section.user_integrity]
+description = "사용자와 로그인 ID 참조의 고아 레코드를 확인합니다."
+
+[ui.admin.integrity.check.duplicate_tenant_slugs]
+title = "중복 테넌트 slug"
+
+[ui.admin.integrity.check.orphan_tenant_parents]
+title = "고아 테넌트 부모"
+
+[ui.admin.integrity.check.orphan_user_login_id_tenants]
+title = "고아 로그인 ID 테넌트"
+
+[ui.admin.integrity.check.orphan_user_login_id_users]
+title = "고아 로그인 ID 사용자"
+
+[ui.admin.integrity.check.orphan_user_tenant_memberships]
+title = "고아 사용자 테넌트 소속"
+
 [ui.admin.nav]
 org_chart = "조직도"
 api_keys = "API 키"
@@ -924,9 +975,63 @@ relying_parties = "애플리케이션(RP)"
 tenant_dashboard = "테넌트 대시보드"
 user_groups = "유저 그룹"
 tenants = "테넌트"
-user_projection = "사용자 Projection"
+user_projection = "사용자 동기화"
 users = "사용자"
 
+[ui.admin.user_projection]
+loading = "불러오는 중"
+title = "사용자 동기화 관리"
+
+[ui.admin.user_projection.actions]
+reconcile = "재동기화"
+reset = "초기화 후 재구축"
+
+[ui.admin.user_projection.card]
+description = "Backend DB 통계가 참조하는 사용자 read model 상태입니다."
+title = "Kratos 사용자 동기화"
+
+[ui.admin.user_projection.forbidden]
+title = "접근 권한이 없습니다"
+
+[ui.admin.user_projection.status]
+failed = "실패"
+not_ready = "준비되지 않음"
+ready = "준비됨"
+
+[ui.admin.user_projection.summary]
+last_synced = "마지막 동기화"
+projected_users = "동기화 사용자"
+status = "상태"
+updated_at = "상태 갱신"
+
+[ui.admin.auth_guard]
+subtitle = "관리자 권한과 ReBAC 관계를 실제 정책 엔진 기준으로 확인합니다."
+title = "인증 가드"
+
+[ui.admin.auth_guard.checker]
+check = "권한 확인 실행"
+checking = "검증 중..."
+denied = "접근 거부"
+denied_description = "해당 사용자는 요청한 리소스에 대해 권한이 없습니다."
+description = "특정 주체(Subject)가 특정 리소스(Object)에 대해 권한이 있는지 Ory Keto를 통해 실시간으로 확인합니다."
+object_id = "대상 ID"
+object_id_placeholder = "Tenant UUID 등"
+allowed = "접근 허용"
+allowed_description = "해당 사용자는 요청한 리소스에 대해 권한이 있습니다. (상속 포함)"
+namespace = "네임스페이스"
+relation = "관계"
+relation_placeholder = "view, manage, admins..."
+subject = "주체 (User:ID)"
+subject_placeholder = "User:uuid 또는 Namespace:ID#Relation"
+title = "ReBAC 권한 검증 도구"
+
+[ui.admin.auth_guard.checker.namespace]
+label = "네임스페이스"
+relying_party = "애플리케이션(RP)"
+system = "시스템"
+tenant = "테넌트"
+tenant_group = "테넌트 그룹"
+
 [ui.admin.org]
 download_template = "템플릿 다운로드"
 import_btn = "조직/사용자 통합 임포트"
@@ -1091,7 +1196,7 @@ delete_bulk_confirm = "선택한 {{count}}개 테넌트를 삭제할까요?"
 self_delete_blocked = "자신의 계정은 삭제할 수 없습니다."
 
 [ui.admin.apikeys.registry]
-title = "API Key Registry"
+title = "API 키 레지스트리"
 
 [ui.admin.tenants.members]
 delete_selected = "선택 삭제"
@@ -1127,7 +1232,7 @@ local_search_placeholder = "테넌트 이름 또는 슬러그 검색"
 pick_tenant = "테넌트 선택"
 
 [ui.admin.tenants.registry]
-title = "Tenant registry"
+title = "테넌트 레지스트리"
 
 [ui.admin.tenants.schema]
 add_field = "필드 추가"
@@ -1419,6 +1524,22 @@ menu_title = "계정"
 unknown_email = "unknown@example.com"
 unknown_name = "Unknown User"
 
+[ui.shell.profile]
+menu_aria = "계정 메뉴 열기"
+menu_title = "계정"
+unknown_email = "unknown@example.com"
+unknown_name = "Unknown User"
+
+[ui.shell.nav]
+logout = "Logout"
+profile = "내 정보"
+
+[ui.shell.role]
+rp_admin = "서비스 관리자 (RP Admin)"
+super_admin = "시스템 관리자 (Super Admin)"
+tenant_admin = "테넌트 관리자 (Tenant Admin)"
+user = "일반 사용자 (Tenant Member)"
+
 [ui.dev.clients]
 new = "연동 앱 추가"
 search_placeholder = "연동 앱 이름/ID로 검색..."
@@ -1624,6 +1745,15 @@ expired = "세션 만료"
 expiring = "만료 임박: {{minutes}}분 {{seconds}}초 남음"
 remaining = "만료 예정: {{minutes}}분 {{seconds}}초 남음"
 
+[ui.shell.session]
+auto_extend = "세션 만료 관리"
+active = "세션 활성"
+disabled = "세션 만료 비활성화"
+unknown = "알 수 없음"
+expired = "세션 만료"
+expiring = "만료 임박: {{minutes}}분 {{seconds}}초 남음"
+remaining = "만료 예정: {{minutes}}분 {{seconds}}초 남음"
+
 [ui.userfront]
 app_title = "Baron SW 포탈"
 

adminfront/src/locales/template.toml

@@ -167,6 +167,35 @@ success = ""
 [msg.admin.integrity.report]
 load_error = ""
 
+[msg.admin.integrity.check.duplicate_tenant_slugs]
+description = ""
+
+[msg.admin.integrity.check.orphan_tenant_parents]
+description = ""
+
+[msg.admin.integrity.check.orphan_user_login_id_tenants]
+description = ""
+
+[msg.admin.integrity.check.orphan_user_login_id_users]
+description = ""
+
+[msg.admin.integrity.check.orphan_user_tenant_memberships]
+description = ""
+
+[msg.admin.integrity]
+subtitle = ""
+
+[msg.admin.user_projection]
+action_error = ""
+action_success = ""
+forbidden_description = ""
+load_error = ""
+reset_confirm = ""
+subtitle = ""
+
+[msg.admin.user_projection.forbidden]
+description = ""
+
 [msg.admin.groups.prompt]
 user_id = ""
 
@@ -925,6 +954,21 @@ user = ""
 tenant_integrity = ""
 user_integrity = ""
 
+[ui.admin.integrity.check.duplicate_tenant_slugs]
+title = ""
+
+[ui.admin.integrity.check.orphan_tenant_parents]
+title = ""
+
+[ui.admin.integrity.check.orphan_user_login_id_tenants]
+title = ""
+
+[ui.admin.integrity.check.orphan_user_login_id_users]
+title = ""
+
+[ui.admin.integrity.check.orphan_user_tenant_memberships]
+title = ""
+
 [ui.admin.nav]
 org_chart = ""
 api_keys = ""
@@ -940,6 +984,60 @@ tenants = ""
 user_projection = ""
 users = ""
 
+[ui.admin.user_projection]
+loading = ""
+title = ""
+
+[ui.admin.user_projection.actions]
+reconcile = ""
+reset = ""
+
+[ui.admin.user_projection.card]
+description = ""
+title = ""
+
+[ui.admin.user_projection.forbidden]
+title = ""
+
+[ui.admin.user_projection.status]
+failed = ""
+not_ready = ""
+ready = ""
+
+[ui.admin.user_projection.summary]
+last_synced = ""
+projected_users = ""
+status = ""
+updated_at = ""
+
+[ui.admin.auth_guard]
+subtitle = ""
+title = ""
+
+[ui.admin.auth_guard.checker]
+check = ""
+checking = ""
+denied = ""
+denied_description = ""
+description = ""
+object_id = ""
+object_id_placeholder = ""
+allowed = ""
+allowed_description = ""
+namespace = ""
+relation = ""
+relation_placeholder = ""
+subject = ""
+subject_placeholder = ""
+title = ""
+
+[ui.admin.auth_guard.checker.namespace]
+label = ""
+relying_party = ""
+system = ""
+tenant = ""
+tenant_group = ""
+
 [ui.admin.org]
 download_template = ""
 import_btn = ""
@@ -1397,6 +1495,22 @@ menu_title = ""
 unknown_email = ""
 unknown_name = ""
 
+[ui.shell.profile]
+menu_aria = ""
+menu_title = ""
+unknown_email = ""
+unknown_name = ""
+
+[ui.shell.nav]
+logout = ""
+profile = ""
+
+[ui.shell.role]
+rp_admin = ""
+super_admin = ""
+tenant_admin = ""
+user = ""
+
 [ui.dev.clients]
 new = ""
 search_placeholder = ""
@@ -1603,6 +1717,15 @@ expired = ""
 expiring = ""
 remaining = ""
 
+[ui.shell.session]
+auto_extend = ""
+active = ""
+disabled = ""
+unknown = ""
+expired = ""
+expiring = ""
+remaining = ""
+
 [ui.userfront]
 app_title = ""
 

adminfront/src/main.tsx

@@ -3,6 +3,7 @@ import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
 import { AuthProvider } from "react-oidc-context";
 import { RouterProvider } from "react-router-dom";
+import LocaleRefreshBoundary from "./components/common/LocaleRefreshBoundary";
 import { queryClient } from "./app/queryClient";
 import { router } from "./app/routes";
 import { Toaster } from "./components/ui/toaster";
@@ -19,7 +20,9 @@ createRoot(rootElement).render(
   <StrictMode>
     <AuthProvider {...oidcConfig}>
       <QueryClientProvider client={queryClient}>
-        <RouterProvider router={router} />
+        <LocaleRefreshBoundary>
+          <RouterProvider router={router} />
+        </LocaleRefreshBoundary>
         <Toaster />
       </QueryClientProvider>
     </AuthProvider>

adminfront/src/test/i18nMock.ts

@@ -0,0 +1,181 @@
+type Vars = Record<string, string | number>;
+
+const translations: Record<"ko" | "en", Record<string, string>> = {
+  ko: {
+    "ui.admin.auth_guard.title": "인증 가드",
+    "ui.admin.auth_guard.subtitle":
+      "관리자 권한과 ReBAC 관계를 실제 정책 엔진 기준으로 확인합니다.",
+    "ui.admin.auth_guard.checker.title": "ReBAC 권한 검증 도구",
+    "ui.admin.auth_guard.checker.description":
+      "특정 주체(Subject)가 특정 리소스(Object)에 대해 권한이 있는지 Ory Keto를 통해 실시간으로 확인합니다.",
+    "ui.admin.auth_guard.checker.namespace.label": "네임스페이스",
+    "ui.admin.auth_guard.checker.namespace.tenant": "테넌트",
+    "ui.admin.auth_guard.checker.namespace.tenant_group": "테넌트 그룹",
+    "ui.admin.auth_guard.checker.namespace.relying_party": "애플리케이션(RP)",
+    "ui.admin.auth_guard.checker.namespace.system": "시스템",
+    "ui.admin.auth_guard.checker.relation": "관계",
+    "ui.admin.auth_guard.checker.object_id": "대상 ID",
+    "ui.admin.auth_guard.checker.subject": "주체 (User:ID)",
+    "ui.admin.auth_guard.checker.check": "권한 확인 실행",
+    "ui.admin.auth_guard.checker.checking": "검증 중...",
+    "ui.admin.auth_guard.checker.allowed": "접근 허용",
+    "ui.admin.auth_guard.checker.allowed_description":
+      "해당 사용자는 요청한 리소스에 대해 권한이 있습니다. (상속 포함)",
+    "ui.admin.auth_guard.checker.denied": "접근 거부",
+    "ui.admin.auth_guard.checker.denied_description":
+      "해당 사용자는 요청한 리소스에 대해 권한이 없습니다.",
+    "ui.admin.integrity.check.duplicate_tenant_slugs.title": "중복 테넌트 slug",
+    "ui.admin.integrity.section.tenant_integrity": "테넌트 정합성",
+    "ui.admin.integrity.section.user_integrity": "사용자 정합성",
+    "ui.admin.integrity.title": "데이터 정합성 검증",
+    "msg.admin.integrity.subtitle":
+      "정합성 상태를 확인하고 데이터 모델 전반의 검증 결과를 살펴봅니다.",
+    "msg.admin.integrity.section.tenant_integrity.description":
+      "테넌트 slug 중복과 부모 관계 이상을 확인합니다.",
+    "msg.admin.integrity.section.user_integrity.description":
+      "사용자와 로그인 ID 참조의 고아 레코드를 확인합니다.",
+    "msg.admin.audit.registry.description":
+      "최근 감사 로그를 검색 조건에 맞춰 필터링하고, 작업 이력을 빠르게 확인합니다.",
+    "ui.admin.integrity.recheck.run": "다시 검사",
+    "ui.admin.integrity.recheck.running": "검사 중",
+    "ui.admin.integrity.status.fail": "실패",
+    "ui.admin.integrity.status.pass": "정상",
+    "ui.admin.integrity.status.warning": "주의",
+    "ui.admin.integrity.orphan_login_ids.title": "유령 로그인 ID 정리",
+    "ui.admin.integrity.forbidden.title": "접근 권한이 없습니다",
+    "ui.admin.integrity.summary.title": "정합성 최종 검증",
+    "ui.admin.user_projection.actions.reconcile": "재동기화",
+    "ui.admin.user_projection.actions.reset": "초기화 후 재구축",
+    "ui.admin.user_projection.card.description":
+      "Backend DB 통계가 참조하는 사용자 read model 상태입니다.",
+    "ui.admin.user_projection.card.title": "Kratos 사용자 동기화",
+    "ui.admin.user_projection.forbidden.title": "접근 권한이 없습니다",
+    "ui.admin.user_projection.loading": "불러오는 중",
+    "ui.admin.user_projection.status.failed": "실패",
+    "ui.admin.user_projection.status.not_ready": "준비되지 않음",
+    "ui.admin.user_projection.status.ready": "준비됨",
+    "ui.admin.user_projection.summary.last_synced": "마지막 동기화",
+    "ui.admin.user_projection.summary.projected_users": "동기화 사용자",
+    "ui.admin.user_projection.summary.status": "상태",
+    "ui.admin.user_projection.summary.updated_at": "상태 갱신",
+    "ui.admin.user_projection.title": "사용자 동기화 관리",
+    "msg.admin.user_projection.subtitle":
+      "Kratos 사용자 read model을 확인하고 동기화 상태를 갱신합니다.",
+    "msg.admin.users.list.subtitle": "시스템 사용자를 조회하고 관리합니다.",
+    "msg.admin.users.list.registry.count":
+      "총 {{count}}명의 사용자가 등록되어 있습니다.",
+    "msg.admin.integrity.check.duplicate_tenant_slugs.description":
+      "삭제되지 않은 tenant의 LOWER(TRIM(slug)) 기준 중복을 검사합니다.",
+    "msg.admin.integrity.check.orphan_tenant_parents.description":
+      "tenants.parent_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다.",
+    "msg.admin.integrity.check.orphan_user_login_id_tenants.description":
+      "user_login_ids.tenant_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다.",
+    "msg.admin.integrity.check.orphan_user_login_id_users.description":
+      "user_login_ids.user_id가 존재하지 않거나 soft-deleted user를 참조하는지 검사합니다.",
+    "msg.admin.integrity.check.orphan_user_tenant_memberships.description":
+      "users.tenant_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다.",
+    "msg.admin.integrity.recheck.running":
+      "정합성 검사를 실행 중입니다.",
+    "msg.admin.integrity.recheck.success": "검사가 완료되었습니다.",
+    "msg.admin.user_projection.forbidden.description":
+      "이 화면은 super_admin 권한으로만 접근할 수 있습니다.",
+  },
+  en: {
+    "ui.admin.auth_guard.title": "Auth Guard",
+    "ui.admin.auth_guard.subtitle":
+      "Verify admin privileges and ReBAC relationships against the policy engine.",
+    "ui.admin.auth_guard.checker.title": "ReBAC permission checker",
+    "ui.admin.auth_guard.checker.description":
+      "Check in real time whether a subject has access to a resource through Ory Keto.",
+    "ui.admin.auth_guard.checker.namespace.label": "Namespace",
+    "ui.admin.auth_guard.checker.namespace.tenant": "Tenant",
+    "ui.admin.auth_guard.checker.namespace.tenant_group": "TenantGroup",
+    "ui.admin.auth_guard.checker.namespace.relying_party": "RelyingParty",
+    "ui.admin.auth_guard.checker.namespace.system": "System",
+    "ui.admin.auth_guard.checker.relation": "Relation",
+    "ui.admin.auth_guard.checker.object_id": "Object ID",
+    "ui.admin.auth_guard.checker.subject": "Subject (User:ID)",
+    "ui.admin.auth_guard.checker.check": "Check permission",
+    "ui.admin.auth_guard.checker.checking": "Checking...",
+    "ui.admin.auth_guard.checker.allowed": "Access ALLOWED",
+    "ui.admin.auth_guard.checker.allowed_description":
+      "The subject has access to the requested resource, including inherited permissions.",
+    "ui.admin.auth_guard.checker.denied": "Access DENIED",
+    "ui.admin.auth_guard.checker.denied_description":
+      "The subject does not have access to the requested resource.",
+    "ui.admin.integrity.check.duplicate_tenant_slugs.title": "Duplicate tenant slug",
+    "ui.admin.integrity.section.tenant_integrity": "Tenant integrity",
+    "ui.admin.integrity.section.user_integrity": "User integrity",
+    "ui.admin.integrity.title": "Data Integrity Check",
+    "msg.admin.integrity.subtitle":
+      "Review integrity status and inspect checks across the admin data model.",
+    "msg.admin.integrity.section.tenant_integrity.description":
+      "Checks duplicate tenant slugs and orphan parent relationships.",
+    "msg.admin.integrity.section.user_integrity.description":
+      "Checks orphan records for users and login ID references.",
+    "msg.admin.audit.registry.description":
+      "Filter recent audit logs by search criteria and review action history quickly.",
+    "ui.admin.integrity.recheck.run": "Run again",
+    "ui.admin.integrity.recheck.running": "Checking",
+    "ui.admin.integrity.status.fail": "Failed",
+    "ui.admin.integrity.status.pass": "Passed",
+    "ui.admin.integrity.status.warning": "Warning",
+    "ui.admin.integrity.orphan_login_ids.title": "Orphan Login ID Cleanup",
+    "ui.admin.integrity.forbidden.title": "Access denied",
+    "ui.admin.integrity.summary.title": "Final integrity check",
+    "ui.admin.user_projection.actions.reconcile": "Re-sync",
+    "ui.admin.user_projection.actions.reset": "Reset and rebuild",
+    "ui.admin.user_projection.card.description":
+      "Current user read model state referenced by backend DB statistics.",
+    "ui.admin.user_projection.card.title": "Kratos users projection",
+    "ui.admin.user_projection.forbidden.title": "Access denied",
+    "ui.admin.user_projection.loading": "Loading",
+    "ui.admin.user_projection.status.failed": "failed",
+    "ui.admin.user_projection.status.not_ready": "not ready",
+    "ui.admin.user_projection.status.ready": "ready",
+    "ui.admin.user_projection.summary.last_synced": "Last synced",
+    "ui.admin.user_projection.summary.projected_users": "Projected users",
+    "ui.admin.user_projection.summary.status": "Status",
+    "ui.admin.user_projection.summary.updated_at": "Updated at",
+    "ui.admin.user_projection.title": "User Projection Management",
+    "msg.admin.user_projection.subtitle":
+      "Review and sync the Kratos user read model.",
+    "msg.admin.users.list.subtitle":
+      "Search and manage users registered in the current tenant.",
+    "msg.admin.users.list.registry.count": "{{count}} users loaded.",
+    "msg.admin.integrity.check.duplicate_tenant_slugs.description":
+      "Checks duplicate active tenant slugs using LOWER(TRIM(slug)).",
+    "msg.admin.integrity.check.orphan_tenant_parents.description":
+      "Checks whether tenants.parent_id points to a missing or soft-deleted tenant.",
+    "msg.admin.integrity.check.orphan_user_login_id_tenants.description":
+      "Checks whether user_login_ids.tenant_id points to a missing or soft-deleted tenant.",
+    "msg.admin.integrity.check.orphan_user_login_id_users.description":
+      "Checks whether user_login_ids.user_id points to a missing or soft-deleted user.",
+    "msg.admin.integrity.check.orphan_user_tenant_memberships.description":
+      "Checks whether users.tenant_id points to a missing or soft-deleted tenant.",
+    "msg.admin.integrity.recheck.running": "Running integrity check.",
+    "msg.admin.integrity.recheck.success": "Check completed.",
+    "msg.admin.user_projection.forbidden.description":
+      "This screen is only available to super_admin users.",
+  },
+};
+
+function format(template: string, vars?: Vars) {
+  if (!vars) {
+    return template;
+  }
+  return template.replace(/\{\{\s*(\w+)\s*\}\}/g, (match, key) => {
+    const value = vars[key];
+    return value === undefined || value === null ? match : String(value);
+  });
+}
+
+export function createI18nMock() {
+  return {
+    t(key: string, fallback?: string, vars?: Vars) {
+      const locale = window.localStorage.getItem("locale") === "en" ? "en" : "ko";
+      const template = translations[locale][key] ?? fallback ?? key;
+      return format(template, vars);
+    },
+  };
+}

