Dev to Main

[Doubtagain]

주요 반영 사항

서버리스 구조 반영

백엔드 인프라 이전에 맞춰 해당 프로젝트에 반영

JWT 이슈 해결

라우터 보안 취약점 해결, iron-session 처리하여 토큰 암호화 진행

뒤로가기 버튼 없는 Privacy Policy 화면 작업

경로 - /terms 에 관련 내용 반영

추후 /terms 형식이 아닌 Agent 기반으로 처리 고려

Cloudflare Pages(workers)로 프론트 배포 이전

현재 dev(staging)에는 반영되어있으나, main(release)에는 반영되어 있지 않음.

해당 부분 깃허브 CI/CD에 변수 PROD 로 반영되어있음.

배너 부분을 제외한 나머지 부분의 웹뷰화면 처리

기존 /mpa 반영 계획에서, 대안 반영 폐기의 일환으로 위 상태를 제거한 아래 웹뷰화면 처리 완료
/mpa/~~ 형식으로 접근 가능

업데이트 시간 반영

서버리스 구조 반영에서 바뀐 동기화 방식으로 인해 업데이트 시간의 실시간화가 떨어짐.
목표하는 성능을 요구하고자 이에 대해 동기화 시간을 좀 더 짧게 주는 방식으로 해결

Minor Fix

/graduation-progress
웹에서도 모바일 화면처럼 보이게 max-width을 조정했습니다.

Check-list

• 현재까지 구현한 기능 에러케이스 존재하는지 극단적으로 테스트하며 확인

Summary by CodeRabbit

릴리스 노트

• New Features

  • Cloudflare Workers 배포 파이프라인 추가
  • MPA(모바일 웹뷰) 전용 레이아웃 및 여러 MPA 페이지 추가
  • 이용약관(개인정보처리방침) 페이지 추가

• Improvements

  • 학교 계정 연동을 비동기 잡 기반으로 재구성한 재동기화 흐름 도입
  • 세션 리프레시 및 토큰 갱신 흐름 개선 (자동 갱신 지원)
  • 페이지 가시성 시 프로필 자동 새로고침 추가
  • 웹뷰-네이티브 브릿지 통합 및 네이티브 내비게이션 지원

• Documentation

  • MPA 학교 인증 웹링크 핸드오프 명세서 추가

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
chukchuk-haksa	Ready	Preview, Comment	May 12, 2026 3:11pm
chukchuk-haksa (staging)	Ready	Preview, Comment	May 12, 2026 3:11pm

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

워크스루

이 PR은 모바일 네이티브 앱과 웹뷰 간 세션 교환을 통해 포탈링크 기반 인증을 구현하고, 클라이언트 저장소에서 서버 기반 Iron Session으로 마이그레이션하며, Cloudflare Workers 배포를 추가합니다. 기존 사용자 인증 흐름에서 직접 API 호출 방식에서 비동기 작업 폴링 기반 흐름으로 전환되며, 새로운 POST /api/session 엔드포인트를 통해 네이티브 앱에서 발급된 토큰을 서버 세션으로 교환합니다.

---

변경 사항

MPA WebView 포탈링크 통합 및 인증

Layer / File(s)	Summary
세션 및 인증 기반 구조 src/lib/auth/session.ts, src/lib/auth/token.ts, src/features/auth/tokenStore.ts, src/features/auth/contexts/AuthContext.tsx, src/features/auth/hooks/useAuthCheck.ts, src/features/auth/services/authService.ts	Iron Session 기반 서버 세션 저장소(httpOnly, 한 달 maxAge), 인메모리 토큰 저장소(구독 메커니즘), 클라이언트 AuthContext(세션 하이드레이션, clearAuth, refresh)를 추가하고 레거시 클라이언트 저장소 API(sessionStorage/document.cookie 접근)를 제거합니다.
포탈링크 비동기 작업 시스템 src/features/portal-link/services/portalLinkService.ts, src/features/portal-link/hooks/usePortalLinkJobPolling.ts, src/features/portal-link/hooks/usePortalLinkMutation.ts, src/features/portal-link/hooks/usePortalLinkSummary.ts, src/features/portal-link/utils/errorMapping.ts, src/config/environment.ts	포탈링크 작업 생성(submitPortalLink), 2초 간격 폴링(timeout 관리 포함), 작업 상태/요약 조회, 에러 코드 기반 메시지 매핑, 환경 변수 기반 timeout 설정을 구현합니다.
WebView 브릿지 및 네이티브 통신 src/lib/webview/bridge.ts, src/lib/webview/index.ts	WebView 런타임 감지, 브릿지 메시지 전송(Sentry 예외 처리 포함), navigateNative() 유틸리티를 추가합니다.
MPA 경로 및 레이아웃 src/constants/routes.ts, src/app/(mpa)/layout.tsx, src/app/(mpa)/layout.module.scss, src/app/(mpa)/mpa/home/page.tsx, src/app/(mpa)/mpa/me/page.tsx, src/app/(mpa)/mpa/resync/login/page.tsx, src/app/(mpa)/mpa/resync/scraping/page.tsx	/mpa 경로 상수, ProtectedRoute 래핑 레이아웃, 홈/설정/리싱크 로그인/스크래핑 페이지를 추가합니다.
기존 페이지 재작성 - 포탈링크 폴링 src/app/(funnel)/scraping/page.tsx, src/app/(funnel)/portal-login/..., src/app/(funnel)/contexts/FunnelContext.tsx, src/app/resync/scraping/page.tsx, src/app/resync/login/page.tsx, src/features/auth/apis/queries/usePortalLoginMutation.ts	agreement/scraping/resync 페이지를 포탈링크 폴링 기반으로 재작성하고 FunnelContext에 jobId 상태를 추가하며 usePortalLinkMutation으로 작업 생성을 수행하고 레거시 mutation을 제거합니다.
세션 교환 및 갱신 API 엔드포인트 src/app/api/session/route.ts, src/app/api/session/refresh/route.ts	POST /api/session(토큰 교환, isPortalLinked=false 강제), GET /api/session(세션 조회), DELETE /api/session(로그아웃), POST /api/session/refresh(토큰 갱신)를 구현합니다.
OAuth 콜백 및 성공 페이지 src/app/auth/callback/route.ts, src/app/auth/success/page.tsx	콜백에서 OIDC provider 매개변수로 authService.login() 호출 후 세션 저장, 성공 페이지에서 /api/session 페칭을 통해 세션 하이드레이션을 수행합니다.
OpenAPI 스키마 및 데이터 계약 swagger/openapi-dev.json, src/shared/api/data-contracts.ts	포탈링크 작업 요청/응답(LinkRequest, AcceptedResponse), 작업 상태/요약(JobStatusResponse, JobSummaryResponse, StudentInfoSummary), SignInRequest에 OIDC provider 필드를 추가합니다.
API 클라이언트 및 HTTP 구성 src/shared/api/client.ts, src/shared/api/domain/portallinkcontroller/PortalLinkController.ts, src/shared/api/domain/portaljobquerycontroller/PortalJobQueryController.ts, src/shared/api/configs/httpConfig.ts	포탈링크/포탈작업 컨트롤러, 토큰 저장소 기반 인증 주입, 401 응답 시 토큰 갱신 후 재시도 로직을 추가합니다.
대시보드 카드 네비게이션 지원 src/features/dashboard/components/GraduationRequirementCard/GraduationRequirementCard.tsx, src/features/dashboard/components/DualMajorRequirementCard/DualMajorRequirementCard.tsx, src/features/dashboard/components/SyncUpdateButton/SyncUpdateButton.tsx, src/features/dashboard/hooks/useRefreshProfileOnVisible.ts	선택적 onNavigate 콜백(MPA 네비게이션용), lastSyncedAt ISO 파싱, 문서 가시성 변경 시 React Query 캐시 무효화를 추가합니다.
환경 설정 및 상수 src/config/environment.ts, src/constants/portal-link.ts, src/constants/routes.ts, src/constants/index.ts, src/constants/token.ts	PORTAL_LINK_TIMEOUT_MS, RESYNC_JOB_ID_KEY, MPA 경로, Cloudflare 환경 감지(CF_PAGES_BRANCH, CF_PAGES)를 추가하고 레거시 토큰 상수를 제거합니다.
Cloudflare Workers 배포 설정 wrangler.jsonc, open-next.config.ts, .github/workflows/deploy-cloudflare.yml, package.json	Wrangler 구성(staging/production 환경), OpenNext Cloudflare 어댑터, GitHub Actions 배포 워크플로우, npm 스크립트를 추가합니다.
유틸리티 및 기타 src/shared/utils/idempotency.ts, src/app/(main)/graduation-progress/layout.module.scss, src/app/(main)/main/page.tsx, src/app/layout.tsx	멱등성 키 생성, 레이아웃 유틸리티 믹스인 통일, 프로필 갱신 훅 호출, AuthProvider 래핑을 추가합니다.
문서화 및 정리 docs/mpa-school-link-handoff.md, src/app/terms/page.tsx, .gitignore, 기타 정리	MPA 스펙 문서(backend/mobile 요구사항, 검증 체크리스트), 약관 페이지, Cloudflare/.wrangler 디렉토리 무시, 테스트 토큰/콘솔 로그 제거를 수행합니다.

