merge feat/304-userfront-wasm-e2e into dev

2026-02-24 15:40:51 +09:00
parent bc07619452 aeb418fb9f
commit 8a074f16e7
55 changed files with 3425 additions and 431 deletions
--- a/.gitea/workflows/code_check.yml
+++ b/.gitea/workflows/code_check.yml
@@ -24,6 +24,11 @@ on:
                required: true
                type: boolean
                default: true
+            run_userfront_e2e_tests:
+                description: "Run userfront WASM Playwright E2E tests"
+                required: true
+                type: boolean
+                default: true
            run_adminfront_tests:
                description: "Run adminfront Playwright tests"
                required: true
@@ -96,10 +101,14 @@ jobs:
                  working-directory: backend
                  args: --enable-only=gofmt,gofumpt

+            - name: Sync userfront locales
+              run: |
+                  /bin/sh ./scripts/sync_userfront_locales.sh
+
            - name: Install Userfront dependencies
              run: |
-                cd userfront
-                flutter pub get
+                  cd userfront
+                  flutter pub get

            - name: Format Flutter userfront
              run: |
@@ -201,6 +210,10 @@ jobs:
                  channel: "stable"
                  cache: true

+            - name: Sync userfront locales
+              run: |
+                  /bin/sh ./scripts/sync_userfront_locales.sh
+
            - name: Run userfront tests
              run: |
                  cd userfront
@@ -276,6 +289,222 @@ jobs:
                      reports/userfront-test.log
                  if-no-files-found: ignore

+    userfront-e2e-tests:
+        needs: lint
+        if: ${{ always() && (github.event_name != 'workflow_dispatch' || inputs.run_userfront_e2e_tests == true) }}
+        runs-on: ubuntu-latest
+        timeout-minutes: 40
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: "20"
+                  cache: "npm"
+                  cache-dependency-path: userfront-e2e/package-lock.json
+
+            - name: Setup Flutter
+              uses: subosito/flutter-action@v2
+              with:
+                  channel: "stable"
+                  cache: true
+
+            - name: Sync userfront locales
+              run: |
+                  /bin/sh ./scripts/sync_userfront_locales.sh
+
+            - name: Install userfront-e2e dependencies
+              run: |
+                  mkdir -p reports
+                  set +e
+                  cd userfront-e2e
+                  npm ci 2>&1 | tee ../reports/userfront-e2e-install.log
+                  install_exit_code=${PIPESTATUS[0]}
+                  cd ..
+                  set -e
+
+                  if [ "$install_exit_code" -ne 0 ]; then
+                    {
+                      echo "# Userfront E2E Test Failure Report"
+                      echo
+                      echo "- Workflow: \`${GITHUB_WORKFLOW:-Code Check}\`"
+                      echo "- Job: \`userfront-e2e-tests\`"
+                      echo "- Reason: \`Dependency install failed\`"
+                      echo "- Exit Code: \`$install_exit_code\`"
+                      echo
+                      echo "## Command"
+                      echo "\`cd userfront-e2e && npm ci\`"
+                      echo
+                      echo "## Install Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-install.log
+                      echo '```'
+                    } > reports/userfront-e2e-test-failure-report.md
+                    exit 1
+                  fi
+
+            - name: Build userfront WASM
+              run: |
+                  mkdir -p reports
+                  set +e
+                  cd userfront
+                  flutter build web --wasm --release 2>&1 | tee ../reports/userfront-e2e-build.log
+                  build_exit_code=${PIPESTATUS[0]}
+                  cd ..
+                  set -e
+
+                  if [ "$build_exit_code" -ne 0 ]; then
+                    {
+                      echo "# Userfront E2E Test Failure Report"
+                      echo
+                      echo "- Workflow: \`${GITHUB_WORKFLOW:-Code Check}\`"
+                      echo "- Job: \`userfront-e2e-tests\`"
+                      echo "- Reason: \`WASM build failed\`"
+                      echo "- Exit Code: \`$build_exit_code\`"
+                      echo
+                      echo "## Command"
+                      echo "\`cd userfront && flutter build web --wasm --release\`"
+                      echo
+                      echo "## Build Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-build.log
+                      echo '```'
+                    } > reports/userfront-e2e-test-failure-report.md
+                    exit 1
+                  fi
+
+            - name: Provision browsers for userfront-e2e tests
+              run: |
+                  set +e
+                  cd userfront-e2e
+                  npx playwright install --with-deps chromium 2>&1 | tee ../reports/userfront-e2e-provision.log
+                  provision_exit_code=${PIPESTATUS[0]}
+                  cd ..
+                  set -e
+
+                  if [ "$provision_exit_code" -ne 0 ]; then
+                    {
+                      echo "# Userfront E2E Test Failure Report"
+                      echo
+                      echo "- Workflow: \`${GITHUB_WORKFLOW:-Code Check}\`"
+                      echo "- Job: \`userfront-e2e-tests\`"
+                      echo "- Reason: \`Browser provisioning failed\`"
+                      echo "- Exit Code: \`$provision_exit_code\`"
+                      echo
+                      echo "## Command"
+                      echo "\`cd userfront-e2e && npx playwright install --with-deps chromium\`"
+                      echo
+                      echo "## Provision Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-provision.log
+                      echo '```'
+                    } > reports/userfront-e2e-test-failure-report.md
+                    exit 1
+                  fi
+
+            - name: Run userfront-e2e tests
+              run: |
+                  mkdir -p reports
+                  set +e
+                  cd userfront-e2e
+                  npm test 2>&1 | tee ../reports/userfront-e2e-test.log
+                  test_exit_code=${PIPESTATUS[0]}
+                  cd ..
+                  set -e
+
+                  if [ "$test_exit_code" -ne 0 ]; then
+                    {
+                      echo "# Userfront E2E Test Failure Report"
+                      echo
+                      echo "- Workflow: \`${GITHUB_WORKFLOW:-Code Check}\`"
+                      echo "- Job: \`userfront-e2e-tests\`"
+                      echo "- Exit Code: \`$test_exit_code\`"
+                      echo
+                      echo "## Commands"
+                      echo "1. \`cd userfront-e2e\`"
+                      echo "2. \`npm ci\`"
+                      echo "3. \`cd ../userfront && flutter build web --wasm --release\`"
+                      echo "4. \`cd ../userfront-e2e && npx playwright install --with-deps chromium\`"
+                      echo "5. \`npm test\`"
+                      echo
+                      echo "## Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-test.log
+                      echo '```'
+                    } > reports/userfront-e2e-test-failure-report.md
+                  fi
+
+                  exit "$test_exit_code"
+
+            - name: Ensure userfront-e2e failure report exists
+              if: ${{ failure() }}
+              run: |
+                  mkdir -p reports
+                  if [ -f reports/userfront-e2e-test-failure-report.md ]; then
+                    exit 0
+                  fi
+
+                  {
+                    echo "# Userfront E2E Test Failure Report"
+                    echo
+                    echo "- Workflow: \`${GITHUB_WORKFLOW:-Code Check}\`"
+                    echo "- Job: \`userfront-e2e-tests\`"
+                    echo "- Reason: \`Job failed before detailed report generation\`"
+                    echo
+                    if [ -f reports/userfront-e2e-install.log ]; then
+                      echo "## Install Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-install.log
+                      echo '```'
+                      echo
+                    fi
+                    if [ -f reports/userfront-e2e-build.log ]; then
+                      echo "## Build Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-build.log
+                      echo '```'
+                      echo
+                    fi
+                    if [ -f reports/userfront-e2e-provision.log ]; then
+                      echo "## Provision Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-provision.log
+                      echo '```'
+                      echo
+                    fi
+                    if [ -f reports/userfront-e2e-test.log ]; then
+                      echo "## Test Log Tail (last 200 lines)"
+                      echo '```text'
+                      tail -n 200 reports/userfront-e2e-test.log
+                      echo '```'
+                    fi
+                  } > reports/userfront-e2e-test-failure-report.md
+
+            - name: Publish userfront-e2e failure summary
+              if: ${{ failure() }}
+              run: |
+                  if [ -f reports/userfront-e2e-test-failure-report.md ]; then
+                    cat reports/userfront-e2e-test-failure-report.md >> "$GITHUB_STEP_SUMMARY"
+                  fi
+
+            - name: Upload userfront-e2e failure report artifact
+              if: ${{ failure() }}
+              uses: actions/upload-artifact@v3
+              continue-on-error: true
+              with:
+                  name: userfront-e2e-test-failure-report
+                  path: |
+                      reports/userfront-e2e-test-failure-report.md
+                      reports/userfront-e2e-install.log
+                      reports/userfront-e2e-build.log
+                      reports/userfront-e2e-provision.log
+                      reports/userfront-e2e-test.log
+                      userfront-e2e/playwright-report
+                      userfront-e2e/test-results
+                  if-no-files-found: ignore
+
    adminfront-tests:
        needs: lint
        if: ${{ always() && (github.event_name != 'workflow_dispatch' || inputs.run_adminfront_tests == true) }}
--- a/23
+++ b/23
@@ -107,9 +107,9 @@ logs-app:
 	docker compose -f $(COMPOSE_APP) logs -f

 # --- 로컬 통합 코드 체크 ---
-.PHONY: code-check code-check-i18n code-check-go-lint code-check-userfront-lint code-check-front-lint code-check-backend-tests code-check-userfront-tests code-check-adminfront-tests code-check-devfront-tests
+.PHONY: code-check code-check-i18n code-check-go-lint code-check-userfront-lint code-check-front-lint code-check-backend-tests code-check-userfront-tests code-check-adminfront-tests code-check-devfront-tests code-check-userfront-e2e-tests

-code-check: code-check-i18n code-check-go-lint code-check-userfront-lint code-check-front-lint code-check-backend-tests code-check-userfront-tests code-check-adminfront-tests code-check-devfront-tests
+code-check: code-check-i18n code-check-go-lint code-check-userfront-lint code-check-front-lint code-check-backend-tests code-check-userfront-tests code-check-adminfront-tests code-check-devfront-tests code-check-userfront-e2e-tests
 	@echo "code-check complete."

 code-check-i18n:
@@ -182,3 +182,22 @@ code-check-devfront-tests:
 	[ -d devfront/playwright-report ] && cp -R devfront/playwright-report reports/devfront/ || true; \
 	[ -d devfront/test-results ] && cp -R devfront/test-results reports/devfront/ || true; \
 	exit $$status
+
+code-check-userfront-e2e-tests:
+	@echo "==> userfront wasm playwright e2e tests"
+	@mkdir -p reports/userfront-e2e
+	@rm -rf reports/userfront-e2e/playwright-report reports/userfront-e2e/test-results
+	@status=0; \
+	(cd userfront && flutter build web --wasm --release) || status=$$?; \
+	if [ $$status -eq 0 ]; then \
+		(cd userfront-e2e && npm ci) || status=$$?; \
+	fi; \
+	if [ $$status -eq 0 ]; then \
+		(cd userfront-e2e && npx playwright install --with-deps chromium) || status=$$?; \
+	fi; \
+	if [ $$status -eq 0 ]; then \
+		(cd userfront-e2e && npm test) || status=$$?; \
+	fi; \
+	[ -d userfront-e2e/playwright-report ] && cp -R userfront-e2e/playwright-report reports/userfront-e2e/ || true; \
+	[ -d userfront-e2e/test-results ] && cp -R userfront-e2e/test-results reports/userfront-e2e/ || true; \
+	exit $$status
--- a/README.md
+++ b/README.md
@@ -193,6 +193,22 @@ USERFRONT_URL=https://sso.example.com
 - `KRATOS_ALLOWED_RETURN_URLS_EXTRA`: 추가 허용 return URL (선택)
  - 빈값: `[]`
  - 다중값: `["https://a.example.com/callback","https://b.example.com/callback"]` 또는 `https://a.example.com/callback,https://b.example.com/callback`
+- `CLIENT_LOG_DEBUG`: 클라이언트 로그 디버그 모드 강제 (기본: 비운영 `true`, 운영 `false`)
+  - 운영(`APP_ENV=production|prod`)에서 `true|1|on|yes` 설정 시 `INFO/DEBUG` 클라이언트 로그 수집 허용
+  - 미설정(기본) 시 운영에서는 `WARN/ERROR`만 수집
+- `USERFRONT_DEBUG_LOG`: UserFront 측 디버그 로그 fallback 플래그
+  - `CLIENT_LOG_DEBUG`가 없을 때만 UserFront에서 대체로 참조
+
+### 클라이언트 로그 정책 (중요)
+- 기본 원칙: 운영 환경에서는 민감정보 보호를 우선하며, 과도한 로그 수집을 제한합니다.
+- 환경별 동작:
+  - 비운영(`dev/local/stage` 등): 디버그 로그 허용 (`INFO/DEBUG/WARN/ERROR`)
+  - 운영(`production/prod`) + `CLIENT_LOG_DEBUG` 미설정: `WARN/ERROR`만 수집
+  - 운영(`production/prod`) + `CLIENT_LOG_DEBUG=true`: 디버그 로그 허용
+- 민감정보는 환경과 무관하게 마스킹합니다.
+  - 예: `password`, `newPassword`, `token`, `authorization`, `cookie`, `sessionJwt`
+  - 문자열 패턴(`token=...`, `authorization:...`, JSON body 내 민감 key)도 마스킹
+- 상세 정책 문서: `docs/client-log-policy.md`

 ### `.env` 작성 후 권장 점검
 ```bash
@@ -320,6 +336,7 @@ KETO_WRITE_URL = "http://keto:4467"
 - `run_lint`: Go/Flutter lint 실행 여부
 - `run_backend_tests`: backend 테스트 실행 여부
 - `run_userfront_tests`: userfront 테스트 실행 여부
+- `run_userfront_e2e_tests`: userfront WASM Playwright E2E 실행 여부
 - `run_adminfront_tests`: adminfront 테스트 실행 여부
 - `run_devfront_tests`: devfront 테스트 실행 여부

@@ -327,6 +344,7 @@ KETO_WRITE_URL = "http://keto:4467"
 - `lint`
 - `backend-tests`
 - `userfront-tests`
+- `userfront-e2e-tests`
 - `adminfront-tests`
 - `devfront-tests`

@@ -353,6 +371,17 @@ KETO_WRITE_URL = "http://keto:4467"
 - 단일 파일만 확인하려면 다음 명령을 사용합니다.
  - `flutter test test/locale_storage_platform_test.dart`

+### userfront WASM Playwright E2E
+- 워크스페이스: `userfront-e2e/`
+- 빌드+실행:
+  - `cd userfront-e2e && npm run test:wasm`
+- 빌드 결과가 이미 있을 때:
+  - `cd userfront-e2e && npm test`
+- Makefile 타깃:
+  - `make code-check-userfront-e2e-tests`
+- 전수 인벤토리:
+  - `docs/test-plan/userfront-wasm-e2e-route-inventory.md`
+
 ### 로컬 개발 (Manual)
 Docker 없이는 개발할 수 없지만 Backend 및 [user/admin/dev]Front 코드는 개발모드로 수정하며 개발가능.
 백그라운드로 infra 및 ory stack이 구동중이라는 가정
--- a/adminfront/src/locales/ko.toml
+++ b/adminfront/src/locales/ko.toml
@@ -374,7 +374,7 @@ empty_detail = "앱을 연동하면 최근 활동과 상태가 표시됩니다."
 error = "연동 정보를 불러오지 못했습니다."

 [msg.userfront.dashboard.approved_session]
-copy_click = "{{label}}: {{id}}\\\\\\\\n클릭하면 복사됩니다."
+copy_click = "{{label}}: {{id}} \\n클릭하면 복사됩니다."
 copy_tap = "{{label}}: {{id}}\\\\\\\\n탭하면 복사됩니다."
 none = "{{label}} 없음"

--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -288,6 +288,8 @@ func main() {

 	// 3. Initialize Fiber
 	appEnv := getEnv("APP_ENV", "dev")
+	clientLogDebugFlag := getEnv("CLIENT_LOG_DEBUG", "")
+	clientDebugEnabled := logger.ClientDebugEnabled(appEnv, clientLogDebugFlag)
 	app := fiber.New(fiber.Config{
 		AppName:               "Baron SSO Backend",
 		DisableStartupMessage: true,  // Clean logs
@@ -378,6 +380,10 @@ func main() {
 	} else {
 		slog.Info("🔒 API Docs disabled in production")
 	}
+	slog.Info("Client log policy configured",
+		"app_env", appEnv,
+		"client_debug_enabled", clientDebugEnabled,
+	)

 	// Routes
 	app.Get("/", func(c *fiber.Ctx) error {
@@ -642,12 +648,20 @@ func main() {
 		if err := c.BodyParser(&req); err != nil {
 			return c.SendStatus(fiber.StatusBadRequest)
 		}
+		if !logger.ShouldAcceptClientLog(appEnv, clientLogDebugFlag, req.Level) {
+			return c.SendStatus(fiber.StatusOK)
+		}
+		level := logger.NormalizeClientLogLevel(req.Level)
+		if level == slog.LevelInfo && logger.ShouldFilterNoisyClientInfo(appEnv, clientLogDebugFlag, req.Message) {
+			return c.SendStatus(fiber.StatusOK)
+		}

 		// Prepare attributes for flattening
 		attrs := []any{
 			slog.String("source", "client"),
 		}
-		for k, v := range req.Data {
+		sanitizedData := logger.SanitizeClientLogData(req.Data)
+		for k, v := range sanitizedData {
 			// Skip svc if it's already set by the global logger to avoid confusion,
 			// or keep it as client_svc
 			if k == "svc" {
@@ -656,30 +670,7 @@ func main() {
 				attrs = append(attrs, slog.Any(k, v))
 			}
 		}
-
-		// Map and log with correct level
-		var level slog.Level
-		switch req.Level {
-		case "SEVERE", "ERROR":
-			level = slog.LevelError
-		case "WARNING", "WARN":
-			level = slog.LevelWarn
-		default:
-			level = slog.LevelInfo
-		}
-
-		// Filter out noisy client navigation logs
-		if level == slog.LevelInfo {
-			msg := strings.ToLower(req.Message)
-			if strings.Contains(msg, "navigating to") ||
-				strings.Contains(msg, "going to") ||
-				strings.Contains(msg, "redirecting to") ||
-				strings.Contains(msg, "full paths for routes") {
-				return c.SendStatus(fiber.StatusOK)
-			}
-		}
-
-		slog.Log(c.Context(), level, req.Message, attrs...)