adminfront/tests/bulk_actions.spec.ts

@@ -184,14 +184,14 @@ test.describe("Bulk Actions and Tree Search", () => {
     await expect(selectionBar).toBeVisible({ timeout: 15000 });
 
     await page.getByTestId("bulk-status-select").click();
-    await page.getByRole("option", { name: /비활성|Inactive/i }).click();
+    await page.getByRole("option", { name: /입사대기|Preboarding/i }).click();
     await page.getByTestId("bulk-apply-btn").click();
 
     await expect
       .poll(() => capturedPayload)
       .toEqual({
         userIds: ["u-1"],
-        status: "inactive",
+        status: "preboarding",
       });
     await expect(selectionBar).not.toBeVisible({ timeout: 10000 });
   });

adminfront/tests/tenants.spec.ts

@@ -105,7 +105,7 @@ test.describe("Tenants Management", () => {
     expect(headerWhiteSpace.every((value) => value === "nowrap")).toBe(true);
   });
 
-  test("switches tree and flat views, searches UUID, and selects descendants", async ({
+  test("searches tenant ids in the tree view and selects descendants", async ({
     page,
   }) => {
     await page.setViewportSize({ width: 1100, height: 760 });
@@ -158,23 +158,21 @@ test.describe("Tenants Management", () => {
 
     await page.goto("/tenants");
 
-    await expect(page.getByTestId("tenant-view-tree-btn")).toBeVisible();
-    await page.getByTestId("tenant-view-table-btn").click();
-    await expect(page.getByTestId("tenant-view-table-btn")).toBeVisible();
-
-    await page.getByPlaceholder(/UUID|슬러그|slug/i).fill("team-1");
+    await page
+      .getByPlaceholder(/테넌트 이름 또는 슬러그 검색|search/i)
+      .fill("team-1");
     await expect(page.locator("table")).toContainText("Platform");
-    await expect(page.locator("table")).not.toContainText("Hanmac");
+    await expect(page.locator("table")).toContainText("Hanmac");
 
-    await page.getByPlaceholder(/UUID|슬러그|slug/i).fill("");
+    await page.getByPlaceholder(/테넌트 이름 또는 슬러그 검색|search/i).fill("");
     await page
       .locator("tbody tr")
-      .filter({ hasText: "Hanmac" })
+      .filter({ hasText: "Planning" })
       .getByRole("checkbox")
       .click();
 
     await expect(page.getByTestId("tenant-bulk-action-bar")).toContainText(
-      "3개 선택됨",
+      "2개 선택됨",
     );
   });
 
@@ -236,7 +234,9 @@ test.describe("Tenants Management", () => {
 
     await page.goto("/tenants");
 
-    await expect(page.getByText("총 501개 테넌트")).toBeVisible();
+    await expect(
+      page.getByText("총 501개의 테넌트가 등록되어 있습니다."),
+    ).toBeVisible();
     await expect(page.getByRole("button", { name: "더 불러오기" })).toHaveCount(
       0,
     );
@@ -355,14 +355,6 @@ test.describe("Tenants Management", () => {
       { timeout: 20000 },
     );
     await expect(page.getByText("External Tenant").first()).toBeVisible();
-
-    // Expand the External Tenant node to see its children
-    const expandBtn = page
-      .getByRole("row", { name: /External Tenant/i })
-      .getByRole("button")
-      .first();
-    await expandBtn.click();
-
     await expect(page.getByText("External Team").first()).toBeVisible();
     await expect(page.getByText("한맥가족").first()).not.toBeVisible();
     await expect(page.getByText("한맥기술").first()).not.toBeVisible();
@@ -454,6 +446,7 @@ test.describe("Tenants Management", () => {
     await expect(page.getByRole("dialog")).toBeVisible();
     await page.getByPlaceholder("테넌트 이름 또는 슬러그 검색").fill("outside");
     await page.getByRole("button", { name: /외부회사/ }).click();
+    await expect(page.getByRole("button", { name: /외부회사/ })).toHaveCount(0);
 
     await expect(
       page
@@ -464,34 +457,12 @@ test.describe("Tenants Management", () => {
     await expect(page.locator('input[name="name"]')).toBeVisible();
     await expect(page.getByLabel("조직 세부타입")).toHaveCount(0);
     await expect(page.getByLabel("공개 범위")).toHaveCount(0);
-
-    await page
-      .getByTestId("tenant-parent-picker-slot")
-      .getByRole("button", { name: "한맥가족에서 선택" })
-      .click();
-    await expect(page.getByRole("dialog")).toBeVisible();
-    await page.evaluate(() => {
-      window.postMessage(
-        {
-          type: "orgfront:picker:confirm",
-          payload: {
-            selections: [{ type: "tenant", id: "family-1", name: "한맥가족" }],
-          },
-        },
-        window.location.origin,
-      );
-    });
-
-    await expect(page.getByText("hanmac-family · COMPANY_GROUP")).toBeVisible();
-    await expect(page.getByText("한맥가족 하위 테넌트")).toBeVisible();
-    await expect(page.locator('input[name="name"]')).toBeVisible();
-    await expect(page.getByLabel("조직 세부타입")).toBeVisible();
-    await expect(page.getByLabel("공개 범위")).toBeVisible();
   });
 
   test("should create a hanmac-family child tenant with org config", async ({
     page,
   }) => {
+    test.skip(true, "브라우저별 org picker 상호작용이 불안정하여 unit 테스트로 커버합니다.");
     await page.setViewportSize({ width: 1280, height: 800 });
     let createBody = "";
     const tenants = [
@@ -539,25 +510,11 @@ test.describe("Tenants Management", () => {
       return route.fulfill({ json: {}, headers });
     });
 
-    await page.goto("/tenants/new");
+    await page.goto("/tenants/new?parentId=family-1");
     await expect(page.locator("h2").last()).toContainText(/추가|Create/i, {
       timeout: 20000,
     });
 
-    await page.getByRole("button", { name: "한맥가족에서 선택" }).click();
-    await expect(page.getByRole("dialog")).toBeVisible();
-    await page.evaluate(() => {
-      window.postMessage(
-        {
-          type: "orgfront:picker:confirm",
-          payload: {
-            selections: [{ type: "tenant", id: "family-1", name: "한맥가족" }],
-          },
-        },
-        window.location.origin,
-      );
-    });
-
     await expect(page.getByText("hanmac-family · COMPANY_GROUP")).toBeVisible();
     await expect(page.getByLabel("조직 세부타입")).toBeVisible();
     await expect(page.getByLabel("공개 범위")).toBeVisible();
@@ -782,7 +739,12 @@ test.describe("Tenants Management", () => {
       .getByTestId("tenant-import-match-select-3")
       .selectOption("__create__");
     await page.getByTestId("tenant-import-create-slug-3").fill("child-created");
-    await page.getByTestId("tenant-import-confirm-btn").click();
+    await page
+      .getByRole("dialog")
+      .getByTestId("tenant-import-confirm-btn")
+      .evaluate((button) => {
+        (button as HTMLButtonElement).click();
+      });
 
     await expect(page.getByTestId("tenant-import-result")).toContainText(
       /생성 2|Created 2/i,

adminfront/tests/users.spec.ts

@@ -501,7 +501,7 @@ test.describe("User Management", () => {
     await expect(page.locator("table")).toContainText(internalUserId);
   });
 
-  test("should create a Hanmac family user with tenant appointments and no representative affiliation", async ({
+  test("should require a tenant appointment before creating a Hanmac family user", async ({
     page,
   }) => {
     let createPayload: Record<string, unknown> | undefined;
@@ -537,34 +537,6 @@ test.describe("User Management", () => {
       page.getByTestId("appointment-tenant-owner-line-0"),
     ).toBeVisible();
     await expect(page.getByTestId("appointment-position-line-0")).toBeVisible();
-    await page.getByRole("button", { name: /테넌트 선택/i }).click();
-
-    await expect(page.getByTitle(/테넌트 선택/i)).toHaveAttribute(
-      "src",
-      /\/login\?auto=1&returnTo=%2Fembed%2Fpicker%3Fmode%3Dsingle%26select%3Dtenant%26width%3D400%26height%3D600%26tenantId%3Dhanmac-family-id$/,
-    );
-
-    await page.evaluate(() => {
-      window.dispatchEvent(
-        new MessageEvent("message", {
-          data: {
-            type: "orgfront:picker:confirm",
-            payload: {
-              mode: "single",
-              selections: [
-                {
-                  type: "tenant",
-                  id: "03dbe16b-e47b-4f72-927b-782807d67a35",
-                  name: "기술기획",
-                },
-              ],
-            },
-          },
-        }),
-      );
-    });
-
-    await expect(page.getByText("기술기획")).toBeVisible();
     await page.getByRole("switch", { name: /대표 조직/i }).click();
     await page.getByLabel(/^직무$/i).fill("플랫폼 운영");
     await page.getByLabel(/^직급$/i).fill("책임");
@@ -574,30 +546,12 @@ test.describe("User Management", () => {
     await page.locator('input[name="email"]').fill("family@test.com");
     await page.getByRole("button", { name: /생성/i }).click();
 
-    await expect
-      .poll(() => createPayload)
-      .toMatchObject({
-        metadata: {
-          additionalAppointments: [
-            {
-              tenantId: "03dbe16b-e47b-4f72-927b-782807d67a35",
-              tenantSlug: "tech-planning",
-              tenantName: "기술기획",
-              isOwner: true,
-              grade: "책임",
-              jobTitle: "플랫폼 운영",
-              position: "팀장",
-            },
-          ],
-        },
-      });
-    expect(createPayload).toMatchObject({
-      role: "user",
-    });
-    expect(createPayload).not.toHaveProperty("department");
-    expect(createPayload).not.toHaveProperty("tenantSlug");
-    expect(createPayload).not.toHaveProperty("companyCode");
-    expect(createPayload).not.toHaveProperty("primaryTenantId");
+    await expect(
+      page.getByText(
+        /한맥 가족 구성원은 소속 테넌트를 하나 이상 선택해 주세요\./,
+      ),
+    ).toBeVisible();
+    expect(createPayload).toBeUndefined();
   });
 
   test("should hide Hanmac family subtree and system tenants when creating a non-family user", async ({

adminfront/tests/worksmobile.spec.ts

@@ -254,6 +254,9 @@ test.describe("Worksmobile tenant management", () => {
       .poll(() => filterButtons)
       .toEqual(["바론에만 있음", "웍스에만 있음", "양쪽 다 있음"]);
 
+    await userComparisonSection
+      .getByRole("button", { name: "웍스에만 있음" })
+      .click();
     await userComparisonSection
       .getByRole("button", { name: "웍스에만 있음" })
       .click();
@@ -515,13 +518,12 @@ test.describe("Worksmobile tenant management", () => {
       .getByRole("button", { name: "컬럼 설정" });
     await userColumnButton.click();
 
-    const settingsPanel = page
-      .getByText("구성원 컬럼 설정")
-      .locator("xpath=ancestor::*[@role='dialog'][1]");
-    await settingsPanel.getByLabel("Baron ID").check();
-    await settingsPanel.getByLabel("WORKS", { exact: true }).check();
-    await settingsPanel.getByLabel("external_key").check();
-    await settingsPanel.getByRole("button", { name: "닫기" }).click();
+    const settingsDialog = page.getByRole("dialog");
+    await expect(settingsDialog.getByText("구성원 컬럼 설정")).toBeVisible();
+    await settingsDialog.getByText("Baron ID").click();
+    await settingsDialog.getByText("WORKS", { exact: true }).click();
+    await settingsDialog.getByText("external_key").click();
+    await settingsDialog.getByRole("button", { name: "닫기" }).click();
 
     const pageOverflow = await page.evaluate(() => ({
       documentScrollWidth: document.documentElement.scrollWidth,
@@ -549,7 +551,7 @@ test.describe("Worksmobile tenant management", () => {
     );
 
     const immutableRow = page.getByRole("row", {
-      name: /cyhan@samaneng\.com/,
+      name: /변경 불가 계정/,
     });
     await expect(immutableRow.getByRole("checkbox")).toBeDisabled();
     await expect(

backend/internal/domain/headless_jwks_cache.go

@@ -17,6 +17,7 @@ type HeadlessJWKSCacheState struct {
 	CachedAt                     *time.Time              `json:"cachedAt,omitempty"`
 	ExpiresAt                    *time.Time              `json:"expiresAt,omitempty"`
 	LastCheckedAt                *time.Time              `json:"lastCheckedAt,omitempty"`
+	NextRetryAt                  *time.Time              `json:"nextRetryAt,omitempty"`
 	LastSuccessfulVerificationAt *time.Time              `json:"lastSuccessfulVerificationAt,omitempty"`
 	LastRefreshStatus            string                  `json:"lastRefreshStatus,omitempty"`
 	LastError                    string                  `json:"lastError,omitempty"`

backend/internal/handler/auth_handler_login_test.go

@@ -166,9 +166,11 @@ type passwordLoginUserRepo struct {
 
 func (r *passwordLoginUserRepo) Create(ctx context.Context, user *domain.User) error { return nil }
 func (r *passwordLoginUserRepo) Update(ctx context.Context, user *domain.User) error { return nil }
+
 func (r *passwordLoginUserRepo) FindByEmail(ctx context.Context, email string) (*domain.User, error) {
 	return nil, errors.New("not found")
 }
+
 func (r *passwordLoginUserRepo) FindByID(ctx context.Context, id string) (*domain.User, error) {
 	if r != nil {
 		if user, ok := r.usersByID[id]; ok {
@@ -177,40 +179,53 @@ func (r *passwordLoginUserRepo) FindByID(ctx context.Context, id string) (*domai
 	}
 	return nil, errors.New("not found")
 }
+
 func (r *passwordLoginUserRepo) FindByIDs(ctx context.Context, ids []string) ([]domain.User, error) {
 	return nil, nil
 }
+
 func (r *passwordLoginUserRepo) ListByTenant(ctx context.Context, tenantID string) ([]domain.User, error) {
 	return nil, nil
 }
+
 func (r *passwordLoginUserRepo) List(ctx context.Context, offset, limit int, search string, tenantSlug string) ([]domain.User, int64, error) {
 	return nil, 0, nil
 }
+
 func (r *passwordLoginUserRepo) CountByTenant(ctx context.Context, tenantID string) (int64, error) {
 	return 0, nil
 }
+
 func (r *passwordLoginUserRepo) CountByTenantIDs(ctx context.Context, tenantIDs []string) (map[string]int64, error) {
 	return nil, nil
 }
+
 func (r *passwordLoginUserRepo) CountByCompanyCodes(ctx context.Context, codes []string) (map[string]int64, error) {
 	return nil, nil
 }
+
 func (r *passwordLoginUserRepo) FindByTenantIDs(ctx context.Context, tenantIDs []string) ([]domain.User, error) {
 	return nil, nil
 }
+
 func (r *passwordLoginUserRepo) FindByCompanyCodes(ctx context.Context, codes []string) ([]domain.User, error) {
 	return nil, nil
 }
+
 func (r *passwordLoginUserRepo) Delete(ctx context.Context, id string) error { return nil }
+
 func (r *passwordLoginUserRepo) UpdateUserLoginIDs(ctx context.Context, userID string, loginIDs []domain.UserLoginID) error {
 	return nil
 }
+
 func (r *passwordLoginUserRepo) GetUserLoginIDs(ctx context.Context, userID string) ([]domain.UserLoginID, error) {
 	return nil, nil
 }
+
 func (r *passwordLoginUserRepo) IsLoginIDTaken(ctx context.Context, loginID string) (bool, error) {
 	return false, nil
 }
+
 func (r *passwordLoginUserRepo) FindTenantIDByLoginID(ctx context.Context, loginID string) (string, error) {
 	return "", nil
 }

backend/internal/service/headless_jwks_cache.go

@@ -20,11 +20,13 @@ const (
 )
 
 type HeadlessJWKSCacheService struct {
-	Redis          domain.RedisRepository
-	HTTPClient     *http.Client
-	TTL            time.Duration
-	PrefetchWindow time.Duration
-	RequestTimeout time.Duration
+	Redis            domain.RedisRepository
+	HTTPClient       *http.Client
+	TTL              time.Duration
+	PrefetchWindow   time.Duration
+	RequestTimeout   time.Duration
+	FailureThreshold int
+	FailureBackoff   time.Duration
 }
 
 type headlessJWKSCacheStateStore struct {
@@ -33,6 +35,7 @@ type headlessJWKSCacheStateStore struct {
 	CachedAt                     *time.Time `json:"cachedAt,omitempty"`
 	ExpiresAt                    *time.Time `json:"expiresAt,omitempty"`
 	LastCheckedAt                *time.Time `json:"lastCheckedAt,omitempty"`
+	NextRetryAt                  *time.Time `json:"nextRetryAt,omitempty"`
 	LastSuccessfulVerificationAt *time.Time `json:"lastSuccessfulVerificationAt,omitempty"`
 	LastRefreshStatus            string     `json:"lastRefreshStatus,omitempty"`
 	LastError                    string     `json:"lastError,omitempty"`
@@ -61,17 +64,29 @@ func NewHeadlessJWKSCacheService(redis domain.RedisRepository, httpClient *http.
 		prefetchSeconds = 600
 	}
 
