feat: improve Worksmobile tenant sync handling

backend/internal/service/user_group_service_test.go

@@ -139,6 +139,27 @@ func (m *MockUserRepository) DB() *gorm.DB {
 	return nil
 }
 
+type fakeUserGroupWorksmobileSyncer struct {
+	userUpserts []domain.User
+}
+
+func (f *fakeUserGroupWorksmobileSyncer) EnqueueTenantUpsertIfInScope(ctx context.Context, tenant domain.Tenant) error {
+	return nil
+}
+
+func (f *fakeUserGroupWorksmobileSyncer) EnqueueTenantDeleteIfInScope(ctx context.Context, tenant domain.Tenant) error {
+	return nil
+}
+
+func (f *fakeUserGroupWorksmobileSyncer) EnqueueUserUpsertIfInScope(ctx context.Context, user domain.User) error {
+	f.userUpserts = append(f.userUpserts, user)
+	return nil
+}
+
+func (f *fakeUserGroupWorksmobileSyncer) EnqueueUserDeleteIfInScope(ctx context.Context, user domain.User) error {
+	return nil
+}
+
 type MockKetoOutboxRepository struct {
 	mock.Mock
 }
@@ -337,6 +358,57 @@ func TestUserGroupService_AddMemberUpsertsLocalReadModelWhenMissing(t *testing.T
 	mockKratos.AssertExpectations(t)
 }
 
+func TestUserGroupService_AddMemberEnqueuesWorksmobileUserSync(t *testing.T) {
+	mockOutbox := new(MockKetoOutboxRepositoryShared)
+	mockUserGroupRepo := new(MockUserGroupRepository)
+	mockUserRepo := new(MockUserRepository)
+	mockTenantRepo := new(MockTenantRepository)
+	mockKratos := new(MockKratosAdminServiceShared)
+	worksmobile := &fakeUserGroupWorksmobileSyncer{}
+	svc := NewUserGroupService(mockUserGroupRepo, mockUserRepo, mockTenantRepo, nil, mockOutbox, mockKratos)
+	svc.SetWorksmobileSyncer(worksmobile)
+
+	groupID := "group-1"
+	userID := "user-1"
+	tenantID := "tenant-1"
+
+	mockUserGroupRepo.On("FindByID", mock.Anything, groupID).Return(&domain.UserGroup{ID: groupID, TenantID: tenantID, Name: "Sales"}, nil)
+	mockUserRepo.On("FindByID", mock.Anything, userID).Return(&domain.User{
+		ID:     userID,
+		Email:  "user@test.com",
+		Name:   "User Test",
+		Status: "active",
+	}, nil)
+	mockTenantRepo.On("FindByID", mock.Anything, tenantID).Return(&domain.Tenant{ID: tenantID, Slug: "tenant-slug"}, nil)
+	mockKratos.On("GetIdentity", mock.Anything, userID).Return(&KratosIdentity{
+		ID:     userID,
+		Traits: map[string]any{"email": "user@test.com"},
+		State:  "active",
+	}, nil)
+	mockKratos.On("UpdateIdentity", mock.Anything, userID, mock.Anything, "active").Return(&KratosIdentity{
+		ID:     userID,
+		Traits: map[string]any{"email": "user@test.com", "tenant_id": tenantID, "department": "Sales"},
+		State:  "active",
+	}, nil)
+	mockOutbox.On("Create", mock.Anything, mock.MatchedBy(func(e *domain.KetoOutbox) bool {
+		return e.Namespace == "Tenant" && e.Object == groupID && e.Relation == "members" && e.Subject == "User:"+userID
+	})).Return(nil).Once()
+	mockOutbox.On("Create", mock.Anything, mock.MatchedBy(func(e *domain.KetoOutbox) bool {
+		return e.Namespace == "Tenant" && e.Object == tenantID && e.Relation == "members" && e.Subject == "User:"+userID
+	})).Return(nil).Once()
+
+	err := svc.AddMember(context.Background(), groupID, userID)
+
+	assert.NoError(t, err)
+	assert.Len(t, worksmobile.userUpserts, 1)
+	assert.Equal(t, userID, worksmobile.userUpserts[0].ID)
+	assert.NotNil(t, worksmobile.userUpserts[0].TenantID)
+	assert.Equal(t, tenantID, *worksmobile.userUpserts[0].TenantID)
+	assert.Equal(t, "Sales", worksmobile.userUpserts[0].Department)
+	mockOutbox.AssertExpectations(t)
+	mockKratos.AssertExpectations(t)
+}
+
 func TestUserGroupService_AssignRoleToTenant(t *testing.T) {
 	mockOutbox := new(MockKetoOutboxRepositoryShared)
 	mockUserGroupRepo := new(MockUserGroupRepository)