+		slog.Log(c.Context(), level, logger.SanitizeClientLogMessage(req.Message), attrs...)
 		return c.SendStatus(fiber.StatusOK)
 	})

--- a/backend/internal/handler/api_key_handler.go
+++ b/backend/internal/handler/api_key_handler.go
@@ -35,7 +35,7 @@ type apiKeyListResponse struct {

 func (h *ApiKeyHandler) ListApiKeys(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	limit := c.QueryInt("limit", 50)
@@ -43,12 +43,12 @@ func (h *ApiKeyHandler) ListApiKeys(c *fiber.Ctx) error {

 	var total int64
 	if err := h.DB.Model(&domain.ApiKey{}).Count(&total).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	var keys []domain.ApiKey
 	if err := h.DB.Order("created_at desc").Limit(limit).Offset(offset).Find(&keys).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	items := make([]apiKeySummary, 0, len(keys))
@@ -73,7 +73,7 @@ func (h *ApiKeyHandler) ListApiKeys(c *fiber.Ctx) error {

 func (h *ApiKeyHandler) CreateApiKey(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	var req struct {
@@ -81,11 +81,11 @@ func (h *ApiKeyHandler) CreateApiKey(c *fiber.Ctx) error {
 		Scopes []string `json:"scopes"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	if strings.TrimSpace(req.Name) == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "name is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "name is required")
 	}

 	// Generate Client ID (16 chars hex)
@@ -96,7 +96,7 @@ func (h *ApiKeyHandler) CreateApiKey(c *fiber.Ctx) error {

 	hashedSecret, err := bcrypt.GenerateFromPassword([]byte(plainSecret), bcrypt.DefaultCost)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to hash secret"})
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to hash secret")
 	}

 	apiKey := domain.ApiKey{
@@ -108,7 +108,7 @@ func (h *ApiKeyHandler) CreateApiKey(c *fiber.Ctx) error {
 	}

 	if err := h.DB.Create(&apiKey).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// Return summary + PLAIN SECRET (only this time)
@@ -129,16 +129,16 @@ func (h *ApiKeyHandler) CreateApiKey(c *fiber.Ctx) error {

 func (h *ApiKeyHandler) DeleteApiKey(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	id := c.Params("id")
 	if id == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "id is required")
 	}

 	if err := h.DB.Delete(&domain.ApiKey{}, "id = ?", id).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.SendStatus(fiber.StatusNoContent)
--- a/backend/internal/handler/audit_handler.go
+++ b/backend/internal/handler/audit_handler.go
@@ -23,9 +23,7 @@ func NewAuditHandler(repo domain.AuditRepository) *AuditHandler {
 func (h *AuditHandler) CreateLog(c *fiber.Ctx) error {
 	var req domain.AuditLog
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "Cannot parse JSON",
-		})
+		return errorJSON(c, fiber.StatusBadRequest, "Cannot parse JSON")
 	}

 	// Auto-fill metadata if missing
@@ -43,16 +41,12 @@ func (h *AuditHandler) CreateLog(c *fiber.Ctx) error {
 	}

 	if h.repo == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{
-			"error": "Audit service unavailable",
-		})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "Audit service unavailable")
 	}

 	if err := h.repo.Create(&req); err != nil {
 		// Log internal error but don't expose details
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
-			"error": "Failed to save audit log",
-		})
+		return errorJSON(c, fiber.StatusInternalServerError, "Failed to save audit log")
 	}

 	return c.Status(fiber.StatusCreated).JSON(fiber.Map{
@@ -66,22 +60,16 @@ func (h *AuditHandler) ListLogs(c *fiber.Ctx) error {
 	cursorRaw := c.Query("cursor")
 	cursor, err := parseAuditCursor(cursorRaw)
 	if err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "Invalid cursor",
-		})
+		return errorJSON(c, fiber.StatusBadRequest, "Invalid cursor")
 	}

 	if h.repo == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{
-			"error": "Audit service unavailable",
-		})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "Audit service unavailable")
 	}

 	logs, err := h.repo.FindPage(c.Context(), limit+1, cursor)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
-			"error": "Failed to retrieve audit logs",
-		})
+		return errorJSON(c, fiber.StatusInternalServerError, "Failed to retrieve audit logs")
 	}

 	nextCursor := ""
--- a/backend/internal/handler/auth_handler.go
+++ b/backend/internal/handler/auth_handler.go
--- a/backend/internal/handler/auth_handler_link_test.go
+++ b/backend/internal/handler/auth_handler_link_test.go
@@ -121,3 +121,26 @@ func TestEnchantedLinkFlow_Sms_Success(t *testing.T) {
 	json.NewDecoder(resp.Body).Decode(&initResp)
 	assert.NotEmpty(t, initResp["userCode"])
 }
+
+func TestPollEnchantedLink_ExpiredToken_ReturnsCode(t *testing.T) {
+	redis := &mockRedisRepo{data: make(map[string]string)}
+	h := &AuthHandler{
+		RedisService: redis,
+	}
+	app := fiber.New()
+	app.Post("/api/v1/auth/enchanted-link/poll", h.PollEnchantedLink)
+
+	body, _ := json.Marshal(map[string]string{
+		"pendingRef": "missing-ref",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/enchanted-link/poll", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, _ := app.Test(req, -1)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+	var got map[string]interface{}
+	json.NewDecoder(resp.Body).Decode(&got)
+	assert.Equal(t, "expired_token", got["error"])
+	assert.Equal(t, "expired_token", got["code"])
+}
--- a/backend/internal/handler/auth_handler_login_code_test.go
+++ b/backend/internal/handler/auth_handler_login_code_test.go
@@ -0,0 +1,206 @@
+package handler
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+)
+
+func newVerifyLoginCodeTestApp(h *AuthHandler) *fiber.App {
+	app := fiber.New()
+	app.Post("/api/v1/auth/login/code/verify", h.VerifyLoginCode)
+	app.Post("/api/v1/auth/login/code/verify-short", h.VerifyLoginShortCode)
+	return app
+}
+
+func decodeJSONBody(t *testing.T, resp *http.Response) map[string]any {
+	t.Helper()
+
+	var got map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&got); err != nil {
+		t.Fatalf("failed to decode response body: %v", err)
+	}
+	return got
+}
+
+func TestVerifyLoginCode_InvalidBody_ReturnsExplicitCode(t *testing.T) {
+	h := &AuthHandler{}
+	app := newVerifyLoginCodeTestApp(h)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login/code/verify", bytes.NewBufferString("{"))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+
+	got := decodeJSONBody(t, resp)
+	if got["code"] != "bad_request" {
+		t.Fatalf("expected code=bad_request, got %v", got["code"])
+	}
+}
+
+func TestVerifyLoginCode_IdpUnavailable_ReturnsExplicitCode(t *testing.T) {
+	h := &AuthHandler{}
+	app := newVerifyLoginCodeTestApp(h)
+
+	body, _ := json.Marshal(map[string]any{
+		"loginId": "user@example.com",
+		"code":    "AA-111111",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login/code/verify", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusServiceUnavailable {
+		t.Fatalf("expected 503, got %d", resp.StatusCode)
+	}
+
+	got := decodeJSONBody(t, resp)
+	if got["code"] != "service_unavailable" {
+		t.Fatalf("expected code=service_unavailable, got %v", got["code"])
+	}
+}
+
+func TestVerifyLoginCode_VerifyOnlyInvalidCode_ReturnsExplicitCode(t *testing.T) {
+	redis := &mockRedisRepo{data: make(map[string]string)}
+	redis.data[prefixLoginCode+"user@example.com"] = "flow-1"
+	redis.data[prefixLoginCodePending+"user@example.com"] = "pending-1"
+	redis.data[prefixLoginCodeValue+"pending-1"] = "AB-123"
+
+	h := &AuthHandler{
+		RedisService: redis,
+		IdpProvider:  &mockIdpProvider{},
+	}
+	app := newVerifyLoginCodeTestApp(h)
+
+	body, _ := json.Marshal(map[string]any{
+		"loginId":    "user@example.com",
+		"code":       "ZZ-999",
+		"verifyOnly": true,
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login/code/verify", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", resp.StatusCode)
+	}
+
+	got := decodeJSONBody(t, resp)
+	if got["code"] != "invalid_code" {
+		t.Fatalf("expected code=invalid_code, got %v", got["code"])
+	}
+}
+
+func TestVerifyLoginShortCode_MissingShortCode_ReturnsExplicitCode(t *testing.T) {
+	h := &AuthHandler{
+		RedisService: &mockRedisRepo{data: make(map[string]string)},
+	}
+	app := newVerifyLoginCodeTestApp(h)
+
+	body, _ := json.Marshal(map[string]any{
+		"shortCode": "",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login/code/verify-short", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+
+	got := decodeJSONBody(t, resp)
+	if got["code"] != "bad_request" {
+		t.Fatalf("expected code=bad_request, got %v", got["code"])
+	}
+}
+
+func TestVerifyLoginShortCode_InvalidOrExpired_ReturnsExplicitCode(t *testing.T) {
+	h := &AuthHandler{
+		RedisService: &mockRedisRepo{data: make(map[string]string)},
+	}
+	app := newVerifyLoginCodeTestApp(h)
+
+	body, _ := json.Marshal(map[string]any{
+		"shortCode": "AB-123456",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login/code/verify-short", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", resp.StatusCode)
+	}
+
+	got := decodeJSONBody(t, resp)
+	if got["code"] != "invalid_or_expired_code" {
+		t.Fatalf("expected code=invalid_or_expired_code, got %v", got["code"])
+	}
+}
+
+func TestVerifyLoginShortCode_VerifyOnlyMissingPendingRef_ReturnsExplicitCode(t *testing.T) {
+	redis := &mockRedisRepo{data: make(map[string]string)}
+	payload, _ := json.Marshal(shortLoginCodePayload{
+		LoginID: "user@example.com",
+		Code:    "AB-123",
+	})
+	redis.data[prefixLoginCodeShort+"AB-123456"] = string(payload)
+
+	h := &AuthHandler{
+		RedisService: redis,
+	}
+	app := newVerifyLoginCodeTestApp(h)
+
+	body, _ := json.Marshal(map[string]any{
+		"shortCode":  "AB-123456",
+		"verifyOnly": true,
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login/code/verify-short", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+
+	got := decodeJSONBody(t, resp)
+	if got["code"] != "invalid_session_reference" {
+		t.Fatalf("expected code=invalid_session_reference, got %v", got["code"])
+	}
+}
--- a/backend/internal/handler/auth_handler_profile_cache_test.go
+++ b/backend/internal/handler/auth_handler_profile_cache_test.go
@@ -0,0 +1,109 @@
+package handler
+
+import (
+	"baron-sso-backend/internal/domain"
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateMe_InvalidatesProfileCacheForTokenSession(t *testing.T) {
+	token := "token-abc"
+	identityID := "user-1"
+	traits := map[string]interface{}{
+		"email":           "qa@example.com",
+		"name":            "QA User",
+		"phone_number":    "+821012345678",
+		"department":      "Old Dept",
+		"affiliationType": "employee",
+		"companyCode":     "",
+		"role":            domain.RoleUser,
+	}
+
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		switch {
+		case r.URL.Host == "kratos.test" &&
+			r.URL.Path == "/sessions/whoami" &&
+			r.Method == http.MethodGet:
+			if r.Header.Get("X-Session-Token") != token {
+				return httpResponse(r, http.StatusUnauthorized, `{"error":"invalid token"}`), nil
+			}
+			return httpJSONAny(r, http.StatusOK, map[string]interface{}{
+				"identity": map[string]interface{}{
+					"id":     identityID,
+					"traits": traits,
+				},
+			}), nil
+
+		case r.URL.Host == "kratos.test" &&
+			r.URL.Path == "/admin/identities/"+identityID &&
+			r.Method == http.MethodPut:
+			var payload struct {
+				Traits map[string]interface{} `json:"traits"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				return httpResponse(r, http.StatusBadRequest, `{"error":"invalid body"}`), nil
+			}
+			for k, v := range payload.Traits {
+				traits[k] = v
+			}
+			return httpResponse(r, http.StatusOK, `{"ok":true}`), nil
+		}
+
+		return httpResponse(r, http.StatusNotFound, "not found"), nil
+	})
+	setDefaultHTTPClientForTest(t, transport)
+	t.Setenv("KRATOS_PUBLIC_URL", "http://kratos.test")
+	t.Setenv("KRATOS_ADMIN_URL", "http://kratos.test")
+
+	redis := &mockRedisRepo{data: make(map[string]string)}
+	h := &AuthHandler{
+		RedisService: redis,
+	}
+	app := fiber.New()
+	app.Get("/api/v1/user/me", h.GetMe)
+	app.Put("/api/v1/user/me", h.UpdateMe)
+
+	// 1) 첫 조회로 Old Dept가 캐시에 저장됨
+	getReq1 := httptest.NewRequest(http.MethodGet, "/api/v1/user/me", nil)
+	getReq1.Header.Set("Authorization", "Bearer "+token)
+	getResp1, err := app.Test(getReq1, -1)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, getResp1.StatusCode)
+	var profile1 map[string]interface{}
+	require.NoError(t, json.NewDecoder(getResp1.Body).Decode(&profile1))
+	require.Equal(t, "Old Dept", profile1["department"])
+
+	// 2) 소속을 New Dept로 변경
+	updateBody, _ := json.Marshal(map[string]string{
+		"name":       "QA User",
+		"phone":      "01012345678",
+		"department": "New Dept",
+	})
+	updateReq := httptest.NewRequest(
+		http.MethodPut,
+		"/api/v1/user/me",
+		bytes.NewReader(updateBody),
+	)
+	updateReq.Header.Set("Content-Type", "application/json")
+	updateReq.Header.Set("Authorization", "Bearer "+token)
+	updateResp, err := app.Test(updateReq, -1)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, updateResp.StatusCode)
+	require.Equal(t, "New Dept", traits["department"])
+
+	// 3) 새로고침 재조회 시 New Dept가 보여야 함(캐시 무효화 회귀 방지)
+	getReq2 := httptest.NewRequest(http.MethodGet, "/api/v1/user/me", nil)
+	getReq2.Header.Set("Authorization", "Bearer "+token)
+	getResp2, err := app.Test(getReq2, -1)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, getResp2.StatusCode)
+	var profile2 map[string]interface{}
+	require.NoError(t, json.NewDecoder(getResp2.Body).Decode(&profile2))
+	require.Equal(t, "New Dept", profile2["department"])
+}
--- a/backend/internal/handler/auth_handler_qr_test.go
+++ b/backend/internal/handler/auth_handler_qr_test.go
@@ -83,6 +83,7 @@ func TestQRLoginFlow_Success(t *testing.T) {
 	var pollResp map[string]interface{}
 	json.NewDecoder(resp.Body).Decode(&pollResp)
 	assert.Equal(t, "authorization_pending", pollResp["error"])
+	assert.Equal(t, "authorization_pending", pollResp["code"])

 	// 3. Mock Approval
 	sessionData, _ := json.Marshal(map[string]string{
--- a/backend/internal/handler/auth_handler_test.go
+++ b/backend/internal/handler/auth_handler_test.go
@@ -1,6 +1,7 @@
 package handler

 import (
+	"baron-sso-backend/internal/middleware"
 	"bytes"
 	"encoding/json"
 	"fmt"
@@ -26,6 +27,13 @@ func newResetFlowTestApp(h *AuthHandler) *fiber.App {
 	return app
 }

+func newResetInitAppWithErrorCodeEnricher(h *AuthHandler) *fiber.App {
+	app := fiber.New()
+	app.Use(middleware.ErrorCodeEnricher())
+	app.Post("/api/v1/auth/password/reset/init", h.InitiatePasswordReset)
+	return app
+}
+
 type testRedisRepo struct {
 	values map[string]string
 }
@@ -286,3 +294,35 @@ func TestProcessPasswordResetToken_EncodesLoginIDInRedirect(t *testing.T) {
 		t.Fatalf("expected encoded loginId round-trip=%s, got %s (location=%s)", loginID, gotLoginID, location)
 	}
 }
+
+func TestPasswordResetInit_LegacyErrorResponseHasCodeViaMiddleware(t *testing.T) {
+	h := &AuthHandler{}
+	app := newResetInitAppWithErrorCodeEnricher(h)
+
+	body, _ := json.Marshal(map[string]string{
+		"loginId": "",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/password/reset/init", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+
+	var got map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&got); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if got["error"] != "Login ID is required" {
+		t.Fatalf("unexpected error message: %v", got["error"])
+	}
+	if got["code"] != "bad_request" {
+		t.Fatalf("expected code=bad_request, got %v", got["code"])
+	}
+}
--- a/backend/internal/handler/common_test.go
+++ b/backend/internal/handler/common_test.go
@@ -163,6 +163,14 @@ func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
 	return f(req)
 }

+func setDefaultHTTPClientForTest(t interface{ Cleanup(func()) }, transport http.RoundTripper) {
+	origDefault := http.DefaultClient
+	http.DefaultClient = &http.Client{Transport: transport}
+	t.Cleanup(func() {
+		http.DefaultClient = origDefault
+	})
+}
+
 func httpResponse(r *http.Request, code int, body string) *http.Response {
 	return &http.Response{
 		StatusCode: code,
--- a/backend/internal/handler/dev_handler.go
+++ b/backend/internal/handler/dev_handler.go
@@ -275,15 +275,13 @@ func (h *DevHandler) ListClients(c *fiber.Ctx) error {
 	clients, err := h.Hydra.ListClients(c.Context(), limit, offset)
 	if err != nil {
 		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "clients not found"})
+			return errorJSON(c, fiber.StatusNotFound, "clients not found")
 		}
 		errMsg := err.Error()
 		if strings.Contains(errMsg, "connection refused") || strings.Contains(errMsg, "dial tcp") {
-			return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{
-				"error": "Hydra service is unavailable. Please check if Ory Hydra is running.",
-			})
+			return errorJSON(c, fiber.StatusServiceUnavailable, "Hydra service is unavailable. Please check if Ory Hydra is running.")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": errMsg})
+		return errorJSON(c, fiber.StatusInternalServerError, errMsg)
 	}

 	items := make([]clientSummary, 0, len(clients))
@@ -306,15 +304,15 @@ func (h *DevHandler) ListClients(c *fiber.Ctx) error {
 func (h *DevHandler) GetClient(c *fiber.Ctx) error {
 	clientID := c.Params("id")
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "client id is required")
 	}

 	client, err := h.Hydra.GetClient(c.Context(), clientID)
 	if err != nil {
 		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "client not found"})
+			return errorJSON(c, fiber.StatusNotFound, "client not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	summary := h.mapClientSummary(*client)
@@ -323,10 +321,10 @@ func (h *DevHandler) GetClient(c *fiber.Ctx) error {
 	if summary.Type == "private" {
 		isAppManager, err := h.checkAppManagerPermission(c)
 		if err != nil {
-			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "permission check error"})
+			return errorJSON(c, fiber.StatusInternalServerError, "permission check error")
 		}
 		if !isAppManager {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: insufficient permissions for private client"})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions for private client")
 		}
 	}

@@ -345,19 +343,19 @@ func (h *DevHandler) GetClient(c *fiber.Ctx) error {
 func (h *DevHandler) UpdateClientStatus(c *fiber.Ctx) error {
 	clientID := c.Params("id")
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "client id is required")
 	}

 	var req struct {
 		Status string `json:"status"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	status := strings.ToLower(strings.TrimSpace(req.Status))
 	if status != "active" && status != "inactive" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "status must be active or inactive"})
+		return errorJSON(c, fiber.StatusBadRequest, "status must be active or inactive")
 	}

 	// [Security] Check permission before patching
@@ -367,7 +365,7 @@ func (h *DevHandler) UpdateClientStatus(c *fiber.Ctx) error {
 		if summary.Type == "private" {
 			isAppManager, _ := h.checkAppManagerPermission(c)
 			if !isAppManager {
-				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: insufficient permissions for private client"})
+				return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions for private client")
 			}
 		}
 	}
@@ -375,9 +373,9 @@ func (h *DevHandler) UpdateClientStatus(c *fiber.Ctx) error {
 	updated, err := h.Hydra.PatchClientStatus(c.Context(), clientID, status)
 	if err != nil {
 		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "client not found"})
+			return errorJSON(c, fiber.StatusNotFound, "client not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	summary := h.mapClientSummary(*updated)
@@ -396,7 +394,7 @@ func (h *DevHandler) UpdateClientStatus(c *fiber.Ctx) error {
 func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
 	var req clientUpsertRequest
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	clientID := strings.TrimSpace(valueOr(req.ID, ""))
@@ -411,7 +409,7 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {

 	redirectURIs := derefSlice(req.RedirectURIs, nil)
 	if len(redirectURIs) == 0 {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "redirectUris is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "redirectUris is required")
 	}

 	scopes := derefSlice(req.Scopes, defaultClientScopes())
@@ -420,23 +418,23 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {

 	clientType := strings.ToLower(strings.TrimSpace(valueOr(req.Type, "private")))
 	if clientType != "pkce" && clientType != "private" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "type must be pkce or private"})
+		return errorJSON(c, fiber.StatusBadRequest, "type must be pkce or private")
 	}

 	// [Security] Check permission for private clients
 	if clientType == "private" {
 		isAppManager, err := h.checkAppManagerPermission(c)
 		if err != nil {
-			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "permission check error"})
+			return errorJSON(c, fiber.StatusInternalServerError, "permission check error")
 		}
 		if !isAppManager {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: insufficient permissions to create private client"})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions to create private client")
 		}
 	}

 	status := strings.ToLower(strings.TrimSpace(valueOr(req.Status, "active")))
 	if status != "active" && status != "inactive" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "status must be active or inactive"})
+		return errorJSON(c, fiber.StatusBadRequest, "status must be active or inactive")
 	}

 	metadata := mergeMetadata(nil, req.Metadata)
@@ -468,7 +466,7 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {

 	created, err := h.Hydra.CreateClient(c.Context(), clientReq)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// Store secret in metadata for later retrieval
@@ -500,27 +498,27 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
 func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 	clientID := strings.TrimSpace(c.Params("id"))
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "client id is required")
 	}

 	var req clientUpsertRequest
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	current, err := h.Hydra.GetClient(c.Context(), clientID)
 	if err != nil {
 		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "client not found"})
+			return errorJSON(c, fiber.StatusNotFound, "client not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	clientType := ""
 	if req.Type != nil {
 		clientType = strings.ToLower(strings.TrimSpace(*req.Type))
 		if clientType != "pkce" && clientType != "private" {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "type must be pkce or private"})
+			return errorJSON(c, fiber.StatusBadRequest, "type must be pkce or private")
 		}
 	}

@@ -529,10 +527,10 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 	if currentSummary.Type == "private" || clientType == "private" {
 		isAppManager, err := h.checkAppManagerPermission(c)
 		if err != nil {
-			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "permission check error"})
+			return errorJSON(c, fiber.StatusInternalServerError, "permission check error")
 		}
 		if !isAppManager {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: insufficient permissions for private client"})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions for private client")
 		}
 	}

@@ -540,7 +538,7 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 	if req.Status != nil {
 		status = strings.ToLower(strings.TrimSpace(*req.Status))
 		if status != "active" && status != "inactive" {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "status must be active or inactive"})
+			return errorJSON(c, fiber.StatusBadRequest, "status must be active or inactive")
 		}
 	}

@@ -554,7 +552,7 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 	}

 	if req.RedirectURIs != nil && len(*req.RedirectURIs) == 0 {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "redirectUris cannot be empty"})
+		return errorJSON(c, fiber.StatusBadRequest, "redirectUris cannot be empty")
 	}

 	metadata := mergeMetadata(current.Metadata, req.Metadata)
@@ -579,9 +577,9 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 	updatedClient, err := h.Hydra.UpdateClient(c.Context(), clientID, updated)
 	if err != nil {
 		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "client not found"})
+			return errorJSON(c, fiber.StatusNotFound, "client not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	summary := h.mapClientSummary(*updatedClient)
@@ -600,7 +598,7 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 func (h *DevHandler) DeleteClient(c *fiber.Ctx) error {
 	clientID := strings.TrimSpace(c.Params("id"))
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "client id is required")
 	}

 	// [Security] Check permission for private clients
@@ -610,16 +608,16 @@ func (h *DevHandler) DeleteClient(c *fiber.Ctx) error {
 		if summary.Type == "private" {
 			isAppManager, _ := h.checkAppManagerPermission(c)
 			if !isAppManager {
-				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: insufficient permissions for private client"})
+				return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions for private client")
 			}
 		}
 	}

 	if err := h.Hydra.DeleteClient(c.Context(), clientID); err != nil {
 		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "client not found"})
+			return errorJSON(c, fiber.StatusNotFound, "client not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// 1. Clean up PostgreSQL
@@ -638,7 +636,7 @@ func (h *DevHandler) DeleteClient(c *fiber.Ctx) error {
 func (h *DevHandler) ListConsents(c *fiber.Ctx) error {
 	clientID := strings.TrimSpace(c.Query("client_id"))
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client_id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "client_id is required")
 	}

 	subject := strings.TrimSpace(c.Query("subject"))
@@ -678,7 +676,7 @@ func (h *DevHandler) ListConsents(c *fiber.Ctx) error {
 	}

 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	items := make([]consentSummary, 0, len(consents))
@@ -719,7 +717,7 @@ func (h *DevHandler) ListConsents(c *fiber.Ctx) error {
 func (h *DevHandler) RevokeConsents(c *fiber.Ctx) error {
 	subject := strings.TrimSpace(c.Query("subject"))
 	if subject == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "subject is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "subject is required")
 	}
 	clientID := strings.TrimSpace(c.Query("client_id"))

@@ -733,7 +731,7 @@ func (h *DevHandler) RevokeConsents(c *fiber.Ctx) error {

 	// 1. Revoke in Hydra
 	if err := h.Hydra.RevokeConsentSessions(c.Context(), subject, clientID); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// 2. Sync to Local DB (Delete)
@@ -747,7 +745,7 @@ func (h *DevHandler) RevokeConsents(c *fiber.Ctx) error {
 func (h *DevHandler) RotateClientSecret(c *fiber.Ctx) error {
 	clientID := strings.TrimSpace(c.Params("id"))
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "client id is required")
 	}

 	// [Security] Check permission for private clients
@@ -757,7 +755,7 @@ func (h *DevHandler) RotateClientSecret(c *fiber.Ctx) error {
 		if summary.Type == "private" {
 			isAppManager, _ := h.checkAppManagerPermission(c)
 			if !isAppManager {
-				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: insufficient permissions for private client"})
+				return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions for private client")
 			}
 		}
 	}
@@ -765,22 +763,22 @@ func (h *DevHandler) RotateClientSecret(c *fiber.Ctx) error {
 	// 1. Generate new secret
 	newSecret, err := generateRandomSecret(20)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to generate secret"})
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to generate secret")
 	}

 	// 2. Get current client to preserve other fields (already fetched above)
 	if err != nil {
 		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "client not found"})
+			return errorJSON(c, fiber.StatusNotFound, "client not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// 3. Update Hydra
 	current.ClientSecret = newSecret
 	updated, err := h.Hydra.UpdateClient(c.Context(), clientID, *current)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// 4. Update Persistence (DB & Redis)
--- a/backend/internal/handler/error_helper.go
+++ b/backend/internal/handler/error_helper.go
@@ -0,0 +1,17 @@
+package handler
+
+import (
+	"baron-sso-backend/internal/response"
+
+	"github.com/gofiber/fiber/v2"
+)
+
+// errorJSON은 기존 error 필드를 유지하면서 기계 판독용 code를 명시적으로 추가합니다.