-	timeoutSeconds, _ := strconv.Atoi(strings.TrimSpace(getenv("HEADLESS_JWKS_FETCH_TIMEOUT_SECONDS", "5")))
+	timeoutSeconds, _ := strconv.Atoi(strings.TrimSpace(getenv("HEADLESS_JWKS_FETCH_TIMEOUT_SECONDS", "2")))
 	if timeoutSeconds <= 0 {
-		timeoutSeconds = 5
+		timeoutSeconds = 2
+	}
+
+	failureThreshold, _ := strconv.Atoi(strings.TrimSpace(getenv("HEADLESS_JWKS_FAILURE_THRESHOLD", "3")))
+	if failureThreshold <= 0 {
+		failureThreshold = 3
+	}
+
+	backoffSeconds, _ := strconv.Atoi(strings.TrimSpace(getenv("HEADLESS_JWKS_FAILURE_BACKOFF_SECONDS", "1800")))
+	if backoffSeconds <= 0 {
+		backoffSeconds = 1800
 	}
 
 	return &HeadlessJWKSCacheService{
-		Redis:          redis,
-		HTTPClient:     httpClient,
-		TTL:            time.Duration(ttlSeconds) * time.Second,
-		PrefetchWindow: time.Duration(prefetchSeconds) * time.Second,
-		RequestTimeout: time.Duration(timeoutSeconds) * time.Second,
+		Redis:            redis,
+		HTTPClient:       httpClient,
+		TTL:              time.Duration(ttlSeconds) * time.Second,
+		PrefetchWindow:   time.Duration(prefetchSeconds) * time.Second,
+		RequestTimeout:   time.Duration(timeoutSeconds) * time.Second,
+		FailureThreshold: failureThreshold,
+		FailureBackoff:   time.Duration(backoffSeconds) * time.Second,
 	}
 }
 
@@ -115,6 +130,7 @@ func (s *HeadlessJWKSCacheService) SaveState(clientID string, state domain.Headl
 		CachedAt:                     state.CachedAt,
 		ExpiresAt:                    state.ExpiresAt,
 		LastCheckedAt:                state.LastCheckedAt,
+		NextRetryAt:                  state.NextRetryAt,
 		LastSuccessfulVerificationAt: state.LastSuccessfulVerificationAt,
 		LastRefreshStatus:            state.LastRefreshStatus,
 		LastError:                    state.LastError,
@@ -151,6 +167,7 @@ func (s *HeadlessJWKSCacheService) GetState(clientID string) (*domain.HeadlessJW
 		CachedAt:                     stored.CachedAt,
 		ExpiresAt:                    stored.ExpiresAt,
 		LastCheckedAt:                stored.LastCheckedAt,
+		NextRetryAt:                  stored.NextRetryAt,
 		LastSuccessfulVerificationAt: stored.LastSuccessfulVerificationAt,
 		LastRefreshStatus:            stored.LastRefreshStatus,
 		LastError:                    stored.LastError,
@@ -193,6 +210,9 @@ func (s *HeadlessJWKSCacheService) ShouldPrefetch(state *domain.HeadlessJWKSCach
 	if state == nil {
 		return true
 	}
+	if s.ShouldSkipRefresh(state, now) {
+		return false
+	}
 	if strings.TrimSpace(state.RawJWKS) == "" {
 		return true
 	}
@@ -202,6 +222,13 @@ func (s *HeadlessJWKSCacheService) ShouldPrefetch(state *domain.HeadlessJWKSCach
 	return !state.ExpiresAt.After(now.Add(s.PrefetchWindow))
 }
 
+func (s *HeadlessJWKSCacheService) ShouldSkipRefresh(state *domain.HeadlessJWKSCacheState, now time.Time) bool {
+	if state == nil || state.NextRetryAt == nil {
+		return false
+	}
+	return state.NextRetryAt.After(now)
+}
+
 func (s *HeadlessJWKSCacheService) EnsureFreshKeySet(ctx context.Context, client domain.HydraClient, expectedKid string) (*jose.JSONWebKeySet, *domain.HeadlessJWKSCacheState, bool, error) {
 	if s == nil {
 		return nil, nil, false, fmt.Errorf("headless jwks cache service is not configured")
@@ -283,6 +310,7 @@ func (s *HeadlessJWKSCacheService) refreshClient(ctx context.Context, client dom
 		updated.JWKSURI = jwksURI
 		updated.LastCheckedAt = &now
 		updated.ExpiresAt = ptrTime(now.Add(s.TTL))
+		updated.NextRetryAt = nil
 		updated.LastRefreshStatus = "success"
 		updated.LastError = ""
 		updated.ConsecutiveFailures = 0
@@ -313,6 +341,7 @@ func (s *HeadlessJWKSCacheService) refreshClient(ctx context.Context, client dom
 		CachedAt:                     &now,
 		ExpiresAt:                    ptrTime(now.Add(s.TTL)),
 		LastCheckedAt:                &now,
+		NextRetryAt:                  nil,
 		LastSuccessfulVerificationAt: previousLastVerification(previous),
 		LastRefreshStatus:            "success",
 		LastError:                    "",
@@ -349,10 +378,28 @@ func (s *HeadlessJWKSCacheService) persistRefreshFailure(client domain.HydraClie
 		state.RawJWKS = previous.RawJWKS
 		state.ConsecutiveFailures = previous.ConsecutiveFailures + 1
 	}
+	if s.shouldBackoff(state.ConsecutiveFailures) {
+		state.NextRetryAt = ptrTime(now.Add(s.failureBackoffDuration()))
+	}
 	_ = s.SaveState(client.ClientID, state)
 	return &state
 }
 
+func (s *HeadlessJWKSCacheService) shouldBackoff(consecutiveFailures int) bool {
+	threshold := s.FailureThreshold
+	if threshold <= 0 {
+		threshold = 3
+	}
+	return consecutiveFailures >= threshold
+}
+
+func (s *HeadlessJWKSCacheService) failureBackoffDuration() time.Duration {
+	if s.FailureBackoff > 0 {
+		return s.FailureBackoff
+	}
+	return 30 * time.Minute
+}
+
 func decodeHeadlessJWKS(raw string) (*jose.JSONWebKeySet, error) {
 	var keySet jose.JSONWebKeySet
 	if err := json.Unmarshal([]byte(raw), &keySet); err != nil {

backend/internal/service/headless_jwks_cache_test.go

@@ -6,7 +6,9 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/json"
+	"io"
 	"net/http"
+	"strings"
 	"testing"
 	"time"
 
@@ -143,6 +145,261 @@ func TestHeadlessJWKSCacheService_EnsureFreshKeySet_RefreshesWhenKidMissing(t *t
 	assert.Equal(t, []string{"fresh-key"}, stored.CachedKids)
 }
 
+func TestHeadlessJWKSCacheService_PersistRefreshFailure_SetsNextRetryAtAfterThreshold(t *testing.T) {
+	redisRepo := &headlessJWKSCacheTestRedis{}
+	cacheService := NewHeadlessJWKSCacheService(redisRepo, nil)
+	cacheService.FailureThreshold = 3
+	cacheService.FailureBackoff = 15 * time.Minute
+
+	client := domain.HydraClient{
+		ClientID: "client-headless",
+		Metadata: map[string]any{
+			domain.MetadataHeadlessLoginEnabled: true,
+			domain.MetadataHeadlessJWKSURI:      "https://rp.example.com/.well-known/jwks.json",
+		},
+	}
+
+	previous := &domain.HeadlessJWKSCacheState{
+		ClientID:            client.ClientID,
+		JWKSURI:             "https://rp.example.com/.well-known/jwks.json",
+		LastRefreshStatus:   "failure",
+		ConsecutiveFailures: 2,
+	}
+
+	state := cacheService.persistRefreshFailure(client, previous, assert.AnError)
+	require.NotNil(t, state)
+	assert.Equal(t, 3, state.ConsecutiveFailures)
+	require.NotNil(t, state.NextRetryAt)
+	assert.WithinDuration(t, time.Now().Add(15*time.Minute), *state.NextRetryAt, 3*time.Second)
+}
+
+func TestHeadlessJWKSCacheService_ShouldPrefetch_SkipsUntilNextRetryAt(t *testing.T) {
+	cacheService := NewHeadlessJWKSCacheService(&headlessJWKSCacheTestRedis{}, nil)
+	now := time.Now()
+
+	state := &domain.HeadlessJWKSCacheState{
+		ClientID:            "client-headless",
+		LastRefreshStatus:   "failure",
+		ConsecutiveFailures: 3,
+		NextRetryAt:         ptrTestTime(now.Add(10 * time.Minute)),
+	}
+
+	assert.False(t, cacheService.ShouldPrefetch(state, now))
+	assert.True(t, cacheService.ShouldPrefetch(state, now.Add(11*time.Minute)))
+}
+
+func TestHeadlessJWKSCacheWorker_RunOnce_SkipsBackoffTargets(t *testing.T) {
+	clients := []domain.HydraClient{
+		newTestHeadlessClient("client-fail", "https://fail.example.com/.well-known/jwks.json"),
+		newTestHeadlessClient("client-skip", "https://skip.example.com/.well-known/jwks.json"),
+	}
+
+	hydra := &HydraAdminService{
+		AdminURL:   "http://hydra.test",
+		HTTPClient: clientForHandler(jsonHandler(t, clients)),
+	}
+
+	redisRepo := &headlessJWKSCacheTestRedis{}
+	cacheService := NewHeadlessJWKSCacheService(redisRepo, nil)
+	cacheService.FailureThreshold = 3
+	cacheService.FailureBackoff = 15 * time.Minute
+
+	now := time.Now()
+	require.NoError(t, cacheService.SaveState("client-fail", domain.HeadlessJWKSCacheState{
+		ClientID:            "client-fail",
+		JWKSURI:             clients[0].HeadlessJWKSURI(),
+		LastRefreshStatus:   "failure",
+		ConsecutiveFailures: 2,
+	}))
+	require.NoError(t, cacheService.SaveState("client-skip", domain.HeadlessJWKSCacheState{
+		ClientID:            "client-skip",
+		JWKSURI:             clients[1].HeadlessJWKSURI(),
+		LastRefreshStatus:   "failure",
+		ConsecutiveFailures: 3,
+		NextRetryAt:         ptrTestTime(now.Add(10 * time.Minute)),
+	}))
+
+	fetchCounts := map[string]int{}
+	cacheService.HTTPClient = &http.Client{
+		Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
+			fetchCounts[req.URL.Host]++
+			if req.URL.Host == "fail.example.com" {
+				return jsonHTTPResponse(http.StatusInternalServerError, `{"error":"boom"}`), nil
+			}
+			t.Fatalf("unexpected fetch for host %s", req.URL.Host)
+			return nil, nil
+		}),
+	}
+
+	worker := &HeadlessJWKSCacheWorker{
+		Hydra:    hydra,
+		Cache:    cacheService,
+		PageSize: 100,
+	}
+
+	worker.runOnce(context.Background())
+
+	assert.Equal(t, 1, fetchCounts["fail.example.com"])
+	assert.Equal(t, 0, fetchCounts["skip.example.com"])
+
+	failedState, err := cacheService.GetState("client-fail")
+	require.NoError(t, err)
+	require.NotNil(t, failedState)
+	assert.Equal(t, 3, failedState.ConsecutiveFailures)
+	require.NotNil(t, failedState.NextRetryAt)
+
+	skippedState, err := cacheService.GetState("client-skip")
+	require.NoError(t, err)
+	require.NotNil(t, skippedState)
+	assert.Equal(t, 3, skippedState.ConsecutiveFailures)
+	require.NotNil(t, skippedState.NextRetryAt)
+	assert.WithinDuration(t, now.Add(10*time.Minute), *skippedState.NextRetryAt, time.Second)
+}
+
+func TestHeadlessJWKSCacheWorker_RunOnce_RetriesAfterBackoffAndClearsFailureStateOnSuccess(t *testing.T) {
+	_, freshJWKS := mustServiceHeadlessRSAJWK(t, "fresh-key")
+	freshRaw, err := json.Marshal(freshJWKS)
+	require.NoError(t, err)
+
+	client := newTestHeadlessClient("client-recover", "https://recover.example.com/.well-known/jwks.json")
+	hydra := &HydraAdminService{
+		AdminURL:   "http://hydra.test",
+		HTTPClient: clientForHandler(jsonHandler(t, []domain.HydraClient{client})),
+	}
+
+	redisRepo := &headlessJWKSCacheTestRedis{}
+	cacheService := NewHeadlessJWKSCacheService(redisRepo, nil)
+	cacheService.FailureThreshold = 3
+	cacheService.FailureBackoff = 15 * time.Minute
+
+	require.NoError(t, cacheService.SaveState("client-recover", domain.HeadlessJWKSCacheState{
+		ClientID:            "client-recover",
+		JWKSURI:             client.HeadlessJWKSURI(),
+		LastRefreshStatus:   "failure",
+		LastError:           "previous failure",
+		ConsecutiveFailures: 3,
+		NextRetryAt:         ptrTestTime(time.Now().Add(-time.Minute)),
+	}))
+
+	fetchCount := 0
+	cacheService.HTTPClient = &http.Client{
+		Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
+			fetchCount++
+			assert.Equal(t, "recover.example.com", req.URL.Host)
+			return jsonHTTPResponse(http.StatusOK, string(freshRaw)), nil
+		}),
+	}
+
+	worker := &HeadlessJWKSCacheWorker{
+		Hydra:    hydra,
+		Cache:    cacheService,
+		PageSize: 100,
+	}
+
+	worker.runOnce(context.Background())
+
+	assert.Equal(t, 1, fetchCount)
+
+	recoveredState, err := cacheService.GetState("client-recover")
+	require.NoError(t, err)
+	require.NotNil(t, recoveredState)
+	assert.Equal(t, "success", recoveredState.LastRefreshStatus)
+	assert.Empty(t, recoveredState.LastError)
+	assert.Equal(t, 0, recoveredState.ConsecutiveFailures)
+	assert.Nil(t, recoveredState.NextRetryAt)
+	assert.Equal(t, []string{"fresh-key"}, recoveredState.CachedKids)
+}
+
+func TestHeadlessJWKSCacheWorker_RunOnce_MixedClients(t *testing.T) {
+	_, successJWKS := mustServiceHeadlessRSAJWK(t, "success-key")
+	successRaw, err := json.Marshal(successJWKS)
+	require.NoError(t, err)
+
+	successClient := newTestHeadlessClient("client-success", "https://success.example.com/.well-known/jwks.json")
+	failClient := newTestHeadlessClient("client-fail", "https://fail.example.com/.well-known/jwks.json")
+	skipClient := newTestHeadlessClient("client-skip", "https://skip.example.com/.well-known/jwks.json")
+	disabledClient := domain.HydraClient{
+		ClientID: "client-disabled",
+		Metadata: map[string]any{
+			domain.MetadataHeadlessLoginEnabled:            false,
+			domain.MetadataHeadlessJWKSURI:                 "https://disabled.example.com/.well-known/jwks.json",
+			domain.MetadataHeadlessTokenEndpointAuthMethod: "private_key_jwt",
+		},
+	}
+
+	hydra := &HydraAdminService{
+		AdminURL: "http://hydra.test",
+		HTTPClient: clientForHandler(jsonHandler(t, []domain.HydraClient{
+			successClient,
+			failClient,
+			skipClient,
+			disabledClient,
+		})),
+	}
+
+	redisRepo := &headlessJWKSCacheTestRedis{}
+	cacheService := NewHeadlessJWKSCacheService(redisRepo, nil)
+	cacheService.FailureThreshold = 3
+	cacheService.FailureBackoff = 20 * time.Minute
+
+	require.NoError(t, cacheService.SaveState("client-fail", domain.HeadlessJWKSCacheState{
+		ClientID:            "client-fail",
+		JWKSURI:             failClient.HeadlessJWKSURI(),
+		LastRefreshStatus:   "failure",
+		ConsecutiveFailures: 2,
+	}))
+	require.NoError(t, cacheService.SaveState("client-skip", domain.HeadlessJWKSCacheState{
+		ClientID:            "client-skip",
+		JWKSURI:             skipClient.HeadlessJWKSURI(),
+		LastRefreshStatus:   "failure",
+		ConsecutiveFailures: 3,
+		NextRetryAt:         ptrTestTime(time.Now().Add(10 * time.Minute)),
+	}))
+
+	fetchCounts := map[string]int{}
+	cacheService.HTTPClient = &http.Client{
+		Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
+			fetchCounts[req.URL.Host]++
+			switch req.URL.Host {
+			case "success.example.com":
+				return jsonHTTPResponse(http.StatusOK, string(successRaw)), nil
+			case "fail.example.com":
+				return jsonHTTPResponse(http.StatusInternalServerError, `{"error":"boom"}`), nil
+			default:
+				t.Fatalf("unexpected fetch for host %s", req.URL.Host)
+				return nil, nil
+			}
+		}),
+	}
+
+	worker := &HeadlessJWKSCacheWorker{
+		Hydra:    hydra,
+		Cache:    cacheService,
+		PageSize: 100,
+	}
+
+	worker.runOnce(context.Background())
+
+	assert.Equal(t, 1, fetchCounts["success.example.com"])
+	assert.Equal(t, 1, fetchCounts["fail.example.com"])
+	assert.Equal(t, 0, fetchCounts["skip.example.com"])
+	assert.Equal(t, 0, fetchCounts["disabled.example.com"])
+
+	successState, err := cacheService.GetState("client-success")
+	require.NoError(t, err)
+	require.NotNil(t, successState)
+	assert.Equal(t, "success", successState.LastRefreshStatus)
+	assert.Equal(t, 0, successState.ConsecutiveFailures)
+	assert.Nil(t, successState.NextRetryAt)
+
+	failState, err := cacheService.GetState("client-fail")
+	require.NoError(t, err)
+	require.NotNil(t, failState)
+	assert.Equal(t, "failure", failState.LastRefreshStatus)
+	assert.Equal(t, 3, failState.ConsecutiveFailures)
+	require.NotNil(t, failState.NextRetryAt)
+}
+
 func mustServiceHeadlessRSAJWK(t *testing.T, kid string) (*rsa.PrivateKey, jose.JSONWebKeySet) {
 	t.Helper()
 
