RP 테넌트 접근 정책 변경 시 기존 consent 자동 폐기

backend/internal/handler/client_tenant_access.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"baron-sso-backend/internal/domain"
+	"encoding/json"
 	"errors"
 	"sort"
 	"strings"
@@ -142,3 +143,98 @@ func isClientTenantAccessAllowed(profile *domain.UserProfileResponse, client dom
 	}
 	return clientTenantAccessAllowed(profile, client)
 }
+
+type clientStructuredScope struct {
+	Name      string `json:"name"`
+	Mandatory bool   `json:"mandatory"`
+	Locked    bool   `json:"locked"`
+}
+
+func mergeRequestedScopesWithClientRequirements(client domain.HydraClient, requested []string) []string {
+	combined := make([]string, 0, len(requested)+2)
+	combined = append(combined, requested...)
+	combined = append(combined, requiredClientScopes(client)...)
+
+	return normalizeScopesInConsentOrder(combined)
+}
+
+func normalizeScopesInConsentOrder(scopes []string) []string {
+	combined := make([]string, 0, len(scopes))
+	combined = append(combined, scopes...)
+
+	seen := make(map[string]struct{}, len(combined))
+	out := make([]string, 0, len(combined))
+
+	appendIfPresent := func(scope string) {
+		scope = strings.TrimSpace(scope)
+		if scope == "" {
+			return
+		}
+		if _, ok := seen[scope]; ok {
+			return
+		}
+		for _, candidate := range combined {
+			if strings.TrimSpace(candidate) != scope {
+				continue
+			}
+			seen[scope] = struct{}{}
+			out = append(out, scope)
+			return
+		}
+	}
+
+	appendIfPresent("openid")
+	appendIfPresent("tenant")
+
+	for _, scope := range combined {
+		scope = strings.TrimSpace(scope)
+		if scope == "" {
+			continue
+		}
+		if _, ok := seen[scope]; ok {
+			continue
+		}
+		seen[scope] = struct{}{}
+		out = append(out, scope)
+	}
+
+	return out
+}
+
+func requiredClientScopes(client domain.HydraClient) []string {
+	required := make([]string, 0, 4)
+	if clientTenantAccessRestricted(client.Metadata) {
+		required = append(required, "tenant")
+	}
+
+	if client.Metadata == nil {
+		return normalizeScopesInConsentOrder(required)
+	}
+
+	rawStructuredScopes, ok := client.Metadata["structured_scopes"]
+	if !ok || rawStructuredScopes == nil {
+		return normalizeScopesInConsentOrder(required)
+	}
+
+	rawBytes, err := json.Marshal(rawStructuredScopes)
+	if err != nil {
+		return normalizeScopesInConsentOrder(required)
+	}
+
+	var scopes []clientStructuredScope
+	if err := json.Unmarshal(rawBytes, &scopes); err != nil {
+		return normalizeScopesInConsentOrder(required)
+	}
+
+	for _, scope := range scopes {
+		name := strings.TrimSpace(scope.Name)
+		if name == "" {
+			continue
+		}
+		if scope.Mandatory || scope.Locked {
+			required = append(required, name)
+		}
+	}
+
+	return normalizeScopesInConsentOrder(required)
+}