+func errorJSON(c *fiber.Ctx, status int, message string) error {
+	return response.Error(c, status, response.StatusCode(status), message)
+}
+
+// errorJSONCode는 상태코드 기반 매핑만으로 부족한 경우 명시 코드를 강제할 때 사용합니다.
+func errorJSONCode(c *fiber.Ctx, status int, code, message string) error {
+	return response.Error(c, status, code, message)
+}
--- a/backend/internal/handler/federation_handler.go
+++ b/backend/internal/handler/federation_handler.go
@@ -33,13 +33,13 @@ func (h *FederationHandler) InitiateOIDCLogin(c *fiber.Ctx) error {
 	loginChallenge := c.Query("login_challenge")

 	if providerID == "" || loginChallenge == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "provider_id and login_challenge are required"})
+		return errorJSON(c, fiber.StatusBadRequest, "provider_id and login_challenge are required")
 	}

 	redirectURL, err := h.fedSvc.InitiateOIDCLogin(c.Context(), providerID, loginChallenge)
 	if err != nil {
 		// Log the error properly in a real application
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to initiate OIDC login"})
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to initiate OIDC login")
 	}

 	return c.Redirect(redirectURL, fiber.StatusFound)
@@ -51,12 +51,12 @@ func (h *FederationHandler) HandleOIDCCallback(c *fiber.Ctx) error {
 	state := c.Query("state")

 	if code == "" || state == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "code and state are required"})
+		return errorJSON(c, fiber.StatusBadRequest, "code and state are required")
 	}

 	redirectURL, err := h.fedSvc.HandleOIDCCallback(c.Context(), code, state)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to handle OIDC callback"})
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to handle OIDC callback")
 	}

 	return c.Redirect(redirectURL, fiber.StatusFound)
@@ -68,12 +68,12 @@ func (h *FederationHandler) HandleOIDCCallback(c *fiber.Ctx) error {
 func (h *FederationHandler) ListIdpConfigsForClient(c *fiber.Ctx) error {
 	clientID := c.Params("clientId")
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "clientId is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "clientId is required")
 	}

 	var configs []domain.IdentityProviderConfig
 	if err := h.db.Where("client_id = ?", clientID).Find(&configs).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.JSON(configs)
@@ -83,12 +83,12 @@ func (h *FederationHandler) ListIdpConfigsForClient(c *fiber.Ctx) error {
 func (h *FederationHandler) CreateIdpConfigForClient(c *fiber.Ctx) error {
 	clientID := c.Params("clientId")
 	if clientID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "clientId is required in path"})
+		return errorJSON(c, fiber.StatusBadRequest, "clientId is required in path")
 	}

 	var req domain.IdentityProviderConfig
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	// Assign clientID from path parameter
@@ -96,14 +96,14 @@ func (h *FederationHandler) CreateIdpConfigForClient(c *fiber.Ctx) error {

 	// Basic validation
 	if req.DisplayName == "" || req.ProviderType == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "display_name and provider_type are required"})
+		return errorJSON(c, fiber.StatusBadRequest, "display_name and provider_type are required")
 	}

 	// TODO: Optionally, validate if the clientID exists in Hydra

 	// Create in DB
 	if err := h.db.Create(&req).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.Status(fiber.StatusCreated).JSON(req)
@@ -115,7 +115,7 @@ func (h *FederationHandler) CreateIdpConfigForClient(c *fiber.Ctx) error {
 func (h *FederationHandler) ListIdpConfigsForTenant(c *fiber.Ctx) error {
 	tenantID := c.Params("tenantId")
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenantId is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenantId is required")
 	}

 	// This is a temporary solution. We should create a proper method in the repository.
@@ -123,7 +123,7 @@ func (h *FederationHandler) ListIdpConfigsForTenant(c *fiber.Ctx) error {
 	// Note: This now queries client_id, which is incorrect for tenants.
 	// This method is deprecated.
 	if err := h.db.Where("tenant_id = ?", tenantID).Find(&configs).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.JSON(configs)
@@ -133,26 +133,26 @@ func (h *FederationHandler) ListIdpConfigsForTenant(c *fiber.Ctx) error {
 func (h *FederationHandler) CreateIdpConfig(c *fiber.Ctx) error {
 	var req domain.IdentityProviderConfig
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	// Basic validation - This is the old validation logic
 	if req.ClientID == "" || req.DisplayName == "" || req.ProviderType == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client_id, display_name, and provider_type are required"})
+		return errorJSON(c, fiber.StatusBadRequest, "client_id, display_name, and provider_type are required")
 	}

 	// This check is now incorrect and deprecated.
 	var tenant domain.Tenant
 	if err := h.db.First(&tenant, "id = ?", req.ClientID).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenant not found"})
+			return errorJSON(c, fiber.StatusBadRequest, "tenant not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// Create in DB
 	if err := h.db.Create(&req).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.Status(fiber.StatusCreated).JSON(req)
--- a/backend/internal/handler/relying_party_handler.go
+++ b/backend/internal/handler/relying_party_handler.go
@@ -20,17 +20,17 @@ func NewRelyingPartyHandler(s service.RelyingPartyService, kratos service.Kratos
 func (h *RelyingPartyHandler) Create(c *fiber.Ctx) error {
 	tenantID := c.Params("tenantId")
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenantId is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenantId is required")
 	}

 	var req domain.HydraClient
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	rp, err := h.Service.Create(c.Context(), tenantID, req)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.Status(fiber.StatusCreated).JSON(rp)
@@ -39,7 +39,7 @@ func (h *RelyingPartyHandler) Create(c *fiber.Ctx) error {
 func (h *RelyingPartyHandler) ListAll(c *fiber.Ctx) error {
 	profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse)
 	if !ok {
-		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized: user profile not found in context"})
+		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized: user profile not found in context")
 	}

 	var rps []domain.RelyingParty
@@ -51,11 +51,11 @@ func (h *RelyingPartyHandler) ListAll(c *fiber.Ctx) error {
 		rps, err = h.Service.List(c.Context(), *profile.TenantID)
 	} else {
 		slog.Warn("Forbidden access to all applications", "userID", profile.ID, "role", profile.Role)
-		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: insufficient role to list all applications"})
+		return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient role to list all applications")
 	}

 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.JSON(rps)
@@ -64,12 +64,12 @@ func (h *RelyingPartyHandler) ListAll(c *fiber.Ctx) error {
 func (h *RelyingPartyHandler) List(c *fiber.Ctx) error {
 	tenantID := c.Params("tenantId")
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenantId is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenantId is required")
 	}

 	rps, err := h.Service.List(c.Context(), tenantID)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.JSON(rps)
@@ -79,7 +79,7 @@ func (h *RelyingPartyHandler) Get(c *fiber.Ctx) error {
 	id := c.Params("id")
 	rp, hydraClient, err := h.Service.Get(c.Context(), id)
 	if err != nil {
-		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "relying party not found"})
+		return errorJSON(c, fiber.StatusNotFound, "relying party not found")
 	}

 	return c.JSON(fiber.Map{
@@ -92,12 +92,12 @@ func (h *RelyingPartyHandler) Update(c *fiber.Ctx) error {
 	id := c.Params("id")
 	var req domain.HydraClient
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	rp, err := h.Service.Update(c.Context(), id, req)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.JSON(rp)
@@ -106,7 +106,7 @@ func (h *RelyingPartyHandler) Update(c *fiber.Ctx) error {
 func (h *RelyingPartyHandler) Delete(c *fiber.Ctx) error {
 	id := c.Params("id")
 	if err := h.Service.Delete(c.Context(), id); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.SendStatus(fiber.StatusNoContent)
--- a/backend/internal/handler/tenant_handler.go
+++ b/backend/internal/handler/tenant_handler.go
@@ -58,17 +58,17 @@ func (h *TenantHandler) RegisterTenantPublic(c *fiber.Ctx) error {
 		AdminEmail  string `json:"adminEmail"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	// Basic validation
 	if req.Name == "" || req.Domain == "" || req.AdminEmail == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "name, domain, and adminEmail are required"})
+		return errorJSON(c, fiber.StatusBadRequest, "name, domain, and adminEmail are required")
 	}

 	tenant, err := h.Service.RequestRegistration(c.Context(), req.Name, req.Slug, req.Description, req.Domain, req.AdminEmail)
 	if err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusBadRequest, err.Error())
 	}

 	return c.Status(fiber.StatusAccepted).JSON(fiber.Map{
@@ -80,11 +80,11 @@ func (h *TenantHandler) RegisterTenantPublic(c *fiber.Ctx) error {
 func (h *TenantHandler) ApproveTenant(c *fiber.Ctx) error {
 	tenantID := c.Params("id")
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenant id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenant id is required")
 	}

 	if err := h.Service.ApproveTenant(c.Context(), tenantID); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.JSON(fiber.Map{"message": "Tenant approved successfully"})
@@ -92,7 +92,7 @@ func (h *TenantHandler) ApproveTenant(c *fiber.Ctx) error {

 func (h *TenantHandler) ListTenants(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	limit := c.QueryInt("limit", 50)
@@ -106,12 +106,12 @@ func (h *TenantHandler) ListTenants(c *fiber.Ctx) error {

 	var total int64
 	if err := h.DB.Model(&domain.Tenant{}).Count(&total).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	var tenants []domain.Tenant
 	if err := h.DB.Order("created_at desc").Limit(limit).Offset(offset).Preload("Domains").Find(&tenants).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	items := make([]tenantSummary, 0, len(tenants))
@@ -124,20 +124,20 @@ func (h *TenantHandler) ListTenants(c *fiber.Ctx) error {

 func (h *TenantHandler) GetTenant(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	tenantID := strings.TrimSpace(c.Params("id"))
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenant id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenant id is required")
 	}

 	var tenant domain.Tenant
 	if err := h.DB.Preload("Domains").First(&tenant, "id = ?", tenantID).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "tenant not found"})
+			return errorJSON(c, fiber.StatusNotFound, "tenant not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.JSON(mapTenantSummary(tenant))
@@ -145,7 +145,7 @@ func (h *TenantHandler) GetTenant(c *fiber.Ctx) error {

 func (h *TenantHandler) CreateTenant(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	var req struct {
@@ -158,12 +158,12 @@ func (h *TenantHandler) CreateTenant(c *fiber.Ctx) error {
 		Config      map[string]any `json:"config"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	name := strings.TrimSpace(req.Name)
 	if name == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "name is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "name is required")
 	}

 	slug := normalizeTenantSlug(req.Slug)
@@ -171,7 +171,7 @@ func (h *TenantHandler) CreateTenant(c *fiber.Ctx) error {
 		slug = normalizeTenantSlug(name)
 	}
 	if slug == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "slug is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "slug is required")
 	}

 	status := normalizeTenantStatus(req.Status)
@@ -189,9 +189,9 @@ func (h *TenantHandler) CreateTenant(c *fiber.Ctx) error {
 	tenant, err := h.Service.RegisterTenant(c.Context(), name, slug, req.Description, req.Domains, parentID)
 	if err != nil {
 		if strings.Contains(err.Error(), "already exists") {
-			return c.Status(fiber.StatusConflict).JSON(fiber.Map{"error": err.Error()})
+			return errorJSON(c, fiber.StatusConflict, err.Error())
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	if req.Config != nil {
@@ -204,20 +204,20 @@ func (h *TenantHandler) CreateTenant(c *fiber.Ctx) error {

 func (h *TenantHandler) UpdateTenant(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	tenantID := strings.TrimSpace(c.Params("id"))
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenant id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenant id is required")
 	}

 	var tenant domain.Tenant
 	if err := h.DB.First(&tenant, "id = ?", tenantID).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "tenant not found"})
+			return errorJSON(c, fiber.StatusNotFound, "tenant not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	var req struct {
@@ -229,27 +229,27 @@ func (h *TenantHandler) UpdateTenant(c *fiber.Ctx) error {
 		Config      map[string]any `json:"config"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	if req.Name != nil {
 		name := strings.TrimSpace(*req.Name)
 		if name == "" {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "name cannot be empty"})
+			return errorJSON(c, fiber.StatusBadRequest, "name cannot be empty")
 		}
 		tenant.Name = name
 	}
 	if req.Slug != nil {
 		slug := normalizeTenantSlug(*req.Slug)
 		if slug == "" {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "slug cannot be empty"})
+			return errorJSON(c, fiber.StatusBadRequest, "slug cannot be empty")
 		}
 		if slug != tenant.Slug {
 			var exists domain.Tenant
 			if err := h.DB.Unscoped().Where("slug = ?", slug).First(&exists).Error; err == nil {
-				return c.Status(fiber.StatusConflict).JSON(fiber.Map{"error": "slug already exists"})
+				return errorJSON(c, fiber.StatusConflict, "slug already exists")
 			} else if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-				return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+				return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 			}
 			tenant.Slug = slug
 		}
@@ -260,7 +260,7 @@ func (h *TenantHandler) UpdateTenant(c *fiber.Ctx) error {
 	if req.Status != nil {
 		status := normalizeTenantStatus(*req.Status)
 		if status == "" {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "status must be active or inactive"})
+			return errorJSON(c, fiber.StatusBadRequest, "status must be active or inactive")
 		}
 		tenant.Status = status
 	}
@@ -269,14 +269,14 @@ func (h *TenantHandler) UpdateTenant(c *fiber.Ctx) error {
 	}

 	if err := h.DB.Save(&tenant).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// Update domains if provided
 	if req.Domains != nil {
 		// Simple approach: Delete existing and recreate
 		if err := h.DB.Delete(&domain.TenantDomain{}, "tenant_id = ?", tenant.ID).Error; err != nil {
-			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to clear old domains"})
+			return errorJSON(c, fiber.StatusInternalServerError, "failed to clear old domains")
 		}
 		for _, d := range req.Domains {
 			if strings.TrimSpace(d) == "" {
@@ -284,7 +284,7 @@ func (h *TenantHandler) UpdateTenant(c *fiber.Ctx) error {
 			}
 			// Use repository for consistency
 			if err := repository.NewTenantRepository(h.DB).AddDomain(c.Context(), tenant.ID, strings.TrimSpace(d), true); err != nil {
-				return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to add domain: " + d})
+				return errorJSON(c, fiber.StatusInternalServerError, "failed to add domain: "+d)
 			}
 		}
 	}
@@ -297,30 +297,30 @@ func (h *TenantHandler) UpdateTenant(c *fiber.Ctx) error {

 func (h *TenantHandler) DeleteTenant(c *fiber.Ctx) error {
 	if h.DB == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "database not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "database not available")
 	}

 	tenantID := strings.TrimSpace(c.Params("id"))
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenant id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenant id is required")
 	}

 	var tenant domain.Tenant
 	if err := h.DB.First(&tenant, "id = ?", tenantID).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "tenant not found"})
+			return errorJSON(c, fiber.StatusNotFound, "tenant not found")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// Rename slug to release it for reuse before soft delete
 	deletedSlug := tenant.Slug + "-deleted-" + time.Now().Format("20060102150405")
 	if err := h.DB.Model(&tenant).Update("slug", deletedSlug).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to release slug"})
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to release slug")
 	}

 	if err := h.DB.Delete(&tenant).Error; err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	return c.SendStatus(fiber.StatusNoContent)
@@ -329,13 +329,13 @@ func (h *TenantHandler) DeleteTenant(c *fiber.Ctx) error {
 func (h *TenantHandler) ListAdmins(c *fiber.Ctx) error {
 	tenantID := c.Params("id")
 	if tenantID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenant id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenant id is required")
 	}

 	// Fetch admins from Keto
 	relations, err := h.Keto.ListRelations(c.Context(), "Tenant", tenantID, "admins", "")
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	type adminInfo struct {
@@ -381,7 +381,7 @@ func (h *TenantHandler) AddAdmin(c *fiber.Ctx) error {
 	tenantID := c.Params("id")
 	userID := c.Params("userId")
 	if tenantID == "" || userID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenantId and userId are required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenantId and userId are required")
 	}

 	if h.KetoOutbox != nil {
@@ -401,7 +401,7 @@ func (h *TenantHandler) RemoveAdmin(c *fiber.Ctx) error {
 	tenantID := c.Params("id")
 	userID := c.Params("userId")
 	if tenantID == "" || userID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "tenantId and userId are required"})
+		return errorJSON(c, fiber.StatusBadRequest, "tenantId and userId are required")
 	}

 	if h.KetoOutbox != nil {
--- a/backend/internal/handler/user_group_handler.go
+++ b/backend/internal/handler/user_group_handler.go
@@ -19,7 +19,7 @@ func (h *UserGroupHandler) List(c *fiber.Ctx) error {
 	tenantID := c.Params("tenantId")
 	groups, err := h.Service.List(c.Context(), tenantID)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	return c.JSON(groups)
 }
@@ -42,7 +42,7 @@ func (h *UserGroupHandler) Get(c *fiber.Ctx) error {
 	id := c.Params("id")
 	group, err := h.Service.Get(c.Context(), id)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to get group: " + err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to get group: "+err.Error())
 	}
 	return c.JSON(group)
 }
@@ -77,11 +77,11 @@ func (h *UserGroupHandler) AddMember(c *fiber.Ctx) error {
 		UserID string `json:"userId"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "userId is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "userId is required")
 	}

 	if err := h.Service.AddMember(c.Context(), groupID, req.UserID); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	return c.SendStatus(fiber.StatusOK)
 }
@@ -91,7 +91,7 @@ func (h *UserGroupHandler) RemoveMember(c *fiber.Ctx) error {
 	userID := c.Params("userId")

 	if err := h.Service.RemoveMember(c.Context(), groupID, userID); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	return c.SendStatus(fiber.StatusNoContent)
 }
@@ -103,11 +103,11 @@ func (h *UserGroupHandler) AssignRole(c *fiber.Ctx) error {
 		Relation string `json:"relation"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid body")
 	}

 	if err := h.Service.AssignRoleToTenant(c.Context(), groupID, req.TenantID, req.Relation); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	return c.SendStatus(fiber.StatusOK)
 }
@@ -116,7 +116,7 @@ func (h *UserGroupHandler) ListRoles(c *fiber.Ctx) error {
 	groupID := c.Params("id")
 	roles, err := h.Service.ListRoles(c.Context(), groupID)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	return c.JSON(roles)
 }
@@ -127,7 +127,7 @@ func (h *UserGroupHandler) RemoveRole(c *fiber.Ctx) error {
 	relation := c.Params("relation")

 	if err := h.Service.RemoveRoleFromTenant(c.Context(), groupID, tenantID, relation); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	return c.SendStatus(fiber.StatusNoContent)
 }
--- a/backend/internal/handler/user_handler.go
+++ b/backend/internal/handler/user_handler.go
@@ -127,7 +127,7 @@ func (h *UserHandler) ListUsers(c *fiber.Ctx) error {
 	// Fetch from UserRepo