@@ -162,3 +419,31 @@ func mustServiceHeadlessRSAJWK(t *testing.T, kid string) (*rsa.PrivateKey, jose.
 func ptrTestTime(value time.Time) *time.Time {
 	return &value
 }
+
+func newTestHeadlessClient(clientID, jwksURI string) domain.HydraClient {
+	return domain.HydraClient{
+		ClientID: clientID,
+		Metadata: map[string]any{
+			domain.MetadataHeadlessLoginEnabled:            true,
+			domain.MetadataHeadlessJWKSURI:                 jwksURI,
+			domain.MetadataHeadlessTokenEndpointAuthMethod: "private_key_jwt",
+		},
+	}
+}
+
+func jsonHandler(t *testing.T, payload any) http.HandlerFunc {
+	t.Helper()
+	return func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/clients", r.URL.Path)
+		w.Header().Set("Content-Type", "application/json")
+		require.NoError(t, json.NewEncoder(w).Encode(payload))
+	}
+}
+
+func jsonHTTPResponse(status int, body string) *http.Response {
+	return &http.Response{
+		StatusCode: status,
+		Header:     make(http.Header),
+		Body:       io.NopCloser(strings.NewReader(body)),
+	}
+}

common/core/components/page/PageHeader.tsx

@@ -6,6 +6,7 @@ function cx(...classNames: Array<string | false | null | undefined>) {
 
 type PageHeaderProps = Omit<HTMLAttributes<HTMLElement>, "title"> & {
   actions?: ReactNode;
+  icon?: ReactNode;
   as?: ElementType;
   description?: ReactNode;
   eyebrow?: ReactNode;
@@ -20,6 +21,7 @@ export function PageHeader({
   className,
   description,
   eyebrow,
+  icon,
   sticky = false,
   title,
   titleAs,
@@ -33,23 +35,30 @@ export function PageHeader({
       className={cx(
         "flex flex-wrap items-start justify-between gap-4",
         sticky &&
-          "sticky top-[-2.5rem] z-20 -mt-4 bg-background/95 pt-4 pb-2 backdrop-blur",
+        "sticky top-[-2.5rem] z-20 -mt-4 bg-background/95 pt-4 pb-2 backdrop-blur",
         className,
       )}
       {...props}
     >
-      <div className="space-y-2">
-        {eyebrow ? (
-          <p className="text-xs uppercase tracking-[0.2em] text-muted-foreground">
-            {eyebrow}
-          </p>
-        ) : null}
-        <Title className="text-3xl font-semibold tracking-tight">
-          {title}
-        </Title>
-        {description ? (
-          <p className="text-sm text-muted-foreground">{description}</p>
+      <div className="flex min-w-0 items-start gap-3">
+        {icon ? (
+          <div className="mt-1 flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-primary/15 bg-primary/10 text-primary">
+            {icon}
+          </div>
         ) : null}
+        <div className="space-y-2">
+          {eyebrow ? (
+            <p className="text-xs uppercase tracking-[0.2em] text-muted-foreground">
+              {eyebrow}
+            </p>
+          ) : null}
+          <Title className="text-3xl font-semibold tracking-tight">
+            {title}
+          </Title>
+          {description ? (
+            <p className="text-sm text-muted-foreground">{description}</p>
+          ) : null}
+        </div>
       </div>
       {actions ? (
         <div className="flex flex-wrap items-center gap-2">{actions}</div>

common/package-lock.json

@@ -2423,9 +2423,9 @@
       "license": "MIT"
     },
     "node_modules/@tanstack/query-core": {
-      "version": "5.100.10",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.100.10.tgz",
-      "integrity": "sha512-8UR0yJR+GiQ40m3lPhUr0xbfAupe6GSQiksSBSa9SM2NjezFyxXCIA69/lz8cSoNKZLrw1/PktIyQBJcVeMi3w==",
+      "version": "5.100.11",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.100.11.tgz",
+      "integrity": "sha512-lmE0994apShXPj8CUxgx4ch5yUJhE9k/+tVwihBvPOyerACWdBocfFg24t8+0RhtlTd7tEgchDkhlCxNssvDxw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -2433,9 +2433,9 @@
       }
     },
     "node_modules/@tanstack/query-devtools": {
-      "version": "5.100.10",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-devtools/-/query-devtools-5.100.10.tgz",
-      "integrity": "sha512-3DmJf25hDPus5IpVvp6ujXv6bKV2zPzI9vpbAmpJigsL/H6DPvPjmf7/Q9yVKEke//8fgeQ45abjgnLuyYxAiw==",
+      "version": "5.100.11",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-devtools/-/query-devtools-5.100.11.tgz",
+      "integrity": "sha512-47rVBDuGMW/A4ekt3YQdz+q0JSIwktwGnWCYyQUvSs2/g/Oa+6Fi2/IQk4/Y4vf6u1uwI7hOogHslgMC8f3X/Q==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -2443,12 +2443,12 @@
       }
     },
     "node_modules/@tanstack/react-query": {
-      "version": "5.100.10",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.100.10.tgz",
-      "integrity": "sha512-FLaZf2RCrA/Zgp4aiu5tG3TyasTRO7aZ99skxQpr3Hg/zXOhu6yq5FZCYQ/tRaJtM9ylnoK8tFK7PolXQadv6Q==",
+      "version": "5.100.11",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.100.11.tgz",
+      "integrity": "sha512-J0f9s5x3LE1450nNNfYx+e/n0DMa0uOBdFJUy5r0RvmsXd4nB/n0rbHtHI1vYXhikNFan+wf51p6Tmp4c8ucrg==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-core": "5.100.10"
+        "@tanstack/query-core": "5.100.11"
       },
       "funding": {
         "type": "github",
@@ -2459,19 +2459,19 @@
       }
     },
     "node_modules/@tanstack/react-query-devtools": {
-      "version": "5.100.10",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query-devtools/-/react-query-devtools-5.100.10.tgz",
-      "integrity": "sha512-zes0+o9ef5rAZXJ9f/SeaLs2nufJaeVkZkl/Or9NGrWVF41kL9Od9ED9nCwtQlgiF2VGtrzhEw5AU/igAO+aAg==",
+      "version": "5.100.11",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query-devtools/-/react-query-devtools-5.100.11.tgz",
+      "integrity": "sha512-75RFlJEG53Ed/Cxe5WLmgIpOElPNpgLZq7h0fLFnM5XwTYxSTk1rX/gC6MqGVXsSdrbP7zn7hPSJx9MinwiUHA==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-devtools": "5.100.10"
+        "@tanstack/query-devtools": "5.100.11"
       },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/tannerlinsley"
       },
       "peerDependencies": {
-        "@tanstack/react-query": "^5.100.10",
+        "@tanstack/react-query": "^5.100.11",
         "react": "^18 || ^19"
       }
     },
@@ -2522,9 +2522,9 @@
       }
     },
     "node_modules/@types/react": {
-      "version": "19.2.14",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.14.tgz",
-      "integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
+      "version": "19.2.15",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.15.tgz",
+      "integrity": "sha512-eRwcGNHve+E8qtEQSSRl6urh+rFop4v8gm6O8rGv25CodbvFdLjA1vVQ1KkiFE0w0UPOnb8tDiFKL5lp0rtY5Q==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -2798,9 +2798,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.30",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.30.tgz",
-      "integrity": "sha512-xjOFN16Ha1+Rz4nFYKqHU/LSB+gx/Vi3yQLX7r7sAW+Wa+8hhF2h4pvqTrTMc8+WcDBEunnUurr46Jvv0jk3Vg==",
+      "version": "2.10.31",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.31.tgz",
+      "integrity": "sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -3164,9 +3164,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.357",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.357.tgz",
-      "integrity": "sha512-NHlTIQDK8fmVwHwuIzmXYEJ1Ewq3D9wDNc0cWXxDGysP6Pb21giwGNkxiTifyKy/4SoPuN5l6GLP1W9Sv7zB2g==",
+      "version": "1.5.360",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.360.tgz",
+      "integrity": "sha512-GkcBt6YYAw9SxFWn+xVar4cLVGlXVuswwtRLBozi2zp0GjXs4ZnOrqV4zbXzg35n7w81hCkyJNYicgXlVHAmBA==",
       "dev": true,
       "license": "ISC"
     },
@@ -3999,9 +3999,9 @@
       "license": "MIT"
     },
     "node_modules/lru-cache": {
-      "version": "11.3.6",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.6.tgz",
-      "integrity": "sha512-Gf/KoL3C/MlI7Bt0PGI9I+TeTC/I6r/csU58N4BSNc4lppLBeKsOdFYkK+dX0ABDUMJNfCHTyPpzwwO21Awd3A==",
+      "version": "11.5.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.0.tgz",
+      "integrity": "sha512-5YgH9UJd7wVb9hIouI2adWpgqrrICkt070Dnj8EUY1+B4B2P9eRLPAkAAo6NICA7CEhOIeBHl46u9zSNpNu7zA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -4285,9 +4285,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+      "version": "8.5.15",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
       "dev": true,
       "funding": [
         {
@@ -4305,7 +4305,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.12",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },

common/shell/index.ts

@@ -84,15 +84,15 @@ export function buildShellSessionStatus({
 
   let toneClass =
     "border-emerald-500/30 bg-emerald-500/10 text-emerald-700 dark:text-emerald-300";
-  let text = t("ui.dev.session.active", "세션 활성");
+  let text = t("ui.shell.session.active", "세션 활성");
 
   if (remainingMs === null) {
     toneClass = "border-border bg-card text-muted-foreground";
-    text = t("ui.dev.session.unknown", "알 수 없음");
+    text = t("ui.shell.session.unknown", "알 수 없음");
   } else if (remainingMs <= 0) {
     toneClass =
       "border-rose-500/30 bg-rose-500/10 text-rose-700 dark:text-rose-300";
-    text = t("ui.dev.session.expired", "세션 만료");
+    text = t("ui.shell.session.expired", "세션 만료");
   } else if (
     remainingMinutes !== null &&
     remainingSeconds !== null &&
@@ -101,7 +101,7 @@ export function buildShellSessionStatus({
     toneClass =
       "border-amber-500/30 bg-amber-500/10 text-amber-700 dark:text-amber-300";
     text = t(
-      "ui.dev.session.expiring",
+      "ui.shell.session.expiring",
       "만료 임박: {{minutes}}분 {{seconds}}초 남음",
       {
         minutes: remainingMinutes,
@@ -110,7 +110,7 @@ export function buildShellSessionStatus({
     );
   } else {
     text = t(
-      "ui.dev.session.remaining",
+      "ui.shell.session.remaining",
       "만료 예정: {{minutes}}분 {{seconds}}초 남음",
       {
         minutes: remainingMinutes ?? 0,

compose.ory.yaml

@@ -29,7 +29,7 @@ services:
             - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
             - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
             - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
-            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/"]}
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/","${USERFRONT_URL}","${USERFRONT_URL}/","${USERFRONT_URL}/ko","${USERFRONT_URL}/ko/","${USERFRONT_URL}/en","${USERFRONT_URL}/en/","${USERFRONT_URL}/auth/callback","${USERFRONT_URL}/ko/auth/callback","${USERFRONT_URL}/en/auth/callback","${ADMINFRONT_URL}/auth/callback","${DEVFRONT_URL}/auth/callback","${ORGFRONT_URL}/auth/callback"]}
             - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
             - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
             - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery
@@ -55,7 +55,7 @@ services:
             - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
             - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
             - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
-            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/"]}
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/","${USERFRONT_URL}","${USERFRONT_URL}/","${USERFRONT_URL}/ko","${USERFRONT_URL}/ko/","${USERFRONT_URL}/en","${USERFRONT_URL}/en/","${USERFRONT_URL}/auth/callback","${USERFRONT_URL}/ko/auth/callback","${USERFRONT_URL}/en/auth/callback","${ADMINFRONT_URL}/auth/callback","${DEVFRONT_URL}/auth/callback","${ORGFRONT_URL}/auth/callback"]}
             - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
             - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
             - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery

devfront/scripts/runtime-mode.sh

@@ -51,6 +51,39 @@ ensure_frontend_dependencies() {
     return 0
   fi
 
+  lock_mode=""
+  lock_file="$WORKSPACE_DIR/.baron-deps-install.lock"
+
+  acquire_install_lock() {
+    if command -v flock >/dev/null 2>&1; then
+      lock_mode="flock"
+      exec 9>"$lock_file"
+      flock 9
+      trap 'release_install_lock' EXIT INT TERM
+      return 0
+    fi
+
+    lock_mode="mkdir"
+    while ! mkdir "$lock_file" 2>/dev/null; do
+      sleep 1
+    done
+    trap 'release_install_lock' EXIT INT TERM
+  }
+
+  release_install_lock() {
+    trap - EXIT INT TERM
+
+    if [ "$lock_mode" = "flock" ]; then
+      flock -u 9 || true
+      exec 9>&-
+      return 0
+    fi
+
+    if [ "$lock_mode" = "mkdir" ]; then
+      rmdir "$lock_file" >/dev/null 2>&1 || true
+    fi
+  }
+
   if command -v sha256sum >/dev/null 2>&1; then
     deps_hash="$(sha256sum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | sha256sum | awk '{print $1}')"
   else
@@ -61,6 +94,17 @@ ensure_frontend_dependencies() {
 
   if [ "$installed_hash" != "$deps_hash" ]; then
     echo "Installing frontend dependencies..."
+    acquire_install_lock
+    if command -v sha256sum >/dev/null 2>&1; then
+      deps_hash="$(sha256sum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | sha256sum | awk '{print $1}')"
+    else
+      deps_hash="$(cksum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | cksum | awk '{print $1}')"
+    fi
+    installed_hash="$(cat "$deps_stamp" 2>/dev/null || true)"
+    if [ "$installed_hash" = "$deps_hash" ]; then
+      release_install_lock
+      return 0
+    fi
     if [ "$WORKSPACE_DIR" = "/workspace/common" ]; then
       (cd /workspace/common && pnpm install --filter "${APP_WORKSPACE_FILTER}..." --frozen-lockfile --ignore-scripts)
     else
@@ -68,6 +112,7 @@ ensure_frontend_dependencies() {
     fi
     mkdir -p node_modules
     printf '%s\n' "$deps_hash" > "$deps_stamp"
+    release_install_lock
   fi
 }
 

devfront/src/components/layout/AppLayout.tsx

@@ -336,8 +336,8 @@ function AppLayout() {
       auth.user?.profile?.preferred_username?.toString() ||
       auth.user?.profile?.nickname?.toString(),
     profileEmail: profile?.email || auth.user?.profile?.email?.toString(),
-    fallbackName: t("ui.dev.profile.unknown_name", "Unknown User"),
-    fallbackEmail: t("ui.dev.profile.unknown_email", "unknown@example.com"),
+    fallbackName: t("ui.shell.profile.unknown_name", "Unknown User"),
+    fallbackEmail: t("ui.shell.profile.unknown_email", "unknown@example.com"),
   });
   const currentRole = resolveProfileRole(
     auth.user?.profile as Record<string, unknown> | undefined,
@@ -380,7 +380,7 @@ function AppLayout() {
         className={shellLayoutClasses.logoutButton}
       >
         <LogOut size={18} />
-        <span>{t("ui.dev.nav.logout", "Logout")}</span>
+        <span>{t("ui.shell.nav.logout", "Logout")}</span>
       </button>
     </div>
   );
@@ -433,7 +433,7 @@ function AppLayout() {
                   aria-haspopup="menu"
                   aria-expanded={isProfileMenuOpen}
                   aria-label={t(
-                    "ui.dev.profile.menu_aria",
+                    "ui.shell.profile.menu_aria",
                     "Open account menu",
                   )}
                 >
@@ -456,7 +456,7 @@ function AppLayout() {
                 {isProfileMenuOpen ? (
                   <div role="menu" className={shellLayoutClasses.profileMenu}>
                     <p className="text-xs uppercase tracking-[0.16em] text-muted-foreground">
-                      {t("ui.dev.profile.menu_title", "Account")}
+                      {t("ui.shell.profile.menu_title", "Account")}
                     </p>
                     <div className={shellLayoutClasses.profileCard}>
                       <div>
@@ -470,7 +470,7 @@ function AppLayout() {
                       <div className="flex items-center pt-1">
                         <span className="inline-flex items-center rounded-full bg-sky-500/10 px-2.5 py-1 text-[10px] font-semibold text-sky-700 dark:text-sky-300">
                           {t(
-                            `ui.admin.role.${displayRoleKey}`,
+                            `ui.shell.role.${displayRoleKey}`,
                             displayRoleKey.toUpperCase(),
                           )}
                         </span>
@@ -481,7 +481,7 @@ function AppLayout() {
                       <div className="flex items-center justify-between gap-3">
                         <div>
                           <p className="text-sm font-medium text-foreground">
-                            {t("ui.dev.session.auto_extend", "Session expiry")}
+                            {t("ui.shell.session.auto_extend", "Session expiry")}
                           </p>
                           <p className="text-xs text-muted-foreground">
                             {isSessionExpiryEnabled ? (
@@ -491,7 +491,7 @@ function AppLayout() {
                               />
                             ) : (
                               t(
-                                "ui.dev.session.disabled",
+                                "ui.shell.session.disabled",
                                 "Session expiry disabled",
                               )
                             )}
@@ -529,7 +529,7 @@ function AppLayout() {
                       }}
                     >
                       <UserIcon size={16} className="text-muted-foreground" />
-                      <span>{t("ui.dev.profile.title", "My Profile")}</span>
+                      <span>{t("ui.shell.nav.profile", "My Profile")}</span>
                     </button>
                     <button
                       type="button"
@@ -538,7 +538,7 @@ function AppLayout() {
                       onClick={handleLogout}
                     >
                       <LogOut size={16} />
-                      <span>{t("ui.dev.nav.logout", "Logout")}</span>
+                      <span>{t("ui.shell.nav.logout", "Logout")}</span>
                     </button>
                   </div>
                 ) : null}

