네이버 계정 정합성 맞춤

2026-06-15 19:54:09 +09:00
parent 8e9d015443
commit 4d468cd39f
97 changed files with 5837 additions and 2031 deletions
--- a/backend/internal/handler/tenant_handler_seed_delete_test.go
+++ b/backend/internal/handler/tenant_handler_seed_delete_test.go
@@ -2,6 +2,7 @@ package handler

 import (
 	"baron-sso-backend/internal/domain"
+	"baron-sso-backend/internal/service"
 	"baron-sso-backend/internal/testsupport"
 	"bytes"
 	"context"
@@ -15,6 +16,7 @@ import (
 	"time"

 	"github.com/gofiber/fiber/v2"
+	"github.com/stretchr/testify/mock"
 	"github.com/testcontainers/testcontainers-go"
 	postgres_module "github.com/testcontainers/testcontainers-go/modules/postgres"
 	"github.com/testcontainers/testcontainers-go/wait"
@@ -56,8 +58,8 @@ func newTenantHandlerSeedDeleteDB(t *testing.T) *gorm.DB {
 	if err != nil {
 		t.Fatalf("failed to open postgres connection: %v", err)
 	}
-	if err := db.AutoMigrate(&domain.Tenant{}); err != nil {
-		t.Fatalf("failed to migrate tenants: %v", err)
+	if err := db.AutoMigrate(&domain.Tenant{}, &domain.User{}, &domain.UserLoginID{}); err != nil {
+		t.Fatalf("failed to migrate tenant delete models: %v", err)
 	}
 	return db
 }
@@ -108,6 +110,137 @@ func TestTenantHandlerDeleteTenantRejectsSeedTenant(t *testing.T) {
 	}
 }