---

Sequence Diagram

sequenceDiagram
  participant NativeApp
  participant BrowserWebView
  participant BFF as Backend
  participant PortalAPI as PortalJobService

  NativeApp->>BrowserWebView: open /mpa/resync/login (with session exchange)
  BrowserWebView->>BFF: POST /api/session {accessToken, refreshToken}
  BFF-->>BrowserWebView: 200 {ok}
  BrowserWebView->>BFF: POST /portal/link (idempotency key)
  BFF->>PortalAPI: createPortalLinkJob
  PortalAPI-->>BFF: {job_id}
  BrowserWebView->>BFF: poll /portal/link/jobs/{job_id}
  BFF->>PortalAPI: getJobStatus / getJobSummary
  PortalAPI-->>BFF: {status / studentInfo}
  BFF-->>BrowserWebView: final redirect or bridge message (done:portal-link)

Loading

---

예상 코드 리뷰 노력

🎯 4 (Complex) | ⏱️ ~60 minutes

---

관련된 가능성 있는 PR

• gyumong/chukchuk-haksa#167: 같은 POST /api/session 흐름에서 네이티브 브릿지 시크릿 게이트 제거 및 관련 변경 일치.
• gyumong/chukchuk-haksa#166: MPA/webview 통합과 포탈링크 폴링 관련 파일 및 문서 변경이 겹칩니다.
• gyumong/chukchuk-haksa#165: WebView 브릿지와 포탈링크 폴링/타임아웃 처리 등 겹치는 기능 변경이 존재합니다.

---

시

🐰 쿠키와 토큰을 가볍게 바구니에 담고,
웹뷰 속으로 달려가 손을 내밀면,
포탈링크가 숫자를 세며 일한다네,
브릿지에 메세지 띄워 네이티브와 악수,
구름 위에 배포되어 조용히 춤춘다 ☁️🍃

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev

[coderabbitai]

Actionable comments posted: 25

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

src/shared/api/http-client.ts (1)

1-11: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

생성된 API 파일의 수동 수정 방지를 위한 CI/CD 검증 추가를 고려하세요.

현재 프로젝트는 yarn api:update 스크립트로 자동 생성된 API 클라이언트를 관리하고 있습니다. 다만 CI/CD 파이프라인에서 생성된 파일의 무결성을 검증하는 단계가 없으므로, GitHub Actions에 다음과 같은 검증 단계를 추가하면 실수로 인한 수동 수정을 방지할 수 있습니다:

• 풀 리퀘스트 시 src/shared/api/ 파일 변경 감지 후 yarn api:update 실행
• 생성된 파일과 실제 커밋된 파일 비교하여 일치 여부 확인
• 불일치 시 자동 수정 또는 PR 빌드 실패 처리

현재 autofix.ci 워크플로우에 이 검증 로직을 추가하는 것이 가장 효과적입니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/shared/api/http-client.ts` around lines 1 - 11, Add a CI validation step
to ensure generated API files under src/shared/api are not manually edited: in
the autofix.ci workflow add a job that runs yarn api:update, then diffs the
regenerated output against the committed files in src/shared/api (fail the job
or auto-commit fixes when differences are found); reference the existing script
name yarn api:update and the src/shared/api path so the workflow explicitly
detects PRs that modify those files and either fails the build or applies the
regenerated changes.

src/app/(funnel)/contexts/FunnelContext.tsx (1)

27-41: 🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

중복된 훅을 정리하세요.

useStudentInfo()와 useFunnelContext()가 동일한 컨텍스트를 반환하고 있습니다. 두 훅이 공존하면 어느 것을 사용해야 할지 혼란을 줄 수 있습니다.

useStudentInfo()는 이제 studentInfo만 제공하는 것이 아니라 jobId도 포함하므로 이름이 부정확합니다. 코드베이스 전체에서 useFunnelContext()로 마이그레이션하고 useStudentInfo()를 제거하거나, 유지해야 한다면 deprecated 처리를 권장합니다.