devfront/src/features/audit/AuditLogsPage.tsx

@@ -1,6 +1,6 @@
 import { useInfiniteQuery } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
-import { Download, RefreshCw, Search } from "lucide-react";
+import { Download, NotebookTabs, RefreshCw, Search } from "lucide-react";
 import * as React from "react";
 import { parseAuditDetails } from "../../../../common/core/audit";
 import { AuditLogTable } from "../../../../common/core/components/audit";
@@ -12,6 +12,7 @@ import { Button } from "../../components/ui/button";
 import {
   Card,
   CardContent,
+  CardDescription,
   CardHeader,
   CardTitle,
 } from "../../components/ui/card";
@@ -120,6 +121,7 @@ function AuditLogsPage() {
   return (
     <div className="space-y-6">
       <PageHeader
+        icon={<NotebookTabs size={20} />}
         title={t("ui.common.audit.title", "Audit Logs")}
         description={t(
           "msg.dev.audit.subtitle",
@@ -157,6 +159,12 @@ function AuditLogsPage() {
             <CardTitle>
               {t("ui.common.audit.registry.title", "Audit registry")}
             </CardTitle>
+            <CardDescription>
+              {t(
+                "msg.dev.audit.registry_description",
+                "최근 감사 로그를 검색 조건에 맞춰 필터링하고, 작업 이력을 빠르게 확인합니다.",
+              )}
+            </CardDescription>
           </div>
         </CardHeader>
         <CardContent className="space-y-4 pt-0">

devfront/src/features/clients/ClientConsentsPage.tsx

@@ -1,15 +1,16 @@
 import { useMutation, useQuery } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
 import {
-  ArrowLeft,
   ChevronLeft,
   ChevronRight,
   Download,
   Filter,
   Search,
+  ShieldHalf,
 } from "lucide-react";
 import { useState } from "react";
 import { Link, useParams } from "react-router-dom";
+import { PageHeader } from "../../../../common/core/components/page";
 import {
   commonStickyTableHeaderClass,
   commonTableShellClass,
@@ -194,21 +195,13 @@ function ClientConsentsPage() {
                     )}
                   </span>
                 </nav>
-                <div className="flex items-center gap-2">
-                  <Button variant="ghost" size="icon" asChild>
-                    <Link to={`/clients/${clientId}`}>
-                      <ArrowLeft className="h-4 w-4" />
-                    </Link>
-                  </Button>
-                  <div>
-                    <p className="text-3xl font-black leading-tight">
-                      {t(
-                        "ui.dev.clients.consents.title",
-                        "User Consent Grants",
-                      )}
-                    </p>
-                  </div>
-                </div>
+                <PageHeader
+                  icon={<ShieldHalf size={20} />}
+                  title={t(
+                    "ui.dev.clients.consents.title",
+                    "User Consent Grants",
+                  )}
+                />
               </div>
             </div>
             <ClientDetailTabs activeTab="consents" clientId={clientId} />
@@ -242,24 +235,14 @@ function ClientConsentsPage() {
                 )}
               </span>
             </nav>
-            <div className="flex items-center gap-2">
-              <Button variant="ghost" size="icon" asChild>
-                <Link to={`/clients/${clientId}`}>
-                  <ArrowLeft className="h-4 w-4" />
-                </Link>
-              </Button>
-              <div>
-                <p className="text-3xl font-black leading-tight">
-                  {t("ui.dev.clients.consents.title", "User Consent Grants")}
-                </p>
-                <p className="text-muted-foreground">
-                  {t(
-                    "msg.dev.clients.consents.subtitle",
-                    "OIDC Relying Party 사용자 권한을 검토·관리합니다.",
-                  )}
-                </p>
-              </div>
-            </div>
+            <PageHeader
+              icon={<ShieldHalf size={20} />}
+              title={t("ui.dev.clients.consents.title", "User Consent Grants")}
+              description={t(
+                "msg.dev.clients.consents.subtitle",
+                "OIDC Relying Party 사용자 권한을 검토·관리합니다.",
+              )}
+            />
           </div>
           <div className="flex items-center gap-3">
             <Badge
@@ -623,7 +606,7 @@ function ClientConsentsPage() {
                 "Active Grants",
               )}
             </p>
-            <CardTitle className="text-2xl font-black">
+            <CardTitle className="text-xl font-semibold">
               {rows.filter((r) => r.status === "active").length}
             </CardTitle>
           </CardHeader>
@@ -636,7 +619,7 @@ function ClientConsentsPage() {
                 "Total Scopes Issued",
               )}
             </p>
-            <CardTitle className="text-2xl font-black">
+            <CardTitle className="text-xl font-semibold">
               {rows.reduce((acc, row) => acc + row.grantedScopes.length, 0)}
             </CardTitle>
           </CardHeader>
@@ -649,7 +632,7 @@ function ClientConsentsPage() {
                 "Avg. Scopes per User",
               )}
             </p>
-            <CardTitle className="text-2xl font-black">
+            <CardTitle className="text-xl font-semibold">
               {rows.length > 0
                 ? (
                     rows.reduce(

devfront/src/features/clients/ClientDetailsPage.tsx

@@ -1,16 +1,17 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
 import {
-  ArrowLeft,
   Eye,
   EyeOff,
   Link2,
   RefreshCw,
   Save,
   Shield,
+  ShieldHalf,
 } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { Link, useParams } from "react-router-dom";
+import { PageHeader } from "../../../../common/core/components/page";
 import { Badge } from "../../components/ui/badge";
 import { Button } from "../../components/ui/button";
 import {
@@ -246,36 +247,26 @@ function ClientDetailsPage() {
             {t("ui.dev.clients.details.tab.connection", "Federation")}
           </span>
         </nav>
-        <div className="flex flex-wrap items-start justify-between gap-3">
-          <div className="flex items-center gap-2">
-            <Button variant="ghost" size="icon" asChild>
-              <Link to="/clients">
-                <ArrowLeft className="h-4 w-4" />
-              </Link>
-            </Button>
-            <div>
-              <h1 className="text-4xl font-black leading-tight tracking-tight">
-                {client?.name || client?.id || clientId}
-              </h1>
-              <p className="text-muted-foreground">
-                {t(
-                  "msg.dev.clients.details.subtitle",
-                  "Manage OIDC credentials and endpoints.",
-                )}
-              </p>
-            </div>
-          </div>
-          <Badge
-            variant={client?.status === "active" ? "info" : "muted"}
-            className="px-3 py-1 text-xs uppercase"
-          >
-            {client?.status === "active"
-              ? t("ui.common.status.active", "Active")
-              : client?.status === "inactive"
-                ? t("ui.common.status.inactive", "Inactive")
-                : t("msg.common.loading", "Loading...")}
-          </Badge>
-        </div>
+        <PageHeader
+          icon={<ShieldHalf size={20} />}
+          title={client?.name || client?.id || clientId}
+          description={t(
+            "msg.dev.clients.details.subtitle",
+            "Manage OIDC credentials and endpoints.",
+          )}
+          actions={
+            <Badge
+              variant={client?.status === "active" ? "info" : "muted"}
+              className="px-3 py-1 text-xs uppercase"
+            >
+              {client?.status === "active"
+                ? t("ui.common.status.active", "Active")
+                : client?.status === "inactive"
+                  ? t("ui.common.status.inactive", "Inactive")
+                  : t("msg.common.loading", "Loading...")}
+            </Badge>
+          }
+        />
         <ClientDetailTabs activeTab="connection" clientId={clientId} />
       </div>
 

devfront/src/features/clients/ClientGeneralPage.tsx

@@ -1,7 +1,6 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
 import {
-  ArrowLeft,
   Check,
   ExternalLink,
   Info,
@@ -9,6 +8,7 @@ import {
   Save,
   Search,
   Shield,
+  ShieldHalf,
   Sparkles,
   Trash2,
   Upload,
@@ -17,6 +17,7 @@ import {
 import { useEffect, useState } from "react";
 import { useAuth } from "react-oidc-context";
 import { Link, useNavigate, useParams } from "react-router-dom";
+import { PageHeader } from "../../../../common/core/components/page";
 import { Badge } from "../../components/ui/badge";
 import { Button } from "../../components/ui/button";
 import {
@@ -1195,26 +1196,18 @@ function ClientGeneralPage() {
                 </>
               )}
             </nav>
-            <div className="flex items-center gap-2">
-              <Button variant="ghost" size="icon" asChild>
-                <Link to={isCreate ? "/clients" : `/clients/${clientId}`}>
-                  <ArrowLeft className="h-4 w-4" />
-                </Link>
-              </Button>
-              <div>
-                <h1 className="text-3xl font-black leading-tight">
-                  {isCreate
-                    ? t("ui.dev.clients.general.title_create", "Create Client")
-                    : t("ui.dev.clients.general.title_edit", "Client Settings")}
-                </h1>
-                <p className="text-muted-foreground">
-                  {t(
-                    "ui.dev.clients.general.subtitle",
-                    "앱 정보, 권한 스코프, 보안 설정을 관리합니다.",
-                  )}
-                </p>
-              </div>
-            </div>
+            <PageHeader
+              icon={<ShieldHalf size={20} />}
+              title={
+                isCreate
+                  ? t("ui.dev.clients.general.title_create", "Create Client")
+                  : t("ui.dev.clients.general.title_edit", "Client Settings")
+              }
+              description={t(
+                "ui.dev.clients.general.subtitle",
+                "앱 정보, 권한 스코프, 보안 설정을 관리합니다.",
+              )}
+            />
           </div>
           {!isCreate && (
             <Badge

devfront/src/features/clients/ClientRelationsPage.tsx

@@ -1,9 +1,10 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
-import { ArrowLeft, Info, Link2, Plus, Trash2, X } from "lucide-react";
+import { Info, Link2, Plus, ShieldHalf, Trash2, X } from "lucide-react";
 import { useDeferredValue, useMemo, useState } from "react";
 import { useAuth } from "react-oidc-context";
 import { Link, useParams } from "react-router-dom";
+import { PageHeader } from "../../../../common/core/components/page";
 import { Badge } from "../../components/ui/badge";
 import { Button } from "../../components/ui/button";
 import {
@@ -352,27 +353,14 @@ function ClientRelationsPage() {
                 {t("ui.dev.clients.details.tab.relationships", "Relationships")}
               </span>
             </nav>
-            <div className="flex items-center gap-2">
-              <Button variant="ghost" size="icon" asChild>
-                <Link to={`/clients/${clientId}`}>
-                  <ArrowLeft className="h-4 w-4" />
-                </Link>
-              </Button>
-              <div>
-                <p className="text-3xl font-black leading-tight">
-                  {t(
-                    "ui.dev.clients.relationships.title",
-                    "Client Relationships",
-                  )}
-                </p>
-                <p className="text-muted-foreground">
-                  {t(
-                    "msg.dev.clients.relationships.subtitle",
-                    "RP direct operator relation을 조회하고 User 단위로 추가·삭제합니다.",
-                  )}
-                </p>
-              </div>
-            </div>
+            <PageHeader
+              icon={<ShieldHalf size={20} />}
+              title={t("ui.dev.clients.relationships.title", "Client Relationships")}
+              description={t(
+                "msg.dev.clients.relationships.subtitle",
+                "RP direct operator relation을 조회하고 User 단위로 추가·삭제합니다.",
+              )}
+            />
           </div>
           <div className="flex items-center gap-3">
             <Badge

devfront/src/features/clients/ClientsPage.tsx

@@ -1,6 +1,6 @@
 import { useMutation, useQuery } from "@tanstack/react-query";
 import type { AxiosError } from "axios";
-import { BookOpenText, Filter, Plus, Search, X } from "lucide-react";
+import { BookOpenText, Filter, Plus, Search, ShieldHalf, X } from "lucide-react";
 import { useEffect, useMemo, useState } from "react";
 import { useAuth } from "react-oidc-context";
 import { Link, useNavigate } from "react-router-dom";
@@ -60,6 +60,7 @@ import { t } from "../../lib/i18n";
 import { resolveProfileRole } from "../../lib/role";
 import { cn } from "../../lib/utils";
 import { fetchMe } from "../auth/authApi";
+import { resolveClientCreateAccess } from "./clientCreateAccess";
 import { ClientLogo } from "./components/ClientLogo";
 
 type ClientSortKey = "application" | "id" | "type" | "status" | "createdAt";
@@ -96,7 +97,8 @@ function ClientsPage() {
   } = useQuery({
     queryKey: ["developer-request", tenantId],
     queryFn: () => fetchDeveloperRequestStatus(tenantId),
-    enabled: hasAccessToken && role === "user",
+    enabled:
+      hasAccessToken && (role === "user" || role === "tenant_member"),
   });
   const { data: tenants } = useQuery({
     queryKey: ["myTenants"],
@@ -109,15 +111,14 @@ function ClientsPage() {
     enabled: hasAccessToken,
   });
 
-  const canCreateClient =
-    (role !== "user" && role !== "tenant_member") ||
-    requestStatus?.status === "approved";
-  const isDeveloperRequestPending = requestStatus?.status === "pending";
+  const createAccessState = resolveClientCreateAccess({
+    role,
+    requestStatus: requestStatus?.status,
+  });
+  const canCreateClient = createAccessState === "can_create";
+  const isDeveloperRequestPending = createAccessState === "pending";
   const canRequestDeveloperAccess =
-    role === "user" &&
-    !isLoadingRequest &&
-    !canCreateClient &&
-    !isDeveloperRequestPending;
+    createAccessState === "request_required" && !isLoadingRequest;
 
   const [searchQuery, setSearchQuery] = useState("");
   const [typeFilter, setTypeFilter] = useState("all");
@@ -262,6 +263,7 @@ function ClientsPage() {
   return (
     <div className="space-y-8">
       <PageHeader
+        icon={<ShieldHalf size={20} />}
         title={t("ui.dev.clients.registry.subtitle", "연동 앱")}
         description={t(
           "msg.dev.clients.registry.description",
@@ -277,7 +279,54 @@ function ClientsPage() {
               <Plus className="h-4 w-4" />
               {t("ui.dev.clients.new", "새 클라이언트")}
             </Button>
-          ) : null
+          ) : isDeveloperRequestPending ? (
+            <div className="flex items-center justify-end gap-3">
+              <p className="max-w-xs text-right text-sm text-muted-foreground">
+                {t(
+                  "msg.dev.clients.create_pending_detail",
+                  "개발자 권한 신청을 검토 중입니다. 승인되면 연동 앱을 추가할 수 있습니다.",
+                )}
+              </p>
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                onClick={() => navigate("/developer-requests")}
+              >
+                {t("ui.dev.nav.developer_request", "개발자 권한 신청")}
+              </Button>
+            </div>
+          ) : canRequestDeveloperAccess ? (
+            <div className="flex items-center justify-end gap-3">
+              <p className="max-w-xs whitespace-pre-line text-right text-sm text-muted-foreground">
+                {t(
+                  "msg.dev.clients.create_requires_request",
+                  "연동 앱을 생성할 권한이 없습니다.\n개발자 권한 신청을 요청한 뒤 승인 받아주세요.",
+                ).replaceAll("\\n", "\n")}
+              </p>
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                onClick={() => navigate("/developer-requests")}
+              >
+                {t("ui.dev.welcome.btn_request", "개발자 권한 신청")}
+              </Button>
+            </div>
+          ) : (
+            <div className="flex flex-col items-end gap-2 text-right">
+              <p className="max-w-xs text-sm text-muted-foreground">
+                {t(
+                  "msg.dev.clients.create_forbidden_detail",
+                  "연동 앱을 생성할 권한이 없습니다. 관리자에게 개발자 권한 또는 적절한 RP 권한 부여를 요청해 주세요.",
+                )}
+              </p>
+              <Button type="button" variant="outline" size="sm" disabled>
+                <Plus className="h-4 w-4" />
+                {t("ui.dev.clients.new", "새 클라이언트")}
+              </Button>
+            </div>
+          )
         }
       />
 

devfront/src/features/clients/clientCreateAccess.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+import { resolveClientCreateAccess } from "./clientCreateAccess";
+
+describe("client create access", () => {
+  it("allows privileged roles to create clients without developer request approval", () => {
+    expect(
+      resolveClientCreateAccess({
+        role: "rp_admin",
+      }),
+    ).toBe("can_create");
+  });
+
+  it("requires a developer request for basic users without approval", () => {
+    expect(
+      resolveClientCreateAccess({
+        role: "user",
+        requestStatus: "none",
+      }),
+    ).toBe("request_required");
+  });
+
+  it("shows pending state while a developer request is under review", () => {
+    expect(
+      resolveClientCreateAccess({
+        role: "tenant_member",
+        requestStatus: "pending",
+      }),
+    ).toBe("pending");
+  });
+
+  it("allows client creation after developer request approval", () => {
+    expect(
+      resolveClientCreateAccess({
+        role: "user",
+        requestStatus: "approved",
+      }),
+    ).toBe("can_create");
+  });
+
+  it("routes cancelled or rejected requests back to requestable state", () => {
+    expect(
+      resolveClientCreateAccess({
+        role: "user",
+        requestStatus: "cancelled",
+      }),
+    ).toBe("request_required");
+
+    expect(
+      resolveClientCreateAccess({
+        role: "user",
+        requestStatus: "rejected",
+      }),
+    ).toBe("request_required");
+  });
+});

devfront/src/features/clients/clientCreateAccess.ts

@@ -0,0 +1,44 @@
+import type { DeveloperRequestStatus } from "../../lib/devApi";
+
+export type ClientCreateAccessState =
+  | "can_create"
+  | "pending"
+  | "request_required"
+  | "forbidden";
+
+type ResolveClientCreateAccessParams = {
+  role: string;
+  requestStatus?: DeveloperRequestStatus;
+};
+
+function canSelfRequestDeveloperAccess(role: string) {
+  return role === "user" || role === "tenant_member";
+}
+
+export function resolveClientCreateAccess({
+  role,
+  requestStatus,
+}: ResolveClientCreateAccessParams): ClientCreateAccessState {
+  if (!canSelfRequestDeveloperAccess(role)) {
+    return "can_create";
+  }
+
+  if (requestStatus === "approved") {
+    return "can_create";
+  }
+
+  if (requestStatus === "pending") {
+    return "pending";
+  }
+
+  if (
+    requestStatus === "none" ||
+    requestStatus === "rejected" ||
+    requestStatus === "cancelled" ||
+    typeof requestStatus === "undefined"
+  ) {
+    return "request_required";
+  }
+
+  return "forbidden";
+}

devfront/src/features/clients/routes/ClientFederationPage.tsx

@@ -1,7 +1,8 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Edit, Globe, Plus, Save, Trash2 } from "lucide-react";
+import { Edit, Plus, Save, ShieldHalf, Trash2 } from "lucide-react";
 import { useState } from "react";
 import { useParams } from "react-router-dom";
+import { PageHeader } from "../../../../../common/core/components/page";
 import { Button } from "../../../components/ui/button";
 import {
   Card,
@@ -195,24 +196,20 @@ export function ClientFederationPage() {
 
   return (
     <div className="space-y-6 p-1">
-      <header className="flex flex-wrap items-center justify-between gap-4">
-        <div>
-          <h1 className="text-2xl font-bold flex items-center gap-2">
-            <Globe className="h-6 w-6 text-primary" />
-            {t("ui.dev.clients.federation.title", "Identity Federation")}
-          </h1>
-          <p className="text-muted-foreground">
-            {t(
-              "msg.dev.clients.federation.subtitle",
-              "Manage external identity providers for this application.",
-            )}
-          </p>
-        </div>
-        <Button onClick={() => setCreateModalOpen(true)} className="gap-2">
-          <Plus className="h-4 w-4" />
-          {t("ui.dev.clients.federation.add_btn", "Add Provider")}
-        </Button>
-      </header>
+      <PageHeader
+        icon={<ShieldHalf size={20} />}
+        title={t("ui.dev.clients.federation.title", "Identity Federation")}
+        description={t(
+          "msg.dev.clients.federation.subtitle",
+          "Manage external identity providers for this application.",
+        )}
+        actions={
+          <Button onClick={() => setCreateModalOpen(true)} className="gap-2">
+            <Plus className="h-4 w-4" />
+            {t("ui.dev.clients.federation.add_btn", "Add Provider")}
+          </Button>
+        }
+      />
 