 	users, total, err := h.UserRepo.List(c.Context(), offset, limit, search)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to fetch users from both kratos and local db"})
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to fetch users from both kratos and local db")
 	}

 	items := make([]userSummary, 0, len(users))
@@ -156,20 +156,20 @@ func (h *UserHandler) ListUsers(c *fiber.Ctx) error {

 func (h *UserHandler) GetUser(c *fiber.Ctx) error {
 	if h.KratosAdmin == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "identity provider not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
 	}

 	userID := strings.TrimSpace(c.Params("id"))
 	if userID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "user id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "user id is required")
 	}

 	identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	if identity == nil {
-		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "user not found"})
+		return errorJSON(c, fiber.StatusNotFound, "user not found")
 	}

 	// [New] Check access scope
@@ -177,7 +177,7 @@ func (h *UserHandler) GetUser(c *fiber.Ctx) error {
 	if requester != nil && requester.Role == domain.RoleTenantAdmin {
 		compCode := extractTraitString(identity.Traits, "companyCode")
 		if requester.CompanyCode == "" || compCode != requester.CompanyCode {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: access to user in another tenant denied"})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: access to user in another tenant denied")
 		}
 	}

@@ -186,7 +186,7 @@ func (h *UserHandler) GetUser(c *fiber.Ctx) error {

 func (h *UserHandler) CreateUser(c *fiber.Ctx) error {
 	if h.OryProvider == nil || h.KratosAdmin == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "identity provider not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
 	}

 	var req struct {
@@ -200,19 +200,19 @@ func (h *UserHandler) CreateUser(c *fiber.Ctx) error {
 		Metadata    map[string]any `json:"metadata"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	email := strings.TrimSpace(req.Email)
 	if email == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "email is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "email is required")
 	}
 	if !strings.Contains(email, "@") || !strings.Contains(email, ".") {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid email format"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid email format")
 	}
 	name := strings.TrimSpace(req.Name)
 	if name == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "name is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "name is required")
 	}

 	password := strings.TrimSpace(req.Password)
@@ -232,13 +232,13 @@ func (h *UserHandler) CreateUser(c *fiber.Ctx) error {
 	if password == "" {
 		generated, genErr := utils.GeneratePasswordWithPolicy(policy)
 		if genErr != nil {
-			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to generate password"})
+			return errorJSON(c, fiber.StatusInternalServerError, "failed to generate password")
 		}
 		password = generated
 		generatedPassword = generated
 	} else {
 		if err := utils.ValidatePasswordWithPolicy(policy, password); err != nil {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error()})
+			return errorJSON(c, fiber.StatusBadRequest, err.Error())
 		}
 	}

@@ -284,9 +284,9 @@ func (h *UserHandler) CreateUser(c *fiber.Ctx) error {
 	identityID, err := h.OryProvider.CreateUser(brokerUser, password)
 	if err != nil {
 		if strings.Contains(err.Error(), "already exists") {
-			return c.Status(fiber.StatusConflict).JSON(fiber.Map{"error": "email already exists"})
+			return errorJSON(c, fiber.StatusConflict, "email already exists")
 		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// [New] Local DB Sync
@@ -351,7 +351,7 @@ func (h *UserHandler) CreateUser(c *fiber.Ctx) error {

 	identity, err := h.KratosAdmin.GetIdentity(c.Context(), identityID)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	if identity == nil {
 		return c.Status(fiber.StatusCreated).JSON(fiber.Map{"id": identityID, "initialPassword": generatedPassword})
@@ -366,20 +366,20 @@ func (h *UserHandler) CreateUser(c *fiber.Ctx) error {

 func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 	if h.KratosAdmin == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "identity provider not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
 	}

 	userID := strings.TrimSpace(c.Params("id"))
 	if userID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "user id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "user id is required")
 	}

 	identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 	if identity == nil {
-		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "user not found"})
+		return errorJSON(c, fiber.StatusNotFound, "user not found")
 	}

 	// [New] Check access scope
@@ -387,7 +387,7 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 	if requester != nil && requester.Role == domain.RoleTenantAdmin {
 		compCode := extractTraitString(identity.Traits, "companyCode")
 		if requester.CompanyCode == "" || compCode != requester.CompanyCode {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: cannot update user in another tenant"})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: cannot update user in another tenant")
 		}
 	}

@@ -402,13 +402,13 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 		Metadata    map[string]any `json:"metadata"`
 	}
 	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
 	}

 	// [New] Tenant Admin restriction: Cannot change companyCode
 	if requester != nil && requester.Role == domain.RoleTenantAdmin {
 		if req.CompanyCode != nil && *req.CompanyCode != requester.CompanyCode {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: tenant admins cannot change user's tenant"})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: tenant admins cannot change user's tenant")
 		}
 	}

@@ -468,7 +468,7 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 	state := normalizeKratosState(req.Status)
 	updated, err := h.KratosAdmin.UpdateIdentity(c.Context(), userID, traits, state)
 	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// [New] Local DB Sync
@@ -561,7 +561,7 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {

 	if req.Password != nil && *req.Password != "" {
 		if err := h.KratosAdmin.UpdateIdentityPassword(c.Context(), userID, *req.Password); err != nil {
-			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+			return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 		}
 	}

@@ -570,12 +570,12 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {

 func (h *UserHandler) DeleteUser(c *fiber.Ctx) error {
 	if h.KratosAdmin == nil {
-		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "identity provider not available"})
+		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
 	}

 	userID := strings.TrimSpace(c.Params("id"))
 	if userID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "user id is required"})
+		return errorJSON(c, fiber.StatusBadRequest, "user id is required")
 	}

 	// [New] Check access scope before deletion
@@ -585,13 +585,13 @@ func (h *UserHandler) DeleteUser(c *fiber.Ctx) error {
 		if err == nil && identity != nil {
 			compCode := extractTraitString(identity.Traits, "companyCode")
 			if requester.CompanyCode == "" || compCode != requester.CompanyCode {
-				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: cannot delete user in another tenant"})
+				return errorJSON(c, fiber.StatusForbidden, "forbidden: cannot delete user in another tenant")
 			}
 		}
 	}

 	if err := h.KratosAdmin.DeleteIdentity(c.Context(), userID); err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}

 	// [Keto] Cleanup relations via Outbox
--- a/backend/internal/logger/client_log_policy.go
+++ b/backend/internal/logger/client_log_policy.go
@@ -0,0 +1,143 @@
+package logger
+
+import (
+	"log/slog"
+	"regexp"
+	"strings"
+)
+
+var sensitiveClientLogKeys = map[string]struct{}{
+	"password":         {},
+	"currentpassword":  {},
+	"newpassword":      {},
+	"oldpassword":      {},
+	"token":            {},
+	"accesstoken":      {},
+	"refreshtoken":     {},
+	"secret":           {},
+	"clientsecret":     {},
+	"authorization":    {},
+	"cookie":           {},
+	"setcookie":        {},
+	"verificationcode": {},
+	"code":             {},
+	"loginchallenge":   {},
+	"loginverifier":    {},
+	"sessionjwt":       {},
+	"accessjwt":        {},
+	"refreshjwt":       {},
+}
+
+var (
+	logJSONSensitivePattern = regexp.MustCompile(`(?i)"(password|currentpassword|newpassword|oldpassword|token|accesstoken|refreshtoken|secret|clientsecret|authorization|cookie|setcookie|verificationcode|code|loginchallenge|loginverifier|sessionjwt|accessjwt|refreshjwt)"\s*:\s*"[^"]*"`)
+	logKVPattern            = regexp.MustCompile(`(?i)\b(password|current_password|currentpassword|new_password|newpassword|old_password|oldpassword|token|access_token|accesstoken|refresh_token|refreshtoken|authorization|cookie|session_jwt|sessionjwt|access_jwt|accessjwt|refresh_jwt|refreshjwt)\b\s*[:=]\s*([^\s,;]+)`)
+)
+
+func IsProductionEnv(appEnv string) bool {
+	env := strings.ToLower(strings.TrimSpace(appEnv))
+	return env == "prod" || env == "production"
+}
+
+func parseBoolFlag(raw string) bool {
+	switch strings.ToLower(strings.TrimSpace(raw)) {
+	case "1", "true", "yes", "y", "on":
+		return true
+	default:
+		return false
+	}
+}
+
+func ClientDebugEnabled(appEnv, productionDebugFlag string) bool {
+	if !IsProductionEnv(appEnv) {
+		return true
+	}
+	return parseBoolFlag(productionDebugFlag)
+}
+
+func NormalizeClientLogLevel(level string) slog.Level {
+	switch strings.ToUpper(strings.TrimSpace(level)) {
+	case "SEVERE", "ERROR":
+		return slog.LevelError
+	case "WARNING", "WARN":
+		return slog.LevelWarn
+	case "DEBUG", "FINE", "TRACE":
+		return slog.LevelDebug
+	default:
+		return slog.LevelInfo
+	}
+}
+
+func ShouldAcceptClientLog(appEnv, productionDebugFlag, level string) bool {
+	if ClientDebugEnabled(appEnv, productionDebugFlag) {
+		return true
+	}
+	return NormalizeClientLogLevel(level) >= slog.LevelWarn
+}
+
+func ShouldFilterNoisyClientInfo(appEnv, productionDebugFlag, message string) bool {
+	if ClientDebugEnabled(appEnv, productionDebugFlag) {
+		return false
+	}
+	msg := strings.ToLower(message)
+	return strings.Contains(msg, "navigating to") ||
+		strings.Contains(msg, "going to") ||
+		strings.Contains(msg, "redirecting to") ||
+		strings.Contains(msg, "full paths for routes")
+}
+
+func SanitizeClientLogMessage(message string) string {
+	if strings.TrimSpace(message) == "" {
+		return message
+	}
+	sanitized := logJSONSensitivePattern.ReplaceAllStringFunc(message, func(segment string) string {
+		parts := strings.SplitN(segment, ":", 2)
+		if len(parts) != 2 {
+			return segment
+		}
+		return parts[0] + `:"*****"`
+	})
+	sanitized = logKVPattern.ReplaceAllString(sanitized, `$1=*****`)
+	return sanitized
+}
+
+func SanitizeClientLogData(data map[string]interface{}) map[string]interface{} {
+	if len(data) == 0 {
+		return data
+	}
+	out := make(map[string]interface{}, len(data))
+	for k, v := range data {
+		if isSensitiveClientLogKey(k) {
+			out[k] = "*****"
+			continue
+		}
+		out[k] = sanitizeClientLogValue(v)
+	}
+	return out
+}
+
+func sanitizeClientLogValue(v interface{}) interface{} {
+	switch val := v.(type) {
+	case map[string]interface{}:
+		return SanitizeClientLogData(val)
+	case []interface{}:
+		next := make([]interface{}, len(val))
+		for i := range val {
+			next[i] = sanitizeClientLogValue(val[i])
+		}
+		return next
+	case string:
+		return SanitizeClientLogMessage(val)
+	default:
+		return val
+	}
+}
+
+func isSensitiveClientLogKey(key string) bool {
+	normalized := strings.ToLower(strings.TrimSpace(key))
+	normalized = strings.ReplaceAll(normalized, "-", "")
+	normalized = strings.ReplaceAll(normalized, "_", "")
+	normalized = strings.ReplaceAll(normalized, ".", "")
+	normalized = strings.ReplaceAll(normalized, " ", "")
+	_, ok := sensitiveClientLogKeys[normalized]
+	return ok
+}
--- a/backend/internal/logger/client_log_policy_test.go
+++ b/backend/internal/logger/client_log_policy_test.go
@@ -0,0 +1,79 @@
+package logger
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClientDebugEnabled(t *testing.T) {
+	t.Run("non production enables debug by default", func(t *testing.T) {
+		assert.True(t, ClientDebugEnabled("dev", ""))
+		assert.True(t, ClientDebugEnabled("local", "false"))
+	})
+
+	t.Run("production disables debug by default", func(t *testing.T) {
+		assert.False(t, ClientDebugEnabled("production", ""))
+		assert.False(t, ClientDebugEnabled("prod", "false"))
+	})
+
+	t.Run("production accepts explicit debug override", func(t *testing.T) {
+		assert.True(t, ClientDebugEnabled("production", "true"))
+		assert.True(t, ClientDebugEnabled("production", "1"))
+		assert.True(t, ClientDebugEnabled("prod", "on"))
+	})
+}
+
+func TestShouldAcceptClientLog(t *testing.T) {
+	assert.False(t, ShouldAcceptClientLog("production", "", "INFO"))
+	assert.False(t, ShouldAcceptClientLog("production", "", "DEBUG"))
+	assert.True(t, ShouldAcceptClientLog("production", "", "WARN"))
+	assert.True(t, ShouldAcceptClientLog("production", "", "ERROR"))
+	assert.True(t, ShouldAcceptClientLog("production", "true", "INFO"))
+	assert.True(t, ShouldAcceptClientLog("dev", "", "INFO"))
+}
+
+func TestShouldFilterNoisyClientInfo(t *testing.T) {
+	assert.True(t, ShouldFilterNoisyClientInfo("production", "", "Navigating to /ko/signin"))
+	assert.False(t, ShouldFilterNoisyClientInfo("production", "true", "Navigating to /ko/signin"))
+	assert.False(t, ShouldFilterNoisyClientInfo("dev", "", "Navigating to /ko/signin"))
+}
+
+func TestSanitizeClientLogData(t *testing.T) {
+	input := map[string]interface{}{
+		"token": "raw-token",
+		"safe":  "ok",
+		"nested": map[string]interface{}{
+			"new_password": "secret-1",
+			"path":         "/ko/profile",
+		},
+		"arr": []interface{}{
+			map[string]interface{}{"authorization": "Bearer abc"},
+			"token=abc123",
+		},
+	}
+
+	result := SanitizeClientLogData(input)
+
+	assert.Equal(t, "*****", result["token"])
+	assert.Equal(t, "ok", result["safe"])
+
+	nested := result["nested"].(map[string]interface{})
+	assert.Equal(t, "*****", nested["new_password"])
+	assert.Equal(t, "/ko/profile", nested["path"])
+
+	arr := result["arr"].([]interface{})
+	first := arr[0].(map[string]interface{})
+	assert.Equal(t, "*****", first["authorization"])
+	assert.Equal(t, "token=*****", arr[1])
+}
+
+func TestSanitizeClientLogMessage(t *testing.T) {
+	msg := `FLUTTER_ERROR token=abc123 payload={"password":"hello","safe":"ok"} authorization:BearerX`
+	sanitized := SanitizeClientLogMessage(msg)
+	assert.NotContains(t, sanitized, "abc123")
+	assert.NotContains(t, sanitized, `"password":"hello"`)
+	assert.Contains(t, sanitized, `"password":"*****"`)
+	assert.Contains(t, sanitized, "token=*****")
+	assert.Contains(t, sanitized, "authorization=*****")
+}
--- a/backend/internal/middleware/error_helper.go
+++ b/backend/internal/middleware/error_helper.go
@@ -0,0 +1,17 @@
+package middleware
+
+import (
+	"baron-sso-backend/internal/response"
+
+	"github.com/gofiber/fiber/v2"
+)
+
+// errorJSON은 legacy error 필드를 유지하면서 status 기반 code를 함께 반환합니다.
+func errorJSON(c *fiber.Ctx, status int, message string) error {
+	return response.Error(c, status, response.StatusCode(status), message)
+}
+
+// errorJSONCode는 상태코드 매핑과 다른 명시 코드가 필요할 때 사용합니다.
+func errorJSONCode(c *fiber.Ctx, status int, code, message string) error {
+	return response.Error(c, status, code, message)
+}
--- a/backend/internal/middleware/rbac.go
+++ b/backend/internal/middleware/rbac.go
@@ -25,7 +25,7 @@ func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.
 	return func(c *fiber.Ctx) error {
 		profile, err := config.AuthHandler.GetEnrichedProfile(c)
 		if err != nil {
-			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized (trace:rbac_keto)"})
+			return errorJSON(c, fiber.StatusUnauthorized, "unauthorized (trace:rbac_keto)")
 		}

 		// Store profile in locals for further use in handlers
@@ -49,7 +49,7 @@ func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.

 		if objectID == "" {
 			slog.Error("RBAC Keto check failed: missing object id", "path", c.Path())
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "missing object id for permission check"})
+			return errorJSON(c, fiber.StatusBadRequest, "missing object id for permission check")
 		}

 		slog.Info("Performing Keto permission check", "userID", profile.ID, "namespace", namespace, "objectID", objectID, "relation", relation)
@@ -63,12 +63,12 @@ func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.
 		allowed, err := config.KetoService.CheckPermission(c.Context(), profile.ID, namespace, objectID, relation)
 		if err != nil {
 			slog.Error("Keto service error", "error", err, "userID", profile.ID, "objectID", objectID)
-			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "permission check error"})
+			return errorJSON(c, fiber.StatusInternalServerError, "permission check error")
 		}

 		if !allowed {
 			slog.Warn("Keto permission denied", "userID", profile.ID, "namespace", namespace, "objectID", objectID, "relation", relation)
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: keto permission denied for " + namespace + ":" + objectID})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: keto permission denied for "+namespace+":"+objectID)
 		}

 		return c.Next()
@@ -85,9 +85,7 @@ func RequireRole(config RBACConfig) fiber.Handler {

 		profile, err := config.AuthHandler.GetEnrichedProfile(c)
 		if err != nil {
-			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
-				"error": "unauthorized (trace:rbac_role): " + err.Error(),
-			})
+			return errorJSON(c, fiber.StatusUnauthorized, "unauthorized (trace:rbac_role): "+err.Error())
 		}

 		// Store profile in locals for further use in handlers
@@ -114,9 +112,7 @@ func RequireRole(config RBACConfig) fiber.Handler {
 				"allowedRoles", config.AllowedRoles,
 				"path", c.Path(),
 			)
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
-				"error": "forbidden: insufficient permissions",
-			})
+			return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions")
 		}

 		// Store profile in locals for further use in handlers
@@ -136,7 +132,7 @@ func RequireTenantMatch(config RBACConfig) fiber.Handler {

 		profile, err := config.AuthHandler.GetEnrichedProfile(c)
 		if err != nil {
-			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized (trace:rbac_match)"})
+			return errorJSON(c, fiber.StatusUnauthorized, "unauthorized (trace:rbac_match)")
 		}

 		// Store profile in locals for further use in handlers
@@ -174,13 +170,11 @@ func RequireTenantMatch(config RBACConfig) fiber.Handler {

 			if !isAllowed {
 				slog.Warn("Tenant match failed", "userID", profile.ID, "targetTenantID", targetTenantID)
-				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
-					"error": "forbidden: you do not have access to this tenant",
-				})
+				return errorJSON(c, fiber.StatusForbidden, "forbidden: you do not have access to this tenant")
 			}
 			return c.Next()
 		}

-		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden"})
+		return errorJSON(c, fiber.StatusForbidden, "forbidden")
 	}
 }
--- a/docs/AGENTS.md
+++ b/docs/AGENTS.md
@@ -48,10 +48,19 @@
 - 환경 변수 추가/변경 시
  - `.env.sample` 반영
  - 문서/가이드 갱신
+  - 클라이언트 로그 정책 영향 확인 (`CLIENT_LOG_DEBUG`, `USERFRONT_DEBUG_LOG`)

 - 배포/운영 변경 시
  - `Makefile`/compose 실행 절차 영향 확인
  - 최소 Smoke 테스트 수행
+  - 로그 수집 레벨이 운영 기본 정책(`WARN/ERROR`)을 유지하는지 확인
+
+## 클라이언트 로그 정책
+- 상세 정책은 `docs/client-log-policy.md`를 기준으로 유지합니다.
+- 원칙:
+  - 운영 기본값은 `WARN/ERROR`만 수집
+  - 운영 디버그는 `CLIENT_LOG_DEBUG=true`로만 일시 허용
+  - 민감정보 마스킹은 환경과 무관하게 항상 적용

 ## 테스트 참고
 - 테스트 계획 및 수동 실행 기준은 `docs/test-plan.md`를 따른다.
--- a/docs/client-log-policy.md
+++ b/docs/client-log-policy.md
@@ -0,0 +1,67 @@
+# Client Log Policy
+
+## 1. 목적
+- 운영 환경에서 클라이언트 로그를 최소권한으로 수집하고, 민감정보 유출을 방지합니다.
+- 장애 분석이 필요한 경우에만 명시적 디버그 옵션으로 로그 레벨을 확장합니다.
+
+## 2. 환경별 수집 정책
+
+### 2.1 기준 변수
+- `APP_ENV`
+- `CLIENT_LOG_DEBUG`
+- (UserFront fallback) `USERFRONT_DEBUG_LOG`
+
+### 2.2 동작 매트릭스
+- `APP_ENV != production|prod`
+  - 클라이언트 로그: `DEBUG/INFO/WARN/ERROR` 수집 허용
+- `APP_ENV == production|prod` AND `CLIENT_LOG_DEBUG` 미설정
+  - 클라이언트 로그: `WARN/ERROR`만 수집
+  - `INFO` 네비게이션 노이즈 로그는 필터
+- `APP_ENV == production|prod` AND `CLIENT_LOG_DEBUG=true|1|on|yes`
+  - 클라이언트 로그: `DEBUG/INFO/WARN/ERROR` 수집 허용
+
+## 3. 민감정보 마스킹 규칙
+
+### 3.1 Key 기반 마스킹
+아래 키는 값 전체를 `*****`로 치환합니다.