+func TestTenantHandlerDeleteTenantReassignsUserMembershipsToParentTenant(t *testing.T) {
+	db := newTenantHandlerSeedDeleteDB(t)
+	parent := domain.Tenant{
+		ID:     "10000000-0000-0000-0000-000000000001",
+		Name:   "Parent",
+		Slug:   "delete-policy-parent",
+		Type:   domain.TenantTypeCompany,
+		Status: domain.TenantStatusActive,
+	}
+	child := domain.Tenant{
+		ID:       "10000000-0000-0000-0000-000000000002",
+		Name:     "Collaboration",
+		Slug:     "delete-policy-collaboration",
+		Type:     domain.TenantTypeUserGroup,
+		ParentID: &parent.ID,
+		Status:   domain.TenantStatusActive,
+	}
+	user := domain.User{
+		ID:       "10000000-0000-0000-0000-000000000101",
+		Email:    "delete-policy-user@example.com",
+		Name:     "Delete Policy User",
+		Role:     domain.RoleUser,
+		TenantID: &child.ID,
+	}
+	loginID := domain.UserLoginID{
+		ID:       "10000000-0000-0000-0000-000000000201",
+		UserID:   user.ID,
+		TenantID: child.ID,
+		FieldKey: "employee_number",
+		LoginID:  "delete-policy-user",
+	}
+	if err := db.Create(&parent).Error; err != nil {
+		t.Fatalf("failed to create parent tenant: %v", err)
+	}
+	if err := db.Create(&child).Error; err != nil {
+		t.Fatalf("failed to create child tenant: %v", err)
+	}
+	if err := db.Create(&user).Error; err != nil {
+		t.Fatalf("failed to create user: %v", err)
+	}
+	if err := db.Create(&loginID).Error; err != nil {
+		t.Fatalf("failed to create login id: %v", err)
+	}
+
+	staleIdentity := service.KratosIdentity{
+		ID:    user.ID,
+		State: "active",
+		Traits: map[string]any{
+			"email":             user.Email,
+			"name":              user.Name,
+			"tenant_id":         child.ID,
+			"primaryTenantId":   child.ID,
+			"primaryTenantSlug": child.Slug,
+			"primaryTenantName": child.Name,
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":   child.ID,
+					"tenantSlug": child.Slug,
+					"tenantName": child.Name,
+					"isPrimary":  true,
+					"grade":      "G5",
+				},
+			},
+		},
+	}
+	updatedIdentity := staleIdentity
+	mockKratos := new(MockKratosAdmin)
+	mockKratos.On("GetIdentity", mock.Anything, user.ID).Return(&staleIdentity, nil).Once()
+	mockKratos.On("UpdateIdentity", mock.Anything, user.ID, mock.MatchedBy(func(traits map[string]any) bool {
+		if traits["tenant_id"] != parent.ID || traits["primaryTenantId"] != parent.ID {
+			return false
+		}
+		if traits["primaryTenantSlug"] != parent.Slug || traits["primaryTenantName"] != parent.Name {
+			return false
+		}
+		appointments, ok := traits["additionalAppointments"].([]any)
+		if !ok || len(appointments) != 1 {
+			return false
+		}
+		appointment, ok := appointments[0].(map[string]any)
+		return ok &&
+			appointment["tenantId"] == parent.ID &&
+			appointment["tenantSlug"] == parent.Slug &&
+			appointment["tenantName"] == parent.Name &&
+			appointment["grade"] == "G5" &&
+			appointment["isPrimary"] == true
+	}), "active").Run(func(args mock.Arguments) {
+		updatedIdentity.Traits = args.Get(2).(map[string]any)
+	}).Return(&updatedIdentity, nil).Once()
+	redis := &mockRedisRepo{data: map[string]string{}}
+	staleRaw, _ := json.Marshal(staleIdentity)
+	if err := redis.Set(identityMirrorKey(user.ID), string(staleRaw), 0); err != nil {
+		t.Fatalf("failed to seed identity mirror: %v", err)
+	}
+
+	app := fiber.New()
+	app.Delete("/tenants/:id", (&TenantHandler{DB: db, KratosAdmin: mockKratos, IdentityCache: redis}).DeleteTenant)
+	req := httptest.NewRequest(http.MethodDelete, "/tenants/"+child.ID, nil)
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d", resp.StatusCode, http.StatusNoContent)
+	}
+
+	var foundUser domain.User
+	if err := db.First(&foundUser, "id = ?", user.ID).Error; err != nil {
+		t.Fatalf("failed to reload user: %v", err)
+	}
+	if foundUser.TenantID == nil || *foundUser.TenantID != parent.ID {
+		t.Fatalf("user tenant_id = %v, want %s", foundUser.TenantID, parent.ID)
+	}
+	var foundLogin domain.UserLoginID
+	if err := db.First(&foundLogin, "id = ?", loginID.ID).Error; err != nil {
+		t.Fatalf("failed to reload login id: %v", err)
+	}
+	if foundLogin.TenantID != parent.ID {
+		t.Fatalf("login tenant_id = %s, want %s", foundLogin.TenantID, parent.ID)
+	}
+	mockKratos.AssertExpectations(t)
+
+	var mirrored service.KratosIdentity
+	if err := json.Unmarshal([]byte(redis.data[identityMirrorKey(user.ID)]), &mirrored); err != nil {
+		t.Fatalf("failed to decode mirrored identity: %v", err)
+	}
+	if mirrored.Traits["tenant_id"] != parent.ID || mirrored.Traits["primaryTenantSlug"] != parent.Slug {
+		t.Fatalf("mirrored traits = %#v, want promoted tenant %s/%s", mirrored.Traits, parent.ID, parent.Slug)
+	}
+}
+
 func TestTenantHandlerDeleteTenantsBulkRejectsSeedTenant(t *testing.T) {
 	setSeedTenantCSVForDeleteGuard(t, "protected-root")
 	db := newTenantHandlerSeedDeleteDB(t)
@@ -157,3 +290,78 @@ func TestTenantHandlerDeleteTenantsBulkRejectsSeedTenant(t *testing.T) {
 		t.Fatalf("remaining tenant count = %d, want 2", count)
 	}
 }
+
+func TestTenantHandlerDeleteTenantsBulkReassignsUsersToNearestRemainingAncestor(t *testing.T) {
+	db := newTenantHandlerSeedDeleteDB(t)
+	root := domain.Tenant{
+		ID:     "10000000-0000-0000-0000-000000000011",
+		Name:   "Root",
+		Slug:   "delete-policy-root",
+		Type:   domain.TenantTypeCompanyGroup,
+		Status: domain.TenantStatusActive,
+	}
+	parent := domain.Tenant{
+		ID:       "10000000-0000-0000-0000-000000000012",
+		Name:     "Parent",
+		Slug:     "delete-policy-bulk-parent",
+		Type:     domain.TenantTypeCompany,
+		ParentID: &root.ID,
+		Status:   domain.TenantStatusActive,
+	}
+	child := domain.Tenant{
+		ID:       "10000000-0000-0000-0000-000000000013",
+		Name:     "Collaboration",
+		Slug:     "delete-policy-bulk-collaboration",
+		Type:     domain.TenantTypeUserGroup,
+		ParentID: &parent.ID,
+		Status:   domain.TenantStatusActive,
+	}
+	user := domain.User{
+		ID:       "10000000-0000-0000-0000-000000000111",
+		Email:    "bulk-delete-policy-user@example.com",
+		Name:     "Bulk Delete Policy User",
+		Role:     domain.RoleUser,
+		TenantID: &child.ID,
+	}
+	if err := db.Create(&root).Error; err != nil {
+		t.Fatalf("failed to create root tenant: %v", err)
+	}
+	if err := db.Create(&parent).Error; err != nil {
+		t.Fatalf("failed to create parent tenant: %v", err)
+	}
+	if err := db.Create(&child).Error; err != nil {
+		t.Fatalf("failed to create child tenant: %v", err)
+	}
+	if err := db.Create(&user).Error; err != nil {
+		t.Fatalf("failed to create user: %v", err)
+	}
+
+	mockSvc := new(MockTenantService)
+	mockSvc.On("DeleteTenantsBulk", mock.Anything, []string{parent.ID, child.ID}).Return(nil).Once()
+
+	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
+	app.Delete("/tenants/bulk", (&TenantHandler{DB: db, Service: mockSvc}).DeleteTenantsBulk)
+	body, _ := json.Marshal(map[string][]string{"ids": {parent.ID, child.ID}})
+	req := httptest.NewRequest(http.MethodDelete, "/tenants/bulk", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want %d", resp.StatusCode, http.StatusOK)
+	}
+
+	var foundUser domain.User
+	if err := db.First(&foundUser, "id = ?", user.ID).Error; err != nil {
+		t.Fatalf("failed to reload user: %v", err)
+	}
+	if foundUser.TenantID == nil || *foundUser.TenantID != root.ID {
+		t.Fatalf("user tenant_id = %v, want %s", foundUser.TenantID, root.ID)
+	}
+	mockSvc.AssertExpectations(t)
+}