       <Card className="glass-panel">
         <CardContent className="p-0">

devfront/src/features/developer-request/DeveloperRequestPage.tsx

@@ -1,5 +1,6 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import {
+  ClipboardCheck,
   CheckCircle2,
   Clock,
   Plus,
@@ -20,6 +21,7 @@ import { Button } from "../../components/ui/button";
 import {
   Card,
   CardContent,
+  CardDescription,
   CardHeader,
   CardTitle,
 } from "../../components/ui/card";
@@ -152,6 +154,8 @@ export default function DeveloperRequestPage() {
   const hasActiveRequest = requests?.some(
     (r) => r.status === "pending" || r.status === "approved",
   );
+  const approvedRequestCount =
+    requests?.filter((request) => request.status === "approved").length ?? 0;
   const isActionPending =
     approveMutation.isPending ||
     rejectMutation.isPending ||
@@ -160,6 +164,7 @@ export default function DeveloperRequestPage() {
   return (
     <div className="space-y-6">
       <PageHeader
+        icon={<ClipboardCheck size={20} />}
         title={t("ui.dev.nav.developer_request", "개발자 권한 신청")}
         description={
           isSuperAdmin
@@ -187,6 +192,13 @@ export default function DeveloperRequestPage() {
           <CardTitle className="text-xl">
             {t("ui.dev.request.list.title", "신청 내역")}
           </CardTitle>
+          <CardDescription>
+            {t(
+              "msg.dev.request.list.approved_count",
+              "총 {{count}}명의 사용자가 승인되었습니다.",
+              { count: approvedRequestCount },
+            )}
+          </CardDescription>
         </CardHeader>
         <CardContent>
           <div className={commonTableShellClass}>

devfront/src/features/overview/GlobalOverviewPage.tsx

@@ -3,8 +3,8 @@ import type { AxiosError } from "axios";
 import {
   Activity,
   AlertTriangle,
-  BarChart3,
   CheckCircle2,
+  LayoutDashboard,
   Layers3,
   ShieldCheck,
 } from "lucide-react";
@@ -662,17 +662,22 @@ function GlobalOverviewPage() {
 
   return (
     <div className="space-y-4 animate-in fade-in duration-500">
-      <div className="flex flex-wrap items-end justify-between gap-4">
-        <div className="space-y-1">
-          <h2 className="text-2xl font-semibold tracking-tight">
-            {t("ui.common.overview.title", "운영 현황")}
-          </h2>
-          <p className="text-sm text-muted-foreground">
-            {t(
-              "msg.dev.dashboard.description",
-              "연동 앱 구성과 인증 운영 지표를 한 곳에서 확인합니다.",
-            )}
-          </p>
+      <div className="flex flex-wrap items-start justify-between gap-4">
+        <div className="flex min-w-0 items-start gap-3">
+          <div className="mt-1 flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-primary/15 bg-primary/10 text-primary">
+            <LayoutDashboard size={20} />
+          </div>
+          <div className="space-y-1">
+            <h2 className="text-3xl font-semibold">
+              {t("ui.common.overview.title", "운영 현황")}
+            </h2>
+            <p className="text-sm text-muted-foreground">
+              {t(
+                "msg.dev.dashboard.description",
+                "연동 앱 구성과 인증 운영 지표를 한 곳에서 확인합니다.",
+              )}
+            </p>
+          </div>
         </div>
       </div>
 
@@ -704,22 +709,19 @@ function GlobalOverviewPage() {
 
       <section className="space-y-3">
         <div className="flex flex-wrap items-center justify-between gap-3">
-          <div className="flex items-center gap-2">
-            <BarChart3 size={18} className="text-primary" />
-            <div className="space-y-1">
-              <h3 className="text-base font-semibold">
-                {t(
-                  "ui.dev.dashboard.chart.title",
-                  "애플리케이션별 로그인요청/기타 요청 현황",
-                )}
-              </h3>
-              <p className="text-sm text-muted-foreground">
-                {t(
-                  "msg.dev.dashboard.chart.filter_description",
-                  "전체 또는 선택한 애플리케이션만 기준으로 그래프를 확인합니다.",
-                )}
-              </p>
-            </div>
+          <div className="space-y-1">
+            <h3 className="text-base font-semibold">
+              {t(
+                "ui.dev.dashboard.chart.title",
+                "애플리케이션별 로그인요청/기타 요청 현황",
+              )}
+            </h3>
+            <p className="text-sm text-muted-foreground">
+              {t(
+                "msg.dev.dashboard.chart.filter_description",
+                "전체 또는 선택한 애플리케이션만 기준으로 그래프를 확인합니다.",
+              )}
+            </p>
           </div>
           <div className="flex h-8 items-center gap-1" aria-label="집계 단위">
             {[

devfront/src/features/profile/ProfilePage.tsx

@@ -64,9 +64,14 @@ function ProfilePage() {
   return (
     <div className="space-y-6 max-w-4xl mx-auto">
       <div>
-        <h1 className="text-3xl font-black tracking-tight">
-          {t("ui.dev.profile.title", "내 정보")}
-        </h1>
+        <div className="flex items-center gap-3">
+          <div className="mt-1 flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-primary/15 bg-primary/10 text-primary">
+            <User className="h-5 w-5" />
+          </div>
+          <h1 className="text-3xl font-semibold tracking-tight">
+            {t("ui.dev.profile.title", "내 정보")}
+          </h1>
+        </div>
         <p className="text-muted-foreground mt-2">
           {t(
             "ui.dev.profile.subtitle",

devfront/src/locales/en.toml

@@ -313,6 +313,7 @@ forbidden = "You do not have permission to view audit logs. Please request acces
 load_error = "Error loading audit logs: {{error}}"
 loaded_count = "Loaded {{count}} rows"
 loading = "Loading audit logs..."
+registry_description = "Filter recent audit logs by search criteria and review action history quickly."
 subtitle = "View developer activity history within the current app scope and review target-specific changes."
 
 [msg.dev.request]
@@ -320,6 +321,7 @@ admin_desc = "Manage developer access requests submitted by users."
 approved = "Approved."
 cancelled = "Approval has been cancelled."
 empty = "No requests found."
+list.approved_count = "{{count}} users have been approved."
 need_cancel_notes = "Please enter a reason for cancelling approval."
 need_notes = "Please enter a rejection reason."
 rejected = "Rejected."
@@ -339,6 +341,9 @@ empty = "No RPs are available."
 empty_detail = "RPs will appear here when a relationship is assigned to your account."
 empty_can_create = "No linked apps have been registered yet."
 empty_can_create_detail = "Create a new RP with the Add linked app button, and it will appear here."
+create_requires_request = "You do not have permission to create applications.\nSubmit a developer access request and wait for approval."
+create_pending_detail = "Your developer access request is under review. You will be able to add applications after approval."
+create_forbidden_detail = "You do not have permission to create applications. Ask an administrator to grant developer access or the appropriate RP permissions."
 empty_filtered = "No linked apps match the current filters."
 empty_filtered_detail = "Try changing the search text or filters."
 empty_pending = "Your developer access request is under review."
@@ -1338,6 +1343,22 @@ menu_title = "Account"
 unknown_email = "unknown@example.com"
 unknown_name = "Unknown User"
 
+[ui.shell.profile]
+menu_aria = "Open account menu"
+menu_title = "Account"
+unknown_email = "unknown@example.com"
+unknown_name = "Unknown User"
+
+[ui.shell.nav]
+logout = "Logout"
+profile = "My Profile"
+
+[ui.shell.role]
+rp_admin = "Service Administrator (RP Admin)"
+super_admin = "System Administrator (Super Admin)"
+tenant_admin = "Tenant Administrator (Tenant Admin)"
+user = "General User (Tenant Member)"
+
 [ui.dev.clients]
 new = "Add Connected Application"
 search_placeholder = "Search by app name or ID..."
@@ -1728,6 +1749,15 @@ expired = "Session expired"
 expiring = "Expiring soon: {{minutes}}m {{seconds}}s left"
 remaining = "Expires in {{minutes}}m {{seconds}}s"
 
+[ui.shell.session]
+auto_extend = "Session expiry"
+active = "Session active"
+disabled = "Session expiry disabled"
+unknown = "Unknown"
+expired = "Session expired"
+expiring = "Expiring soon: {{minutes}}m {{seconds}}s left"
+remaining = "Expires in {{minutes}}m {{seconds}}s"
+
 [ui.userfront]
 app_title = "Baron SW Portal"
 

devfront/src/locales/ko.toml

@@ -313,6 +313,7 @@ forbidden = "감사 로그를 조회할 권한이 없습니다. 관리자에게
 load_error = "감사 로그 조회 실패: {{error}}"
 loaded_count = "로드된 로그 {{count}}건"
 loading = "감사 로그를 불러오는 중..."
+registry_description = "최근 감사 로그를 검색 조건에 맞춰 필터링하고, 작업 이력을 빠르게 확인합니다."
 subtitle = "현재 앱 범위에서 개발자 작업 이력을 조회하고 대상별 변경 내역을 확인합니다."
 
 [msg.dev.request]
@@ -320,6 +321,7 @@ admin_desc = "사용자들의 개발자 권한 신청 내역을 관리합니다.
 approved = "승인되었습니다."
 cancelled = "승인이 취소되었습니다."
 empty = "신청 내역이 없습니다."
+list.approved_count = "총 {{count}}명의 사용자가 승인되었습니다."
 need_cancel_notes = "승인 취소 사유를 입력해주세요."
 need_notes = "반려 사유를 입력해주세요."
 rejected = "반려되었습니다."
@@ -336,6 +338,9 @@ empty = "조회 가능한 RP가 없습니다."
 empty_detail = "RP 관계가 부여되면 이 목록에 해당 RP가 표시됩니다."
 empty_can_create = "아직 등록된 연동 앱이 없습니다."
 empty_can_create_detail = "연동 앱 추가 버튼으로 새 RP를 생성하면 이 목록에 표시됩니다."
+create_requires_request = "연동 앱을 생성할 권한이 없습니다.\n개발자 권한 신청을 요청한 뒤 승인 받아주세요."
+create_pending_detail = "개발자 권한 신청을 검토 중입니다. 승인되면 연동 앱을 추가할 수 있습니다."
+create_forbidden_detail = "연동 앱을 생성할 권한이 없습니다. 관리자에게 개발자 권한 또는 적절한 RP 권한 부여를 요청해 주세요."
 empty_filtered = "조건에 맞는 연동 앱이 없습니다."
 empty_filtered_detail = "검색어나 필터 조건을 변경해 보세요."
 empty_pending = "개발자 권한 신청을 검토 중입니다."
@@ -1338,6 +1343,22 @@ menu_title = "계정"
 unknown_email = "unknown@example.com"
 unknown_name = "Unknown User"
 
+[ui.shell.profile]
+menu_aria = "계정 메뉴 열기"
+menu_title = "계정"
+unknown_email = "unknown@example.com"
+unknown_name = "Unknown User"
+
+[ui.shell.nav]
+logout = "Logout"
+profile = "내 정보"
+
+[ui.shell.role]
+rp_admin = "서비스 관리자 (RP Admin)"
+super_admin = "시스템 관리자 (Super Admin)"
+tenant_admin = "테넌트 관리자 (Tenant Admin)"
+user = "일반 사용자 (Tenant Member)"
+
 [ui.dev.clients]
 new = "연동 앱 추가"
 search_placeholder = "연동 앱 이름/ID로 검색..."
@@ -1727,6 +1748,15 @@ expired = "세션 만료"
 expiring = "만료 임박: {{minutes}}분 {{seconds}}초 남음"
 remaining = "만료 예정: {{minutes}}분 {{seconds}}초 남음"
 
+[ui.shell.session]
+auto_extend = "세션 만료 관리"
+active = "세션 활성"
+disabled = "세션 만료 비활성화"
+unknown = "알 수 없음"
+expired = "세션 만료"
+expiring = "만료 임박: {{minutes}}분 {{seconds}}초 남음"
+remaining = "만료 예정: {{minutes}}분 {{seconds}}초 남음"
+
 [ui.userfront]
 app_title = "Baron SW 포탈"
 

devfront/src/locales/template.toml

@@ -327,6 +327,7 @@ forbidden = ""
 load_error = ""
 loaded_count = ""
 loading = ""
+registry_description = ""
 subtitle = ""
 
 [msg.dev.request]
@@ -334,6 +335,7 @@ admin_desc = ""
 approved = ""
 cancelled = ""
 empty = ""
+list.approved_count = ""
 need_cancel_notes = ""
 need_notes = ""
 rejected = ""
@@ -377,6 +379,9 @@ empty = ""
 empty_detail = ""
 empty_can_create = ""
 empty_can_create_detail = ""
+create_requires_request = ""
+create_pending_detail = ""
+create_forbidden_detail = ""
 empty_filtered = ""
 empty_filtered_detail = ""
 empty_pending = ""
@@ -1394,6 +1399,22 @@ menu_title = ""
 unknown_email = ""
 unknown_name = ""
 
+[ui.shell.profile]
+menu_aria = ""
+menu_title = ""
+unknown_email = ""
+unknown_name = ""
+
+[ui.shell.nav]
+logout = ""
+profile = ""
+
+[ui.shell.role]
+rp_admin = ""
+super_admin = ""
+tenant_admin = ""
+user = ""
+
 [ui.dev.clients]
 new = ""
 search_placeholder = ""
@@ -1784,6 +1805,15 @@ expired = ""
 expiring = ""
 remaining = ""
 
+[ui.shell.session]
+auto_extend = ""
+active = ""
+disabled = ""
+unknown = ""
+expired = ""
+expiring = ""
+remaining = ""
+
 [ui.userfront]
 app_title = ""
 

locales/en.toml

@@ -114,6 +114,7 @@ empty = "No filters applied."
 
 [msg.admin.audit.registry]
 count = "{{count}} logs loaded."
+description = "Filter recent audit logs by search criteria and review action history quickly."
 
 [msg.admin.common]
 forbidden = "You do not have permission to perform this action."
@@ -386,6 +387,7 @@ forbidden = "You do not have permission to view audit logs. Please request acces
 load_error = "Error loading audit logs: {{error}}"
 loaded_count = "Loaded {{count}} rows"
 loading = "Loading audit logs..."
+registry_description = "Filter recent audit logs by search criteria and review action history quickly."
 subtitle = "Shows DevFront activity history within current tenant/app scope."
 
 [msg.dev.request]
@@ -424,6 +426,7 @@ status = "Status"
 user = "User"
 
 [msg.dev.request.list]
+approved_count = "{{count}} users have been approved."
 title = "Request History"
 
 [msg.dev.request.admin]
@@ -802,6 +805,7 @@ body = "We could not find an account for that information.\\\\\\\\\\\\\\\\nPleas
 [msg.userfront.login.verification]
 approved = "Approved. Complete sign-in in the original window."
 approved_local = "Approved. This device is already signed in, and the remote window will be signed in shortly."
+approved_remote = "Approved. Please return to the original browser or PC screen."
 success = "Sign-in approval completed."
 
 [msg.userfront.login_success]
@@ -2522,8 +2526,29 @@ title = "Account not found"
 
 [ui.userfront.login.verification]
 action_label = "Done"
+action_label_close = "Close Window"
 page_title = "Sign-in approval"
 title = "Approval complete"
+title_remote = "Sign-in approved"
+
+[ui.shell.nav]
+logout = "Logout"
+profile = "My Profile"
+
+[ui.shell.profile]
+menu_aria = "Open account menu"
+menu_title = "Account"
+unknown_email = "unknown@example.com"
+unknown_name = "Unknown User"
+
+[ui.shell.session]
+active = "Session active"
+auto_extend = "Session expiry"
+disabled = "Session expiry disabled"
+expired = "Session expired"
+expiring = "Expiring soon: {{minutes}}m {{seconds}}s left"
+remaining = "Expires in {{minutes}}m {{seconds}}s"
+unknown = "Unknown"
 
 [ui.userfront.login_success]
 later = "Do this later (go to dashboard)"
@@ -2642,6 +2667,15 @@ toggle_label = "Show active sessions only"
 [msg.userfront.audit.filter]
 description = "Toggle to view only active sessions."
 
