From 0de9d5bb486163d817881279b26065702d232d37 Mon Sep 17 00:00:00 2001
From: Hyungi Ahn <hyungiahn@Hyungiui-MacBookPro.local>
Date: Wed, 1 Apr 2026 15:44:02 +0900
Subject: [PATCH] =?UTF-8?q?feat(sso):=20=EC=9D=B8=EC=95=B1=20=EB=B8=8C?=
 =?UTF-8?q?=EB=9D=BC=EC=9A=B0=EC=A0=80=20SSO=20=ED=86=A0=ED=81=B0=20?=
 =?UTF-8?q?=EB=A6=B4=EB=A0=88=EC=9D=B4=20=E2=80=94=20=EC=B9=B4=ED=86=A1=20?=
 =?UTF-8?q?WebView=20=EC=BF=A0=ED=82=A4=20=EB=AF=B8=EA=B3=B5=EC=9C=A0=20?=
 =?UTF-8?q?=ED=95=B4=EA=B2=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

카카오톡 인앱 WebView는 서브도메인 간 쿠키를 공유하지 않아
tkds에서 로그인 후 tkfb로 리다이렉트 시 인증이 풀리는 문제.

- sso-relay.js: URL hash의 _sso= 토큰을 로컬 쿠키+localStorage로 설정
- gateway dashboard: 로그인 후 redirect URL에 #_sso=<token> 추가
- 전 서비스 HTML: core JS 직전에 sso-relay.js 로드 (81개 파일)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 gateway/html/dashboard.html                   |  6 ++-
 shared/frontend/sso-relay.js                  | 39 +++++++++++++++++++
 system1-factory/web/index.html                |  1 +
 system1-factory/web/js/sso-relay.js           | 39 +++++++++++++++++++
 .../web/pages/admin/attendance-report.html    |  1 +
 .../web/pages/admin/equipment-detail.html     |  1 +
 .../web/pages/admin/equipments.html           |  1 +
 .../web/pages/admin/purchase-analysis.html    |  1 +
 .../web/pages/admin/repair-management.html    |  1 +
 .../web/pages/attendance/annual-overview.html |  1 +
 .../web/pages/attendance/checkin.html         |  1 +
 .../web/pages/attendance/daily.html           |  1 +
 .../pages/attendance/monthly-comparison.html  |  1 +
 .../web/pages/attendance/monthly.html         |  1 +
 .../pages/attendance/my-monthly-confirm.html  |  1 +
 .../pages/attendance/my-vacation-info.html    |  1 +
 .../pages/attendance/vacation-allocation.html |  1 +
 .../pages/attendance/vacation-approval.html   |  1 +
 .../web/pages/attendance/vacation-input.html  |  1 +
 .../pages/attendance/vacation-management.html |  1 +
 .../pages/attendance/vacation-request.html    |  1 +
 .../web/pages/attendance/work-status.html     |  1 +
 system1-factory/web/pages/dashboard-new.html  |  1 +
 system1-factory/web/pages/dashboard.html      |  1 +
 .../web/pages/inspection/daily-patrol.html    |  1 +
 .../web/pages/inspection/zone-detail.html     |  1 +
 system1-factory/web/pages/profile/info.html   |  1 +
 .../web/pages/profile/password.html           |  1 +
 .../web/pages/purchase/request-mobile.html    |  1 +
 .../web/pages/purchase/request.html           |  1 +
 system1-factory/web/pages/work/analysis.html  |  3 +-
 .../web/pages/work/daily-status.html          |  1 +
 .../web/pages/work/meeting-detail.html        |  1 +
 system1-factory/web/pages/work/meetings.html  |  1 +
 .../web/pages/work/proxy-input.html           |  1 +
 .../web/pages/work/report-create-mobile.html  |  1 +
 .../web/pages/work/report-create.html         |  1 +
 system1-factory/web/pages/work/schedule.html  |  1 +
 .../web/pages/work/tbm-create.html            |  1 +
 .../web/pages/work/tbm-mobile.html            |  1 +
 system1-factory/web/pages/work/tbm.html       |  1 +
 system2-report/web/js/sso-relay.js            | 39 +++++++++++++++++++
 .../web/pages/safety/chat-report.html         |  1 +
 .../web/pages/safety/issue-detail.html        |  1 +
 .../web/pages/safety/issue-report.html        |  1 +
 .../web/pages/safety/report-status.html       |  1 +
 system3-nonconformance/web/ai-assistant.html  |  1 +
 system3-nonconformance/web/issue-view.html    |  1 +
 .../web/issues-archive.html                   |  1 +
 .../web/issues-dashboard.html                 |  1 +
 system3-nonconformance/web/issues-inbox.html  |  1 +
 .../web/issues-management.html                |  1 +
 system3-nonconformance/web/m/dashboard.html   |  1 +
 system3-nonconformance/web/m/inbox.html       |  1 +
 system3-nonconformance/web/m/management.html  |  1 +
 system3-nonconformance/web/reports-daily.html |  1 +