+- `password`, `currentPassword`, `newPassword`, `oldPassword`
+- `token`, `accessToken`, `refreshToken`
+- `secret`, `clientSecret`
+- `authorization`, `cookie`, `setCookie`
+- `verificationCode`, `code`
+- `loginChallenge`, `loginVerifier`
+- `sessionJwt`, `accessJwt`, `refreshJwt`
+
+### 3.2 문자열 패턴 마스킹
+메시지 본문에서도 아래 패턴을 마스킹합니다.
+- `token=...`
+- `authorization:...` 또는 `authorization=...`
+- JSON 문자열 내 민감 key/value
+
+## 4. 구현 위치
+- Backend
+  - 정책/마스킹 로직: `backend/internal/logger/client_log_policy.go`
+  - 수집 엔드포인트 적용: `backend/cmd/server/main.go` (`POST /api/v1/client-log`)
+- UserFront
+  - 정책/마스킹 로직: `userfront/lib/core/services/log_policy.dart`
+  - 로그 출력/전송 정책: `userfront/lib/core/services/logger_service.dart`
+  - 전송 직전 마스킹: `userfront/lib/core/services/auth_proxy_service.dart`
+
+## 5. 검증
+
+### 5.1 Backend
+```bash
+cd backend
+go test ./internal/logger -count=1
+go test ./cmd/server -count=1
+```
+
+### 5.2 UserFront
+```bash
+cd userfront
+flutter test test/log_policy_test.dart
+```
+
+## 6. 운영 가이드
+- 운영에서 디버그 로그가 필요하면 `CLIENT_LOG_DEBUG=true`를 명시적으로 설정하고, 이슈 해결 후 즉시 원복합니다.
+- 운영에서도 민감정보 마스킹은 항상 강제되며 비활성화할 수 없습니다.
--- a/docs/test-plan.md
+++ b/docs/test-plan.md
@@ -13,6 +13,7 @@
  - Backend(Go): **104개**
  - UserFront(Flutter): **47개**
  - AdminFront/DevFront(Playwright): **4개**
+  - UserFront WASM Playwright E2E: **42개**

 ### Backend 패키지별 커버리지
 - `cmd/server`: 2.6%
@@ -29,6 +30,7 @@
 - UserFront 테스트 전수 목록: `docs/test-plan/userfront-test-inventory.md`
 - AdminFront/DevFront E2E 전수 목록: `docs/test-plan/web-e2e-test-inventory.md`
 - UserFront WASM Playwright E2E 확장 계획: `docs/test-plan/userfront-wasm-e2e-expansion-plan.md`
+- UserFront WASM Playwright E2E 전수 목록: `docs/test-plan/userfront-wasm-e2e-route-inventory.md`

 ## 4) 실행 커맨드
 - Backend 전체 테스트: `cd backend && go test ./...`
@@ -36,7 +38,8 @@
 - UserFront 테스트: `cd userfront && flutter test`
 - AdminFront E2E: `cd adminfront && npm test`
 - DevFront E2E: `cd devfront && npm test`
- UserFront WASM E2E(계획): `docs/test-plan/userfront-wasm-e2e-expansion-plan.md` 기준으로 Playwright 워크스페이스를 추가한 뒤 실행
+- UserFront WASM E2E: `cd userfront-e2e && npm run test:wasm`
+- UserFront WASM E2E(테스트만): `cd userfront-e2e && npm test`

 ## 5) 유지 원칙
 - 신규 기능은 관련 테스트를 반드시 추가합니다.
--- a/docs/test-plan/userfront-wasm-e2e-expansion-plan.md
+++ b/docs/test-plan/userfront-wasm-e2e-expansion-plan.md
@@ -58,12 +58,46 @@
 - 범위 6 구현
 - null-check 복구 라우팅 검증

-## 4) 완료 기준
+## 4) 현재 구현 상태 (2026-02-24)
+- Phase 0: 완료
+  - `userfront-e2e/` 워크스페이스 추가
+  - 로컬 SPA fallback 서버(`scripts/serve-userfront-build.mjs`) 추가
+  - 실행 커맨드: `cd userfront-e2e && npm run test:wasm`
+  - CI 잡 연결: `.gitea/workflows/code_check.yml`의 `userfront-e2e-tests`
+- Phase 1: 완료
+  - `tests/auth-routing.spec.ts` 추가
+  - 구현 시나리오:
+    - 비로그인 `/ko` → `/ko/signin` 리다이렉트
+    - 로그인 상태 `/ko` 진입 + 새로고침 후 `/ko/dashboard` 유지
+    - 비로그인 `/ko/approve?ref=...` 진입 시 `notice=qr_login_required`와 함께 signin 이동
+    - 로그인 상태 `/ko/approve?ref=...`에서 approve API 호출 후 dashboard 이동
+- Phase 2: 완료
+  - `tests/password-and-reset.spec.ts` 추가
+  - 구현 시나리오:
+    - 비밀번호 로그인 성공 시 dashboard 이동 + 토큰 저장 확인
+    - 비밀번호 로그인 실패 시 코드 기반 에러(`password_or_email_mismatch`)가 client-log로 기록되는지 확인
+    - reset-password 성공 시 signin 이동 확인
+  - 참고:
+    - WASM 렌더링에서는 접근성/DOM selector가 제한되어 로그인/리셋 폼은 `flt-glass-pane` 좌표 기반 입력으로 검증
+  - 전수 인벤토리:
+    - `docs/test-plan/userfront-wasm-e2e-route-inventory.md`
+    - 라우트 22개 + 기능 회귀 12개(총 42 테스트) 코드화 완료
+  - 프로필 소속 회귀 강화:
+    - `tests/profile-department.spec.ts` 추가
+    - 구현 시나리오:
+      - 소속 수정 후 blur 저장 요청 전송
+      - 입력 후 즉시 새로고침 시 저장 요청 미전송 재현
+      - 동일값/빈값 입력 시 저장 요청 미전송
+      - 수정 후 새로고침 뒤 재수정 저장 요청 누락 방지
+
+## 5) 완료 기준
 - 핵심 인증 플로우(로그인/새로고침/리다이렉트/QR)가 Playwright 회귀군으로 자동화됩니다.
 - 프로덕션 이슈 재발 건은 재현 테스트가 먼저 추가됩니다.
 - PR에서 E2E 결과 링크(성공/실패 로그) 확인이 가능합니다.

-## 5) 운영 원칙
+## 6) 운영 원칙
 - 버그는 반드시 재현 테스트를 먼저 추가합니다.
 - 재현 테스트가 실패하는 상태를 확인한 뒤 수정합니다.
 - 수정 후 동일 테스트를 반복 실행해 안정 통과까지 완료합니다.
+- 테스트 하네스는 단계별로 초기화/정리합니다.
+  - 예: `beforeEach`에서 auth/mock state 재시드, `afterEach`에서 route mock 해제(`page.unroute`) 및 누수 상태 정리
--- a/docs/test-plan/userfront-wasm-e2e-route-inventory.md
+++ b/docs/test-plan/userfront-wasm-e2e-route-inventory.md
@@ -0,0 +1,59 @@
+# UserFront WASM E2E 라우트/기능 전수 인벤토리
+
+- 기준 소스: `userfront/lib/main.dart`
+- 목적: 라우트 전수 항목을 Playwright 테스트로 코드화하고 CI에서 상시 검증
+- 현재 구현 파일:
+  - `userfront-e2e/tests/route-inventory.spec.ts`
+  - `userfront-e2e/tests/auth-routing.spec.ts`
+  - `userfront-e2e/tests/password-and-reset.spec.ts`
+  - `userfront-e2e/tests/profile-department.spec.ts`
+
+## 1) 라우트 전수 (main.dart 기준)
+
+| ID | Route | 검증 상태 | 테스트 파일 |
+|---|---|---|---|
+| R01 | `/` | 비로그인 시 `/{locale}/signin` 리다이렉트 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R02 | `/:locale` (`/ko`) | 비로그인 `signin` / 로그인 `dashboard` 분기 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts`, `userfront-e2e/tests/auth-routing.spec.ts` |
+| R03 | `/:locale/dashboard` | 비로그인 `signin` / 로그인 유지 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts`, `userfront-e2e/tests/auth-routing.spec.ts` |
+| R04 | `/:locale/profile` | 비로그인 `signin` / 로그인 유지 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R05 | `/:locale/signin` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R06 | `/:locale/login` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R07 | `/:locale/consent` | challenge 유무 케이스 진입 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R08 | `/:locale/signup` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R09 | `/:locale/registration` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R10 | `/:locale/verify` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R11 | `/:locale/verify/:token` | verify 경로 진입/처리 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R12 | `/:locale/verification` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R13 | `/:locale/l/:shortCode` | short code 경로 진입/처리 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R14 | `/:locale/forgot-password` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R15 | `/:locale/recovery` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R16 | `/:locale/reset-password` | token 기반 진입 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts`, `userfront-e2e/tests/password-and-reset.spec.ts` |
+| R17 | `/:locale/error` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R18 | `/:locale/settings` | 진입 가능 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R19 | `/:locale/approve` | 비로그인 `signin?notice=...` / 로그인 `dashboard` 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts`, `userfront-e2e/tests/auth-routing.spec.ts` |
+| R20 | `/:locale/ql/:ref` | 비로그인 `signin?notice=...` / 로그인 `dashboard` 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R21 | `/:locale/scan` | 비로그인 `signin` / 로그인 진입 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+| R22 | `/:locale/admin/users` | 비로그인 `signin` / 로그인 진입 검증 완료 | `userfront-e2e/tests/route-inventory.spec.ts` |
+
+## 2) 기능 회귀 (핵심)
+
+| ID | 기능 | 검증 상태 | 테스트 파일 |
+|---|---|---|---|
+| F01 | `/ko` 비로그인 리다이렉트 | 완료 | `userfront-e2e/tests/auth-routing.spec.ts` |
+| F02 | 로그인 후 `/ko` + 새로고침 세션 유지 | 완료 | `userfront-e2e/tests/auth-routing.spec.ts` |
+| F03 | approve 경로 비로그인 보호 | 완료 | `userfront-e2e/tests/auth-routing.spec.ts` |
+| F04 | approve 경로 로그인 자동 승인 | 완료 | `userfront-e2e/tests/auth-routing.spec.ts` |
+| F05 | 비밀번호 로그인 성공 | 완료 | `userfront-e2e/tests/password-and-reset.spec.ts` |
+| F06 | 비밀번호 로그인 실패 코드 처리 | 완료 | `userfront-e2e/tests/password-and-reset.spec.ts` |
+| F07 | 비밀번호 재설정 완료 후 signin 이동 | 완료 | `userfront-e2e/tests/password-and-reset.spec.ts` |
+| F08 | 프로필 소속 수정 후 blur 저장 요청 전송 | 완료 | `userfront-e2e/tests/profile-department.spec.ts` |
+| F09 | 프로필 소속 입력 후 즉시 새로고침 시 저장 요청 미전송(재현) | 완료 | `userfront-e2e/tests/profile-department.spec.ts` |
+| F10 | 프로필 소속 동일값 입력 시 저장 요청 미전송 | 완료 | `userfront-e2e/tests/profile-department.spec.ts` |
+| F11 | 프로필 소속 빈값 입력 시 저장 요청 미전송 | 완료 | `userfront-e2e/tests/profile-department.spec.ts` |
+| F12 | 프로필 소속 수정 후 새로고침 뒤 재수정 저장 요청 누락 방지 | 완료 | `userfront-e2e/tests/profile-department.spec.ts` |
+
+## 3) 실행/CI
+
+- 로컬 실행: `cd userfront-e2e && npm run test:wasm`
+- CI 워크플로우: `.gitea/workflows/code_check.yml`의 `userfront-e2e-tests` 잡에서 매 실행 검증
+- 현재 스위트 수량: 총 42 테스트(라우트 30 + 인증/리다이렉트 4 + 비밀번호/리셋 3 + 프로필 소속 5)
--- a/docs/trouble-shooting/issue-303-login-link-shortcode-locale-route.md
+++ b/docs/trouble-shooting/issue-303-login-link-shortcode-locale-route.md
@@ -0,0 +1,47 @@
+# #303 로그인 링크/코드 진입 실패 (`/{locale}/l/{shortCode}`) 대응
+
+## 요약
+- 로그인 링크 발송은 정상이나, 링크 클릭 후 로그인 검증 진입이 실패하는 사례가 있었습니다.
+- 특히 locale prefix가 포함된 short-code 경로(`/{locale}/l/{shortCode}`)에서 재현되었습니다.
+- 원인은 라우터의 public path 판별과 short-code 추출 로직이 locale prefix 경로를 고려하지 못한 점이었습니다.
+
+## 증상
+- 링크 클릭 URL이 `https://.../ko/l/AB123456` 형태일 때 로그인 검증이 자동 시작되지 않음
+- 비로그인 상태에서 해당 경로 접근 시 signin으로 리다이렉트되어 short-code 검증이 끊김
+
+## 원인
+1. Public path 판별에서 `/l/` 경로가 제외되어 있었음
+2. `LoginScreen`의 short-code 추출이 `uri.pathSegments.first == 'l'`에만 의존
+   - `/{locale}/l/{shortCode}`에서는 첫 세그먼트가 locale이므로 추출 실패
+
+## 조치 내용
+1. 경로 정책 분리
+- `userfront/lib/features/auth/domain/login_link_route_policy.dart` 신규 추가
+- public path 판별(`isPublicAuthPath`)과 short-code 추출(`extractLoginShortCode`)을 공용화
+
+2. 라우터 반영
+- `userfront/lib/main.dart` redirect에서 `isPublicAuthPath` 사용
+- `/l/` 경로를 public path로 허용
+
+3. 로그인 화면 반영
+- `userfront/lib/features/auth/presentation/login_screen.dart`에서
+  `extractLoginShortCode(Uri.base)`로 short-code를 추출하도록 변경
+- locale prefix 유무와 관계없이 short-code 검증 진입 가능
+
+## 테스트
+### 재현 테스트 (Failing first)
+- `flutter test test/login_link_route_policy_test.dart`
+- 초기 실패 확인:
+  - localized short-code 추출 실패
+  - localized short-code public path 판별 실패
+
+### 수정 후 회귀 테스트
+- `flutter test test/login_link_route_policy_test.dart` 통과
+- `flutter test test/router_redirect_widget_test.dart` 통과
+
+## 영향 범위
+- 링크/코드 로그인 진입 라우팅 (`/l/{shortCode}` 및 `/{locale}/l/{shortCode}`)
+- 기존 `/verify`, `/signin`, `/login` 경로에는 동작 변화 없음
+
+## 관련 이슈
+- Gitea: #303 `[bug][auth] 링크 클릭/코드 입력 로그인 실패 재현 및 수정`
--- a/locales/en.toml
+++ b/locales/en.toml
@@ -24,6 +24,24 @@ user_group = "User Group"
 [err.common]
 unknown = "An unknown error occurred."

+[err.backend]
+authorization_pending = "Authentication approval is still pending."
+bad_request = "Please check your request."
+conflict = "The request conflicts with the current state."
+expired_token = "The token has expired."
+forbidden = "This request is not allowed."
+internal_error = "An internal error occurred while processing the request."
+invalid_code = "The verification code is invalid."
+invalid_or_expired_code = "The verification code is invalid or expired."
+invalid_session = "The session is invalid."
+invalid_session_reference = "The session reference is invalid."
+not_found = "The requested authentication flow was not found."
+not_supported = "This login method is not supported."
+password_or_email_mismatch = "Email or password does not match."
+rate_limited = "Too many requests. Please try again later."
+service_unavailable = "The authentication service is currently unavailable."
+slow_down = "Requests are too frequent. Please try again shortly."
+
 [err.userfront]

 [err.userfront.auth_proxy]
--- a/locales/ko.toml
+++ b/locales/ko.toml
@@ -24,6 +24,24 @@ user_group = "USER_GROUP (내부 부서/팀)"
 [err.common]
 unknown = "알 수 없는 오류가 발생했습니다."

+[err.backend]
+authorization_pending = "인증 승인이 아직 완료되지 않았습니다."
+bad_request = "요청 값을 확인해 주세요."
+conflict = "요청이 현재 상태와 충돌합니다."
+expired_token = "토큰이 만료되었습니다."
+forbidden = "요청이 허용되지 않습니다."
+internal_error = "요청 처리 중 내부 오류가 발생했습니다."
+invalid_code = "인증 코드가 올바르지 않습니다."
+invalid_or_expired_code = "인증 코드가 유효하지 않거나 만료되었습니다."
+invalid_session = "세션이 유효하지 않습니다."
+invalid_session_reference = "세션 참조 정보가 유효하지 않습니다."
+not_found = "요청한 인증 흐름을 찾을 수 없습니다."
+not_supported = "지원하지 않는 로그인 방식입니다."
+password_or_email_mismatch = "이메일 혹은 비밀번호가 일치하지 않습니다."
+rate_limited = "요청이 너무 많습니다. 잠시 후 다시 시도해 주세요."
+service_unavailable = "인증 서비스를 현재 사용할 수 없습니다."
+slow_down = "요청 간격이 너무 빠릅니다. 잠시 후 다시 시도해 주세요."
+
 [err.userfront]

 [err.userfront.auth_proxy]
--- a/locales/template.toml
+++ b/locales/template.toml
@@ -18,6 +18,24 @@ saman = ""
 [err.common]
 unknown = ""

+[err.backend]
+authorization_pending = ""
+bad_request = ""
+conflict = ""
+expired_token = ""
+forbidden = ""
+internal_error = ""
+invalid_code = ""
+invalid_or_expired_code = ""
+invalid_session = ""
+invalid_session_reference = ""
+not_found = ""
+not_supported = ""
+password_or_email_mismatch = ""
+rate_limited = ""
+service_unavailable = ""
+slow_down = ""
+
 [err.userfront]

 [err.userfront.auth_proxy]
--- a/userfront-e2e/.gitignore
+++ b/userfront-e2e/.gitignore
@@ -0,0 +1,3 @@
+node_modules/
+playwright-report/
+test-results/
--- a/userfront-e2e/README.md
+++ b/userfront-e2e/README.md
@@ -0,0 +1,29 @@
+# UserFront WASM E2E
+
+`userfront` WASM 빌드 산출물을 Playwright로 검증하는 테스트 워크스페이스입니다.
+
+## 실행 방법
+
+1. 의존성 설치
+```bash
+cd userfront-e2e
+npm install
+```
+
+2. 테스트 실행(빌드 포함)
+```bash
+cd userfront-e2e
+npm run test:wasm
+```
+
+3. 이미 빌드가 있을 때 테스트만 실행
+```bash
+cd userfront-e2e
+npm test
+```
+
+## 환경변수
+
+- `BASE_URL`: 외부 배포 URL을 테스트할 때 사용합니다. 설정하면 로컬 정적 서버를 띄우지 않습니다.
