네이버 계정 정합성 맞춤

backend/internal/service/worksmobile_mapper.go

@@ -202,6 +202,14 @@ func BuildWorksmobileUserPayloadForDomainTenant(user domain.User, tenant domain.
 }
 
 func BuildWorksmobileUserPayloadForDomainTenants(user domain.User, tenant domain.Tenant, tenantByID map[string]domain.Tenant, rootConfig domain.JSONMap) (WorksmobileUserPayload, error) {
+	return buildWorksmobileUserPayloadForDomainTenants(user, tenant, tenantByID, rootConfig, true)
+}
+
+func BuildWorksmobileUserPayloadForScopedDomainTenants(user domain.User, tenant domain.Tenant, tenantByID map[string]domain.Tenant, rootConfig domain.JSONMap) (WorksmobileUserPayload, error) {
+	return buildWorksmobileUserPayloadForDomainTenants(user, tenant, tenantByID, rootConfig, false)
+}
+
+func buildWorksmobileUserPayloadForDomainTenants(user domain.User, tenant domain.Tenant, tenantByID map[string]domain.Tenant, rootConfig domain.JSONMap, includeFallbackTenant bool) (WorksmobileUserPayload, error) {
 	if err := ValidateWorksmobileExternalKey(user.ID); err != nil {
 		return WorksmobileUserPayload{}, err
 	}
@@ -211,7 +219,9 @@ func BuildWorksmobileUserPayloadForDomainTenants(user domain.User, tenant domain
 	if tenantByID == nil {
 		tenantByID = map[string]domain.Tenant{}
 	}
-	tenantByID[tenant.ID] = tenant
+	if includeFallbackTenant {
+		tenantByID[tenant.ID] = tenant
+	}
 	domainID, err := ResolveWorksmobileAccountDomainIDFromEmail(user.Email, tenant, rootConfig)
 	if err != nil {
 		return WorksmobileUserPayload{}, err
@@ -253,7 +263,7 @@ func buildWorksmobileUserOrganizations(user domain.User, tenant domain.Tenant, t
 	appointments := worksmobileAppointmentsFromMetadata(user.Metadata)
 	if len(appointments) == 0 {
 		appointments = []worksmobileAppointment{{TenantID: tenant.ID, IsPrimary: true}}
-	} else if !worksmobileAppointmentsContainTenant(appointments, tenant.ID) && !worksmobileAppointmentsHavePrimary(appointments) {
+	} else if !worksmobileAppointmentsContainSyncableOrgUnit(appointments, tenantByID) && !worksmobileAppointmentsContainTenant(appointments, tenant.ID) {
 		appointments = append([]worksmobileAppointment{{
 			TenantID:   tenant.ID,
 			IsPrimary:  true,
@@ -284,6 +294,10 @@ func buildWorksmobileUserOrganizations(user domain.User, tenant domain.Tenant, t
 		if !ok {
 			continue
 		}
+		if worksmobileTenantExcludedFromSync(appointmentTenant, tenantByID) {
+			seen[appointment.TenantID] = true
+			continue
+		}
 		if worksmobileShouldSkipEmailDomainRootAppointment(appointment, appointmentTenant, appointments, tenantByID) {
 			seen[appointment.TenantID] = true
 			continue
@@ -303,8 +317,7 @@ func buildWorksmobileUserOrganizations(user domain.User, tenant domain.Tenant, t
 		if err != nil {
 			return nil, "", err
 		}
-		isAccountDomain := worksmobileTenantDomainIDEnvKey(domainTenant) == accountDomainEnvKey
-		isPrimaryOrganization := isAccountDomain && !worksmobileOrganizationsHavePrimary(organizations)
+		isPrimaryOrganization := !worksmobileOrganizationsHavePrimary(organizations)
 		organizationIndex, organizationExists := organizationIndexByDomainID[domainID]
 		orgUnit := WorksmobileUserOrgUnit{
 			OrgUnitID:  "externalKey:" + appointmentTenant.ID,
@@ -361,6 +374,23 @@ func worksmobileAppointmentsContainTenant(appointments []worksmobileAppointment,
 	return false
 }
 
+func worksmobileAppointmentsContainSyncableOrgUnit(appointments []worksmobileAppointment, tenantByID map[string]domain.Tenant) bool {
+	for _, appointment := range appointments {
+		tenant, ok := tenantByID[strings.TrimSpace(appointment.TenantID)]
+		if !ok {
+			continue
+		}
+		if worksmobileTenantExcludedFromSync(tenant, tenantByID) {
+			continue
+		}
+		if isWorksmobileDomainRootTenant(tenant) {
+			continue
+		}
+		return true
+	}
+	return false
+}
+
 func worksmobileAppointmentsHavePrimary(appointments []worksmobileAppointment) bool {
 	for _, appointment := range appointments {
 		if appointment.IsPrimary {
@@ -376,6 +406,9 @@ func worksmobileAppointmentsContainDomain(appointments []worksmobileAppointment,
 		if !ok {
 			continue
 		}
+		if worksmobileTenantExcludedFromSync(tenant, tenantByID) {
+			continue
+		}
 		domainTenant := worksmobileDomainClassificationTenant(tenant, tenantByID)
 		if worksmobileTenantDomainIDEnvKey(domainTenant) == envKey {
 			return true
@@ -384,6 +417,26 @@ func worksmobileAppointmentsContainDomain(appointments []worksmobileAppointment,
 	return false
 }
 
+func worksmobileTenantExcludedFromSync(tenant domain.Tenant, tenantByID map[string]domain.Tenant) bool {
+	visited := map[string]bool{}
+	current := tenant
+	for {
+		if WorksmobileExcluded(current.Config) {
+			return true
+		}
+		parentID := worksmobileTenantParentID(current)
+		if parentID == "" || visited[parentID] {
+			return false
+		}
+		visited[parentID] = true
+		parent, ok := tenantByID[parentID]
+		if !ok {
+			return false
+		}
+		current = parent
+	}
+}
+
 func worksmobileShouldSkipEmailDomainRootAppointment(appointment worksmobileAppointment, tenant domain.Tenant, appointments []worksmobileAppointment, tenantByID map[string]domain.Tenant) bool {
 	if strings.TrimSpace(appointment.Source) != "email_domain" || !isWorksmobileDomainRootTenant(tenant) {
 		return false