feat: expose auth identity migration reports

backend/internal/handler/admin/admin_basic_handlers_test.go

@@ -22,6 +22,8 @@ func setupAdminRouter() (*gin.Engine, *stubAdminService) {
 	redeemHandler := NewRedeemHandler(adminSvc, nil)
 
 	router.GET("/api/v1/admin/users", userHandler.List)
+	router.GET("/api/v1/admin/users/auth-identity-migration-reports/summary", userHandler.GetAuthIdentityMigrationReportSummary)
+	router.GET("/api/v1/admin/users/auth-identity-migration-reports", userHandler.ListAuthIdentityMigrationReports)
 	router.GET("/api/v1/admin/users/:id", userHandler.GetByID)
 	router.POST("/api/v1/admin/users", userHandler.Create)
 	router.PUT("/api/v1/admin/users/:id", userHandler.Update)
@@ -70,6 +72,16 @@ func TestUserHandlerEndpoints(t *testing.T) {
 	router.ServeHTTP(rec, req)
 	require.Equal(t, http.StatusOK, rec.Code)
 
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest(http.MethodGet, "/api/v1/admin/users/auth-identity-migration-reports/summary", nil)
+	router.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusOK, rec.Code)
+
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest(http.MethodGet, "/api/v1/admin/users/auth-identity-migration-reports?report_type=oidc_synthetic_email_requires_manual_recovery", nil)
+	router.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusOK, rec.Code)
+
 	rec = httptest.NewRecorder()
 	req = httptest.NewRequest(http.MethodGet, "/api/v1/admin/users/1", nil)
 	router.ServeHTTP(rec, req)

backend/internal/handler/admin/admin_service_stub_test.go

@@ -17,6 +17,7 @@ type stubAdminService struct {
 	proxies              []service.Proxy
 	proxyCounts          []service.ProxyWithAccountCount
 	redeems              []service.RedeemCode
+	migrationReports     []service.AuthIdentityMigrationReport
 	createdAccounts      []*service.CreateAccountInput
 	createdProxies       []*service.CreateProxyInput
 	updatedProxyIDs      []int64
@@ -123,6 +124,15 @@ func newStubAdminService() *stubAdminService {
 		proxies:     []service.Proxy{proxy},
 		proxyCounts: []service.ProxyWithAccountCount{{Proxy: proxy, AccountCount: 1}},
 		redeems:     []service.RedeemCode{redeem},
+		migrationReports: []service.AuthIdentityMigrationReport{
+			{
+				ID:         1,
+				ReportType: "oidc_synthetic_email_requires_manual_recovery",
+				ReportKey:  "u-1",
+				Details:    map[string]any{"user_id": 1},
+				CreatedAt:  now,
+			},
+		},
 	}
 }
 
@@ -167,6 +177,30 @@ func (s *stubAdminService) GetUserUsageStats(ctx context.Context, userID int64,
 	return map[string]any{"user_id": userID}, nil
 }
 
+func (s *stubAdminService) ListAuthIdentityMigrationReports(ctx context.Context, reportType string, page, pageSize int) ([]service.AuthIdentityMigrationReport, int64, error) {
+	if reportType == "" {
+		return s.migrationReports, int64(len(s.migrationReports)), nil
+	}
+	filtered := make([]service.AuthIdentityMigrationReport, 0, len(s.migrationReports))
+	for _, report := range s.migrationReports {
+		if strings.EqualFold(report.ReportType, reportType) {
+			filtered = append(filtered, report)
+		}
+	}
+	return filtered, int64(len(filtered)), nil
+}
+
+func (s *stubAdminService) GetAuthIdentityMigrationReportSummary(ctx context.Context) (*service.AuthIdentityMigrationReportSummary, error) {
+	summary := &service.AuthIdentityMigrationReportSummary{
+		ByType: map[string]int64{},
+	}
+	for _, report := range s.migrationReports {
+		summary.Total++
+		summary.ByType[report.ReportType]++
+	}
+	return summary, nil
+}
+
 func (s *stubAdminService) ListGroups(ctx context.Context, page, pageSize int, platform, status, search string, isExclusive *bool, sortBy, sortOrder string) ([]service.Group, int64, error) {
 	return s.groups, int64(len(s.groups)), nil
 }

backend/internal/handler/admin/user_handler.go

@@ -172,6 +172,31 @@ func (h *UserHandler) GetByID(c *gin.Context) {
 	response.Success(c, dto.UserFromServiceAdmin(user))
 }
 
+// GetAuthIdentityMigrationReportSummary returns aggregate migration report counts.
+// GET /api/v1/admin/users/auth-identity-migration-reports/summary
+func (h *UserHandler) GetAuthIdentityMigrationReportSummary(c *gin.Context) {
+	summary, err := h.adminService.GetAuthIdentityMigrationReportSummary(c.Request.Context())
+	if err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+	response.Success(c, summary)
+}
+
+// ListAuthIdentityMigrationReports returns paginated auth identity migration reports.
+// GET /api/v1/admin/users/auth-identity-migration-reports
+func (h *UserHandler) ListAuthIdentityMigrationReports(c *gin.Context) {
+	page, pageSize := response.ParsePagination(c)
+	reportType := strings.TrimSpace(c.Query("report_type"))
+
+	reports, total, err := h.adminService.ListAuthIdentityMigrationReports(c.Request.Context(), reportType, page, pageSize)
+	if err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+	response.Paginated(c, reports, total, page, pageSize)
+}
+
 // Create handles creating a new user
 // POST /api/v1/admin/users
 func (h *UserHandler) Create(c *gin.Context) {