+- `PORT`: 로컬 정적 서버 포트 (기본 `4173`)
+- `LOCALE`: 브라우저 locale (기본 `ko-KR`)
--- a/userfront-e2e/package-lock.json
+++ b/userfront-e2e/package-lock.json
@@ -0,0 +1,111 @@
+{
+  "name": "userfront-e2e",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "userfront-e2e",
+      "version": "0.1.0",
+      "devDependencies": {
+        "@playwright/test": "^1.58.2",
+        "@types/node": "^24.3.0",
+        "typescript": "^5.9.2"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "24.10.13",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.13.tgz",
+      "integrity": "sha512-oH72nZRfDv9lADUBSo104Aq7gPHpQZc4BTx38r9xf9pg5LfP6EzSyH2n7qFmmxRQXh7YlUXODcYsg6PuTDSxGg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~7.16.0"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
+      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "dev": true,
+      "license": "MIT"
+    }
+  }
+}
--- a/userfront-e2e/package.json
+++ b/userfront-e2e/package.json
@@ -0,0 +1,18 @@
+{
+  "name": "userfront-e2e",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "test": "playwright test",
+    "test:ui": "playwright test --ui",
+    "serve:build": "node ./scripts/serve-userfront-build.mjs",
+    "build:userfront:wasm": "cd ../userfront && flutter build web --wasm --release",
+    "test:wasm": "npm run build:userfront:wasm && npm test"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.58.2",
+    "@types/node": "^24.3.0",
+    "typescript": "^5.9.2"
+  }
+}
--- a/userfront-e2e/playwright.config.ts
+++ b/userfront-e2e/playwright.config.ts
@@ -0,0 +1,39 @@
+import { defineConfig, devices } from '@playwright/test';
+
+const port = Number.parseInt(process.env.PORT ?? '4173', 10);
+const defaultBaseUrl = `http://127.0.0.1:${port}`;
+const baseURL = process.env.BASE_URL ?? defaultBaseUrl;
+const reuseExistingServer = !process.env.CI;
+
+export default defineConfig({
+  testDir: './tests',
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 1 : undefined,
+  reporter: process.env.CI ? [['html', { open: 'never' }], ['list']] : 'html',
+  use: {
+    baseURL,
+    trace: 'on-first-retry',
+    screenshot: 'only-on-failure',
+    video: 'retain-on-failure',
+    locale: process.env.LOCALE ?? 'ko-KR',
+    serviceWorkers: 'block',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: {
+        ...devices['Desktop Chrome'],
+      },
+    },
+  ],
+  webServer: process.env.BASE_URL
+    ? undefined
+    : {
+        command: 'node ./scripts/serve-userfront-build.mjs',
+        url: defaultBaseUrl,
+        reuseExistingServer,
+        timeout: 120_000,
+      },
+});
--- a/userfront-e2e/scripts/serve-userfront-build.mjs
+++ b/userfront-e2e/scripts/serve-userfront-build.mjs
@@ -0,0 +1,68 @@
+import { createReadStream, existsSync, statSync } from 'node:fs';
+import { dirname, extname, join, normalize } from 'node:path';
+import { createServer } from 'node:http';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const root = normalize(join(__dirname, '../../userfront/build/web'));
+
+if (!existsSync(root) || !statSync(root).isDirectory()) {
+  console.error(
+    '[userfront-e2e] userfront/build/web not found. Run: cd userfront && flutter build web --wasm --release',
+  );
+  process.exit(1);
+}
+
+const port = Number.parseInt(process.env.PORT ?? '4173', 10);
+
+const contentTypes = {
+  '.css': 'text/css; charset=utf-8',
+  '.html': 'text/html; charset=utf-8',
+  '.ico': 'image/x-icon',
+  '.js': 'application/javascript; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.mjs': 'application/javascript; charset=utf-8',
+  '.png': 'image/png',
+  '.svg': 'image/svg+xml; charset=utf-8',
+  '.txt': 'text/plain; charset=utf-8',
+  '.wasm': 'application/wasm',
+  '.webmanifest': 'application/manifest+json; charset=utf-8',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+};
+
+const server = createServer((req, res) => {
+  const url = new URL(req.url ?? '/', 'http://localhost');
+  const pathname = decodeURIComponent(url.pathname);
+  const relative = pathname === '/' ? '/index.html' : pathname;
+  const candidate = normalize(join(root, relative));
+
+  if (!candidate.startsWith(root)) {
+    res.statusCode = 403;
+    res.end('Forbidden');
+    return;
+  }
+
+  let filePath = candidate;
+
+  if (!existsSync(filePath) || statSync(filePath).isDirectory()) {
+    // Flutter web 라우팅 경로(`/ko`, `/ko/signin`)도 index.html로 fallback 처리
+    filePath = join(root, 'index.html');
+  }
+
+  const ext = extname(filePath);
+  const contentType = contentTypes[ext] ?? 'application/octet-stream';
+
+  res.setHeader('Content-Type', contentType);
+  createReadStream(filePath)
+    .on('error', () => {
+      res.statusCode = 500;
+      res.end('Internal Server Error');
+    })
+    .pipe(res);
+});
+
+server.listen(port, '127.0.0.1', () => {
+  console.log(`[userfront-e2e] serving ${root} at http://127.0.0.1:${port}`);
+});
--- a/userfront-e2e/tests/auth-routing.spec.ts
+++ b/userfront-e2e/tests/auth-routing.spec.ts
@@ -0,0 +1,143 @@
+import { expect, test, type Page, type Route } from '@playwright/test';
+
+type MockOptions = {
+  sessionStatus?: number;
+  captureApprove?: (pendingRef: string | null) => void;
+};
+
+async function seedTokenLogin(page: Page): Promise<void> {
+  await page.addInitScript(() => {
+    window.localStorage.setItem('baron_auth_token', 'e30.e30.e30');
+    window.localStorage.setItem('baron_auth_provider', 'ory');
+    window.localStorage.removeItem('baron_auth_cookie_mode');
+    window.localStorage.removeItem('baron_auth_pending_provider');
+  });
+}
+
+async function mockUserfrontApis(
+  page: Page,
+  options: MockOptions = {},
+): Promise<void> {
+  const sessionStatus = options.sessionStatus ?? 200;
+
+  await page.route('**/api/v1/**', async (route: Route) => {
+    const requestUrl = new URL(route.request().url());
+    const path = requestUrl.pathname;
+
+    if (path.endsWith('/api/v1/user/me')) {
+      if (sessionStatus === 200) {
+        await route.fulfill({
+          status: 200,
+          contentType: 'application/json',
+          body: JSON.stringify({
+            id: 'e2e-user',
+            email: 'e2e@example.com',
+            name: 'E2E User',
+            phone: '+821012341234',
+            department: 'QA',
+            affiliationType: 'employee',
+            companyCode: 'BARON',
+            tenant: {
+              id: 'tenant-1',
+              name: 'Baron',
+              slug: 'baron',
+              description: 'E2E tenant',
+            },
+          }),
+        });
+        return;
+      }
+
+      await route.fulfill({
+        status: sessionStatus,
+        contentType: 'application/json',
+        body: JSON.stringify({ error: 'unauthorized' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/user/rp/linked')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [] }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/audit/auth/timeline')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [], next_cursor: '' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/qr/approve')) {
+      const body = route.request().postDataJSON() as { pendingRef?: string };
+      options.captureApprove?.(body.pendingRef ?? null);
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ ok: true }),
+      });
+      return;
+    }
+
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({}),
+    });
+  });
+}
+
+test.describe('UserFront WASM auth routing', () => {
+  test('비로그인 /ko 진입 시 /ko/signin 으로 리다이렉트된다', async ({ page }) => {
+    await mockUserfrontApis(page, { sessionStatus: 401 });
+
+    await page.goto('/ko');
+
+    await expect(page).toHaveURL(/\/ko\/signin(?:\?.*)?$/);
+  });
+
+  test('로그인 상태 /ko 진입 후 새로고침해도 /ko/dashboard 를 유지한다', async ({
+    page,
+  }) => {
+    await seedTokenLogin(page);
+    await mockUserfrontApis(page);
+
+    await page.goto('/ko');
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+
+    await page.reload();
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+  });
+
+  test('비로그인 /ko/approve 는 signin(+notice)으로 이동한다', async ({ page }) => {
+    await mockUserfrontApis(page, { sessionStatus: 401 });
+
+    await page.goto('/ko/approve?ref=e2e-ref');
+
+    await expect(page).toHaveURL(/\/ko\/signin\?notice=qr_login_required$/);
+  });
+
+  test('로그인 상태 /ko/approve 는 승인 API 호출 후 dashboard로 이동한다', async ({
+    page,
+  }) => {
+    let approvedRef: string | null = null;
+
+    await seedTokenLogin(page);
+    await mockUserfrontApis(page, {
+      captureApprove: (pendingRef) => {
+        approvedRef = pendingRef;
+      },
+    });
+
+    await page.goto('/ko/approve?ref=e2e-approve-ref');
+
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+    expect(approvedRef).toBe('e2e-approve-ref');
+  });
+});
--- a/userfront-e2e/tests/password-and-reset.spec.ts
+++ b/userfront-e2e/tests/password-and-reset.spec.ts
@@ -0,0 +1,257 @@
+import { expect, test, type Page, type Route } from '@playwright/test';
+
+type RequestCapture = {
+  loginBody?: Record<string, unknown>;
+  resetBody?: Record<string, unknown>;
+  resetToken?: string | null;
+  clientLogs: string[];
+};
+
+const SIGNIN_PASSWORD_TAB_X = 522;
+const SIGNIN_TAB_Y = 158;
+const SIGNIN_LOGIN_ID_X = 640;
+const SIGNIN_LOGIN_ID_Y = 245;
+const SIGNIN_PASSWORD_X = 640;
+const SIGNIN_PASSWORD_Y = 311;
+const SIGNIN_SUBMIT_X = 640;
+const SIGNIN_SUBMIT_Y = 381;
+
+const RESET_NEW_PASSWORD_X = 640;
+const RESET_NEW_PASSWORD_Y = 401;
+const RESET_CONFIRM_PASSWORD_X = 640;
+const RESET_CONFIRM_PASSWORD_Y = 464;
+const RESET_SUBMIT_X = 640;
+const RESET_SUBMIT_Y = 534;
+
+async function clickPasswordTab(page: Page): Promise<void> {
+  await page.waitForTimeout(900);
+  const pane = page.locator('flt-glass-pane');
+  await pane.click({
+    position: { x: SIGNIN_PASSWORD_TAB_X, y: SIGNIN_TAB_Y },
+    force: true,
+  });
+  await page.waitForTimeout(120);
+  await pane.click({
+    position: { x: SIGNIN_PASSWORD_TAB_X, y: SIGNIN_TAB_Y },
+    force: true,
+  });
+  await page.waitForTimeout(200);
+}
+
+async function fillAt(page: Page, x: number, y: number, value: string): Promise<void> {
+  const pane = page.locator('flt-glass-pane');
+  await pane.click({ position: { x, y }, force: true });
+  await page.waitForTimeout(100);
+  await page.keyboard.press('Control+A');
+  await page.keyboard.press('Backspace');
+  await page.keyboard.type(value);
+}
+
+async function mockAuthApis(page: Page, capture: RequestCapture): Promise<void> {
+  await page.route('**/api/v1/**', async (route: Route) => {
+    const requestUrl = new URL(route.request().url());
+    const path = requestUrl.pathname;
+
+    if (path.endsWith('/api/v1/auth/password/login')) {
+      capture.loginBody = (route.request().postDataJSON() ?? {}) as Record<
+        string,
+        unknown
+      >;
+
+      const loginId = String(capture.loginBody.loginId ?? '');
+      const password = String(capture.loginBody.password ?? '');
+      if (loginId === 'e2e@example.com' && password === 'ValidPass1!') {
+        await route.fulfill({
+          status: 200,
+          contentType: 'application/json',
+          body: JSON.stringify({
+            sessionJwt: 'e30.e30.e30',
+            provider: 'ory',
+          }),
+        });
+        return;
+      }
+
+      await route.fulfill({
+        status: 401,
+        contentType: 'application/json',
+        body: JSON.stringify({ error: 'password_or_email_mismatch' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/password/policy')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          minLength: 12,
+          minCharacterTypes: 3,
+          lowercase: true,
+          uppercase: true,
+          number: true,
+          nonAlphanumeric: true,
+        }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/password/reset/complete')) {
+      capture.resetBody = (route.request().postDataJSON() ?? {}) as Record<
+        string,
+        unknown
+      >;
+      capture.resetToken = requestUrl.searchParams.get('token');
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ status: 'ok' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/client-log')) {
+      const payload = (route.request().postDataJSON() ?? {}) as {
+        message?: string;
+      };
+      if (payload.message != null) {
+        capture.clientLogs.push(payload.message);
+      }
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ ok: true }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/user/me')) {
+      const authHeader = route.request().headers()['authorization'] ?? '';
+      if (!authHeader.startsWith('Bearer ')) {
+        await route.fulfill({
+          status: 401,
+          contentType: 'application/json',
+          body: JSON.stringify({ error: 'unauthorized' }),
+        });
+        return;
+      }
+
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          id: 'e2e-user',
+          email: 'e2e@example.com',
+          name: 'E2E User',
+          phone: '+821012341234',
+          department: 'QA',
+          affiliationType: 'employee',
+          companyCode: 'BARON',
+          tenant: {
+            id: 'tenant-1',
+            name: 'Baron',
+            slug: 'baron',
+            description: 'E2E tenant',
+          },
+        }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/user/rp/linked')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [] }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/audit/auth/timeline')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [], next_cursor: '' }),
+      });
+      return;
+    }
+
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({}),
+    });
+  });
+}
+
+test.describe('UserFront WASM password login and reset', () => {
+  test('비밀번호 로그인 성공 시 dashboard로 이동하고 토큰을 저장한다', async ({ page }) => {
+    const capture: RequestCapture = { clientLogs: [] };
+    await mockAuthApis(page, capture);
+
+    await page.goto('/ko/signin');
+    await clickPasswordTab(page);
+    await fillAt(page, SIGNIN_LOGIN_ID_X, SIGNIN_LOGIN_ID_Y, 'e2e@example.com');
+    await fillAt(page, SIGNIN_PASSWORD_X, SIGNIN_PASSWORD_Y, 'ValidPass1!');
+    await page.locator('flt-glass-pane').click({
+      position: { x: SIGNIN_SUBMIT_X, y: SIGNIN_SUBMIT_Y },
+      force: true,
+    });
+
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+
+    expect(capture.loginBody?.loginId).toBe('e2e@example.com');
+    expect(capture.loginBody?.password).toBe('ValidPass1!');
+
+    const storedToken = await page.evaluate(() =>
+      window.localStorage.getItem('baron_auth_token'),
+    );
+    expect(storedToken).toBe('e30.e30.e30');
+  });
+
+  test('비밀번호 로그인 실패 시 에러 코드를 사용자에게 표시한다', async ({ page }) => {
+    const capture: RequestCapture = { clientLogs: [] };
+    await mockAuthApis(page, capture);
+
+    await page.goto('/ko/signin');
+    await clickPasswordTab(page);
+    await fillAt(page, SIGNIN_LOGIN_ID_X, SIGNIN_LOGIN_ID_Y, 'e2e@example.com');
+    await fillAt(page, SIGNIN_PASSWORD_X, SIGNIN_PASSWORD_Y, 'WrongPass1!');
+    await page.locator('flt-glass-pane').click({
+      position: { x: SIGNIN_SUBMIT_X, y: SIGNIN_SUBMIT_Y },
+      force: true,
+    });
+
+    await expect(page).toHaveURL(/\/ko\/signin$/);
+    await expect
+      .poll(() =>
+        capture.clientLogs.some((message) =>
+          message.includes('password_or_email_mismatch'),
+        ),
+      )
+      .toBe(true);
+  });
+
+  test('reset-password에서 변경 성공 시 signin으로 이동한다', async ({ page }) => {
+    const capture: RequestCapture = { clientLogs: [] };
+    await mockAuthApis(page, capture);
+
+    await page.goto('/ko/reset-password?token=reset-token-e2e');
+    await page.waitForTimeout(900);
+    await fillAt(page, RESET_NEW_PASSWORD_X, RESET_NEW_PASSWORD_Y, 'ValidPass1!A');
+    await fillAt(
+      page,
+      RESET_CONFIRM_PASSWORD_X,
+      RESET_CONFIRM_PASSWORD_Y,
+      'ValidPass1!A',
+    );
+    await page.locator('flt-glass-pane').click({
+      position: { x: RESET_SUBMIT_X, y: RESET_SUBMIT_Y },
+      force: true,
+    });
+
+    await expect(page).toHaveURL(/\/ko\/signin$/);
+    expect(capture.resetToken).toBe('reset-token-e2e');
+    expect(capture.resetBody?.newPassword).toBe('ValidPass1!A');
+  });
+});
--- a/userfront-e2e/tests/profile-department.spec.ts
+++ b/userfront-e2e/tests/profile-department.spec.ts
@@ -0,0 +1,275 @@
+import { expect, test, type Page, type Route } from '@playwright/test';
+
+type ProfileState = {
+  department: string;
+  getMeCount: number;
+  putBodies: Array<Record<string, unknown>>;
+};
+
+const PROFILE_DEPARTMENT_EDIT_X = 1170;
+const PROFILE_DEPARTMENT_EDIT_Y = 680;
+const PROFILE_DEPARTMENT_INPUT_X = 110;
+const PROFILE_DEPARTMENT_INPUT_Y = 685;
+const PROFILE_BLUR_X = 200;
+const PROFILE_BLUR_Y = 260;
+
+async function seedTokenLogin(page: Page): Promise<void> {
+  await page.addInitScript(() => {
+    window.localStorage.setItem('baron_auth_token', 'e30.e30.e30');
+    window.localStorage.setItem('baron_auth_provider', 'ory');
+    window.localStorage.removeItem('baron_auth_cookie_mode');
+    window.localStorage.removeItem('baron_auth_pending_provider');
+  });
+}
+
+async function fillAt(page: Page, x: number, y: number, value: string): Promise<void> {
+  const pane = page.locator('flt-glass-pane');
+  await pane.click({ position: { x, y }, force: true });
+  await page.waitForTimeout(100);
+  await page.keyboard.press('Control+A');
+  await page.keyboard.press('Backspace');
+  await page.keyboard.type(value);
+}
+
+async function openDepartmentEditor(page: Page): Promise<void> {
+  await page.locator('flt-glass-pane').click({
+    position: { x: PROFILE_DEPARTMENT_EDIT_X, y: PROFILE_DEPARTMENT_EDIT_Y },
+    force: true,
+  });
+  await page.waitForTimeout(200);
+}
+
+async function blurDepartmentEditor(page: Page): Promise<void> {
+  await page.locator('flt-glass-pane').click({
+    position: { x: PROFILE_BLUR_X, y: PROFILE_BLUR_Y },
+    force: true,
+  });
+  await page.waitForTimeout(250);
+}
+
+async function mockProfileApis(page: Page, state: ProfileState): Promise<void> {
+  await page.route('**/api/v1/**', async (route: Route) => {
+    const request = route.request();
+    const requestUrl = new URL(request.url());
+    const path = requestUrl.pathname;
+    const method = request.method().toUpperCase();
+
+    if (path.endsWith('/api/v1/user/me') && method === 'GET') {
+      const authHeader = request.headers()['authorization'] ?? '';
+      if (!authHeader.startsWith('Bearer ')) {
+        await route.fulfill({
+          status: 401,
+          contentType: 'application/json',
+          body: JSON.stringify({ error: 'unauthorized' }),
+        });
+        return;
+      }
+      state.getMeCount += 1;
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          id: 'e2e-user',
+          email: 'e2e@example.com',
+          name: 'E2E User',
+          phone: '+821012341234',
+          department: state.department,
+          affiliationType: 'employee',
+          companyCode: 'BARON',
+          tenant: {
+            id: 'tenant-1',
+            name: 'Baron',
+            slug: 'baron',
+            description: 'E2E tenant',
+          },
+        }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/user/me') && method === 'PUT') {
+      const body = (request.postDataJSON() ?? {}) as Record<string, unknown>;
+      state.putBodies.push(body);
+      const nextDepartment = String(body.department ?? '').trim();
+      if (nextDepartment !== '') {
+        state.department = nextDepartment;
+      }
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          status: 'success',
+          updatedAt: '2026-02-24T00:00:00Z',
+        }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/user/rp/linked')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [] }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/audit/auth/timeline')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [], next_cursor: '' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/client-log')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ ok: true }),
+      });
+      return;
+    }
+
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({ ok: true }),
+    });
+  });
+}
+
+async function openProfilePage(page: Page): Promise<void> {
+  await page.goto('/ko/profile');
+  await expect(page).toHaveURL(/\/ko\/profile$/);
+  await page.waitForTimeout(1200);
+}
+
+async function waitForInitialProfileLoad(state: ProfileState): Promise<void> {
+  await expect.poll(() => state.getMeCount).toBeGreaterThan(0);
+}
+
+test.describe('UserFront WASM profile department editing', () => {
+  test.afterEach(async ({ page }) => {
+    await page.unroute('**/api/v1/**');
+  });
+
+  test('소속 수정 후 포커스 아웃하면 저장 요청이 전송되고 새로고침 후 최신 값으로 재조회된다', async ({
+    page,
+  }) => {
+    const state: ProfileState = {
+      department: 'QA',
+      getMeCount: 0,
+      putBodies: [],
+    };
+    await seedTokenLogin(page);
+    await mockProfileApis(page, state);
+    await openProfilePage(page);
+    await waitForInitialProfileLoad(state);
+
+    await openDepartmentEditor(page);
+    await fillAt(page, PROFILE_DEPARTMENT_INPUT_X, PROFILE_DEPARTMENT_INPUT_Y, 'QA-Updated');
+    await blurDepartmentEditor(page);
+
+    await expect.poll(() => state.putBodies.length).toBe(1);
+    expect(state.putBodies[0]?.department).toBe('QA-Updated');
+    expect(state.department).toBe('QA-Updated');
+
+    const getCountBeforeReload = state.getMeCount;
+    await page.reload();
+    await expect(page).toHaveURL(/\/ko\/profile$/);
+    await expect.poll(() => state.getMeCount).toBeGreaterThan(getCountBeforeReload);
+  });
+
+  test('재현: 소속 입력만 하고 즉시 새로고침하면 저장 요청이 전송되지 않는다', async ({
+    page,
+  }) => {
+    const state: ProfileState = {
+      department: 'QA',
+      getMeCount: 0,
+      putBodies: [],
+    };
+    await seedTokenLogin(page);
+    await mockProfileApis(page, state);
+    await openProfilePage(page);
+    await waitForInitialProfileLoad(state);
+
+    await openDepartmentEditor(page);
+    await fillAt(page, PROFILE_DEPARTMENT_INPUT_X, PROFILE_DEPARTMENT_INPUT_Y, 'QA-Repro');
+
+    await page.reload();
+    await expect(page).toHaveURL(/\/ko\/profile$/);
+    expect(state.putBodies).toHaveLength(0);
+    expect(state.department).toBe('QA');
+  });
+
+  test('소속에 기존값을 그대로 입력하고 포커스 아웃하면 저장 요청이 전송되지 않는다', async ({