 .../web/reports-monthly.html                  |  1 +
 .../web/reports-weekly.html                   |  1 +
 system3-nonconformance/web/reports.html       |  1 +
 .../web/static/js/sso-relay.js                | 39 +++++++++++++++++++
 tkpurchase/web/accounts.html                  |  1 +
 tkpurchase/web/daylabor.html                  |  1 +
 tkpurchase/web/index.html                     |  1 +
 tkpurchase/web/partner-history.html           |  1 +
 tkpurchase/web/partner-portal.html            |  1 +
 tkpurchase/web/partner.html                   |  1 +
 tkpurchase/web/schedule.html                  |  1 +
 tkpurchase/web/static/js/sso-relay.js         | 39 +++++++++++++++++++
 tkpurchase/web/workreport-summary.html        |  1 +
 tkpurchase/web/workreport.html                |  1 +
 tksafety/web/checklist.html                   |  1 +
 tksafety/web/education.html                   |  1 +
 tksafety/web/entry-dashboard.html             |  1 +
 tksafety/web/index.html                       |  1 +
 tksafety/web/risk-assess.html                 |  1 +
 tksafety/web/risk-projects.html               |  1 +
 tksafety/web/static/js/sso-relay.js           | 39 +++++++++++++++++++
 tksafety/web/training.html                    |  1 +
 tksafety/web/visit-management.html            |  1 +
 tksafety/web/visit-request.html               |  1 +
 tksupport/web/company-holidays.html           |  1 +
 tksupport/web/index.html                      |  1 +
 tksupport/web/static/js/sso-relay.js          | 39 +++++++++++++++++++
 tksupport/web/vacation-admin.html             |  1 +
 tksupport/web/vacation-approval.html          |  1 +
 tksupport/web/vacation-dashboard.html         |  1 +
 tksupport/web/vacation-request.html           |  1 +
 tksupport/web/vacation-status.html            |  1 +
 user-management/web/index.html                |  1 +
 user-management/web/static/js/sso-relay.js    | 39 +++++++++++++++++++
 90 files changed, 398 insertions(+), 3 deletions(-)
 create mode 100644 shared/frontend/sso-relay.js
 create mode 100644 system1-factory/web/js/sso-relay.js
 create mode 100644 system2-report/web/js/sso-relay.js
 create mode 100644 system3-nonconformance/web/static/js/sso-relay.js
 create mode 100644 tkpurchase/web/static/js/sso-relay.js
 create mode 100644 tksafety/web/static/js/sso-relay.js
 create mode 100644 tksupport/web/static/js/sso-relay.js
 create mode 100644 user-management/web/static/js/sso-relay.js

diff --git a/gateway/html/dashboard.html b/gateway/html/dashboard.html
index 056f828..ea0f02a 100644
--- a/gateway/html/dashboard.html
+++ b/gateway/html/dashboard.html
@@ -781,7 +781,8 @@
 
                 var redirect = new URLSearchParams(location.search).get('redirect');
                 if (redirect && isSafeRedirect(redirect)) {
-                    window.location.href = redirect;
+                    var sep = redirect.indexOf('#') === -1 ? '#' : '&';
+                    window.location.href = redirect + sep + '_sso=' + encodeURIComponent(data.access_token);
                 } else {
                     window.location.href = '/dashboard';
                 }
@@ -840,7 +841,8 @@
                         // Already logged in + redirect param
                         var redirect = params.get('redirect');
                         if (redirect && isSafeRedirect(redirect)) {
-                            window.location.href = redirect;
+                            var sep = redirect.indexOf('#') === -1 ? '#' : '&';
+                            window.location.href = redirect + sep + '_sso=' + encodeURIComponent(token);
                             return;
                         }
 
diff --git a/shared/frontend/sso-relay.js b/shared/frontend/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/shared/frontend/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();
diff --git a/system1-factory/web/index.html b/system1-factory/web/index.html
index 9a4421d..44a390e 100644
--- a/system1-factory/web/index.html
