가입 전략 수립

backend/internal/handler/auth_handler.go

@@ -388,8 +388,7 @@ func (h *AuthHandler) Signup(c *fiber.Ctx) error {
 		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "Identity provider unavailable"})
 	}
 
-	// [Strict] Enforce Tenant Auto-Assignment by Domain ONLY
-	// Manual companyCode from request is ignored to prevent unauthorized tenant joining
+	// [Strict] Enforce Tenant Auto-Assignment
 	companyCode := ""
 	var tenantID *string
 
@@ -399,19 +398,36 @@ func (h *AuthHandler) Signup(c *fiber.Ctx) error {
 		tenant, err := h.TenantService.GetTenantByDomain(c.Context(), domainName)
 		if err == nil && tenant != nil {
 			if tenant.Status == domain.TenantStatusActive {
-				slog.Info("[Signup] Auto-assigning tenant", "email", req.Email, "tenant", tenant.Slug)
+				slog.Info("[Signup] Auto-assigning tenant by domain", "email", req.Email, "tenant", tenant.Slug)
 				companyCode = tenant.Slug
 				tenantID = &tenant.ID
 			} else {
-				slog.Warn("[Signup] Attempted to join non-active tenant", "email", req.Email, "tenant", tenant.Slug, "status", tenant.Status)
-				// Policy: If tenant exists but not active, reject signup or allow as general?
-				// For now, let's allow as general but log it.
-				// Or return error if we want strict domain locking.
+				slog.Warn("[Signup] Attempted to join non-active tenant by domain", "email", req.Email, "tenant", tenant.Slug, "status", tenant.Status)
 				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "Your organization's tenant is currently not active."})
 			}
 		}
 	}
 
+	// Fallback/Validation for manually provided CompanyCode if domain lookup didn't yield a tenant
+	if tenantID == nil && req.CompanyCode != "" {
+		tenant, err := h.TenantService.GetTenantBySlug(c.Context(), req.CompanyCode)
+		if err == nil && tenant != nil {
+			if tenant.Status == domain.TenantStatusActive {
+				// Policy: Should we allow manual joining by Slug?
+				// For now, let's allow it but log it as manual.
+				slog.Info("[Signup] Assigning tenant by manual slug", "email", req.Email, "tenant", tenant.Slug)
+				companyCode = tenant.Slug
+				tenantID = &tenant.ID
+			} else {
+				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "The specified organization is not active."})
+			}
+		} else {
+			// If companyCode provided but not found, we should probably reject if we want strictness,
+			// or just treat as GENERAL user. Given the risk "존재하지 않는 테넌트도 저장됨", we should reject.
+			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid company code."})
+		}
+	}
+
 	// Normalize Phone (E.164 형태로 보관)
 	normalizedPhone := strings.ReplaceAll(req.Phone, "-", "")
 	normalizedPhone = strings.ReplaceAll(normalizedPhone, " ", "")

backend/internal/handler/tenant_handler.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"baron-sso-backend/internal/domain"
+	"baron-sso-backend/internal/repository"
 	"baron-sso-backend/internal/service"
 	"errors"
 	"strings"
@@ -272,14 +273,8 @@ func (h *TenantHandler) UpdateTenant(c *fiber.Ctx) error {
 			if strings.TrimSpace(d) == "" {
 				continue
 			}
-			td := domain.TenantDomain{
-				TenantID: tenant.ID,
-				Domain:   strings.TrimSpace(d),
-				Verified: true,
-			}
-			if err := h.DB.Create(&td).Error; err != nil {
-				// Log and continue or return error?
-				// For now return error to be safe.
+			// Use repository for consistency
+			if err := repository.NewTenantRepository(h.DB).AddDomain(c.Context(), tenant.ID, strings.TrimSpace(d), true); err != nil {
 				return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to add domain: " + d})
 			}
 		}
@@ -301,7 +296,21 @@ func (h *TenantHandler) DeleteTenant(c *fiber.Ctx) error {
 		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenant id is required"})
 	}
 
-	if err := h.DB.Delete(&domain.Tenant{}, "id = ?", tenantID).Error; err != nil {
+	var tenant domain.Tenant
+	if err := h.DB.First(&tenant, "id = ?", tenantID).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "tenant not found"})
+		}
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+	}
+
+	// Rename slug to release it for reuse before soft delete
+	deletedSlug := tenant.Slug + "-deleted-" + time.Now().Format("20060102150405")
+	if err := h.DB.Model(&tenant).Update("slug", deletedSlug).Error; err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to release slug"})
+	}
+
+	if err := h.DB.Delete(&tenant).Error; err != nil {
 		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
 	}