♻️ 제안: 중복 훅 제거

-export function useStudentInfo() {
-  const context = useContext(FunnelContext);
-  if (!context) {
-    throw new Error('useStudentInfo must be used within a FunnelProvider');
-  }
-  return context;
-}
-
 export function useFunnelContext() {
   const context = useContext(FunnelContext);
   if (!context) {
     throw new Error('useFunnelContext must be used within a FunnelProvider');
   }
   return context;
 }

그 후 index.ts에서도 제거:

-export { FunnelProvider, useStudentInfo, useFunnelContext } from './FunnelContext';
+export { FunnelProvider, useFunnelContext } from './FunnelContext';

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/app/`(funnel)/contexts/FunnelContext.tsx around lines 27 - 41, The two
hooks useStudentInfo and useFunnelContext both return the same FunnelContext and
are redundant; remove useStudentInfo (or mark it deprecated) and update
exports/imports to use only useFunnelContext. Locate useStudentInfo,
useFunnelContext and the FunnelContext provider in FunnelContext.tsx, delete the
useStudentInfo function (or replace it with a thin deprecated wrapper that calls
useFunnelContext and logs a deprecation warning), and update index.ts exports to
stop exporting useStudentInfo and ensure all internal imports are migrated to
useFunnelContext.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy-cloudflare.yml:
- Around line 35-53: The current secret mapping repeatedly uses ternary-style
expressions with needs.resolve-env.outputs.name; to simplify switch the job to
use GitHub Environments and reference environment-scoped secrets directly by
setting the job's environment to needs.resolve-env.outputs.name (keep
NEXT_PUBLIC_DEPLOY_ENV as is), then replace expressions like
NEXT_PUBLIC_API_BASE_URL: ${{ needs.resolve-env.outputs.name == 'production' &&
secrets.PROD_NEXT_PUBLIC_API_BASE_URL ||
secrets.STAGING_NEXT_PUBLIC_API_BASE_URL }} with a single secret reference such
as NEXT_PUBLIC_API_BASE_URL: ${{ secrets.NEXT_PUBLIC_API_BASE_URL }} (do this
for each variable: NEXT_PUBLIC_BASE_URL, NEXT_PUBLIC_SUPABASE_URL,
NEXT_PUBLIC_SUPABASE_ANON_KEY, NEXT_PUBLIC_JAVASCRIPT_KEY,
NEXT_PUBLIC_SENTRY_DSN, REST_API_KEY, CLIENT_SECRET, SUPABASE_PROJECT_ID,
SESSION_SECRET, SENTRY_AUTH_TOKEN, UPSTASH_REDIS_REST_URL,
UPSTASH_REDIS_REST_TOKEN, LAMBDA_DEV_URL, AWS_URL) after creating matching
secrets in the production and staging Environments.

In `@docs/mpa-school-link-handoff.md`:
- Around line 14-31: The fenced code blocks in the document are missing language
tags and missing blank lines before/after fences and headings, causing
markdown-lint warnings; update each triple-backtick block (the examples showing
the MPA flow) to include an appropriate language tag (e.g., ```text or ```bash)
and ensure there is a blank line above and below each fenced block and any
headings adjacent to them (apply the same fixes to the other occurrences you
noted around the blocks at ~86-92, 129-137, 157-171); run the markdown linter to
confirm warnings are resolved.
- Around line 17-19: Unify the POST /api/session contract so the request
example, parameter description, and response/security notes agree: decide
whether the server accepts the isPortalLinked boolean or ignores it and always
sets it to false, then update the request body example (accessToken,
refreshToken, isPortalLinked), the textual description, and the
response/security sentence about forced false to match that decision; ensure
references to POST /api/session, the isPortalLinked field, and the BFF behavior
(sealData → Set-Cookie: cchaksa_session) are consistent across the doc so mobile
implementers get one clear contract.

In `@next.config.mjs`:
- Around line 13-15: The images.unoptimized = true setting disables Next.js
image optimization; either configure Cloudflare Images integration or a CDN
image service: add the Cloudflare IMAGES binding in your Workers config, set
next.config.mjs images to use a custom loader (e.g., replace unoptimized:true
with loader:'custom' and appropriate loader configuration), and enable image
optimization options in open-next.config.ts (or alternatively wire a different
CDN/image service and update next.config.mjs accordingly). Ensure references to
IMAGES binding, next.config.mjs images, loader:'custom', and open-next.config.ts
are updated so the `@opennextjs/cloudflare` integration (or chosen CDN) performs
image optimization.

In `@package.json`:
- Line 60: The dependency version for `@opennextjs/cloudflare` is too loose
("^1"); update package.json to a stricter pin to prevent unexpected upgrades by
replacing "^1" with either a tilde-pinned version "~1.19.8" or an exact version
"1.19.8" (use the exact string "1.19.8" if you want full immutability), then run
your package manager install to update lockfiles; locate the dependency entry
for "@opennextjs/cloudflare" in package.json to make this change.
- Line 83: The package.json dependency for "wrangler" uses a permissive semver
range ("wrangler": "^4") that allows vulnerable 4.x releases; update the
constraint to require a minimum fixed version by changing the version specifier
for "wrangler" to ">=4.59.1" or a caret range that starts at the patched release
(for example "wrangler": "^4.59.1") so installs will not pick vulnerable
4.0–4.59.0 releases; update package.json accordingly and run your lockfile
update (npm/yarn/pnpm install) to regenerate the lockfile.

In
`@src/app/`(funnel)/portal-login/components/PortalLoginForm/PortalLoginForm.tsx:
- Around line 30-44: The code currently shows an error UI but does not notify
the parent via onError when mutateAsync resolves successfully but returns no
job_id; update the success branch after calling linkMutation.mutateAsync (where
newJobId is checked) to call onError with an Error (e.g., new Error('no job_id
in response')) in the else path after setErrorMessage, so the parent receives
the failure (keep existing setJobId/onSuccess path unchanged), and change the
catch parameter from err: any to err: unknown and derive the message with err
instanceof Error ? err.message : String(err) before calling setErrorMessage and
onError to improve type safety; reference functions: linkMutation.mutateAsync,
setJobId, onSuccess, setErrorMessage, onError.

