[FIX/BE-US] changes permission to redis and scope

internal/modules/sso/controllers/sso.controller.go

@@ -200,7 +200,7 @@ func (h *Controller) Refresh(c *fiber.Ctx) error {
 		return fiber.NewError(fiber.StatusUnauthorized, "invalid access token")
 	}
 
-	issueCookies(c, struct {
+	if err := issueCookies(c, struct {
 		AccessToken  string `json:"access_token"`
 		RefreshToken string `json:"refresh_token"`
 		TokenType    string `json:"token_type"`
@@ -218,7 +218,9 @@ func (h *Controller) Refresh(c *fiber.Ctx) error {
 		IDToken:      tokenResp.IDToken,
 		Error:        tokenResp.Error,
 		Description:  tokenResp.Description,
-	}, verification)
+	}, verification); err != nil {
+		return err
+	}
 
 	utils.Log.WithFields(logrus.Fields{
 		"user_id": verification.UserID,
@@ -307,7 +309,9 @@ func (h *Controller) Callback(c *fiber.Ctx) error {
 	}
 
 	// prepare cookies
-	issueCookies(c, tokenResp, verification)
+	if err := issueCookies(c, tokenResp, verification); err != nil {
+		return err
+	}
 
 	redirectTarget := sessionData.ReturnTo
 	if redirectTarget == "" {
@@ -742,13 +746,21 @@ func issueCookies(c *fiber.Ctx, tokenResp struct {
 	IDToken      string `json:"id_token"`
 	Error        string `json:"error"`
 	Description  string `json:"error_description"`
-}, verification *sso.VerificationResult) {
+}, verification *sso.VerificationResult) error {
 	if revoker := session.GetRevocationStore(); revoker != nil && verification != nil {
 		if err := revoker.ClearUserLogout(c.Context(), verification.UserID); err != nil {
 			utils.Log.WithError(err).Warn("failed to clear logout marker")
 		}
 	}
 
+	if max := config.SSOAccessTokenMaxBytes; max > 0 && len(tokenResp.AccessToken) > max {
+		utils.Log.WithFields(logrus.Fields{
+			"token_len": len(tokenResp.AccessToken),
+			"max_len":   max,
+		}).Warn("sso access token exceeds cookie size limit")
+		return fiber.NewError(fiber.StatusRequestEntityTooLarge, "access token too large")
+	}
+
 	accessName := resolveSSOCookieName(config.SSOAccessCookieName, "access")
 	refreshName := resolveSSOCookieName(config.SSORefreshCookieName, "refresh")
 	maxAge := tokenResp.ExpiresIn
@@ -790,6 +802,7 @@ func issueCookies(c *fiber.Ctx, tokenResp struct {
 
 	// Optional: expose limited info via headers for FE debugging (avoid tokens)
 	c.Set("X-Auth-User", fmt.Sprintf("%d", verification.UserID))
+	return nil
 }
 
 func clearSSOCookie(c *fiber.Ctx, name string) {