Add auth identity legacy backfill and email sync

backend/internal/service/admin_service.go

@@ -630,6 +630,9 @@ func (s *adminServiceImpl) CreateUser(ctx context.Context, input *CreateUserInpu
 	if err := s.userRepo.Create(ctx, user); err != nil {
 		return nil, err
 	}
+	if err := ensureEmailAuthIdentitySync(ctx, s.userRepo, user.ID, user.Email); err != nil {
+		return nil, fmt.Errorf("sync email auth identity: %w", err)
+	}
 	s.assignDefaultSubscriptions(ctx, user.ID)
 	return user, nil
 }
@@ -665,6 +668,7 @@ func (s *adminServiceImpl) UpdateUser(ctx context.Context, id int64, input *Upda
 	oldConcurrency := user.Concurrency
 	oldStatus := user.Status
 	oldRole := user.Role
+	oldEmail := user.Email
 
 	if input.Email != "" {
 		user.Email = input.Email
@@ -697,6 +701,9 @@ func (s *adminServiceImpl) UpdateUser(ctx context.Context, id int64, input *Upda
 	if err := s.userRepo.Update(ctx, user); err != nil {
 		return nil, err
 	}
+	if err := replaceEmailAuthIdentitySync(ctx, s.userRepo, user.ID, oldEmail, user.Email); err != nil {
+		return nil, fmt.Errorf("sync email auth identity: %w", err)
+	}
 
 	// 同步用户专属分组倍率
 	if input.GroupRates != nil && s.userGroupRateRepo != nil {

backend/internal/service/admin_service_email_identity_sync_test.go

@@ -0,0 +1,95 @@
+//go:build unit
+
+package service
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+type ensureEmailCall struct {
+	userID int64
+	email  string
+}
+
+type replaceEmailCall struct {
+	userID   int64
+	oldEmail string
+	newEmail string
+}
+
+type emailSyncUserRepoStub struct {
+	*userRepoStub
+	ensureCalls  []ensureEmailCall
+	replaceCalls []replaceEmailCall
+}
+
+func (s *emailSyncUserRepoStub) EnsureEmailAuthIdentity(_ context.Context, userID int64, email string) error {
+	s.ensureCalls = append(s.ensureCalls, ensureEmailCall{userID: userID, email: email})
+	return nil
+}
+
+func (s *emailSyncUserRepoStub) ReplaceEmailAuthIdentity(_ context.Context, userID int64, oldEmail, newEmail string) error {
+	s.replaceCalls = append(s.replaceCalls, replaceEmailCall{
+		userID:   userID,
+		oldEmail: oldEmail,
+		newEmail: newEmail,
+	})
+	return nil
+}
+
+func (s *emailSyncUserRepoStub) GetLatestUsedAtByUserIDs(context.Context, []int64) (map[int64]*time.Time, error) {
+	return map[int64]*time.Time{}, nil
+}
+
+func (s *emailSyncUserRepoStub) GetLatestUsedAtByUserID(context.Context, int64) (*time.Time, error) {
+	return nil, nil
+}
+
+func TestAdminService_CreateUser_EnsuresEmailAuthIdentity(t *testing.T) {
+	repo := &emailSyncUserRepoStub{userRepoStub: &userRepoStub{nextID: 55}}
+	svc := &adminServiceImpl{userRepo: repo}
+
+	user, err := svc.CreateUser(context.Background(), &CreateUserInput{
+		Email:    "admin-created@example.com",
+		Password: "strong-pass",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, user)
+	require.Equal(t, []ensureEmailCall{{
+		userID: 55,
+		email:  "admin-created@example.com",
+	}}, repo.ensureCalls)
+	require.Empty(t, repo.replaceCalls)
+}
+
+func TestAdminService_UpdateUser_ReplacesEmailAuthIdentity(t *testing.T) {
+	repo := &emailSyncUserRepoStub{
+		userRepoStub: &userRepoStub{
+			user: &User{
+				ID:          91,
+				Email:       "before@example.com",
+				Role:        RoleUser,
+				Status:      StatusActive,
+				Concurrency: 3,
+			},
+		},
+	}
+	svc := &adminServiceImpl{userRepo: repo}
+
+	updated, err := svc.UpdateUser(context.Background(), 91, &UpdateUserInput{
+		Email: "after@example.com",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, updated)
+	require.Equal(t, "after@example.com", updated.Email)
+	require.Equal(t, []replaceEmailCall{{
+		userID:   91,
+		oldEmail: "before@example.com",
+		newEmail: "after@example.com",
+	}}, repo.replaceCalls)
+	require.Empty(t, repo.ensureCalls)
+}

backend/internal/service/user_service_email_identity_sync_test.go

@@ -0,0 +1,68 @@
+//go:build unit
+
+package service
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+type emailSyncMockUserRepo struct {
+	*mockUserRepo
+	ensureCalls  []ensureEmailCall
+	replaceCalls []replaceEmailCall
+}
+
+func (m *emailSyncMockUserRepo) EnsureEmailAuthIdentity(_ context.Context, userID int64, email string) error {
+	m.ensureCalls = append(m.ensureCalls, ensureEmailCall{userID: userID, email: email})
+	return nil
+}
+
+func (m *emailSyncMockUserRepo) ReplaceEmailAuthIdentity(_ context.Context, userID int64, oldEmail, newEmail string) error {
+	m.replaceCalls = append(m.replaceCalls, replaceEmailCall{
+		userID:   userID,
+		oldEmail: oldEmail,
+		newEmail: newEmail,
+	})
+	return nil
+}
+
+func (m *emailSyncMockUserRepo) GetLatestUsedAtByUserIDs(context.Context, []int64) (map[int64]*time.Time, error) {
+	return map[int64]*time.Time{}, nil
+}
+
+func (m *emailSyncMockUserRepo) GetLatestUsedAtByUserID(context.Context, int64) (*time.Time, error) {
+	return nil, nil
+}
+
+func TestUpdateProfile_ReplacesEmailAuthIdentityWhenEmailChanges(t *testing.T) {
+	repo := &emailSyncMockUserRepo{
+		mockUserRepo: &mockUserRepo{
+			getByIDUser: &User{
+				ID:          19,
+				Email:       "profile-before@example.com",
+				Username:    "tester",
+				Concurrency: 2,
+			},
+		},
+	}
+	svc := NewUserService(repo, nil, nil, nil)
+
+	newEmail := "profile-after@example.com"
+	updated, err := svc.UpdateProfile(context.Background(), 19, UpdateProfileRequest{
+		Email: &newEmail,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, updated)
+	require.Equal(t, newEmail, updated.Email)
+	require.Equal(t, 1, repo.updateCalls)
+	require.Equal(t, []replaceEmailCall{{
+		userID:   19,
+		oldEmail: "profile-before@example.com",
+		newEmail: "profile-after@example.com",
+	}}, repo.replaceCalls)
+	require.Empty(t, repo.ensureCalls)
+}