In `@src/app/`(funnel)/scraping/page.tsx:
- Around line 23-31: The effect currently triggers on any new summaryData
reference and can call setStudentInfo and router.push multiple times; add a
guard (e.g., a useRef like processedStudentRef) to record the last-handled
student identifier or a serialized studentInfo and only run the body when
summaryData.data.studentInfo exists and differs from
processedStudentRef.current; inside the guarded block call setStudentInfo,
optionally setUser({ id: jobId }) if jobId, call
router.push(ROUTES.FUNNEL.AGREEMENT), and update processedStudentRef.current to
the current student key so subsequent background refetches with identical data
won’t re-trigger actions (keep dependencies unchanged except the ref).

In `@src/app/api/session/refresh/route.ts`:
- Around line 16-20: The fetch call to `${getApiBaseUrl()}/api/auth/refresh` in
the route handler has no timeout and can hang indefinitely; wrap the request in
an AbortController with a timer (e.g., setTimeout to call controller.abort()
after a reasonable ms value), pass controller.signal into the fetch options, and
clear the timer on success or error; update the fetch invocation site (the POST
calling fetch with JSON.stringify({ refreshToken: session.refreshToken })) to
use this AbortController pattern and handle the abort error path cleanly.

In `@src/app/auth/callback/route.ts`:
- Around line 30-32: The current guard allows null for isPortalLinked; update
the validation in route.ts so isPortalLinked is explicitly validated as a
boolean before proceeding: in the block that throws AuthError for
missing/malformed user, check that typeof isPortalLinked === 'boolean' (or use
isPortalLinked != null && typeof isPortalLinked === 'boolean') and that
refreshToken exists, and throw AuthError('User is missing or malformed.') when
the boolean check fails; reference the isPortalLinked variable and the existing
AuthError throw to locate and replace the condition.

In `@src/app/auth/success/page.tsx`:
- Around line 14-28: The component is using inline styles/Tailwind instead of
SCSS modules; create a corresponding SCSS module (e.g., success.module.scss),
move all styling from inline styles or Tailwind classNames into named CSS
classes in that module, import it into src/app/auth/success/page.tsx (e.g.,
import styles from './success.module.scss') and replace the inline
style/className usages with className={styles.someClass}; keep the existing
hydrate function and router.replace logic unchanged (refer to hydrate and
router.replace in the file to locate where to swap className usages).
- Around line 14-28: The hydrate function currently performs
fetch('/api/session', { credentials: 'include' }) and immediately redirects via
router.replace without any user feedback; add short-lived UI state (e.g.,
isLoading and errorMessage via useState) and set isLoading = true before calling
hydrate (or at start of hydrate), set isLoading = false after the fetch
completes, and set errorMessage on catch or non-ok response; update the page
component to render a loading spinner when isLoading is true and an inline error
message with a retry option when errorMessage is set instead of silently
redirecting; keep using router.replace(redirect) on success but only after
toggling state so the spinner is visible during network delays and errors are
shown when fetch('/api/session') fails.

In `@src/app/resync/scraping/page.tsx`:
- Around line 14-19: The component currently reads sessionStorage during initial
render (the useState initializer that sets jobId from RESYNC_JOB_ID_KEY),
causing an SSR/client hydration mismatch: on the server jobId is null and
triggers the throw new Error(...) path that renders error.tsx, while the client
may render LoadingScreen when sessionStorage has a value. Fix by removing
synchronous sessionStorage access from the state initializer (keep jobId
initialised to null via useState(null)) and add a useEffect that runs on mount
to read sessionStorage.getItem(RESYNC_JOB_ID_KEY) and call setJobId(...) so
server and client initial HTML match; alternatively, if you prefer to skip
server rendering, wrap the page component with dynamic(..., { ssr: false }).
Ensure references to jobId, RESYNC_JOB_ID_KEY, LoadingScreen and the throw new
Error(...) logic are updated so the error is only thrown after jobId is settled
by the effect.

In `@src/app/terms/page.tsx`:
- Around line 3-121: The TermsPage component currently hardcodes the entire
privacy/terms content in JSX (inside TermsPage), which makes updates and
localization cumbersome; extract the static content into a managed data source
(e.g., a markdown/MDX file or CMS entry) and load it in TermsPage instead (use
getStaticProps/getServerSideProps or a client fetch depending on update
frequency), render the loaded markdown/HTML inside the existing container (refer
to TermsPage and the surrounding classNames like styles.container and
styles.content) and add a simple version/locale metadata field so future changes
and i18n can be tracked without redeploying.
- Line 1: The import in page.tsx currently pulls
'../privacy-policy/PrivacyPolicy.module.scss' via a relative path; either make
the intention explicit by moving the shared stylesheet into a canonical shared
styles location and update the import to use the path alias (e.g., import styles
from '@/styles/PrivacyPolicy.module.scss') for consistency with the guideline,
or create a page-specific module (e.g., TermsPage.module.scss) and update the
import in page.tsx to './TermsPage.module.scss'; update any references to the
imported symbol (styles) accordingly and ensure the project path-alias config
supports the chosen '@/...' import.

In `@src/features/dashboard/components/SyncUpdateButton/SyncUpdateButton.tsx`:
- Around line 20-22: The current fallback returns an empty string for
formattedLastSyncedAt (computed from parsedLastSyncedAt/data.lastSyncedAt) which
makes the UI show ambiguous "업데이트" only; update the logic in SyncUpdateButton so
that when data.lastSyncedAt is missing or invalid formattedLastSyncedAt becomes
an explicit message like '최근 동기화 없음' (or null and switch the button label to
'동기화 시작' when formattedLastSyncedAt is falsy) and keep using
parsedLastSyncedAt/isValid to decide validity; adjust the component rendering to
display that fallback text instead of showing an empty date string.

In `@src/features/portal-link/hooks/usePortalLinkJobPolling.ts`:
- Around line 21-31: In usePortalLinkJobPolling, don't call setIsTimedOut inside
the refetchInterval callback (avoid state mutation during React Query's
scheduling); instead remove setIsTimedOut(true) from refetchInterval and have it
only return false when timed out, and add a separate useEffect inside
usePortalLinkJobPolling that watches startedAtRef.current and the query status
(q.state.data?.data?.status) to call setIsTimedOut(true) when Date.now() -
startedAtRef.current >= ENV.PORTAL_LINK_TIMEOUT_MS; keep refetchInterval
returning POLLING_INTERVAL_MS otherwise and reference the same symbols
(refetchInterval, startedAtRef, setIsTimedOut, ENV.PORTAL_LINK_TIMEOUT_MS,
POLLING_INTERVAL_MS) so behavior is unchanged but state updates happen outside
the React Query callback.
- Line 34: usePortalLinkJobPolling currently only returns { data, isTimedOut },
which hides important request states; update the hook to also expose the React
Query fields (e.g., query.isLoading, query.isFetching, query.isError,
query.error, query.isSuccess) so callers can handle loading and error UI. Locate
the query variable inside usePortalLinkJobPolling and either return {...query,
isTimedOut} or explicitly add the listed properties to the returned object
(preserving data and isTimedOut) so consumers have full network state telemetry.

