From a6e7f1253ce3c99a645ecfdc8a09411000d98555 Mon Sep 17 00:00:00 2001
From: chan <b24028@hanmaceng.co.kr>
Date: Tue, 3 Mar 2026 14:33:58 +0900
Subject: [PATCH] =?UTF-8?q?=ED=85=8C=EB=84=8C=ED=8A=B8=20=EA=B4=80?=
 =?UTF-8?q?=EB=A6=AC=EC=9E=90(Tenant=20Admin)=EC=9D=98=20=EB=B3=B8?=
 =?UTF-8?q?=EC=9D=B8=20=EC=86=8C=EC=9C=A0=20=ED=85=8C=EB=84=8C=ED=8A=B8=20?=
 =?UTF-8?q?=EB=AA=A9=EB=A1=9D=20=EC=A1=B0=ED=9A=8C=20=EB=B0=8F=20=EA=B4=80?=
 =?UTF-8?q?=EB=A6=AC=20=EA=B8=B0=EB=8A=A5=20=EA=B0=9C=EC=84=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/components/layout/RoleSwitcher.tsx    |  4 +--
 backend/cmd/server/main.go                    |  4 +--
 backend/internal/handler/auth_handler.go      | 15 ++++++---
 backend/internal/handler/tenant_handler.go    | 33 +++++++++++++++++--
 backend/internal/middleware/rbac.go           |  6 ++--
 backend/internal/service/tenant_service.go    |  1 +
 6 files changed, 47 insertions(+), 16 deletions(-)

diff --git a/adminfront/src/components/layout/RoleSwitcher.tsx b/adminfront/src/components/layout/RoleSwitcher.tsx
index 68e299c4..040d623a 100644
--- a/adminfront/src/components/layout/RoleSwitcher.tsx
+++ b/adminfront/src/components/layout/RoleSwitcher.tsx
@@ -40,7 +40,7 @@ const RoleSwitcher: FC = () => {
     super_admin: t("ui.admin.role.super_admin", "SUPER ADMIN"),
     tenant_admin: t("ui.admin.role.tenant_admin", "TENANT ADMIN"),
     rp_admin: t("ui.admin.role.rp_admin", "RP ADMIN"),
-    tenant_member: t("ui.admin.role.tenant_member", "TENANT MEMBER"),
+    user: t("ui.admin.role.user", "TENANT MEMBER"),
   };
 
   return (
@@ -110,7 +110,7 @@ const RoleSwitcher: FC = () => {
               "super_admin",
               "tenant_admin",
               "rp_admin",
-              "tenant_member",
+              "user",
             ] as const
           ).map((role) => (
             <button
diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index 777d51d7..fb2b361b 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -556,8 +556,8 @@ func main() {
 	admin.Get("/check", adminHandler.CheckAuth) // 기본 Admin 체크는 requireAdmin 없이 ApiKeyAuth로만 보호될 수 있음 (또는 추가 가능)
 	admin.Get("/stats", requireSuperAdmin, adminHandler.GetSystemStats)
 
-	// Tenant Management (Super Admin Only)
-	admin.Get("/tenants", requireSuperAdmin, tenantHandler.ListTenants)
+	// Tenant Management (Mixed roles, handler filters results)
+	admin.Get("/tenants", requireAdmin, tenantHandler.ListTenants)
 	admin.Post("/tenants", requireSuperAdmin, tenantHandler.CreateTenant)
 	admin.Post("/tenants/:id/approve", requireSuperAdmin, tenantHandler.ApproveTenant)
 	admin.Get("/tenants/:id", requireAdmin, middleware.RequireKetoPermission(middleware.RBACConfig{AuthHandler: authHandler, KetoService: ketoService}, "Tenant", "view"), tenantHandler.GetTenant)
diff --git a/backend/internal/handler/auth_handler.go b/backend/internal/handler/auth_handler.go
index 9f30dc1d..5e5b058f 100644
--- a/backend/internal/handler/auth_handler.go
+++ b/backend/internal/handler/auth_handler.go
@@ -3948,7 +3948,7 @@ func (h *AuthHandler) resolveCurrentProfile(c *fiber.Ctx) (*domain.UserProfileRe
 			cached, _ := h.RedisService.Get(cacheKey)
 			if cached != "" {
 				if json.Unmarshal([]byte(cached), &profile) == nil {
-					// Fall through to role override check
+					slog.Debug("Profile loaded from cache", "token", token[:10]+"...", "role", profile.Role)
 				}
 			}
 		}
@@ -3959,6 +3959,7 @@ func (h *AuthHandler) resolveCurrentProfile(c *fiber.Ctx) (*domain.UserProfileRe
 				profile, err = h.getKratosProfile(token)
 				if err != nil && h.Hydra != nil {
 					// Fallback to Hydra introspection
+					slog.Debug("Kratos session check failed, trying Hydra", "error", err)
 					profile, err = h.getHydraProfile(c.Context(), token)
 				}
 			} else if cookie != "" {
@@ -3970,12 +3971,12 @@ func (h *AuthHandler) resolveCurrentProfile(c *fiber.Ctx) (*domain.UserProfileRe
 	// 2. Role Override for real profile or fallback to Mock Profile
 	if profile != nil {
 		if isDev && mockRole != "" {
-			slog.Info("🔑 [AUTH_DEBUG] Overriding real profile role with mock role",
-				"email", profile.Email, "oldRole", profile.Role, "newRole", mockRole)
+			slog.Info("🔑 [AUTH] Overriding real profile role",
+				"email", profile.Email, "originalRole", profile.Role, "overriddenRole", mockRole)
 			profile.Role = mockRole
 		}
 	} else if isDev && mockRole != "" && token == "" && cookie == "" {
-		slog.Info("🔑 [AUTH_DEBUG] No real session found, using full Mock Auth", "role", mockRole)
+		slog.Info("🔑 [AUTH] Using full Mock Auth (no session)", "role", mockRole)
 		profile = &domain.UserProfileResponse{
 			ID:    "00000000-0000-0000-0000-000000000000",
 			Email: "mock@hmac.kr",
@@ -3988,6 +3989,7 @@ func (h *AuthHandler) resolveCurrentProfile(c *fiber.Ctx) (*domain.UserProfileRe
 	}
 