+++ b/system1-factory/web/index.html
@@ -10,6 +10,7 @@
   if('serviceWorker' in navigator){navigator.serviceWorker.getRegistrations().then(function(r){r.forEach(function(reg){reg.unregister()});})}
   if('caches' in window){caches.keys().then(function(k){k.forEach(function(key){caches.delete(key)})})}
   </script>
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script>
     // SSO 토큰 확인
diff --git a/system1-factory/web/js/sso-relay.js b/system1-factory/web/js/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/system1-factory/web/js/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();
diff --git a/system1-factory/web/pages/admin/attendance-report.html b/system1-factory/web/pages/admin/attendance-report.html
index c572f04..e92795a 100644
--- a/system1-factory/web/pages/admin/attendance-report.html
+++ b/system1-factory/web/pages/admin/attendance-report.html
@@ -190,6 +190,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/admin/equipment-detail.html b/system1-factory/web/pages/admin/equipment-detail.html
index c943064..f6f8b13 100644
--- a/system1-factory/web/pages/admin/equipment-detail.html
+++ b/system1-factory/web/pages/admin/equipment-detail.html
@@ -314,6 +314,7 @@
     </div>
   </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/admin/equipments.html b/system1-factory/web/pages/admin/equipments.html
index a27223a..d0736e0 100644
--- a/system1-factory/web/pages/admin/equipments.html
+++ b/system1-factory/web/pages/admin/equipments.html
@@ -190,6 +190,7 @@
     </div>
   </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/admin/purchase-analysis.html b/system1-factory/web/pages/admin/purchase-analysis.html
index 3f4d8a4..a79ca02 100644
--- a/system1-factory/web/pages/admin/purchase-analysis.html
+++ b/system1-factory/web/pages/admin/purchase-analysis.html
@@ -135,6 +135,7 @@
             </div>
         </div>
     </div>
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/static/js/purchase-analysis.js?v=2026040103"></script>
 </body>
diff --git a/system1-factory/web/pages/admin/repair-management.html b/system1-factory/web/pages/admin/repair-management.html
index 1ab55a7..f61291e 100644
--- a/system1-factory/web/pages/admin/repair-management.html
+++ b/system1-factory/web/pages/admin/repair-management.html
@@ -507,6 +507,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031401"></script>
     <script>
diff --git a/system1-factory/web/pages/attendance/annual-overview.html b/system1-factory/web/pages/attendance/annual-overview.html
index cac8c50..e7a7ce1 100644
--- a/system1-factory/web/pages/attendance/annual-overview.html
+++ b/system1-factory/web/pages/attendance/annual-overview.html
@@ -390,6 +390,7 @@
     </div>
   </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/checkin.html b/system1-factory/web/pages/attendance/checkin.html
index 0732227..5dfb423 100644
--- a/system1-factory/web/pages/attendance/checkin.html
+++ b/system1-factory/web/pages/attendance/checkin.html
@@ -234,6 +234,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/daily.html b/system1-factory/web/pages/attendance/daily.html
index feebbde..4103749 100644
--- a/system1-factory/web/pages/attendance/daily.html
+++ b/system1-factory/web/pages/attendance/daily.html
@@ -70,6 +70,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/monthly-comparison.html b/system1-factory/web/pages/attendance/monthly-comparison.html
index 3e0789c..b457822 100644
--- a/system1-factory/web/pages/attendance/monthly-comparison.html
+++ b/system1-factory/web/pages/attendance/monthly-comparison.html
@@ -162,6 +162,7 @@
     <!-- Toast -->
     <div id="toastContainer" class="toast-container"></div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031701"></script>
     <script src="/js/monthly-comparison.js?v=2026040109"></script>
diff --git a/system1-factory/web/pages/attendance/monthly.html b/system1-factory/web/pages/attendance/monthly.html
index 1518c20..a6b394e 100644