+    page,
+  }) => {
+    const state: ProfileState = {
+      department: 'QA',
+      getMeCount: 0,
+      putBodies: [],
+    };
+    await seedTokenLogin(page);
+    await mockProfileApis(page, state);
+    await openProfilePage(page);
+    await waitForInitialProfileLoad(state);
+
+    await openDepartmentEditor(page);
+    await fillAt(page, PROFILE_DEPARTMENT_INPUT_X, PROFILE_DEPARTMENT_INPUT_Y, 'QA');
+    await blurDepartmentEditor(page);
+
+    expect(state.putBodies).toHaveLength(0);
+  });
+
+  test('소속을 빈 값으로 입력하면 저장 요청이 전송되지 않는다', async ({ page }) => {
+    const state: ProfileState = {
+      department: 'QA',
+      getMeCount: 0,
+      putBodies: [],
+    };
+    await seedTokenLogin(page);
+    await mockProfileApis(page, state);
+    await openProfilePage(page);
+    await waitForInitialProfileLoad(state);
+
+    await openDepartmentEditor(page);
+    await fillAt(page, PROFILE_DEPARTMENT_INPUT_X, PROFILE_DEPARTMENT_INPUT_Y, '');
+    await blurDepartmentEditor(page);
+
+    expect(state.putBodies).toHaveLength(0);
+    expect(state.department).toBe('QA');
+  });
+
+  test('소속을 수정한 뒤 새로고침 후 다시 수정해도 저장 요청이 누락되지 않는다', async ({ page }) => {
+    const state: ProfileState = {
+      department: 'QA',
+      getMeCount: 0,
+      putBodies: [],
+    };
+    await seedTokenLogin(page);
+    await mockProfileApis(page, state);
+    await openProfilePage(page);
+    await waitForInitialProfileLoad(state);
+
+    await openDepartmentEditor(page);
+    await fillAt(page, PROFILE_DEPARTMENT_INPUT_X, PROFILE_DEPARTMENT_INPUT_Y, 'QA-1');
+    await blurDepartmentEditor(page);
+    await expect.poll(() => state.putBodies.length).toBe(1);
+
+    await page.reload();
+    await expect(page).toHaveURL(/\/ko\/profile$/);
+    await page.waitForTimeout(1200);
+
+    await openDepartmentEditor(page);
+    await fillAt(page, PROFILE_DEPARTMENT_INPUT_X, PROFILE_DEPARTMENT_INPUT_Y, 'QA-2');
+    await blurDepartmentEditor(page);
+    await expect.poll(() => state.putBodies.length).toBe(2);
+
+    expect(state.putBodies[0]?.department).toBe('QA-1');
+    expect(state.putBodies[1]?.department).toBe('QA-2');
+    expect(state.department).toBe('QA-2');
+  });
+});
--- a/userfront-e2e/tests/route-inventory.spec.ts
+++ b/userfront-e2e/tests/route-inventory.spec.ts
@@ -0,0 +1,320 @@
+import { expect, test, type Page, type Route } from '@playwright/test';
+
+async function seedTokenLogin(page: Page): Promise<void> {
+  await page.addInitScript(() => {
+    window.localStorage.setItem('baron_auth_token', 'e30.e30.e30');
+    window.localStorage.setItem('baron_auth_provider', 'ory');
+    window.localStorage.removeItem('baron_auth_cookie_mode');
+    window.localStorage.removeItem('baron_auth_pending_provider');
+  });
+}
+
+async function mockInventoryApis(page: Page): Promise<void> {
+  await page.route('**/api/v1/**', async (route: Route) => {
+    const requestUrl = new URL(route.request().url());
+    const path = requestUrl.pathname;
+    const method = route.request().method().toUpperCase();
+
+    if (path.endsWith('/api/v1/user/me')) {
+      const authHeader = route.request().headers()['authorization'] ?? '';
+      if (authHeader.startsWith('Bearer ')) {
+        await route.fulfill({
+          status: 200,
+          contentType: 'application/json',
+          body: JSON.stringify({
+            id: 'e2e-user',
+            email: 'e2e@example.com',
+            name: 'E2E User',
+            phone: '+821012341234',
+            department: 'QA',
+            affiliationType: 'employee',
+            companyCode: 'BARON',
+            tenant: {
+              id: 'tenant-1',
+              name: 'Baron',
+              slug: 'baron',
+              description: 'E2E tenant',
+            },
+          }),
+        });
+        return;
+      }
+
+      await route.fulfill({
+        status: 401,
+        contentType: 'application/json',
+        body: JSON.stringify({ error: 'unauthorized' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/user/rp/linked')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [] }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/audit/auth/timeline')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ items: [], next_cursor: '' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/password/policy')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          minLength: 12,
+          minCharacterTypes: 3,
+          lowercase: true,
+          uppercase: true,
+          number: true,
+          nonAlphanumeric: true,
+        }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/magic-link/verify')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ status: 'approved' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/login/code/verify')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ status: 'approved' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/login/code/verify-short')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ status: 'approved' }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/consent') && method === 'GET') {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          client: {
+            client_name: 'E2E Client',
+            client_id: 'e2e-client',
+          },
+          requested_scope: ['openid'],
+          scope_details: {
+            openid: {
+              description: 'OpenID',
+              mandatory: true,
+            },
+          },
+        }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/auth/qr/approve')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ ok: true }),
+      });
+      return;
+    }
+
+    if (path.endsWith('/api/v1/client-log')) {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ ok: true }),
+      });
+      return;
+    }
+
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({}),
+    });
+  });
+}
+
+test.describe('UserFront WASM route inventory (unauth)', () => {
+  test.beforeEach(async ({ page }) => {
+    await mockInventoryApis(page);
+  });
+
+  test('route: /', async ({ page }) => {
+    await page.goto('/');
+    await expect(page).toHaveURL(/\/(ko|en)\/signin(?:\?.*)?$/);
+  });
+
+  test('route: /ko', async ({ page }) => {
+    await page.goto('/ko');
+    await expect(page).toHaveURL(/\/ko\/signin(?:\?.*)?$/);
+  });
+
+  test('route: /ko/dashboard', async ({ page }) => {
+    await page.goto('/ko/dashboard');
+    await expect(page).toHaveURL(/\/ko\/signin$/);
+  });
+
+  test('route: /ko/profile', async ({ page }) => {
+    await page.goto('/ko/profile');
+    await expect(page).toHaveURL(/\/ko\/signin$/);
+  });
+
+  test('route: /ko/admin/users', async ({ page }) => {
+    await page.goto('/ko/admin/users');
+    await expect(page).toHaveURL(/\/ko\/signin$/);
+  });
+
+  test('route: /ko/scan', async ({ page }) => {
+    await page.goto('/ko/scan');
+    await expect(page).toHaveURL(/\/ko\/signin$/);
+  });
+
+  test('route: /ko/signin', async ({ page }) => {
+    await page.goto('/ko/signin');
+    await expect(page).toHaveURL(/\/ko\/signin$/);
+  });
+
+  test('route: /ko/login', async ({ page }) => {
+    await page.goto('/ko/login');
+    await expect(page).toHaveURL(/\/ko\/login$/);
+  });
+
+  test('route: /ko/signup', async ({ page }) => {
+    await page.goto('/ko/signup');
+    await expect(page).toHaveURL(/\/ko\/signup$/);
+  });
+
+  test('route: /ko/registration', async ({ page }) => {
+    await page.goto('/ko/registration');
+    await expect(page).toHaveURL(/\/ko\/registration$/);
+  });
+
+  test('route: /ko/verify', async ({ page }) => {
+    await page.goto('/ko/verify');
+    await expect(page).toHaveURL(/\/ko\/verify$/);
+  });
+
+  test('route: /ko/verify/:token', async ({ page }) => {
+    await page.goto('/ko/verify/e2e-token');
+    await expect(page).toHaveURL(/\/ko\/verify\/e2e-token$/);
+  });
+
+  test('route: /ko/verification', async ({ page }) => {
+    await page.goto('/ko/verification');
+    await expect(page).toHaveURL(/\/ko\/verification$/);
+  });
+
+  test('route: /ko/l/:shortCode', async ({ page }) => {
+    await page.goto('/ko/l/AB123456');
+    await expect(page).toHaveURL(/\/ko\/l\/AB123456$/);
+  });
+
+  test('route: /ko/forgot-password', async ({ page }) => {
+    await page.goto('/ko/forgot-password');
+    await expect(page).toHaveURL(/\/ko\/forgot-password$/);
+  });
+
+  test('route: /ko/recovery', async ({ page }) => {
+    await page.goto('/ko/recovery');
+    await expect(page).toHaveURL(/\/ko\/recovery$/);
+  });
+
+  test('route: /ko/reset-password', async ({ page }) => {
+    await page.goto('/ko/reset-password?token=e2e-reset-token');
+    await expect(page).toHaveURL(/\/ko\/reset-password\?token=e2e-reset-token$/);
+  });
+
+  test('route: /ko/error', async ({ page }) => {
+    await page.goto('/ko/error?error=invalid_request');
+    await expect(page).toHaveURL(/\/ko\/error\?error=invalid_request$/);
+  });
+
+  test('route: /ko/settings', async ({ page }) => {
+    await page.goto('/ko/settings');
+    await expect(page).toHaveURL(/\/ko\/settings$/);
+  });
+
+  test('route: /ko/consent (missing challenge)', async ({ page }) => {
+    await page.goto('/ko/consent');
+    await expect(page).toHaveURL(/\/ko\/consent$/);
+  });
+
+  test('route: /ko/consent?consent_challenge=...', async ({ page }) => {
+    await page.goto('/ko/consent?consent_challenge=e2e-consent');
+    await expect(page).toHaveURL(/\/ko\/consent\?consent_challenge=e2e-consent$/);
+  });
+
+  test('route: /ko/approve?ref=...', async ({ page }) => {
+    await page.goto('/ko/approve?ref=e2e-ref');
+    await expect(page).toHaveURL(/\/ko\/signin\?notice=qr_login_required$/);
+  });
+
+  test('route: /ko/ql/:ref', async ({ page }) => {
+    await page.goto('/ko/ql/e2e-ref');
+    await expect(page).toHaveURL(/\/ko\/signin\?notice=qr_login_required$/);
+  });
+});
+
+test.describe('UserFront WASM route inventory (authed)', () => {
+  test.beforeEach(async ({ page }) => {
+    await seedTokenLogin(page);
+    await mockInventoryApis(page);
+  });
+
+  test('route: /ko -> /ko/dashboard', async ({ page }) => {
+    await page.goto('/ko');
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+  });
+
+  test('route: /ko/dashboard', async ({ page }) => {
+    await page.goto('/ko/dashboard');
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+  });
+
+  test('route: /ko/profile', async ({ page }) => {
+    await page.goto('/ko/profile');
+    await expect(page).toHaveURL(/\/ko\/profile$/);
+  });
+
+  test('route: /ko/admin/users', async ({ page }) => {
+    await page.goto('/ko/admin/users');
+    await expect(page).toHaveURL(/\/ko\/admin\/users$/);
+  });
+
+  test('route: /ko/scan', async ({ page }) => {
+    await page.goto('/ko/scan');
+    await expect(page).toHaveURL(/\/ko\/scan$/);
+  });
+
+  test('route: /ko/approve?ref=... -> /ko/dashboard', async ({ page }) => {
+    await page.goto('/ko/approve?ref=e2e-ref');
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+  });
+
+  test('route: /ko/ql/:ref -> /ko/dashboard', async ({ page }) => {
+    await page.goto('/ko/ql/e2e-ref');
+    await expect(page).toHaveURL(/\/ko\/dashboard$/);
+  });
+});
--- a/userfront-e2e/tsconfig.json
+++ b/userfront-e2e/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "types": ["node", "@playwright/test"],
+    "strict": true,
+    "noEmit": true,
+    "resolveJsonModule": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": ["playwright.config.ts", "tests/**/*.ts", "scripts/**/*.mjs"]
+}
--- a/userfront/assets/translations/ko.toml
+++ b/userfront/assets/translations/ko.toml
@@ -54,12 +54,12 @@ empty_detail = "앱을 연동하면 최근 활동과 상태가 표시됩니다."
 error = "연동 정보를 불러오지 못했습니다."

 [msg.userfront.dashboard.approved_session]
-copy_click = "{label}: {id}\\\\\\\\n클릭하면 복사됩니다."
-copy_tap = "{label}: {id}\\\\\\\\n탭하면 복사됩니다."
+copy_click = "{label}: {id} \\n클릭하면 복사됩니다."
+copy_tap = "{label}: {id} \\n탭하면 복사됩니다."
 none = "{label} 없음"

 [msg.userfront.dashboard.revoke]
-confirm = "{app} 앱과의 연동을 해지하시겠습니까?\\\\\\\\n해지하면 다음 로그인 시 다시 동의가 필요합니다."
+confirm = "{app} 앱과의 연동을 해지하시겠습니까? \\n해지하면 다음 로그인 시 다시 동의가 필요합니다."
 error = "해지 실패: {error}"
 success = "{app} 연동이 해지되었습니다."

--- a/userfront/lib/core/services/auth_proxy_service.dart
+++ b/userfront/lib/core/services/auth_proxy_service.dart
@@ -4,6 +4,7 @@ import 'package:flutter_dotenv/flutter_dotenv.dart';
 import 'package:userfront/i18n.dart';
 import 'http_client.dart';
 import 'auth_token_store.dart';
+import 'log_policy.dart';

 class AuthProxyService {
  static String _envOrDefault(String key, String fallback) {
@@ -793,12 +794,30 @@ class AuthProxyService {
    if (!_canSendClientLog()) {
      return;
    }
+    final appEnv = _envOrDefault('APP_ENV', 'dev');
+    final productionDebugFlag = _envOrDefault(
+      'CLIENT_LOG_DEBUG',
+      _envOrDefault('USERFRONT_DEBUG_LOG', ''),
+    );
+    if (!LogPolicy.shouldRelayClientLog(
+      level: level,
+      appEnv: appEnv,
+      productionDebugFlag: productionDebugFlag,
+    )) {
+      return;
+    }
    final url = Uri.parse('$_baseUrl/api/v1/client-log');
+    final sanitizedMessage = LogPolicy.sanitizeMessage(message);
+    final sanitizedData = data == null ? null : LogPolicy.sanitizeData(data);
    try {
      await http.post(
        url,
        headers: {'Content-Type': 'application/json'},
-        body: jsonEncode({'level': level, 'message': message, 'data': ?data}),
+        body: jsonEncode({
+          'level': level,
+          'message': sanitizedMessage,
+          if (sanitizedData != null) 'data': sanitizedData,
+        }),
      );
      _recordClientLogSuccess();
    } catch (_) {
--- a/userfront/lib/core/services/log_policy.dart
+++ b/userfront/lib/core/services/log_policy.dart
@@ -0,0 +1,123 @@
+class LogPolicy {
+  static const Set<String> _sensitiveKeys = {
+    'password',
+    'currentpassword',
+    'newpassword',
+    'oldpassword',
+    'token',
+    'accesstoken',
+    'refreshtoken',
+    'secret',
+    'clientsecret',
+    'authorization',
+    'cookie',
+    'setcookie',
+    'verificationcode',
+    'code',
+    'loginchallenge',
+    'loginverifier',
+    'sessionjwt',
+    'accessjwt',
+    'refreshjwt',
+  };
+
+  static bool isProductionEnv(String? appEnv) {
+    final env = (appEnv ?? '').trim().toLowerCase();
+    return env == 'prod' || env == 'production';
+  }
+
+  static bool parseBoolFlag(String? raw) {
+    final value = (raw ?? '').trim().toLowerCase();
+    return value == '1' ||
+        value == 'true' ||
+        value == 'yes' ||
+        value == 'y' ||
+        value == 'on';
+  }
+
+  static bool debugEnabled({
+    required String? appEnv,
+    required String? productionDebugFlag,
+  }) {
+    if (!isProductionEnv(appEnv)) {
+      return true;
+    }
+    return parseBoolFlag(productionDebugFlag);
+  }
+
+  static bool shouldRelayClientLog({
+    required String level,
+    required String? appEnv,
+    required String? productionDebugFlag,
+  }) {
+    if (debugEnabled(
+      appEnv: appEnv,
+      productionDebugFlag: productionDebugFlag,
+    )) {
+      return true;
+    }
+    final normalized = level.trim().toUpperCase();
+    return normalized == 'SEVERE' ||
+        normalized == 'ERROR' ||
+        normalized == 'WARNING' ||
+        normalized == 'WARN';
+  }
+
+  static String sanitizeMessage(String message) {
+    if (message.trim().isEmpty) {
+      return message;
+    }
+    var sanitized = message.replaceAllMapped(
+      RegExp(
+        r'"(password|currentpassword|newpassword|oldpassword|token|accesstoken|refreshtoken|secret|clientsecret|authorization|cookie|setcookie|verificationcode|code|loginchallenge|loginverifier|sessionjwt|accessjwt|refreshjwt)"\s*:\s*"[^"]*"',
+        caseSensitive: false,
+      ),
+      (match) {
+        final key = match.group(1) ?? 'sensitive';
+        return '"$key":"*****"';
+      },
+    );
+    sanitized = sanitized.replaceAllMapped(
+      RegExp(
+        r'\b(password|current_password|currentpassword|new_password|newpassword|old_password|oldpassword|token|access_token|accesstoken|refresh_token|refreshtoken|authorization|cookie|session_jwt|sessionjwt|access_jwt|accessjwt|refresh_jwt|refreshjwt)\b\s*[:=]\s*([^\s,;]+)',
+        caseSensitive: false,
+      ),
+      (match) {
+        final key = match.group(1) ?? 'sensitive';
+        return '$key=*****';
+      },
+    );
+    return sanitized;
+  }
+
+  static Map<String, dynamic> sanitizeData(Map<String, dynamic> input) {
+    final output = <String, dynamic>{};
+    for (final entry in input.entries) {
+      if (_isSensitiveKey(entry.key)) {
+        output[entry.key] = '*****';
+      } else {
+        output[entry.key] = _sanitizeValue(entry.value);
+      }
+    }
+    return output;
+  }
+
+  static dynamic _sanitizeValue(dynamic value) {
+    if (value is Map<String, dynamic>) {
+      return sanitizeData(value);
+    }
+    if (value is List) {
+      return value.map(_sanitizeValue).toList(growable: false);
+    }
+    if (value is String) {
+      return sanitizeMessage(value);
+    }
+    return value;
+  }
+
+  static bool _isSensitiveKey(String key) {
+    var normalized = key.trim().toLowerCase();
+    normalized = normalized.replaceAll(RegExp(r'[-_.\s]'), '');
+    return _sensitiveKeys.contains(normalized);
+  }
+}
--- a/userfront/lib/core/services/logger_service.dart
+++ b/userfront/lib/core/services/logger_service.dart
@@ -1,8 +1,10 @@
 import 'dart:convert';
 import 'package:flutter/foundation.dart';
+import 'package:flutter_dotenv/flutter_dotenv.dart';
 import 'package:logging/logging.dart' as std_log;
 import 'package:logger/logger.dart' as pretty_log;
 import 'auth_proxy_service.dart';
+import 'log_policy.dart';

 /// Global Logger Service for Baron SSO Frontend
 class LoggerService {
@@ -10,8 +12,20 @@ class LoggerService {
  factory LoggerService() => _instance;

  late final pretty_log.Logger _prettyLogger;
+  late final String _appEnv;
+  late final String _productionDebugFlag;

  LoggerService._internal() {
+    _appEnv = _envOrDefault('APP_ENV', 'dev');
+    _productionDebugFlag = _envOrDefault(
+      'CLIENT_LOG_DEBUG',
+      _envOrDefault('USERFRONT_DEBUG_LOG', ''),
+    );
+    final debugEnabled = LogPolicy.debugEnabled(
+      appEnv: _appEnv,
+      productionDebugFlag: _productionDebugFlag,
+    );
+
    // 1. Initialize Pretty Logger for Dev
    _prettyLogger = pretty_log.Logger(
      printer: pretty_log.PrettyPrinter(
@@ -25,9 +39,9 @@ class LoggerService {
    );

    // 2. Configure Standard Logger (logging package)
-    std_log.Logger.root.level = kReleaseMode
-        ? std_log.Level.WARNING
-        : std_log.Level.ALL;
+    std_log.Logger.root.level = debugEnabled
+        ? std_log.Level.ALL
+        : std_log.Level.WARNING;

    std_log.Logger.root.onRecord.listen((record) {
      if (kReleaseMode) {
@@ -40,6 +54,17 @@ class LoggerService {
    });
  }

+  static String _envOrDefault(String key, String fallback) {
+    if (!dotenv.isInitialized) {
+      return fallback;
+    }
+    final value = dotenv.env[key];
+    if (value == null || value.trim().isEmpty) {
+      return fallback;
+    }
+    return value;
+  }
+
  /// Initialize the logger. Call this in main.dart
  static void init() {
    // Accessing the instance triggers the constructor
@@ -64,10 +89,11 @@ class LoggerService {
  }

  void _logJson(std_log.LogRecord record) {
+    final sanitizedMessage = LogPolicy.sanitizeMessage(record.message);
    final logData = {
      'time': record.time.toUtc().toIso8601String(), // Use UTC for consistency
      'level': record.level.name,
-      'msg': record.message,
+      'msg': sanitizedMessage,
      'svc': 'baron-userfront',
      if (record.error != null) 'error': record.error.toString(),
      if (record.stackTrace != null) 'stack': record.stackTrace.toString(),
@@ -77,10 +103,14 @@ class LoggerService {
    debugPrint(jsonEncode(logData));

    // 2. Relay to Backend (Docker Terminal)
-    if (record.level >= std_log.Level.WARNING) {
+    if (LogPolicy.shouldRelayClientLog(
+      level: record.level.name,
+      appEnv: _appEnv,
+      productionDebugFlag: _productionDebugFlag,
+    )) {
      AuthProxyService.sendLog(
        record.level.name,
-        record.message,
+        sanitizedMessage,
        data: {
          'client_time': record.time.toUtc().toIso8601String(),
          'logger': record.loggerName,
--- a/userfront/lib/features/auth/presentation/login_screen.dart
+++ b/userfront/lib/features/auth/presentation/login_screen.dart
@@ -1361,6 +1361,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                              child: Column(
                                children: [
                                  TextField(
+                                    key: const ValueKey(
+                                      'password_login_id_input',
+                                    ),
                                    controller: _passwordLoginIdController,
                                    decoration: InputDecoration(
                                      labelText: tr(
@@ -1375,6 +1378,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                                  ),
                                  const SizedBox(height: 16),
                                  TextField(
+                                    key: const ValueKey(
+                                      'password_login_password_input',
+                                    ),
                                    controller: _passwordController,
                                    obscureText: true,
                                    decoration: InputDecoration(
@@ -1390,6 +1396,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                                  ),
                                  const SizedBox(height: 24),
                                  FilledButton(
+                                    key: const ValueKey(
+                                      'password_login_submit_button',
+                                    ),
                                    onPressed: _handlePasswordLogin,
                                    style: FilledButton.styleFrom(
                                      minimumSize: const Size.fromHeight(50),
