kratos SSOT 재설계

backend/internal/handler/worksmobile_handler_test.go

@@ -195,6 +195,19 @@ func TestWorksmobileHandlerLogsActionFailures(t *testing.T) {
 	require.Contains(t, logs.String(), "works user sync failed")
 }
 
+func TestWorksmobileHandlerReturnsBadRequestForOutOfScopeUserSync(t *testing.T) {
+	h := NewWorksmobileHandler(&fakeWorksmobileAdminService{
+		syncUserErr: errors.New("target user tenant is excluded from Worksmobile sync"),
+	})
+	app := fiber.New()
+	app.Post("/tenants/:tenantId/worksmobile/users/:userId/sync", h.SyncUser)
+
+	resp, err := app.Test(httptest.NewRequest("POST", "/tenants/hanmac-id/worksmobile/users/user-1/sync", nil))
+
+	require.NoError(t, err)
+	require.Equal(t, fiber.StatusBadRequest, resp.StatusCode)
+}
+
 type fakeWorksmobileAdminService struct {
 	overview                       service.WorksmobileTenantOverview
 	credentials                    []service.WorksmobileInitialPasswordCredential