--- a/system1-factory/web/pages/attendance/monthly.html
+++ b/system1-factory/web/pages/attendance/monthly.html
@@ -489,6 +489,7 @@
     </div>
   </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/my-monthly-confirm.html b/system1-factory/web/pages/attendance/my-monthly-confirm.html
index e9c690c..a42408f 100644
--- a/system1-factory/web/pages/attendance/my-monthly-confirm.html
+++ b/system1-factory/web/pages/attendance/my-monthly-confirm.html
@@ -104,6 +104,7 @@
     <!-- Toast -->
     <div id="toastContainer" class="toast-container"></div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031701"></script>
     <script src="/js/my-monthly-confirm.js?v=2026040106"></script>
diff --git a/system1-factory/web/pages/attendance/my-vacation-info.html b/system1-factory/web/pages/attendance/my-vacation-info.html
index 0d8b570..d636a34 100644
--- a/system1-factory/web/pages/attendance/my-vacation-info.html
+++ b/system1-factory/web/pages/attendance/my-vacation-info.html
@@ -267,6 +267,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/vacation-allocation.html b/system1-factory/web/pages/attendance/vacation-allocation.html
index 75e6225..49965c8 100644
--- a/system1-factory/web/pages/attendance/vacation-allocation.html
+++ b/system1-factory/web/pages/attendance/vacation-allocation.html
@@ -353,6 +353,7 @@
     </div>
   </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script type="module" src="/js/vacation-allocation.js" defer></script>
diff --git a/system1-factory/web/pages/attendance/vacation-approval.html b/system1-factory/web/pages/attendance/vacation-approval.html
index 45890ab..496952a 100644
--- a/system1-factory/web/pages/attendance/vacation-approval.html
+++ b/system1-factory/web/pages/attendance/vacation-approval.html
@@ -130,6 +130,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/vacation-input.html b/system1-factory/web/pages/attendance/vacation-input.html
index 0ddc45a..b910a51 100644
--- a/system1-factory/web/pages/attendance/vacation-input.html
+++ b/system1-factory/web/pages/attendance/vacation-input.html
@@ -123,6 +123,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/vacation-management.html b/system1-factory/web/pages/attendance/vacation-management.html
index 9c417f9..de707fb 100644
--- a/system1-factory/web/pages/attendance/vacation-management.html
+++ b/system1-factory/web/pages/attendance/vacation-management.html
@@ -215,6 +215,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/vacation-request.html b/system1-factory/web/pages/attendance/vacation-request.html
index 91fe46e..e4ecb1c 100644
--- a/system1-factory/web/pages/attendance/vacation-request.html
+++ b/system1-factory/web/pages/attendance/vacation-request.html
@@ -117,6 +117,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/attendance/work-status.html b/system1-factory/web/pages/attendance/work-status.html
index 57c3a50..35a99d8 100644
--- a/system1-factory/web/pages/attendance/work-status.html
+++ b/system1-factory/web/pages/attendance/work-status.html
@@ -286,6 +286,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
diff --git a/system1-factory/web/pages/dashboard-new.html b/system1-factory/web/pages/dashboard-new.html
index c3d8133..c37d57b 100644
--- a/system1-factory/web/pages/dashboard-new.html
+++ b/system1-factory/web/pages/dashboard-new.html
@@ -47,6 +47,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/production-dashboard.js?v=2026040103"></script>
     <script src="/static/js/shared-bottom-nav.js?v=2026040103"></script>
diff --git a/system1-factory/web/pages/dashboard.html b/system1-factory/web/pages/dashboard.html
index c966878..954afbc 100644
--- a/system1-factory/web/pages/dashboard.html
+++ b/system1-factory/web/pages/dashboard.html
@@ -324,6 +324,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031401"></script>
     <script type="module" src="/js/modern-dashboard.js?v=2026031401"></script>