 	if profile == nil {
+		slog.Warn("No profile resolved", "token_len", len(token), "cookie_len", len(cookie), "mockRole", mockRole)
 		return nil, errors.New("invalid session (trace:resolve_profile)")
 	}
 
@@ -4012,7 +4014,10 @@ func (h *AuthHandler) resolveCurrentProfile(c *fiber.Ctx) (*domain.UserProfileRe
 	}
 
 	// 4. Save to Redis Cache (Short TTL)
-	if h.RedisService != nil && cacheKey != "" && err == nil {
+	// IMPORTANT: In dev mode, if role was overridden, we should NOT cache it under the token key
+	// or we should include the mock role in the cache key.
+	// For simplicity, let's skip caching if mockRole is present in dev.
+	if h.RedisService != nil && cacheKey != "" && err == nil && !(isDev && mockRole != "") {
 		if data, err := json.Marshal(profile); err == nil {
 			ttlStr := os.Getenv("PROFILE_CACHE_TTL")
 			ttl := 30 * time.Minute // Default TTL
diff --git a/backend/internal/handler/tenant_handler.go b/backend/internal/handler/tenant_handler.go
index 37f5b57b..56cf1bc4 100644
--- a/backend/internal/handler/tenant_handler.go
+++ b/backend/internal/handler/tenant_handler.go
@@ -109,9 +109,36 @@ func (h *TenantHandler) ListTenants(c *fiber.Ctx) error {
 		offset = 0
 	}
 
-	tenants, total, err := h.Service.ListTenants(c.Context(), limit, offset, parentId)
-	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+	var tenants []domain.Tenant
+	var total int64
+	var err error
+
+	profile, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
+
+	// If Tenant Admin, only list manageable tenants
+	if profile != nil && profile.Role == domain.RoleTenantAdmin {
+		slog.Info("Listing manageable tenants for tenant admin", "userID", profile.ID)
+		tenants, err = h.Service.ListManageableTenants(c.Context(), profile.ID)
+		if err != nil {
+			return errorJSON(c, fiber.StatusInternalServerError, "failed to list manageable tenants: "+err.Error())
+		}
+		total = int64(len(tenants))
+		// Apply basic pagination if needed (optional for usually small number of manageable tenants)
+		if offset < len(tenants) {
+			end := offset + limit
+			if end > len(tenants) {
+				end = len(tenants)
+			}
+			tenants = tenants[offset:end]
+		} else {
+			tenants = []domain.Tenant{}
+		}
+	} else {
+		// Super Admin case
+		tenants, total, err = h.Service.ListTenants(c.Context(), limit, offset, parentId)
+		if err != nil {
+			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		}
 	}
 
 	// Fetch member counts for all tenants in one query using slugs (company codes)
diff --git a/backend/internal/middleware/rbac.go b/backend/internal/middleware/rbac.go
index c1299116..aaa345ab 100644
--- a/backend/internal/middleware/rbac.go
+++ b/backend/internal/middleware/rbac.go
@@ -67,7 +67,7 @@ func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.
 		}
 
 		if !allowed {
-			slog.Warn("Keto permission denied", "userID", profile.ID, "namespace", namespace, "objectID", objectID, "relation", relation)
+			slog.Warn("Keto permission denied", "userID", profile.ID, "userRole", profile.Role, "namespace", namespace, "objectID", objectID, "relation", relation, "X-Test-Role", c.Get("X-Test-Role"))
 			return errorJSON(c, fiber.StatusForbidden, "forbidden: keto permission denied for "+namespace+":"+objectID)
 		}
 
@@ -111,13 +111,11 @@ func RequireRole(config RBACConfig) fiber.Handler {
 				"userRole", profile.Role,
 				"allowedRoles", config.AllowedRoles,
 				"path", c.Path(),
+				"X-Test-Role", c.Get("X-Test-Role"),
 			)
 			return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions")
 		}
 
-		// Store profile in locals for further use in handlers
-		c.Locals("user_profile", profile)
-
 		return c.Next()
 	}
 }
diff --git a/backend/internal/service/tenant_service.go b/backend/internal/service/tenant_service.go
index c3fceff7..553e9554 100644
--- a/backend/internal/service/tenant_service.go
+++ b/backend/internal/service/tenant_service.go
@@ -19,6 +19,7 @@ type TenantService interface {
 	GetTenantBySlug(ctx context.Context, slug string) (*domain.Tenant, error)
 	GetTenant(ctx context.Context, id string) (*domain.Tenant, error)
 	ListTenants(ctx context.Context, limit, offset int, parentID string) ([]domain.Tenant, int64, error)
+	ListManageableTenants(ctx context.Context, userID string) ([]domain.Tenant, error)
 	ApproveTenant(ctx context.Context, id string) error
 	SetKetoService(keto KetoService) // 추가
 }