--- a/userfront/lib/features/auth/presentation/reset_password_screen.dart
+++ b/userfront/lib/features/auth/presentation/reset_password_screen.dart
@@ -192,6 +192,7 @@ class _ResetPasswordScreenState extends State<ResetPasswordScreen> {
                      ),
                      const SizedBox(height: 40),
                      TextFormField(
+                        key: const ValueKey('reset_password_new_input'),
                        controller: _passwordController,
                        obscureText: _isPasswordObscured,
                        decoration: InputDecoration(
@@ -263,6 +264,7 @@ class _ResetPasswordScreenState extends State<ResetPasswordScreen> {
                      ),
                      const SizedBox(height: 16),
                      TextFormField(
+                        key: const ValueKey('reset_password_confirm_input'),
                        controller: _confirmPasswordController,
                        obscureText: _isConfirmPasswordObscured,
                        decoration: InputDecoration(
@@ -292,6 +294,7 @@ class _ResetPasswordScreenState extends State<ResetPasswordScreen> {
                      ),
                      const SizedBox(height: 24),
                      FilledButton(
+                        key: const ValueKey('reset_password_submit_button'),
                        onPressed: _isLoading ? null : _handlePasswordReset,
                        style: FilledButton.styleFrom(
                          minimumSize: const Size.fromHeight(50),
--- a/userfront/lib/features/dashboard/presentation/dashboard_screen.dart
+++ b/userfront/lib/features/dashboard/presentation/dashboard_screen.dart
@@ -1,5 +1,6 @@
 import 'dart:async';
 import 'dart:convert';
+import 'dart:math' as math;
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -31,6 +32,9 @@ class _DashboardScreenState extends ConsumerState<DashboardScreen> {
  static const _surface = Colors.white;
  static const _border = Color(0xFFE5E7EB);
  static const _subtle = Color(0xFFF7F8FA);
+  static const double _historySessionMinWidth = 92;
+  static const double _historyOtherColumnsBaselineWidth = 780;
+  static const int _historySessionMinVisibleChars = 8;

  final ScrollController _pageScrollController = ScrollController();
  final ScrollController _rpScrollController = ScrollController();
@@ -1370,6 +1374,9 @@ class _DashboardScreenState extends ConsumerState<DashboardScreen> {
        children: [
          LayoutBuilder(
            builder: (context, constraints) {
+              final sessionColumnWidth = _historySessionColumnWidth(
+                constraints.maxWidth,
+              );
              return SingleChildScrollView(
                scrollDirection: Axis.horizontal,
                child: ConstrainedBox(
@@ -1379,10 +1386,13 @@ class _DashboardScreenState extends ConsumerState<DashboardScreen> {
                    horizontalMargin: 12,
                    columns: [
                      DataColumn(
-                        label: Text(
-                          tr(
-                            'ui.userfront.audit.table.session_id',
-                            fallback: 'Session ID',
+                        label: SizedBox(
+                          width: sessionColumnWidth,
+                          child: Text(
+                            tr(
+                              'ui.userfront.audit.table.session_id',
+                              fallback: 'Session ID',
+                            ),
                          ),
                        ),
                      ),
@@ -1426,10 +1436,14 @@ class _DashboardScreenState extends ConsumerState<DashboardScreen> {
                      return DataRow(
                        cells: [
                          DataCell(
-                            _selectableText(
-                              log.sessionId.isEmpty
-                                  ? tr('ui.common.hyphen', fallback: '-')
-                                  : log.sessionId,
+                            SizedBox(
+                              width: sessionColumnWidth,
+                              child: _buildHistorySessionIdCell(
+                                log.sessionId.isEmpty
+                                    ? tr('ui.common.hyphen', fallback: '-')
+                                    : log.sessionId,
+                                sessionColumnWidth,
+                              ),
                            ),
                          ),
                          DataCell(
@@ -1474,6 +1488,36 @@ class _DashboardScreenState extends ConsumerState<DashboardScreen> {
    );
  }

+  double _historySessionColumnWidth(double maxWidth) {
+    return math.max(
+      _historySessionMinWidth,
+      maxWidth - _historyOtherColumnsBaselineWidth,
+    );
+  }
+
+  String _compactSessionId(String sessionId) {
+    if (sessionId.length <= _historySessionMinVisibleChars) {
+      return sessionId;
+    }
+    return '${sessionId.substring(0, _historySessionMinVisibleChars)}...';
+  }
+
+  Widget _buildHistorySessionIdCell(String sessionId, double columnWidth) {
+    final compactMode = columnWidth <= _historySessionMinWidth + 0.5;
+    final displayText = compactMode ? _compactSessionId(sessionId) : sessionId;
+    final textWidget = Text(
+      displayText,
+      maxLines: 1,
+      softWrap: false,
+      overflow: TextOverflow.ellipsis,
+    );
+
+    if (displayText == sessionId) {
+      return textWidget;
+    }
+    return Tooltip(message: sessionId, child: textWidget);
+  }
+
  Widget _buildHistoryList(AuthTimelineState state) {
    return _buildHistoryContainer(
      child: Column(
--- a/userfront/lib/features/profile/presentation/pages/profile_page.dart
+++ b/userfront/lib/features/profile/presentation/pages/profile_page.dart
@@ -1,6 +1,7 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
+import 'package:logging/logging.dart';
 import 'package:userfront/i18n.dart';
 import '../../../../core/notifiers/auth_notifier.dart';
 import '../../../../core/i18n/locale_utils.dart';
@@ -22,6 +23,7 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
  static const _surface = Colors.white;
  static const _border = Color(0xFFE5E7EB);
  static const _subtle = Color(0xFFF7F8FA);
+  static final _log = Logger('ProfilePage');

  UserProfile? _cachedProfile;
  String? _editingField;
@@ -41,6 +43,7 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
  bool _phoneTouched = false;
  bool _phoneCodeTouched = false;
  bool _isSavingField = false;
+  String? _skipAutoSaveField;

  String _initialPhone = '';
  bool _isPhoneChanged = false;
@@ -64,6 +67,22 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
    _phoneCodeFocus.addListener(_onPhoneCodeFocusChange);
  }

+  void _debugLog(
+    String event, {
+    String? field,
+    String? reason,
+    bool? changed,
+    bool? hasFocus,
+  }) {
+    final parts = <String>['event=$event'];
+    if (field != null) parts.add('field=$field');
+    if (reason != null) parts.add('reason=$reason');
+    if (changed != null) parts.add('changed=$changed');
+    if (hasFocus != null) parts.add('hasFocus=$hasFocus');
+    if (_editingField != null) parts.add('editing=$_editingField');
+    _log.fine(parts.join(' '));
+  }
+
  void _onNameFocusChange() {
    if (!mounted) return;
    if (!_nameFocus.hasFocus && _nameTouched) {
@@ -76,6 +95,11 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {

  void _onDepartmentFocusChange() {
    if (!mounted) return;
+    _debugLog(
+      'department_focus_change',
+      field: 'department',
+      hasFocus: _departmentFocus.hasFocus,
+    );
    if (!_departmentFocus.hasFocus && _departmentTouched) {
      final profile = ref.read(profileProvider).value ?? _cachedProfile;
      if (profile != null) _autoSaveIfEditing(profile, 'department');
@@ -179,6 +203,7 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
  }

  void _startEditing(String field, UserProfile profile) {
+    _debugLog('start_editing', field: field);
    setState(() {
      _editingField = field;
      if (field == 'name') {
@@ -354,9 +379,26 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {

  void _autoSaveIfEditing(UserProfile profile, String field) {
    if (_editingField != field) return;
-    if (_isVerifying) return;
-    if (_isSavingField) return;
+    if (_skipAutoSaveField == field) {
+      _debugLog('autosave_skip', field: field, reason: 'skip_flag');
+      _skipAutoSaveField = null;
+      return;
+    }
+    if (_isVerifying) {
+      _debugLog('autosave_skip', field: field, reason: 'verifying');
+      return;
+    }
+    if (_isSavingField) {
+      _debugLog('autosave_skip', field: field, reason: 'saving_in_flight');
+      return;
+    }
    if (!_hasFieldChanged(profile, field)) {
+      _debugLog(
+        'autosave_skip',
+        field: field,
+        reason: 'unchanged',
+        changed: false,
+      );
      setState(() {
        if (field == 'phone') {
          _resetPhoneState();
@@ -370,11 +412,16 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
      });
      return;
    }
+    _debugLog('autosave_trigger', field: field, changed: true);
    _saveField(profile);
  }

  void _handlePhoneFocusChange(UserProfile profile) {
    if (_editingField != 'phone') return;
+    if (_skipAutoSaveField == 'phone') {
+      _skipAutoSaveField = null;
+      return;
+    }
    if (_isVerifying) return;
    if (_isSavingField) return;
    if (_phoneFocus.hasFocus || _phoneCodeFocus.hasFocus) return;
@@ -403,25 +450,33 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {

  Future<void> _saveField(UserProfile profile) async {
    if (_editingField == null) return;
-    if (_isSavingField) return;
+    if (_isSavingField) {
+      _debugLog('save_skip', reason: 'saving_in_flight');
+      return;
+    }
+    final currentField = _editingField!;

-    final nextName = _editingField == 'name'
+    final nextName = currentField == 'name'
        ? _nameController!.text.trim()
        : profile.name;
-    final nextPhone = _editingField == 'phone'
+    final nextPhone = currentField == 'phone'
        ? _phoneController!.text.trim()
        : profile.phone;
-    final nextDepartment = _editingField == 'department'
+    final nextDepartment = currentField == 'department'
        ? _departmentController!.text.trim()
        : profile.department;

-    if (_editingField == 'name' && nextName.isEmpty) {
+    _debugLog('save_attempt', field: currentField);
+
+    if (currentField == 'name' && nextName.isEmpty) {
+      _debugLog('save_skip', field: currentField, reason: 'empty_name');
      ScaffoldMessenger.of(context).showSnackBar(
        SnackBar(content: Text(tr('msg.userfront.profile.name_required'))),
      );
      return;
    }
-    if (_editingField == 'department' && nextDepartment.isEmpty) {
+    if (currentField == 'department' && nextDepartment.isEmpty) {
+      _debugLog('save_skip', field: currentField, reason: 'empty_department');
      ScaffoldMessenger.of(context).showSnackBar(
        SnackBar(
          content: Text(tr('msg.userfront.profile.department_required')),
@@ -429,14 +484,20 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
      );
      return;
    }
-    if (_editingField == 'phone') {
+    if (currentField == 'phone') {
      if (nextPhone.isEmpty) {
+        _debugLog('save_skip', field: currentField, reason: 'empty_phone');
        ScaffoldMessenger.of(context).showSnackBar(
          SnackBar(content: Text(tr('msg.userfront.profile.phone_required'))),
        );
        return;
      }
      if (_isPhoneChanged && !_isPhoneVerified) {
+        _debugLog(
+          'save_skip',
+          field: currentField,
+          reason: 'phone_not_verified',
+        );
        ScaffoldMessenger.of(context).showSnackBar(
          SnackBar(
            content: Text(tr('msg.userfront.profile.phone_verify_required')),
@@ -446,7 +507,13 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
      }
    }

-    if (!_hasFieldChanged(profile, _editingField!)) {
+    if (!_hasFieldChanged(profile, currentField)) {
+      _debugLog(
+        'save_skip',
+        field: currentField,
+        reason: 'unchanged',
+        changed: false,
+      );
      setState(() {
        if (_editingField == 'phone') {
          _resetPhoneState();
@@ -459,6 +526,7 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
    }

    _isSavingField = true;
+    _debugLog('save_dispatch', field: currentField, changed: true);

    try {
      await ref
@@ -470,7 +538,7 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
          );
      if (mounted) {
        setState(() {
-          if (_editingField == 'phone') {
+          if (currentField == 'phone') {
            _initialPhone = nextPhone;
            _resetPhoneState();
          }
@@ -478,11 +546,13 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
          _nameTouched = false;
          _departmentTouched = false;
        });
+        _debugLog('save_success', field: currentField);
        ScaffoldMessenger.of(context).showSnackBar(
          SnackBar(content: Text(tr('msg.userfront.profile.update_success'))),
        );
      }
    } catch (e) {
+      _debugLog('save_failed', field: currentField, reason: e.toString());
      if (mounted) {
        ScaffoldMessenger.of(context).showSnackBar(
          SnackBar(
@@ -704,6 +774,7 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
        title: Text(label),
        subtitle: Text(displayValue),
        trailing: TextButton(
+          key: Key('profile-$field-edit-button'),
          onPressed: isUpdating ? null : () => _startEditing(field, profile),
          child: Text(tr('ui.common.edit')),
        ),
@@ -720,6 +791,7 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
          children: [
            Expanded(
              child: TextField(
+                key: Key('profile-$field-input'),
                controller: controller,
                focusNode: field == 'name' ? _nameFocus : _departmentFocus,
                textInputAction: TextInputAction.done,
@@ -731,9 +803,15 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
              ),
            ),
            const SizedBox(width: 12),
-            OutlinedButton(
-              onPressed: isUpdating ? null : () => _cancelEditing(profile),
-              child: Text(tr('ui.common.cancel')),
+            Listener(
+              onPointerDown: (_) {
+                _skipAutoSaveField = field;
+              },
+              child: OutlinedButton(
+                key: Key('profile-$field-cancel-button'),
+                onPressed: isUpdating ? null : () => _cancelEditing(profile),
+                child: Text(tr('ui.common.cancel')),
+              ),
            ),
          ],
        ),
@@ -796,9 +874,14 @@ class _ProfilePageState extends ConsumerState<ProfilePage> {
                ),
              ),
            const SizedBox(width: 8),
-            OutlinedButton(
-              onPressed: isUpdating ? null : () => _cancelEditing(profile),
-              child: Text(tr('ui.common.cancel')),
+            Listener(
+              onPointerDown: (_) {
+                _skipAutoSaveField = 'phone';
+              },
+              child: OutlinedButton(
+                onPressed: isUpdating ? null : () => _cancelEditing(profile),
+                child: Text(tr('ui.common.cancel')),
+              ),
            ),
          ],
        ),
--- a/userfront/test/log_policy_test.dart
+++ b/userfront/test/log_policy_test.dart
@@ -0,0 +1,114 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:userfront/core/services/log_policy.dart';
+
+void main() {
+  group('LogPolicy.debugEnabled', () {
+    test('non production enables debug by default', () {
+      expect(
+        LogPolicy.debugEnabled(appEnv: 'dev', productionDebugFlag: null),
+        isTrue,
+      );
+      expect(
+        LogPolicy.debugEnabled(appEnv: 'staging', productionDebugFlag: 'false'),
+        isTrue,
+      );
+    });
+
+    test('production disables debug unless explicitly enabled', () {
+      expect(
+        LogPolicy.debugEnabled(appEnv: 'production', productionDebugFlag: ''),
+        isFalse,
+      );
+      expect(
+        LogPolicy.debugEnabled(
+          appEnv: 'production',
+          productionDebugFlag: 'true',
+        ),
+        isTrue,
+      );
+      expect(
+        LogPolicy.debugEnabled(appEnv: 'prod', productionDebugFlag: '1'),
+        isTrue,
+      );
+    });
+  });
+
+  group('LogPolicy.shouldRelayClientLog', () {
+    test('production default forwards only warning or higher', () {
+      expect(
+        LogPolicy.shouldRelayClientLog(
+          level: 'INFO',
+          appEnv: 'production',
+          productionDebugFlag: '',
+        ),
+        isFalse,
+      );
+      expect(
+        LogPolicy.shouldRelayClientLog(
+          level: 'WARNING',
+          appEnv: 'production',
+          productionDebugFlag: '',
+        ),
+        isTrue,
+      );
+      expect(
+        LogPolicy.shouldRelayClientLog(
+          level: 'ERROR',
+          appEnv: 'production',
+          productionDebugFlag: '',
+        ),
+        isTrue,
+      );
+    });
+
+    test('production debug option forwards info logs', () {
+      expect(
+        LogPolicy.shouldRelayClientLog(
+          level: 'INFO',
+          appEnv: 'production',
+          productionDebugFlag: 'true',
+        ),
+        isTrue,
+      );
+    });
+  });
+
+  group('LogPolicy.sanitize', () {
+    test('sanitizes sensitive message patterns', () {
+      const message =
+          'token=abc123 payload={"password":"hello","safe":"ok"} authorization:BearerXYZ';
+      final sanitized = LogPolicy.sanitizeMessage(message);
+      expect(sanitized, isNot(contains('abc123')));
+      expect(sanitized, contains('token=*****'));
+      expect(sanitized, contains('"password":"*****"'));
+      expect(sanitized, contains('authorization=*****'));
+    });
+
+    test('sanitizes nested sensitive keys', () {
+      final data = <String, dynamic>{
+        'token': 'tok',
+        'ok': 'value',
+        'nested': {'new_password': 'pw', 'safe': 'x'},
+        'arr': [
+          {'authorization': 'Bearer secret'},
+          'cookie=session=raw',
+        ],
+      };
+
+      final sanitized = LogPolicy.sanitizeData(data);
+      expect(sanitized['token'], '*****');
+      expect(sanitized['ok'], 'value');
+      expect(
+        (sanitized['nested'] as Map<String, dynamic>)['new_password'],
+        '*****',
+      );
+      expect((sanitized['nested'] as Map<String, dynamic>)['safe'], 'x');
+      expect(
+        ((sanitized['arr'] as List).first
+            as Map<String, dynamic>)['authorization'],
+        '*****',
+      );
+      expect((sanitized['arr'] as List)[1], 'cookie=*****');
+    });
+  });
+}
--- a/userfront/test/profile_notifier_persistence_test.dart
+++ b/userfront/test/profile_notifier_persistence_test.dart
@@ -0,0 +1,112 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:userfront/features/profile/data/models/user_profile_model.dart';
+import 'package:userfront/features/profile/data/repositories/profile_repository.dart';
+import 'package:userfront/features/profile/domain/notifiers/profile_notifier.dart';
+
+class _FakeProfileRepository extends ProfileRepository {
+  _FakeProfileRepository({
+    required this.initialProfile,
+    required this.persistUpdate,
+  }) : _profile = initialProfile;
+
+  final UserProfile initialProfile;
+  final bool persistUpdate;
+  UserProfile _profile;
+
+  int updateCount = 0;
+  String? lastRequestedDepartment;
+
+  @override
+  Future<UserProfile> getMyProfile() async {
+    return _profile;
+  }
+
+  @override
+  Future<void> updateMyProfile({
+    required String name,
+    required String phone,
+    required String department,
+  }) async {
+    updateCount += 1;
+    lastRequestedDepartment = department;
+    if (!persistUpdate) {
+      return;
+    }
+    _profile = _profile.copyWith(
+      name: name,
+      phone: phone,
+      department: department,
+    );
+  }
+}
+
+UserProfile _seedProfile({required String department}) {
+  return UserProfile(
+    id: 'user-1',
+    email: 'qa@example.com',
+    name: 'QA User',
+    phone: '01012345678',
+    department: department,
+    affiliationType: 'employee',
+    companyCode: 'BARON',
+  );
+}
+
+void main() {
+  test('재현: 저장소가 소속 변경을 반영하지 않으면 loadProfile 이후 이전 값으로 보인다', () async {
+    final repository = _FakeProfileRepository(
+      initialProfile: _seedProfile(department: 'Old Dept'),
+      persistUpdate: false,
+    );
+    final container = ProviderContainer(
+      overrides: [profileRepositoryProvider.overrideWithValue(repository)],
+    );
+    addTearDown(container.dispose);
+
+    final initial = await container.read(profileProvider.future);
+    expect(initial?.department, 'Old Dept');
+
+    await container
+        .read(profileProvider.notifier)
+        .updateProfile(
+          name: 'QA User',
+          phone: '01012345678',
+          department: 'New Dept',
+        );
+
+    expect(repository.updateCount, 1);
+    expect(repository.lastRequestedDepartment, 'New Dept');
+
+    await container.read(profileProvider.notifier).loadProfile();
+    expect(container.read(profileProvider).value?.department, 'Old Dept');
+  });
+
+  test('소속 변경이 저장소에 반영되면 loadProfile 이후에도 변경값이 유지된다', () async {
+    final repository = _FakeProfileRepository(
+      initialProfile: _seedProfile(department: 'Old Dept'),
+      persistUpdate: true,
+    );
+    final container = ProviderContainer(
+      overrides: [profileRepositoryProvider.overrideWithValue(repository)],
+    );
+    addTearDown(container.dispose);
+
+    final initial = await container.read(profileProvider.future);
+    expect(initial?.department, 'Old Dept');
+
+    await container
+        .read(profileProvider.notifier)
+        .updateProfile(
+          name: 'QA User',
+          phone: '01012345678',
+          department: 'New Dept',
+        );
+
+    expect(repository.updateCount, 1);
+    expect(repository.lastRequestedDepartment, 'New Dept');
+
+    await container.read(profileProvider.notifier).loadProfile();
+    expect(container.read(profileProvider).value?.department, 'New Dept');
+  });
+}