diff --git a/system1-factory/web/pages/inspection/daily-patrol.html b/system1-factory/web/pages/inspection/daily-patrol.html
index 69aad0e..ba7bb50 100644
--- a/system1-factory/web/pages/inspection/daily-patrol.html
+++ b/system1-factory/web/pages/inspection/daily-patrol.html
@@ -209,6 +209,7 @@
       }, 50);
     })();
   </script>
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="/js/daily-patrol.js?v=2026031401"></script>
diff --git a/system1-factory/web/pages/inspection/zone-detail.html b/system1-factory/web/pages/inspection/zone-detail.html
index a22c728..23cf471 100644
--- a/system1-factory/web/pages/inspection/zone-detail.html
+++ b/system1-factory/web/pages/inspection/zone-detail.html
@@ -304,6 +304,7 @@
       }, 50);
     })();
   </script>
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="/js/zone-detail.js?v=2026031401"></script>
diff --git a/system1-factory/web/pages/profile/info.html b/system1-factory/web/pages/profile/info.html
index a10175e..6a5e117 100644
--- a/system1-factory/web/pages/profile/info.html
+++ b/system1-factory/web/pages/profile/info.html
@@ -320,6 +320,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script type="module" src="/js/my-profile.js"></script>
diff --git a/system1-factory/web/pages/profile/password.html b/system1-factory/web/pages/profile/password.html
index b8e2a7b..173b40c 100644
--- a/system1-factory/web/pages/profile/password.html
+++ b/system1-factory/web/pages/profile/password.html
@@ -390,6 +390,7 @@
         </div>
     </div>
 
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script>initAuth();</script>
   <script src="/js/change-password.js?v=2026040101"></script>
diff --git a/system1-factory/web/pages/purchase/request-mobile.html b/system1-factory/web/pages/purchase/request-mobile.html
index a145c13..5c1fb6a 100644
--- a/system1-factory/web/pages/purchase/request-mobile.html
+++ b/system1-factory/web/pages/purchase/request-mobile.html
@@ -97,6 +97,7 @@
         <div class="pm-sheet-body" id="detailContent"></div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/static/js/purchase-request-mobile.js?v=2026040104"></script>
     <script src="/static/js/shared-bottom-nav.js?v=2026040103"></script>
diff --git a/system1-factory/web/pages/purchase/request.html b/system1-factory/web/pages/purchase/request.html
index 8eee40e..903af7e 100644
--- a/system1-factory/web/pages/purchase/request.html
+++ b/system1-factory/web/pages/purchase/request.html
@@ -312,6 +312,7 @@
             </div>
         </div>
     </div>
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/static/js/purchase-request.js?v=2026040104"></script>
 </body>
diff --git a/system1-factory/web/pages/work/analysis.html b/system1-factory/web/pages/work/analysis.html
index 85e44dc..282d4cf 100644
--- a/system1-factory/web/pages/work/analysis.html
+++ b/system1-factory/web/pages/work/analysis.html
@@ -277,6 +277,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031401"></script>
     <script type="module" src="/js/work-analysis.js?v=2026031401"></script>
@@ -2871,4 +2872,4 @@
     </script>
     <script>initAuth();</script>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/system1-factory/web/pages/work/daily-status.html b/system1-factory/web/pages/work/daily-status.html
index d652637..a3b4610 100644
--- a/system1-factory/web/pages/work/daily-status.html
+++ b/system1-factory/web/pages/work/daily-status.html
@@ -163,6 +163,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031701"></script>
     <script src="/js/daily-status.js?v=2026033001"></script>
diff --git a/system1-factory/web/pages/work/meeting-detail.html b/system1-factory/web/pages/work/meeting-detail.html
index cf464d4..9de24c5 100644
--- a/system1-factory/web/pages/work/meeting-detail.html
+++ b/system1-factory/web/pages/work/meeting-detail.html
@@ -193,6 +193,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/meeting-detail.js?v=2026031701"></script>
 </body>
diff --git a/system1-factory/web/pages/work/meetings.html b/system1-factory/web/pages/work/meetings.html