In `@src/features/portal-link/hooks/usePortalLinkSummary.ts`:
- Around line 4-10: The hook usePortalLinkSummary currently calls useQuery;
update it to use useSuspenseQuery (replace useQuery with useSuspenseQuery) so
data fetching uses React Query Suspense semantics and lets consuming components
rely on Suspense/ErrorBoundary for loading/error handling; keep the same
queryKey (['portal-link-summary', jobId]) and queryFn (getJobSummary(jobId!))
and preserve the conditional activation logic around enabled (Boolean(jobId) &&
jobStatus === 'succeeded')—if you decide to remove conditional activation then
call useSuspenseQuery unconditionally and ensure all components using
usePortalLinkSummary are wrapped in React.Suspense and an ErrorBoundary.
- Line 7: Replace the non-null assertion on jobId in the queryFn with an
explicit runtime type guard: inside the queryFn used in usePortalLinkSummary,
check if jobId is undefined/null and throw a clear error (or return a rejected
Promise) before calling getJobSummary(jobId); this preserves the existing
enabled guard but makes the null-safety explicit to TypeScript and future
readers (referencing queryFn, jobId, and getJobSummary).

In `@src/lib/auth/session.ts`:
- Around line 7-21: The session currently stores both accessToken and
refreshToken in SessionData via sessionOptions (cookieName SESSION_COOKIE_NAME,
password ENV.SESSION_SECRET) which risks exceeding the ~4KB cookie limit; change
to store only a minimal identifier (e.g., sessionId or userId) in the cookie and
move accessToken/refreshToken to server-side storage (DB or in-memory store)
keyed by that identifier, update codepaths that read/write SessionData to fetch
tokens from the server store, and optionally add a size check before setting the
cookie in the session handling logic to prevent oversized iron-session cookies.

In `@src/lib/webview/bridge.ts`:
- Around line 39-67: postBridgeMessage currently swallows missing-bridge and
postMessage errors and returns void, preventing callers from performing
fallbacks; change postBridgeMessage to return boolean: return false when
getWebViewWindow() or resolveBridgePostMessage(w) is falsy (preserve the dev
console warn), return true on successful post, and on exceptions call
captureException(err, { extra: { bridgeMessage: message } }) then return false
(preserve the dev warn). Update navigateNative to return the boolean result of
postBridgeMessage(`navigate:${url}`) so callers can fallback (e.g., router.push)
when false. Use the existing symbols postBridgeMessage, navigateNative,
getWebViewWindow, resolveBridgePostMessage, and captureException to locate and
modify the logic.

In `@src/shared/api/http-client.ts`:
- Line 65: The generated HttpClient class currently has a hardcoded public
baseUrl value which must not be edited manually; revert this manual change and
instead update the swagger-typescript-api generator/template so baseUrl is set
from configuration/runtime (e.g., accept a constructor option or read an
injected value), then regenerate the client with the yarn api:* commands; if you
need runtime injection immediately, create a small wrapper/factory that
instantiates HttpClient with baseUrl taken from process.env (or app config) and
use that wrapper everywhere rather than modifying the generated
HttpClient.baseUrl.

In `@swagger/openapi-dev.json`:
- Line 1: The root-level "security": [{"bearerAuth": []}] is being inherited by
all operations (e.g., operationId signInUser, refreshResponse, health,
handleCallback, createPortalLinkJob, getJobStatus, getJobSummary, sentryTest),
incorrectly marking public endpoints as authenticated; fix by removing the
top-level security entry and instead add "security": [{"bearerAuth": []}] only
to operations that require authentication (e.g., getProfile, getSemesterRecord,
getSemesterGrades, getGraduationProgress, getAcademicSummary, getAcademicRecord,
deleteUser, setTargetGpa, resetStudentData, etc.), or alternatively keep the
root security and explicitly mark the listed public operations' paths (POST
/portal/link createPortalLinkJob, POST /internal/scrape-results handleCallback,
POST /api/users/signin signInUser, POST /api/auth/refresh refreshResponse, GET
/sentry-test sentryTest, GET /portal/link/jobs/{jobId} getJobStatus, GET
/portal/link/jobs/{jobId}/summary getJobSummary, GET /health health) with
"security": [] to override inheritance; choose one approach and apply
consistently across the OpenAPI document.

In `@wrangler.jsonc`:
- Line 5: Update the "compatibility_date" value to a recent date (e.g.,
"2026-05-10") so the Workers runtime uses the latest features and fixes; locate
the "compatibility_date" key in wrangler.jsonc and replace the old "2024-09-23"
value with the new ISO date string, then run any build/validation steps to
ensure the config is accepted.

---

Outside diff comments:
In `@src/app/`(funnel)/contexts/FunnelContext.tsx:
- Around line 27-41: The two hooks useStudentInfo and useFunnelContext both
return the same FunnelContext and are redundant; remove useStudentInfo (or mark
it deprecated) and update exports/imports to use only useFunnelContext. Locate
useStudentInfo, useFunnelContext and the FunnelContext provider in
FunnelContext.tsx, delete the useStudentInfo function (or replace it with a thin
deprecated wrapper that calls useFunnelContext and logs a deprecation warning),
and update index.ts exports to stop exporting useStudentInfo and ensure all
internal imports are migrated to useFunnelContext.

In `@src/shared/api/http-client.ts`:
- Around line 1-11: Add a CI validation step to ensure generated API files under
src/shared/api are not manually edited: in the autofix.ci workflow add a job
that runs yarn api:update, then diffs the regenerated output against the
committed files in src/shared/api (fail the job or auto-commit fixes when
differences are found); reference the existing script name yarn api:update and
the src/shared/api path so the workflow explicitly detects PRs that modify those
files and either fails the build or applies the regenerated changes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e227f477-26eb-4631-9339-c3b5ecfdd576

📥 Commits

Reviewing files that changed from the base of the PR and between a7792ac and c5e823e.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (73)