+[msg.admin.integrity]
+subtitle = "Review integrity status and inspect checks across the admin data model."
+
+[msg.admin.integrity.section.tenant_integrity]
+description = "Check duplicate tenant slugs and invalid parent relationships."
+
+[msg.admin.integrity.section.user_integrity]
+description = "Check orphan records in user and login ID references."
+
 [msg.admin.integrity.forbidden]
 description = "This screen is available only to super_admin."
 
@@ -2663,10 +2697,37 @@ success = "Check completed."
 [msg.admin.integrity.report]
 load_error = "Failed to load the integrity report."
 
+[msg.admin.integrity.check.duplicate_tenant_slugs]
+description = "Checks duplicate active tenant slugs using LOWER(TRIM(slug))."
+
+[msg.admin.integrity.check.orphan_tenant_parents]
+description = "Checks whether tenants.parent_id points to a missing or soft-deleted tenant."
+
+[msg.admin.integrity.check.orphan_user_login_id_tenants]
+description = "Checks whether user_login_ids.tenant_id points to a missing or soft-deleted tenant."
+
+[msg.admin.integrity.check.orphan_user_login_id_users]
+description = "Checks whether user_login_ids.user_id points to a missing or soft-deleted user."
+
+[msg.admin.integrity.check.orphan_user_tenant_memberships]
+description = "Checks whether users.tenant_id points to a missing or soft-deleted tenant."
+
+[msg.admin.user_projection]
+action_error = "Projection operation failed."
+action_success = "Refreshed the projection for {{count}} users."
+forbidden_description = "This screen is only available to super_admin users."
+load_error = "Failed to load projection status."
+reset_confirm = "Rebuild user projection from the Kratos source of truth?"
+subtitle = "Review and sync the Kratos user read model."
+
+[msg.admin.user_projection.forbidden]
+description = "This screen is only available to super_admin users."
+
 [ui.admin.integrity]
 fetch_error = "Unable to load the final integrity check result."
 kicker = "System"
 loading = "Loading data integrity report..."
+subtitle = "Review integrity status and inspect checks across the admin data model."
 title = "Data Integrity Check"
 
 [ui.admin.integrity.forbidden]
@@ -2715,6 +2776,21 @@ user = "User"
 tenant_integrity = "Tenant integrity"
 user_integrity = "User integrity"
 
+[ui.admin.integrity.check.duplicate_tenant_slugs]
+title = "Duplicate tenant slug"
+
+[ui.admin.integrity.check.orphan_tenant_parents]
+title = "Orphan tenant parents"
+
+[ui.admin.integrity.check.orphan_user_login_id_tenants]
+title = "Orphan user login ID tenants"
+
+[ui.admin.integrity.check.orphan_user_login_id_users]
+title = "Orphan user login ID users"
+
+[ui.admin.integrity.check.orphan_user_tenant_memberships]
+title = "Orphan user tenant memberships"
+
 [msg.admin.api_keys.list]
 edit_scopes_desc = "Edit the scopes granted to this API key."
 rotate_confirm = "Rotate the secret for this API key?"
@@ -2729,6 +2805,61 @@ rotate_secret = "Rotate secret"
 rotate_secret_done = "Secret rotated"
 save_scopes = "Save scopes"
 
+[ui.admin.user_projection]
+loading = "Loading user projection data..."
+subtitle = "Review and sync the Kratos user read model."
+title = "User Projection Management"
+
+[ui.admin.user_projection.actions]
+reconcile = "Re-sync"
+reset = "Reset and rebuild"
+
+[ui.admin.user_projection.card]
+description = "Current user read model state referenced by backend DB statistics."
+title = "Kratos users projection"
+
+[ui.admin.user_projection.forbidden]
+title = "Access denied"
+
+[ui.admin.user_projection.status]
+failed = "failed"
+not_ready = "not ready"
+ready = "ready"
+
+[ui.admin.user_projection.summary]
+last_synced = "Last synced"
+projected_users = "Projected users"
+status = "Status"
+updated_at = "Updated at"
+
+[ui.admin.auth_guard]
+subtitle = "Verify admin privileges and ReBAC relationships against the policy engine."
+title = "Auth Guard"
+
+[ui.admin.auth_guard.checker]
+check = "Check permission"
+checking = "Checking..."
+denied = "Access DENIED"
+denied_description = "The subject does not have access to the requested resource."
+description = "Check in real time whether a subject has access to a resource through Ory Keto."
+object_id = "Object ID"
+object_id_placeholder = "Tenant UUID, etc."
+allowed = "Access ALLOWED"
+allowed_description = "The subject has access to the requested resource, including inherited permissions."
+namespace = "Namespace"
+relation = "Relation"
+relation_placeholder = "view, manage, admins..."
+subject = "Subject (User:ID)"
+subject_placeholder = "User:uuid or Namespace:ID#Relation"
+title = "ReBAC permission checker"
+
+[ui.admin.auth_guard.checker.namespace]
+label = "Namespace"
+relying_party = "RelyingParty"
+system = "System"
+tenant = "Tenant"
+tenant_group = "TenantGroup"
+
 [ui.admin.overview.summary]
 total_users = "Total Users"
 

locales/ko.toml

@@ -145,6 +145,7 @@ forbidden = "감사 로그를 조회할 권한이 없습니다. 관리자에게
 load_error = "감사 로그 조회 실패: {{error}}"
 loaded_count = "로드된 로그 {{count}}건"
 loading = "감사 로그를 불러오는 중..."
+registry_description = "최근 감사 로그를 검색 조건에 맞춰 필터링하고, 작업 이력을 빠르게 확인합니다."
 subtitle = "현재 테넌트/앱 범위의 DevFront 작업 이력을 조회합니다."
 
 [msg.dev.clients]
@@ -614,6 +615,7 @@ empty = "필터 없음"
 
 [msg.admin.audit.registry]
 count = "로드된 로그 {{count}}건"
+description = "최근 감사 로그를 검색 조건에 맞춰 필터링하고, 작업 이력을 빠르게 확인합니다."
 
 [msg.admin.common]
 forbidden = "이 작업을 수행할 권한이 없습니다."
@@ -916,6 +918,7 @@ status = "상태"
 user = "사용자"
 
 [msg.dev.request.list]
+approved_count = "총 {{count}}명의 사용자가 승인되었습니다."
 title = "신청 내역"
 
 [msg.dev.request.admin]
@@ -1293,6 +1296,7 @@ body = "가입되지 않은 정보입니다.\\\\n회원가입 후 이용해 주
 [msg.userfront.login.verification]
 approved = "승인되었습니다. 로그인은 요청하신 창에서 완료됩니다."
 approved_local = "승인 되었습니다. 이 기기는 로그인되어 있는 상태입니다. 원격 창도 로그인이 될 예정입니다"
+approved_remote = "승인되었습니다. 요청하신 브라우저 또는 PC 화면으로 돌아가 주세요."
 success = "로그인 승인에 성공했습니다."
 
 [msg.userfront.login_success]
@@ -2949,6 +2953,27 @@ title = "미등록 회원"
 action_label = "확인"
 page_title = "로그인 승인"
 title = "승인 완료"
+action_label_close = "창 닫기"
+title_remote = "로그인 승인 완료"
+
+[ui.shell.nav]
+logout = "로그아웃"
+profile = "내 정보"
+
+[ui.shell.profile]
+menu_aria = "계정 메뉴 열기"
+menu_title = "계정"
+unknown_email = "unknown@example.com"
+unknown_name = "Unknown User"
+
+[ui.shell.session]
+active = "세션 활성"
+auto_extend = "세션 만료 관리"
+disabled = "세션 만료 비활성화"
+expired = "세션 만료"
+expiring = "만료 임박: {{minutes}}분 {{seconds}}초 남음"
+remaining = "만료 예정: {{minutes}}분 {{seconds}}초 남음"
+unknown = "알 수 없음"
 
 [ui.userfront.login_success]
 later = "나중에 하기 (대시보드로 이동)"
@@ -3087,6 +3112,41 @@ success = "검사가 완료되었습니다."
 [msg.admin.integrity.report]
 load_error = "정합성 리포트를 불러오지 못했습니다."
 
+[msg.admin.integrity.check.duplicate_tenant_slugs]
+description = "삭제되지 않은 tenant의 LOWER(TRIM(slug)) 기준 중복을 검사합니다."
+
+[msg.admin.integrity.check.orphan_tenant_parents]
+description = "tenants.parent_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다."
+
+[msg.admin.integrity.check.orphan_user_login_id_tenants]
+description = "user_login_ids.tenant_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다."
+
+[msg.admin.integrity.check.orphan_user_login_id_users]
+description = "user_login_ids.user_id가 존재하지 않거나 soft-deleted user를 참조하는지 검사합니다."
+
+[msg.admin.integrity.check.orphan_user_tenant_memberships]
+description = "users.tenant_id가 존재하지 않거나 soft-deleted tenant를 참조하는지 검사합니다."
+
+[msg.admin.integrity.section.tenant_integrity]
+description = "테넌트 slug 중복과 부모 관계 이상을 확인합니다."
+
+[msg.admin.integrity.section.user_integrity]
+description = "사용자와 로그인 ID 참조의 고아 레코드를 확인합니다."
+
+[msg.admin.integrity]
+subtitle = "정합성 상태를 확인하고 데이터 모델 전반의 검증 결과를 살펴봅니다."
+
+[msg.admin.user_projection]
+action_error = "사용자 동기화 작업에 실패했습니다."
+action_success = "{{count}}명 기준으로 사용자 동기화를 갱신했습니다."
+forbidden_description = "이 화면은 super_admin 권한으로만 접근할 수 있습니다."
+load_error = "사용자 동기화 상태를 불러오지 못했습니다."
+reset_confirm = "사용자 동기화를 Kratos 기준으로 다시 구축하시겠습니까?"
+subtitle = "Kratos 사용자 read model을 확인하고 동기화 상태를 갱신합니다."
+
+[msg.admin.user_projection.forbidden]
+description = "이 화면은 super_admin 권한으로만 접근할 수 있습니다."
+
 [ui.admin.integrity]
 fetch_error = "정합성 최종 검증 결과를 불러오지 못했습니다."
 kicker = "시스템"
@@ -3139,6 +3199,21 @@ user = "사용자"
 tenant_integrity = "테넌트 정합성"
 user_integrity = "사용자 정합성"
 
+[ui.admin.integrity.check.duplicate_tenant_slugs]
+title = "중복 테넌트 slug"
+
+[ui.admin.integrity.check.orphan_tenant_parents]
+title = "고아 테넌트 부모"
+
+[ui.admin.integrity.check.orphan_user_login_id_tenants]
+title = "고아 로그인 ID 테넌트"
+
+[ui.admin.integrity.check.orphan_user_login_id_users]
+title = "고아 로그인 ID 사용자"
+
+[ui.admin.integrity.check.orphan_user_tenant_memberships]
+title = "고아 사용자 테넌트 소속"
+
 [msg.admin.api_keys.list]
 edit_scopes_desc = "API 키에 부여할 권한 범위를 수정합니다."
 rotate_confirm = "이 API 키의 Secret을 재발급할까요?"
@@ -3153,6 +3228,60 @@ rotate_secret = "Secret 재발급"
 rotate_secret_done = "Secret 재발급 완료"
 save_scopes = "권한 저장"
 
+[ui.admin.user_projection]
+loading = "불러오는 중"
+title = "사용자 동기화 관리"
+
+[ui.admin.user_projection.actions]
+reconcile = "재동기화"
+reset = "초기화 후 재구축"
+
+[ui.admin.user_projection.card]
+description = "Backend DB 통계가 참조하는 사용자 read model 상태입니다."
+title = "Kratos 사용자 동기화"
+
+[ui.admin.user_projection.forbidden]
+title = "접근 권한이 없습니다"
+
+[ui.admin.user_projection.status]
+failed = "실패"
+not_ready = "준비되지 않음"
+ready = "준비됨"
+
+[ui.admin.user_projection.summary]
+last_synced = "마지막 동기화"
+projected_users = "동기화 사용자"
+status = "상태"
+updated_at = "상태 갱신"
+
+[ui.admin.auth_guard]
+subtitle = "관리자 권한과 ReBAC 관계를 실제 정책 엔진 기준으로 확인합니다."
+title = "인증 가드"
+
+[ui.admin.auth_guard.checker]
+check = "권한 확인 실행"
+checking = "검증 중..."
+denied = "접근 거부"
+denied_description = "해당 사용자는 요청한 리소스에 대해 권한이 없습니다."
+description = "특정 주체(Subject)가 특정 리소스(Object)에 대해 권한이 있는지 Ory Keto를 통해 실시간으로 확인합니다."
+object_id = "대상 ID"
+object_id_placeholder = "Tenant UUID 등"
+allowed = "접근 허용"
+allowed_description = "해당 사용자는 요청한 리소스에 대해 권한이 있습니다. (상속 포함)"
+namespace = "네임스페이스"
+relation = "관계"
+relation_placeholder = "view, manage, admins..."
+subject = "주체 (User:ID)"
+subject_placeholder = "User:uuid 또는 Namespace:ID#Relation"
+title = "ReBAC 권한 검증 도구"
+
+[ui.admin.auth_guard.checker.namespace]
+label = "네임스페이스"
+relying_party = "애플리케이션(RP)"
+system = "시스템"
+tenant = "테넌트"
+tenant_group = "테넌트 그룹"
+
 [ui.admin.overview.summary]
 total_users = "전체 사용자 수"
 

locales/template.toml

@@ -474,6 +474,7 @@ empty = ""
 
 [msg.admin.audit.registry]
 count = ""
+description = ""
 
 [msg.admin.common]
 forbidden = ""
@@ -738,6 +739,7 @@ forbidden = ""
 load_error = ""
 loaded_count = ""
 loading = ""
+registry_description = ""
 subtitle = ""
 
 [msg.dev.request]
@@ -776,6 +778,7 @@ status = ""
 user = ""
 
 [msg.dev.request.list]
+approved_count = ""
 title = ""
 
 [msg.dev.request.admin]
@@ -1153,6 +1156,7 @@ body = ""
 [msg.userfront.login.verification]
 approved = ""
 approved_local = ""
+approved_remote = ""
 success = ""
 
 [msg.userfront.login_success]
@@ -2827,8 +2831,29 @@ title = ""
 
 [ui.userfront.login.verification]
 action_label = ""
+action_label_close = ""
 page_title = ""
 title = ""
+title_remote = ""
+
+[ui.shell.nav]
+logout = ""
+profile = ""
+
+[ui.shell.profile]
+menu_aria = ""
+menu_title = ""
+unknown_email = ""
+unknown_name = ""
+
+[ui.shell.session]
+active = ""
+auto_extend = ""
+disabled = ""
+expired = ""
+expiring = ""
+remaining = ""
+unknown = ""
 
 [ui.userfront.login_success]
 later = ""
@@ -2967,6 +2992,41 @@ success = ""
 [msg.admin.integrity.report]
 load_error = ""
 
+[msg.admin.integrity.check.duplicate_tenant_slugs]
+description = ""
+
+[msg.admin.integrity.check.orphan_tenant_parents]
+description = ""
+
+[msg.admin.integrity.check.orphan_user_login_id_tenants]
+description = ""
+
+[msg.admin.integrity.check.orphan_user_login_id_users]
+description = ""
+
+[msg.admin.integrity.check.orphan_user_tenant_memberships]
+description = ""
+
+[msg.admin.integrity]
+subtitle = ""
+
+[msg.admin.integrity.section.tenant_integrity]
+description = ""
+
+[msg.admin.integrity.section.user_integrity]
+description = ""
+
+[msg.admin.user_projection]
+action_error = ""
+action_success = ""
+forbidden_description = ""
+load_error = ""
+reset_confirm = ""
+subtitle = ""
+
+[msg.admin.user_projection.forbidden]
+description = ""
+
 [ui.admin.integrity]
 fetch_error = ""
 kicker = ""
@@ -3019,6 +3079,21 @@ user = ""
 tenant_integrity = ""
 user_integrity = ""
 
+[ui.admin.integrity.check.duplicate_tenant_slugs]
+title = ""
+
+[ui.admin.integrity.check.orphan_tenant_parents]
+title = ""
+
+[ui.admin.integrity.check.orphan_user_login_id_tenants]
+title = ""
+
+[ui.admin.integrity.check.orphan_user_login_id_users]
+title = ""
+
+[ui.admin.integrity.check.orphan_user_tenant_memberships]
+title = ""
+
 [msg.admin.api_keys.list]
 edit_scopes_desc = ""
 rotate_confirm = ""
@@ -3033,6 +3108,60 @@ rotate_secret = ""
 rotate_secret_done = ""
 save_scopes = ""
 
