From 407511ea13af43e09303d8bf12045bbe16004823 Mon Sep 17 00:00:00 2001
From: root <root@disong.localdomain>
Date: Mon, 14 Sep 2026 13:27:54 +0900
Subject: [PATCH] =?UTF-8?q?fix:=20support=20API=20=EC=97=B0=EA=B2=B0=20?=
 =?UTF-8?q?=EC=98=A4=EB=A5=98=20=EC=A7=84=EB=8B=A8=20=EA=B0=9C=EC=84=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy-staging.yml           |  2 +-
 apps/web/src/pages/_app.tsx                   |  7 +---
 apps/web/src/pages/api/support/access.ts      | 36 ++++++++++++-------
 .../workspaces/[workspaceCode]/submit.ts      |  4 +++
 apps/web/src/server/support-external.ts       |  8 +++--
 5 files changed, 35 insertions(+), 22 deletions(-)

diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml
index 8f97c01..8ea5639 100644
--- a/.gitea/workflows/deploy-staging.yml
+++ b/.gitea/workflows/deploy-staging.yml
@@ -87,7 +87,7 @@ jobs:
           sso_authorization_endpoint="${SSO_AUTHORIZATION_ENDPOINT:-https://sso.hmac.kr/oidc/oauth2/auth}"
           sso_token_endpoint="${SSO_TOKEN_ENDPOINT:-https://sso.hmac.kr/oidc/oauth2/token}"
           sso_userinfo_endpoint="${SSO_USERINFO_ENDPOINT:-https://sso.hmac.kr/oidc/userinfo}"
-          sso_scope="${SSO_SCOPE:-openid profile email}"
+          sso_scope="${SSO_SCOPE:-openid profile email tenants}"
           sso_client_id="${SSO_CLIENT_ID_SECRET:-${SSO_CLIENT_ID_VAR:-}}"
           sso_client_secret="$SSO_CLIENT_SECRET"
           jwt_secret="$JWT_SECRET"
diff --git a/apps/web/src/pages/_app.tsx b/apps/web/src/pages/_app.tsx
index 8a53104..557787f 100644
--- a/apps/web/src/pages/_app.tsx
+++ b/apps/web/src/pages/_app.tsx
@@ -76,12 +76,7 @@ function App({ Component, pageProps }: AppPropsWithLayout) {
         ).join('')
       : readCookie('baron_sso_debug_tenants');
 
-    if (!cookie) {
-      window.console.warn(
-        '[SSO OAuth debug] callback 디버그 쿠키가 없습니다. 로그아웃 후 다시 로그인하세요.',
-      );
-      return;
-    }
+    if (!cookie) return;
 
     try {
       const data = JSON.parse(
diff --git a/apps/web/src/pages/api/support/access.ts b/apps/web/src/pages/api/support/access.ts
index e45784d..d9752ac 100644
--- a/apps/web/src/pages/api/support/access.ts
+++ b/apps/web/src/pages/api/support/access.ts
@@ -17,22 +17,34 @@ import { createNextApiHandler } from '@/server/api-handler';
 import { getSupportAuthHeaders } from '@/server/support-auth';
 import { supportExternalUrl } from '@/server/support-external';
 
+const getErrorMessage = (error: unknown) =>
+  error instanceof Error ? error.message : String(error);
+
 const handler = createNextApiHandler({
   GET: async (req, res) => {
+    const query =
+      req.query.candidates ?
+        '?candidates=1'
+      : req.query.management ?
+        '?management=1'
+      : '';
+    const target = supportExternalUrl('/access') + query;
+
     try {
-      const query =
-        req.query.candidates ?
-          '?candidates=1'
-        : req.query.management ?
-          '?management=1'
-        : '';
-      const response = await fetch(
-        supportExternalUrl('/access') + query,
-        { headers: getSupportAuthHeaders(req) },
-      );
-      const data = (await response.json()) as unknown;
+      const response = await fetch(target, { headers: getSupportAuthHeaders(req) });
+      const raw = await response.text();
+      let data: unknown = {};
+      try {
+        data = raw.trim() ? JSON.parse(raw) : {};
+      } catch {
+        data = { message: raw.trim().slice(0, 1000) };
+      }
       return res.status(response.status).json(data);
-    } catch {
+    } catch (error) {
+      console.error('[support access] upstream request failed', {
+        target,
+        error: getErrorMessage(error),
+      });
       return res.status(503).json({
         message: '권한 정보를 확인할 수 없습니다.',
       });
diff --git a/apps/web/src/pages/api/support/workspaces/[workspaceCode]/submit.ts b/apps/web/src/pages/api/support/workspaces/[workspaceCode]/submit.ts
index 8a2bf83..629f9ab 100644
--- a/apps/web/src/pages/api/support/workspaces/[workspaceCode]/submit.ts
+++ b/apps/web/src/pages/api/support/workspaces/[workspaceCode]/submit.ts
@@ -288,6 +288,10 @@ const handler = createNextApiHandler({
 
       return res.status(response.status).json(await readJsonOrMessage(response));
     } catch (error) {
+      console.error('[support submit] upstream request failed', {
+        workspaceCode,
+        error: error instanceof Error ? error.message : String(error),
+      });
       return res.status(isUploadSizeError(error) ? 413 : 502).json({
         message:
           isUploadSizeError(error) ?
diff --git a/apps/web/src/server/support-external.ts b/apps/web/src/server/support-external.ts
index 639c97c..1318d27 100644
--- a/apps/web/src/server/support-external.ts
+++ b/apps/web/src/server/support-external.ts
@@ -6,9 +6,11 @@
  * URL such as `http://127.0.0.1:8010`; both forms are supported here.
  */
 const configuredBaseUrl =
-  process.env.SUPPORT_CONSOLE_API_BASE_URL ??
-  process.env.SUPPORT_API_BASE_URL ??
-  'https://feedback.hmac.kr/api/support';
+  (
+    process.env.SUPPORT_CONSOLE_API_BASE_URL ??
+    process.env.SUPPORT_API_BASE_URL ??
+    'https://feedback.hmac.kr/api/support'
+  ).trim() || 'https://feedback.hmac.kr/api/support';
 
 export const supportExternalUrl = (path: string) => {
   const baseUrl = configuredBaseUrl.replace(/\/$/, '');