• .github/workflows/deploy-cloudflare.yml
• .gitignore
• docs/mpa-school-link-handoff.md
• next.config.mjs
• open-next.config.ts
• package.json
• src/app/(funnel)/agreement/page.tsx
• src/app/(funnel)/contexts/FunnelContext.tsx
• src/app/(funnel)/contexts/index.ts
• src/app/(funnel)/portal-login/components/PortalLoginForm/PortalLoginForm.tsx
• src/app/(funnel)/portal-login/page.tsx
• src/app/(funnel)/scraping/error.tsx
• src/app/(funnel)/scraping/page.tsx
• src/app/(main)/graduation-progress/layout.module.scss
• src/app/(main)/main/page.tsx
• src/app/(mpa)/layout.module.scss
• src/app/(mpa)/layout.tsx
• src/app/(mpa)/mpa/home/page.tsx
• src/app/(mpa)/mpa/me/page.tsx
• src/app/(mpa)/mpa/resync/login/page.tsx
• src/app/(mpa)/mpa/resync/scraping/page.tsx
• src/app/api/session/refresh/route.ts
• src/app/api/session/route.ts
• src/app/auth/callback/route.ts
• src/app/auth/success/page.tsx
• src/app/layout.tsx
• src/app/resync/login/page.tsx
• src/app/resync/scraping/error.tsx
• src/app/resync/scraping/page.tsx
• src/app/terms/page.tsx
• src/config/env.ts
• src/config/environment.ts
• src/constants/index.ts
• src/constants/portal-link.ts
• src/constants/routes.ts
• src/constants/token.ts
• src/features/auth/apis/queries/usePortalLoginMutation.ts
• src/features/auth/apis/service.ts
• src/features/auth/contexts/AuthContext.tsx
• src/features/auth/hooks/useAuthCheck.ts
• src/features/auth/services/authService.ts
• src/features/auth/tokenStore.ts
• src/features/dashboard/apis/queries/useProfileQuery.ts
• src/features/dashboard/components/DualMajorRequirementCard/DualMajorRequirementCard.tsx
• src/features/dashboard/components/GraduationRequirementCard/GraduationRequirementCard.tsx
• src/features/dashboard/components/SyncUpdateButton/SyncUpdateButton.tsx
• src/features/dashboard/hooks/useRefreshProfileOnVisible.ts
• src/features/portal-link/hooks/index.ts
• src/features/portal-link/hooks/usePortalLinkJobPolling.ts
• src/features/portal-link/hooks/usePortalLinkMutation.ts
• src/features/portal-link/hooks/usePortalLinkSummary.ts
• src/features/portal-link/services/portalLinkService.ts
• src/features/portal-link/utils/errorMapping.ts
• src/lib/auth/index.ts
• src/lib/auth/session.ts
• src/lib/auth/token.ts
• src/lib/webview/bridge.ts
• src/lib/webview/index.ts
• src/shared/api/client.ts
• src/shared/api/configs/httpConfig.ts
• src/shared/api/data-contracts.ts
• src/shared/api/domain/index.ts
• src/shared/api/domain/internalscraperesultcontroller/InternalScrapeResultController.ts
• src/shared/api/domain/portaljobquerycontroller/PortalJobQueryController.ts
• src/shared/api/domain/portallink/PortalLink.ts
• src/shared/api/domain/portallinkcontroller/PortalLinkController.ts
• src/shared/api/domain/suwonscraping/SuwonScraping.ts
• src/shared/api/domain/user/User.ts
• src/shared/api/http-client.ts
• src/shared/components/AsyncBoundary.tsx
• src/shared/utils/idempotency.ts
• swagger/openapi-dev.json
• wrangler.jsonc

💤 Files with no reviewable changes (11)

• src/constants/token.ts
• src/app/resync/scraping/error.tsx
• src/lib/auth/index.ts
• src/app/(funnel)/scraping/error.tsx
• src/features/auth/apis/queries/usePortalLoginMutation.ts
• src/features/auth/apis/service.ts
• src/constants/index.ts
• src/shared/components/AsyncBoundary.tsx
• src/lib/auth/token.ts
• src/config/env.ts
• src/shared/api/domain/suwonscraping/SuwonScraping.ts

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | 💤 Low value

환경 변수 매핑이 반복적이지만 명확함

production/staging 환경 변수를 삼항 연산자로 매핑하는 패턴이 반복됩니다. GitHub Actions의 Environment 기능을 사용하면 더 간결하게 작성할 수 있지만, 현재 방식도 명시적이고 추적하기 쉽다는 장점이 있습니다.

💡 Environment 기능을 사용한 대안 (선택사항)

GitHub Repository Settings → Environments에서 production과 staging 환경을 생성하고 각 환경별로 시크릿을 등록한 후:

deploy:
  needs: resolve-env
  runs-on: ubuntu-latest
  environment: ${{ needs.resolve-env.outputs.name }}
  env:
    NEXT_PUBLIC_DEPLOY_ENV: ${{ needs.resolve-env.outputs.name }}
    NEXT_PUBLIC_API_BASE_URL: ${{ secrets.NEXT_PUBLIC_API_BASE_URL }}
    # ... 각 시크릿을 환경별로 관리

현재 방식이 더 명시적이므로 변경은 선택사항입니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-cloudflare.yml around lines 35 - 53, The current
secret mapping repeatedly uses ternary-style expressions with
needs.resolve-env.outputs.name; to simplify switch the job to use GitHub
Environments and reference environment-scoped secrets directly by setting the
job's environment to needs.resolve-env.outputs.name (keep NEXT_PUBLIC_DEPLOY_ENV
as is), then replace expressions like NEXT_PUBLIC_API_BASE_URL: ${{
needs.resolve-env.outputs.name == 'production' &&
secrets.PROD_NEXT_PUBLIC_API_BASE_URL ||
secrets.STAGING_NEXT_PUBLIC_API_BASE_URL }} with a single secret reference such
as NEXT_PUBLIC_API_BASE_URL: ${{ secrets.NEXT_PUBLIC_API_BASE_URL }} (do this
for each variable: NEXT_PUBLIC_BASE_URL, NEXT_PUBLIC_SUPABASE_URL,
NEXT_PUBLIC_SUPABASE_ANON_KEY, NEXT_PUBLIC_JAVASCRIPT_KEY,
NEXT_PUBLIC_SENTRY_DSN, REST_API_KEY, CLIENT_SECRET, SUPABASE_PROJECT_ID,
SESSION_SECRET, SENTRY_AUTH_TOKEN, UPSTASH_REDIS_REST_URL,
UPSTASH_REDIS_REST_TOKEN, LAMBDA_DEV_URL, AWS_URL) after creating matching
secrets in the production and staging Environments.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚖️ Poor tradeoff

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check for alternative image optimization solutions

# Check for Cloudflare Images configuration
rg -i 'cloudflare.*image|cf.*image' --type ts --type tsx --type js -C 3

# Check for image loader configuration or external image domains
rg 'loader.*=|images.*domains|images.*remotePatterns' next.config -A 5