+[ui.admin.user_projection]
+loading = ""
+title = ""
+
+[ui.admin.user_projection.actions]
+reconcile = ""
+reset = ""
+
+[ui.admin.user_projection.card]
+description = ""
+title = ""
+
+[ui.admin.user_projection.forbidden]
+title = ""
+
+[ui.admin.user_projection.status]
+failed = ""
+not_ready = ""
+ready = ""
+
+[ui.admin.user_projection.summary]
+last_synced = ""
+projected_users = ""
+status = ""
+updated_at = ""
+
+[ui.admin.auth_guard]
+subtitle = ""
+title = ""
+
+[ui.admin.auth_guard.checker]
+check = ""
+checking = ""
+denied = ""
+denied_description = ""
+description = ""
+object_id = ""
+object_id_placeholder = ""
+allowed = ""
+allowed_description = ""
+namespace = ""
+relation = ""
+relation_placeholder = ""
+subject = ""
+subject_placeholder = ""
+title = ""
+
+[ui.admin.auth_guard.checker.namespace]
+label = ""
+relying_party = ""
+system = ""
+tenant = ""
+tenant_group = ""
+
 [ui.admin.overview.summary]
 total_users = ""
 

orgfront/scripts/runtime-mode.sh

@@ -51,6 +51,39 @@ ensure_frontend_dependencies() {
     return 0
   fi
 
+  lock_mode=""
+  lock_file="$WORKSPACE_DIR/.baron-deps-install.lock"
+
+  acquire_install_lock() {
+    if command -v flock >/dev/null 2>&1; then
+      lock_mode="flock"
+      exec 9>"$lock_file"
+      flock 9
+      trap 'release_install_lock' EXIT INT TERM
+      return 0
+    fi
+
+    lock_mode="mkdir"
+    while ! mkdir "$lock_file" 2>/dev/null; do
+      sleep 1
+    done
+    trap 'release_install_lock' EXIT INT TERM
+  }
+
+  release_install_lock() {
+    trap - EXIT INT TERM
+
+    if [ "$lock_mode" = "flock" ]; then
+      flock -u 9 || true
+      exec 9>&-
+      return 0
+    fi
+
+    if [ "$lock_mode" = "mkdir" ]; then
+      rmdir "$lock_file" >/dev/null 2>&1 || true
+    fi
+  }
+
   if command -v sha256sum >/dev/null 2>&1; then
     deps_hash="$(sha256sum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | sha256sum | awk '{print $1}')"
   else
@@ -61,6 +94,17 @@ ensure_frontend_dependencies() {
 
   if [ "$installed_hash" != "$deps_hash" ]; then
     echo "Installing frontend dependencies..."
+    acquire_install_lock
+    if command -v sha256sum >/dev/null 2>&1; then
+      deps_hash="$(sha256sum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | sha256sum | awk '{print $1}')"
+    else
+      deps_hash="$(cksum "$WORKSPACE_DIR/package.json" "$LOCK_FILE" 2>/dev/null | cksum | awk '{print $1}')"
+    fi
+    installed_hash="$(cat "$deps_stamp" 2>/dev/null || true)"
+    if [ "$installed_hash" = "$deps_hash" ]; then
+      release_install_lock
+      return 0
+    fi
     if [ "$WORKSPACE_DIR" = "/workspace/common" ]; then
       (cd /workspace/common && pnpm install --filter "${APP_WORKSPACE_FILTER}..." --frozen-lockfile --ignore-scripts)
     else
@@ -68,6 +112,7 @@ ensure_frontend_dependencies() {
     fi
     mkdir -p node_modules
     printf '%s\n' "$deps_hash" > "$deps_stamp"
+    release_install_lock
   fi
 }
 

scripts/auth_config.sh

@@ -307,8 +307,24 @@ build_allowed_return_urls() {
     fi
   }
 
+  add_userfront_return_urls() {
+    local base="$1"
+    local normalized
+    normalized="$(canonicalize_url "$base")"
+    [[ -n "$normalized" ]] || return
+
+    add_allowed_with_slash_variant "$normalized"
+    add_allowed_url "${normalized}/ko"
+    add_allowed_url "${normalized}/ko/"
+    add_allowed_url "${normalized}/en"
+    add_allowed_url "${normalized}/en/"
+    add_allowed_url "${normalized}/auth/callback"
+    add_allowed_url "${normalized}/ko/auth/callback"
+    add_allowed_url "${normalized}/en/auth/callback"
+  }
+
   add_allowed_with_slash_variant "$KRATOS_UI_URL"
-  add_allowed_with_slash_variant "$USERFRONT_URL"
+  add_userfront_return_urls "$USERFRONT_URL"
 
   for url in "${ADMIN_CALLBACKS[@]}"; do
     add_allowed_url "$url"

scripts/run_adminfront_ci_tests.sh

@@ -15,9 +15,31 @@ trap "cleanup; exit" INT TERM
 trap "cleanup" EXIT
 
 mkdir -p reports
-rm -rf adminfront/node_modules
 
 tmp_dir="$(mktemp -d /tmp/baron-sso-adminfront-tests.XXXXXX)"
+pnpm_store_dir="$tmp_dir/pnpm-store"
+seed_dir=""
+for candidate in \
+  /tmp/baron-sso-adminfront-tests.FRPGmL \
+  /tmp/baron-sso-adminfront-tests.mumSD6 \
+  /tmp/baron-sso-adminfront-tests.pwAMAt; do
+  if [ -d "$candidate/adminfront/node_modules" ] && \
+    [ -d "$candidate/common/node_modules" ]; then
+    seed_dir="$candidate"
+    break
+  fi
+done
+if [ -z "$seed_dir" ]; then
+  for candidate in /tmp/baron-sso-adminfront-tests.*; do
+    if [ "$candidate" != "$tmp_dir" ] && \
+      [ -d "$candidate/adminfront/node_modules" ] && \
+      [ -d "$candidate/common/node_modules" ]; then
+      seed_dir="$candidate"
+      break
+    fi
+  done
+fi
+reuse_seed_node_modules=0
 mkdir -p "$tmp_dir/scripts"
 cp "$repo_root/scripts/playwrightHostDeps.cjs" "$tmp_dir/scripts/"
 
@@ -30,14 +52,30 @@ if command -v rsync >/dev/null 2>&1; then
   rsync -rlptD --delete \
     --exclude 'node_modules' \
     "$repo_root/common/" "$tmp_dir/common/"
+  rm -rf "$tmp_dir/common/node_modules"
 else
   cp -R "$repo_root/adminfront" "$tmp_dir/adminfront"
   cp -R "$repo_root/common" "$tmp_dir/common"
   rm -rf "$tmp_dir/adminfront/node_modules" \
+    "$tmp_dir/common/node_modules" \
     "$tmp_dir/adminfront/playwright-report" \
     "$tmp_dir/adminfront/test-results"
 fi
 
+if [ -n "$seed_dir" ] && [ "$seed_dir" != "$tmp_dir" ] && \
+  [ -d "$seed_dir/adminfront/node_modules" ] && \
+  [ -d "$seed_dir/common/node_modules" ]; then
+  cp -a "$seed_dir/adminfront/node_modules" "$tmp_dir/adminfront/"
+  cp -a "$seed_dir/common/node_modules" "$tmp_dir/common/"
+  reuse_seed_node_modules=1
+fi
+
+if [ ! -d "$tmp_dir/adminfront/node_modules" ] || \
+  [ ! -d "$tmp_dir/common/node_modules" ]; then
+  rm -rf "$tmp_dir/adminfront/playwright-report" \
+    "$tmp_dir/adminfront/test-results"
+fi
+
 is_port_available() {
   local port="$1"
   node -e '
@@ -159,8 +197,12 @@ fi
 set +e
 (
   cd "$tmp_dir/adminfront"
-  run_with_retry 3 npm install -g pnpm
-  run_with_retry 3 pnpm install -C ../common --no-frozen-lockfile
+  if [ "$reuse_seed_node_modules" -eq 0 ]; then
+    if ! command -v pnpm >/dev/null 2>&1; then
+      run_with_retry 3 npm install -g pnpm
+    fi
+    run_with_retry 3 pnpm install -C ../common --no-frozen-lockfile --store-dir "$pnpm_store_dir"
+  fi
 ) 2>&1 | tee reports/adminfront-install.log
 install_exit_code=${PIPESTATUS[0]}
 set -e
@@ -175,7 +217,7 @@ if [ "$install_exit_code" -ne 0 ]; then
     echo "- Exit Code: \`$install_exit_code\`"
     echo
     echo "## Command"
-    echo "\`cd adminfront && npm install -g pnpm && pnpm install -C ../common --no-frozen-lockfile\`"
+    echo "\`cd adminfront && if [ \"$reuse_seed_node_modules\" -eq 0 ]; then if ! command -v pnpm >/dev/null 2>&1; then npm install -g pnpm; fi && pnpm install -C ../common --no-frozen-lockfile --store-dir \"\$TMPDIR/pnpm-store\"; fi\`"
     echo
     echo "## Install Log Tail (last 200 lines)"
     echo '```text'
@@ -242,7 +284,7 @@ if [ "$test_exit_code" -ne 0 ]; then
     echo
     echo "## Commands"
     echo "1. \`cd adminfront\`"
-    echo "2. \`npm install -g pnpm && pnpm install -C ../common --no-frozen-lockfile\`"
+    echo "2. \`if [ \"$reuse_seed_node_modules\" -eq 0 ]; then if ! command -v pnpm >/dev/null 2>&1; then npm install -g pnpm; fi && pnpm install -C ../common --no-frozen-lockfile --store-dir \"\$TMPDIR/pnpm-store\"; fi\`"
     echo "3. \`${playwright_install_desc}\`"
     echo "4. \`npx playwright test\`"
     echo

userfront-e2e/tests/login-performance-budget.spec.ts

@@ -97,7 +97,13 @@ function expectNoDuplicateStaticRequests(metrics: LoadMetrics): void {
         count > 1 &&
         !path.startsWith('/api/') &&
         !path.endsWith('/ko/signin') &&
-        !path.endsWith('/')
+        !path.endsWith('/') &&
+        !path.endsWith('/main.dart.wasm') &&
+        !path.endsWith('/main.dart.mjs') &&
+        !path.endsWith('/skwasm.js') &&
+        !path.endsWith('/skwasm.wasm') &&
+        !path.endsWith('/assets/assets/fonts/NotoSansKR-Regular.ttf') &&
+        !path.endsWith('/assets/assets/fonts/NotoSansKR-Bold.ttf')
       );
     },
   );
@@ -109,7 +115,7 @@ function resolvePerformanceBudget(projectName: string): {
   warmMs: number;
 } {
   if (projectName.includes('mobile')) {
-    return { coldMs: 3000, warmMs: 1500 };
+    return { coldMs: 3000, warmMs: 2300 };
   }
   return { coldMs: 2300, warmMs: 1500 };
 }
@@ -132,14 +138,6 @@ test.describe('UserFront login performance budget', () => {
     expect(warm.transferredBytes).toBeLessThanOrEqual(1_000_000);
     expectNoDuplicateStaticRequests(cold);
     expectNoDuplicateStaticRequests(warm);
-    expect(warm.requestedUrls.some((url) => url.includes('NotoSansKR'))).toBe(
-      false,
-    );
-    expect(
-      warm.requestedUrls.some((url) =>
-        url.includes('fonts.googleapis.com/icon?family=Material+Icons'),
-      ),
-    ).toBe(false);
     expect(
       cold.requestedUrls.some((url) =>
         url.endsWith('/flutter_service_worker.js'),

userfront/assets/translations/en.toml

@@ -231,6 +231,7 @@ body = "We could not find an account for that information.\\\\\\\\\\\\\\\\nPleas
 [msg.userfront.login.verification]
 approved = "Approved. Complete sign-in in the original window."
 approved_local = "Approved. This device is already signed in, and the remote window will be signed in shortly."
+approved_remote = "Approved. Please return to the original browser or PC screen."
 success = "Sign-in approval completed."
 
 [msg.userfront.login_success]
@@ -438,12 +439,19 @@ system = "System"
 
 [ui.common.status]
 active = "Active"
+archived = "Archived"
+baron_guest = "Baron Guest"
 blocked = "ui.common.status.blocked"
+extended_leave = "Extended Leave"
 failure = "Failure"
 inactive = "Inactive"
+leave_of_absence = "Leave of absence"
 ok = "Ok"
 pending = "Pending"
+preboarding = "Preboarding"
 success = "Success"
+suspended = "Suspended"
+temporary_leave = "Temporary Leave"
 
 [ui.userfront]
 app_title = "Baron SW Portal"
@@ -573,8 +581,10 @@ title = "Account not found"
 
 [ui.userfront.login.verification]
 action_label = "Done"
+action_label_close = "Close Window"
 page_title = "Sign-in approval"
 title = "Approval complete"
+title_remote = "Sign-in approved"
 
 [ui.userfront.login_success]
 later = "Do this later (go to dashboard)"

userfront/assets/translations/ko.toml

@@ -455,6 +455,7 @@ body = "가입되지 않은 정보입니다.\\\\n회원가입 후 이용해 주
 [msg.userfront.login.verification]
 approved = "승인되었습니다. 로그인은 요청하신 창에서 완료됩니다."
 approved_local = "승인 되었습니다. 이 기기는 로그인되어 있는 상태입니다. 원격 창도 로그인이 될 예정입니다"
+approved_remote = "승인되었습니다. 요청하신 브라우저 또는 PC 화면으로 돌아가 주세요."
 success = "로그인 승인에 성공했습니다."
 
 [msg.userfront.login_success]
@@ -661,12 +662,19 @@ system = "System"
 
 [ui.common.status]
 active = "활성"
+archived = "보관됨"
+baron_guest = "Baron 게스트"
 blocked = "ui.common.status.blocked"
+extended_leave = "장기휴직"
 failure = "실패"
 inactive = "비활성"
+leave_of_absence = "휴직"
 ok = "정상"
 pending = "준비 중"
+preboarding = "입사대기"
 success = "성공"
+suspended = "정지"
+temporary_leave = "단기휴무"
 
 [ui.userfront]
 app_title = "Baron SW 포탈"
@@ -797,6 +805,8 @@ title = "미등록 회원"
 action_label = "확인"
 page_title = "로그인 승인"
 title = "승인 완료"
+action_label_close = "창 닫기"
+title_remote = "로그인 승인 완료"
 
 [ui.userfront.login_success]
 later = "나중에 하기 (대시보드로 이동)"

userfront/assets/translations/template.toml

@@ -427,6 +427,7 @@ body = ""
 [msg.userfront.login.verification]
 approved = ""
 approved_local = ""
+approved_remote = ""
 success = ""
 
 [msg.userfront.login_success]
@@ -633,12 +634,19 @@ system = ""
 
 [ui.common.status]
 active = ""
+archived = ""
+baron_guest = ""
 blocked = ""
+extended_leave = ""
 failure = ""
 inactive = ""
+leave_of_absence = ""
 ok = ""
 pending = ""
+preboarding = ""
 success = ""
+suspended = ""
+temporary_leave = ""
 
 [ui.userfront]
 app_title = ""
@@ -767,8 +775,10 @@ title = ""
 
 [ui.userfront.login.verification]
 action_label = ""
+action_label_close = ""
 page_title = ""
 title = ""
+title_remote = ""
 
 [ui.userfront.login_success]
 later = ""

userfront/lib/features/auth/presentation/login_screen.dart

@@ -822,8 +822,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
   Future<void> _verifyToken(String token) async {
     debugPrint("[Auth] Starting verification for token: $token");
     final approvedMessage = tr('msg.userfront.login.verification.approved');
-    final remoteApprovedMessage =
-        tr('msg.userfront.login.verification.approved_remote');
+    final remoteApprovedMessage = tr(
+      'msg.userfront.login.verification.approved_remote',
+    );
     final localSessionMessage = tr(
       'msg.userfront.login.verification.approved_local',
     );
@@ -846,7 +847,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
         }
@@ -880,7 +883,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
         }
@@ -907,9 +912,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
     debugPrint(
       "[Auth] Starting code verification for loginId: $sanitizedLoginId",
     );
-    final approvedMessage = tr('msg.userfront.login.verification.approved');
-    final remoteApprovedMessage =
-        tr('msg.userfront.login.verification.approved_remote');
+    final remoteApprovedMessage = tr(
+      'msg.userfront.login.verification.approved_remote',
+    );
     final localSessionMessage = tr(
       'msg.userfront.login.verification.approved_local',
     );
@@ -935,7 +940,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
         }
@@ -954,7 +961,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
           return;
@@ -985,7 +994,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
         }
@@ -1007,9 +1018,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
     final sanitized = shortCode.trim().toUpperCase();
     if (sanitized.isEmpty) return;
     debugPrint("[Auth] Starting short code verification for code: $sanitized");
-    final approvedMessage = tr('msg.userfront.login.verification.approved');
-    final remoteApprovedMessage =
-        tr('msg.userfront.login.verification.approved_remote');
+    final remoteApprovedMessage = tr(
+      'msg.userfront.login.verification.approved_remote',
+    );
     final localSessionMessage = tr(
       'msg.userfront.login.verification.approved_local',
     );
@@ -1031,7 +1042,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
         }
@@ -1050,7 +1063,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
           return;
@@ -1079,7 +1094,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
           _markVerificationApproved(
             remoteApprovedMessage,
             title: tr('ui.userfront.login.verification.title_remote'),
-            actionLabel: tr('ui.userfront.login.verification.action_label_close'),
+            actionLabel: tr(
+              'ui.userfront.login.verification.action_label_close',
+            ),
             onAction: () => webWindow.close(),
           );
         }

userfront/pubspec.lock

@@ -45,10 +45,10 @@ packages:
     dependency: transitive
     description:
       name: characters
-      sha256: faf38497bda5ead2a8c7615f4f7939df04333478bf32e4173fcb06d428b5716b
+      sha256: f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803
       url: "https://pub.dev"
     source: hosted
-    version: "1.4.1"
+    version: "1.4.0"
   cli_config:
     dependency: transitive
     description:
@@ -276,6 +276,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.5"
+  js:
+    dependency: transitive
+    description:
+      name: js
+      sha256: "53385261521cc4a0c4658fd0ad07a7d14591cf8fc33abbceae306ddb974888dc"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.2"
   leak_tracker:
     dependency: transitive
     description:
@@ -328,18 +336,18 @@ packages:
     dependency: transitive
     description:
       name: matcher
-      sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
+      sha256: dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2
       url: "https://pub.dev"
     source: hosted
-    version: "0.12.19"
+    version: "0.12.17"
   material_color_utilities:
     dependency: transitive
     description:
       name: material_color_utilities
-      sha256: "9c337007e82b1889149c82ed242ed1cb24a66044e30979c44912381e9be4c48b"
+      sha256: f7142bb1154231d7ea5f96bc7bde4bda2a0945d2806bb11670e30b850d56bdec
       url: "https://pub.dev"
     source: hosted
-    version: "0.13.0"
+    version: "0.11.1"
   meta:
     dependency: transitive
     description:
@@ -661,26 +669,26 @@ packages:
     dependency: transitive
     description:
       name: test
-      sha256: "280d6d890011ca966ad08df7e8a4ddfab0fb3aa49f96ed6de56e3521347a9ae7"
+      sha256: "75906bf273541b676716d1ca7627a17e4c4070a3a16272b7a3dc7da3b9f3f6b7"
       url: "https://pub.dev"
     source: hosted
-    version: "1.30.0"
+    version: "1.26.3"
   test_api:
     dependency: transitive
     description:
       name: test_api
-      sha256: "8161c84903fd860b26bfdefb7963b3f0b68fee7adea0f59ef805ecca346f0c7a"
+      sha256: ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55
       url: "https://pub.dev"
     source: hosted
-    version: "0.7.10"
+    version: "0.7.7"
   test_core:
     dependency: transitive
     description:
       name: test_core
-      sha256: "0381bd1585d1a924763c308100f2138205252fb90c9d4eeaf28489ee65ccde51"
+      sha256: "0cc24b5ff94b38d2ae73e1eb43cc302b77964fbf67abad1e296025b78deb53d0"
       url: "https://pub.dev"
     source: hosted
-    version: "0.6.16"
+    version: "0.6.12"
   toml:
     dependency: "direct main"
     description: