정합성 위반사항 확인 및 조치기능 추가

backend/internal/handler/user_handler_test.go

@@ -1020,6 +1020,21 @@ func TestUserHandler_BulkUpdateUsers(t *testing.T) {
 		assert.Equal(t, domain.UserStatusInactive, worksmobile.upserts[0].Status)
 	})
 
+	t.Run("Fail - Super admin cannot assign tenant or RP admin roles", func(t *testing.T) {
+		for _, role := range []string{domain.RoleTenantAdmin, domain.RoleRPAdmin} {
+			payload := map[string]interface{}{
+				"userIds": []string{"u-1"},
+				"role":    role,
+			}
+			body, _ := json.Marshal(payload)
+			req := httptest.NewRequest("PUT", "/users/bulk", bytes.NewReader(body))
+			req.Header.Set("Content-Type", "application/json")
+
+			resp, _ := app.Test(req)
+			assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+		}
+	})
+
 	t.Run("Fail - Tenant admin cannot update role", func(t *testing.T) {
 		app := fiber.New()
 		h := &UserHandler{KratosAdmin: new(MockKratosAdmin)}
@@ -1141,6 +1156,33 @@ func TestUserHandler_UpdateUser_AdminOnlyField(t *testing.T) {
 	})
 }
 
+func TestUserHandler_UpdateUser_RejectsDeprecatedAdminRoles(t *testing.T) {
+	app := fiber.New()
+	mockKratos := new(MockKratosAdmin)
+	h := &UserHandler{KratosAdmin: mockKratos}
+	app.Put("/users/:id", func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "admin-1", Role: domain.RoleSuperAdmin})
+		return h.UpdateUser(c)
+	})
+
+	for _, role := range []string{domain.RoleTenantAdmin, domain.RoleRPAdmin} {
+		mockKratos.On("GetIdentity", mock.Anything, "u-1").Return(&service.KratosIdentity{
+			ID:     "u-1",
+			Traits: map[string]interface{}{"email": "user@test.com", "role": domain.RoleUser},
+			State:  "active",
+		}, nil).Once()
+
+		payload := map[string]interface{}{"role": role}
+		body, _ := json.Marshal(payload)
+		req := httptest.NewRequest("PUT", "/users/u-1", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+
+		resp, _ := app.Test(req)
+		assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	}
+	mockKratos.AssertExpectations(t)
+}
+
 func TestUserHandler_UpdateUser_LoginIDSync(t *testing.T) {
 	t.Run("Success - Sync LoginID from namespaced metadata", func(t *testing.T) {
 		app := fiber.New()