# Look for image optimization services in dependencies
cat package.json | jq '.dependencies, .devDependencies' | grep -i 'image\|cloudflare'

Repository: gyumong/chukchuk-haksa

Length of output: 198

---

🏁 Script executed:

#!/bin/bash
# Find next.config file
fd -e mjs -e js -e ts -e cjs | grep -i 'next\.config'

Repository: gyumong/chukchuk-haksa

Length of output: 102

---

🏁 Script executed:

#!/bin/bash
# Once we locate next.config.mjs, read its content
git ls-files | grep -i 'next\.config' | head -5

Repository: gyumong/chukchuk-haksa

Length of output: 102

---

🏁 Script executed:

#!/bin/bash
# Search for image-related configuration in the codebase
rg -i 'images\s*[:{]|loader|imageOptimization' -A 3 | head -50

Repository: gyumong/chukchuk-haksa

Length of output: 2886

---

🏁 Script executed:

#!/bin/bash
# Check what `@opennextjs/cloudflare` provides regarding image handling
cat package.json | jq '.dependencies, .devDependencies' | head -30

Repository: gyumong/chukchuk-haksa

Length of output: 916

---

🏁 Script executed:

#!/bin/bash
# Read next.config.mjs to see the image configuration
cat -n next.config.mjs

Repository: gyumong/chukchuk-haksa

Length of output: 4215

---

🏁 Script executed:

#!/bin/bash
# Check open-next.config.ts for image-related settings
cat -n open-next.config.ts

Repository: gyumong/chukchuk-haksa

Length of output: 194

---

🏁 Script executed:

#!/bin/bash
# Search for image loader, custom image handler, or Cloudflare Images configuration
rg -i 'loader|cloudflareImages|imageOptimization|customImageLoader' -A 3 -B 1

Repository: gyumong/chukchuk-haksa

Length of output: 50379

---

🌐 Web query:

@opennextjs/cloudflare image optimization support

💡 Result:

Yes, @opennextjs/cloudflare (OpenNext Cloudflare adapter) supports Next.js image optimization via the <Image /> component. It provides a Next.js-compatible image optimization API powered by Cloudflare Images.[1][2] To enable it: - Define an IMAGES binding in your Cloudflare Worker configuration for Cloudflare Images.[1] - Configure next.config.js as needed (e.g., remotePatterns, formats like PNG/JPEG/WEBP/AVIF/GIF/SVG).[1] - Images are optimized at the edge; unsupported formats return unchanged.[1] Alternatively, use a custom loader for Cloudflare Images: - Enable Cloudflare Images for your zone. - Create image-loader.ts with a cloudflareLoader function. - Set images: { loader: 'custom', loaderFile: './image-loader.ts' } in next.config.js.[1] Limitations: No minimumCacheTTL support (uses immutable caching); local IPs always allowed if in remotePatterns; custom loader bypasses remotePatterns—use Cloudflare dashboard for origin restrictions.[1] Official guide: https://opennext.js.org/cloudflare/howtos/image[1]

Citations:

• 1: https://opennext.js.org/cloudflare/howtos/image
• 2: https://opennext.js.org/cloudflare

---

이미지 최적화 대체 방안이 구성되지 않았습니다.

images.unoptimized = true 설정으로 Next.js 자동 이미지 최적화가 비활성화되어 있습니다. @opennextjs/cloudflare는 Cloudflare Images를 통한 이미지 최적화를 지원하지만, 현재 codebase에서는 다음이 구성되지 않았습니다:

• Cloudflare Workers 설정의 IMAGES 바인딩
• next.config.mjs의 커스텀 이미지 로더 (loader: 'custom')
• open-next.config.ts의 이미지 최적화 설정

성능 최적화를 위해 다음 중 하나를 구성하세요:

1. Cloudflare Images 바인딩 추가 및 커스텀 이미지 로더 설정
2. 다른 CDN 기반 이미지 최적화 서비스 구성

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@next.config.mjs` around lines 13 - 15, The images.unoptimized = true setting
disables Next.js image optimization; either configure Cloudflare Images
integration or a CDN image service: add the Cloudflare IMAGES binding in your
Workers config, set next.config.mjs images to use a custom loader (e.g., replace
unoptimized:true with loader:'custom' and appropriate loader configuration), and
enable image optimization options in open-next.config.ts (or alternatively wire
a different CDN/image service and update next.config.mjs accordingly). Ensure
references to IMAGES binding, next.config.mjs images, loader:'custom', and
open-next.config.ts are updated so the `@opennextjs/cloudflare` integration (or
chosen CDN) performs image optimization.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

@opennextjs/cloudflare latest stable version npm

💡 Result:

Latest stable version on npm (as of 2026-05-10): 1.19.8. [1][2] How to install: - npm i @opennextjs/cloudflare@1.19.8 [1] - npm i @opennextjs/cloudflare (will install the latest stable tag) [1] Notes: - The package’s npm page shows “1.19.8 · Published May 7, 2026”. [1] - The GitHub repository indicates the latest release is 1.19.7, which may lag one patch behind npm’s latest published stable version. [3]

Citations:

• 1: https://www.npmjs.com/package/@opennextjs/cloudflare
• 2: https://registry.npmjs.org/@opennextjs/cloudflare
• 3: https://github.com/opennextjs/opennextjs-cloudflare

---

@opennextjs/cloudflare 버전 지정 검토

현재 @opennextjs/cloudflare는 ^1로 지정되어 있어 1.0.0부터 1.x까지의 모든 버전이 허용됩니다. 최신 안정 버전은 1.19.8(2026년 5월 7일 기준)입니다.

^1은 npm 생태계의 표준 관행이지만, 더 엄격한 버전 고정이 필요한 경우 ~1.19.8 또는 1.19.8으로 변경하여 마이너 버전 이상의 자동 업데이트를 방지할 수 있습니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 60, The dependency version for `@opennextjs/cloudflare`
is too loose ("^1"); update package.json to a stricter pin to prevent unexpected
upgrades by replacing "^1" with either a tilde-pinned version "~1.19.8" or an
exact version "1.19.8" (use the exact string "1.19.8" if you want full
immutability), then run your package manager install to update lockfiles; locate
the dependency entry for "@opennextjs/cloudflare" in package.json to make this
change.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🌐 Web query:

Does iron-session store the full session payload inside the encrypted cookie, and what is the practical per-cookie size limit enforced by major browsers and common proxies?

