브런치 병합 devfront 에러 수정

backend/internal/handler/auth_handler.go

@@ -4849,26 +4849,40 @@ func (h *AuthHandler) getKratosIdentity(sessionToken string) (string, map[string
 	req.Header.Set("X-Session-Token", sessionToken)
 
 	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return "", nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode >= 300 {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 2048))
-		return "", nil, fmt.Errorf("kratos whoami failed status=%d body=%s", resp.StatusCode, string(body))
+	if err == nil {
+		defer resp.Body.Close()
+		if resp.StatusCode == http.StatusOK {
+			var result struct {
+				Identity struct {
+					ID     string                 `json:"id"`
+					Traits map[string]interface{} `json:"traits"`
+				} `json:"identity"`
+			}
+			if err := json.NewDecoder(resp.Body).Decode(&result); err == nil {
+				return result.Identity.ID, result.Identity.Traits, nil
+			}
+		}
 	}
 
-	var result struct {
-		Identity struct {
-			ID     string                 `json:"id"`
-			Traits map[string]interface{} `json:"traits"`
-		} `json:"identity"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return "", nil, err
+	// 2. Kratos 실패 시 Hydra Introspection 시도 (OIDC Access Token 대응)
+	if h.Hydra != nil {
+		slog.Debug("[Auth] Kratos whoami failed, trying Hydra introspection", "token_prefix", sessionToken[:min(len(sessionToken), 10)])
+		introspection, err := h.Hydra.IntrospectToken(context.Background(), sessionToken)
+		if err == nil && introspection["active"] == true {
+			subject, _ := introspection["sub"].(string)
+			if subject != "" {
+				// Hydra는 Traits를 직접 주지 않으므로, Kratos Admin API로 상세 정보를 가져옴
+				identity, err := h.KratosAdmin.GetIdentity(context.Background(), subject)
+				if err == nil && identity != nil {
+					return identity.ID, identity.Traits, nil
+				}
+				// Identity 정보가 없더라도 최소한 Subject는 반환
+				return subject, map[string]interface{}{}, nil
+			}
+		}
 	}
 
-	return result.Identity.ID, result.Identity.Traits, nil
+	return "", nil, fmt.Errorf("invalid session or token")
 }
 
 func (h *AuthHandler) getKratosSessionID(sessionToken string) (string, error) {

backend/internal/service/hydra_admin_service.go

@@ -597,3 +597,34 @@ func (s *HydraAdminService) AcceptLoginRequest(ctx context.Context, challenge st
 
 	return &AcceptLoginRequestResponse{RedirectTo: hydraResp.RedirectTo}, nil
 }
+
+func (s *HydraAdminService) IntrospectToken(ctx context.Context, token string) (map[string]interface{}, error) {
+	endpoint := fmt.Sprintf("%s/admin/oauth2/introspect", strings.TrimRight(s.AdminURL, "/"))
+
+	data := url.Values{}
+	data.Set("token", token)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := s.HttpClient().Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 2048))
+		return nil, fmt.Errorf("hydra admin: introspect failed status=%d body=%s", resp.StatusCode, string(body))
+	}
+
+	var result map[string]interface{}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}