feat: update worksmobile sync and restore planning

backend/internal/service/ory_service_test.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"baron-sso-backend/internal/domain"
 	"bytes"
 	"encoding/json"
 	"io"
@@ -35,6 +36,76 @@ type roundTripperFunc func(req *http.Request) (*http.Response, error)
 
 func (f roundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) { return f(req) }
 
+func TestCreateUserSendsRequestedIdentityID(t *testing.T) {
+	const requestedID = "9f8cc1b1-af8d-45d4-946c-924a529c2556"
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/admin/identities" && r.Method == http.MethodGet:
+			_ = json.NewEncoder(w).Encode([]map[string]string{})
+			return
+		case r.URL.Path == "/admin/identities" && r.Method == http.MethodPost:
+			var payload map[string]interface{}
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				t.Fatalf("failed to decode payload: %v", err)
+			}
+			if payload["id"] != requestedID {
+				t.Fatalf("expected id=%s, got=%v", requestedID, payload["id"])
+			}
+			_ = json.NewEncoder(w).Encode(map[string]string{"id": requestedID})
+			return
+		default:
+			t.Fatalf("unexpected request: %s %s", r.Method, r.URL.String())
+		}
+	})
+
+	provider := &OryProvider{
+		KratosAdminURL: "http://kratos-admin.local",
+		HTTPClient:     clientForHandler(handler),
+	}
+
+	id, err := provider.CreateUser(&domain.BrokerUser{
+		ID:    requestedID,
+		Email: "restore@test.com",
+		Name:  "Restore User",
+	}, "Sup3rStr0ng!Pass#2026")
+	if err != nil {
+		t.Fatalf("CreateUser returned error: %v", err)
+	}
+	if id != requestedID {
+		t.Fatalf("expected %s, got %s", requestedID, id)
+	}
+}
+
+func TestCreateUserRejectsRequestedIdentityIDMismatch(t *testing.T) {
+	const requestedID = "9f8cc1b1-af8d-45d4-946c-924a529c2556"
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/admin/identities" && r.Method == http.MethodGet:
+			_ = json.NewEncoder(w).Encode([]map[string]string{})
+			return
+		case r.URL.Path == "/admin/identities" && r.Method == http.MethodPost:
+			_ = json.NewEncoder(w).Encode(map[string]string{"id": "generated-id"})
+			return
+		default:
+			t.Fatalf("unexpected request: %s %s", r.Method, r.URL.String())
+		}
+	})
+
+	provider := &OryProvider{
+		KratosAdminURL: "http://kratos-admin.local",
+		HTTPClient:     clientForHandler(handler),
+	}
+
+	_, err := provider.CreateUser(&domain.BrokerUser{
+		ID:    requestedID,
+		Email: "restore@test.com",
+		Name:  "Restore User",
+	}, "Sup3rStr0ng!Pass#2026")
+	if err == nil || !strings.Contains(err.Error(), "requested identity id was not preserved") {
+		t.Fatalf("expected requested identity id mismatch error, got: %v", err)
+	}
+}
+
 func TestUpdateUserPassword_Success(t *testing.T) {
 	const (
 		loginID     = "user@example.com"