💡 Result:

Yes. iron-session stores the entire session data inside the cookie itself by “sealing” (signing and encrypting) your session payload into an encrypted cookie value that the server later decodes (“unseal[s]”) on requests. [1][2] The repo calls this “stateless” because “the data is passed around in cookies.” [1][2] Practical per-cookie size limit (major browsers + common proxies) 1) Browser-enforced cookie size: ~4 KiB per cookie - iron-session explicitly enforces a 4096-byte limit: it throws if the serialized cookie value exceeds 4096 bytes, noting “browsers will refuse it.” [3] - RFC 6265 says user agents should support “at least 4096 bytes per cookie (as measured by the sum of the length of the cookie's name, value, and attributes).” [4] - Therefore, in practice you should target a cookie value around 4,096 bytes or less. iron-session’s own guidance/expectations and error message are aligned with this. [3][5] 2) Proxy/server limits on request headers: can be lower than cookie-only limits - Even if a browser can store a ~4 KiB cookie, the cookie will be sent on every request, increasing request header size. The HTTP cookie drafts warn that server/proxy header field limits (commonly defaulting to ~8 KiB) can cause requests to fail and advise avoiding large cookies such that the final cookie-string would exceed header field limits. [6] - So the practical limit becomes the minimum of: browser per-cookie limit (~4 KiB) and your edge/proxy/server request header limits (often ~8 KiB default in common servers), especially if you have multiple cookies or multiple cookie headers combined. [6][7] One-number practical guidance - Keep each iron-session cookie to <= 4096 bytes (iron-session’s own check) and, additionally, ensure your total Cookie header size stays comfortably below typical proxy/server header limits (often ~8 KiB default), otherwise requests can fail even though the browser accepted the cookie. [3][6]

Citations:

• 1: https://github.com/vvo/iron-session/blob/main/README.md
• 2: https://github.com/vvo/iron-session
• 3: https://github.com/vvo/iron-session/blob/main/src/core.ts
• 4: http://www.irt.org/rfc/rfc6265.htm
• 5: Add cookie chunking support for sessions exceeding 4KB limit vvo/iron-session#937
• 6: https://httpwg.org/http-extensions/draft-ietf-httpbis-layered-cookies.html
• 7: https://dt.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/

---

세션 쿠키 크기: accessToken과 refreshToken 함께 저장 시 4KB 한도 초과 위험

현재 구현은 accessToken과 refreshToken 두 개의 JWT를 모두 iron-session의 암호화 쿠키에 저장합니다. iron-session은 암호화된 쿠키 값이 4096바이트를 초과하면 요청을 실패시키며, 브라우저도 RFC 6265에 따라 쿠키당 ~4KiB 한도를 강제합니다. 두 JWT의 길이 + sealing 오버헤드를 고려하면 이 한도를 초과할 가능성이 높으며, 이 경우 세션이 간헐적으로 저장되지 않는 문제가 발생합니다.

권장 해결 방안:

• 쿠키에는 최소 식별자만 저장하고 토큰은 서버 저장소에서 관리하기
• 또는 저장 직전에 암호화된 쿠키 크기를 강제로 검증하기

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/auth/session.ts` around lines 7 - 21, The session currently stores
both accessToken and refreshToken in SessionData via sessionOptions (cookieName
SESSION_COOKIE_NAME, password ENV.SESSION_SECRET) which risks exceeding the ~4KB
cookie limit; change to store only a minimal identifier (e.g., sessionId or
userId) in the cookie and move accessToken/refreshToken to server-side storage
(DB or in-memory store) keyed by that identifier, update codepaths that
read/write SessionData to fetch tokens from the server store, and optionally add
a size check before setting the cookie in the session handling logic to prevent
oversized iron-session cookies.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
python - <<'PY'
import json
from pathlib import Path

spec = json.loads(Path("swagger/openapi-dev.json").read_text())
global_security = spec.get("security")
methods = {"get", "post", "put", "patch", "delete", "options", "head", "trace"}

print("Global security:", global_security)
print("Operations inheriting global security:\n")

for path, path_item in spec.get("paths", {}).items():
    for method, operation in path_item.items():
        if method.lower() not in methods:
            continue
        if "security" not in operation and global_security:
            print(f"{method.upper():6} {path}")
PY

Repository: gyumong/chukchuk-haksa

Length of output: 355

---

루트 레벨 security 선언이 공개 엔드포인트를 포함한 모든 operation으로 상속되고 있습니다.

OpenAPI 3.0에서는 최상위 security 정의가 각 operation으로 상속됩니다. 현재 스펙에서 {"bearerAuth":[]} 요구사항이 /api/users/signin, /api/auth/refresh, /health, /internal/scrape-results 등 인증 없이 호출되어야 하는 엔드포인트까지 전파되어, 문서와 생성된 클라이언트에 잘못된 계약을 나타냅니다.

다음 8개 operation이 영향을 받습니다:

• POST /portal/link
• POST /internal/scrape-results
• POST /api/users/signin
• POST /api/auth/refresh
• GET /sentry-test
• GET /portal/link/jobs/{jobId}
• GET /portal/link/jobs/{jobId}/summary
• GET /health

공개 엔드포인트에는 명시적으로 "security": []를 추가하거나, 반대로 루트 레벨 security를 제거하고 인증이 필요한 operation만 opt-in 방식으로 "security": [{"bearerAuth":[]}]를 선언하는 방식으로 수정이 필요합니다.

🧰 Tools

🪛 Checkov (3.2.526)

[medium] 1: Ensure that arrays have a maximum number of items

(CKV_OPENAPI_21)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@swagger/openapi-dev.json` at line 1, The root-level "security":
[{"bearerAuth": []}] is being inherited by all operations (e.g., operationId
signInUser, refreshResponse, health, handleCallback, createPortalLinkJob,
getJobStatus, getJobSummary, sentryTest), incorrectly marking public endpoints
as authenticated; fix by removing the top-level security entry and instead add
"security": [{"bearerAuth": []}] only to operations that require authentication
(e.g., getProfile, getSemesterRecord, getSemesterGrades, getGraduationProgress,
getAcademicSummary, getAcademicRecord, deleteUser, setTargetGpa,
resetStudentData, etc.), or alternatively keep the root security and explicitly
mark the listed public operations' paths (POST /portal/link createPortalLinkJob,
POST /internal/scrape-results handleCallback, POST /api/users/signin signInUser,
POST /api/auth/refresh refreshResponse, GET /sentry-test sentryTest, GET
/portal/link/jobs/{jobId} getJobStatus, GET /portal/link/jobs/{jobId}/summary
getJobSummary, GET /health health) with "security": [] to override inheritance;
choose one approach and apply consistently across the OpenAPI document.