index 68a9567..92e6dae 100644
--- a/system1-factory/web/pages/work/meetings.html
+++ b/system1-factory/web/pages/work/meetings.html
@@ -80,6 +80,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/meetings.js?v=2026031701"></script>
 </body>
diff --git a/system1-factory/web/pages/work/proxy-input.html b/system1-factory/web/pages/work/proxy-input.html
index ca43b84..4004c6f 100644
--- a/system1-factory/web/pages/work/proxy-input.html
+++ b/system1-factory/web/pages/work/proxy-input.html
@@ -114,6 +114,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031701"></script>
     <script src="/js/proxy-input.js?v=2026033202"></script>
diff --git a/system1-factory/web/pages/work/report-create-mobile.html b/system1-factory/web/pages/work/report-create-mobile.html
index 2f7f94f..afa8194 100644
--- a/system1-factory/web/pages/work/report-create-mobile.html
+++ b/system1-factory/web/pages/work/report-create-mobile.html
@@ -190,6 +190,7 @@
   </div>
 
   <!-- 공통 모듈 -->
+  <script src="/js/sso-relay.js?v=20260401"></script>
   <script src="/static/js/tkfb-core.js?v=2026040105"></script>
   <script src="/js/api-base.js?v=2026031401"></script>
   <script src="/js/common/utils.js?v=2026031401"></script>
diff --git a/system1-factory/web/pages/work/report-create.html b/system1-factory/web/pages/work/report-create.html
index 70f1afd..e155630 100644
--- a/system1-factory/web/pages/work/report-create.html
+++ b/system1-factory/web/pages/work/report-create.html
@@ -149,6 +149,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031401"></script>
     <script src="/js/common/utils.js?v=2026031401"></script>
diff --git a/system1-factory/web/pages/work/schedule.html b/system1-factory/web/pages/work/schedule.html
index c087027..45034fe 100644
--- a/system1-factory/web/pages/work/schedule.html
+++ b/system1-factory/web/pages/work/schedule.html
@@ -347,6 +347,7 @@
         </div>
     </div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/schedule.js?v=2026031701"></script>
     <script>
diff --git a/system1-factory/web/pages/work/tbm-create.html b/system1-factory/web/pages/work/tbm-create.html
index e6a8f26..80b4594 100644
--- a/system1-factory/web/pages/work/tbm-create.html
+++ b/system1-factory/web/pages/work/tbm-create.html
@@ -843,6 +843,7 @@
     </div>
 
     <!-- Scripts -->
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026040101"></script>
     <!-- 공통 모듈 -->
diff --git a/system1-factory/web/pages/work/tbm-mobile.html b/system1-factory/web/pages/work/tbm-mobile.html
index ad831dd..f063b49 100644
--- a/system1-factory/web/pages/work/tbm-mobile.html
+++ b/system1-factory/web/pages/work/tbm-mobile.html
@@ -264,6 +264,7 @@
     </div>
 
     <!-- 공통 모듈 -->
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026040101"></script>
     <script src="/js/common/utils.js?v=2026040101"></script>
diff --git a/system1-factory/web/pages/work/tbm.html b/system1-factory/web/pages/work/tbm.html
index 7074352..e932138 100644
--- a/system1-factory/web/pages/work/tbm.html
+++ b/system1-factory/web/pages/work/tbm.html
@@ -573,6 +573,7 @@
     <!-- 토스트 -->
     <div class="toast-container" id="toastContainer"></div>
 
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkfb-core.js?v=2026040105"></script>
     <script src="/js/api-base.js?v=2026031602"></script>
     <script src="/js/common/utils.js?v=2026031602"></script>
diff --git a/system2-report/web/js/sso-relay.js b/system2-report/web/js/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/system2-report/web/js/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();
diff --git a/system2-report/web/pages/safety/chat-report.html b/system2-report/web/pages/safety/chat-report.html
index a142f90..22bc402 100644
--- a/system2-report/web/pages/safety/chat-report.html
+++ b/system2-report/web/pages/safety/chat-report.html
@@ -6,6 +6,7 @@
     <title>AI 신고 도우미 | (주)테크니컬코리아</title>
     <link rel="icon" type="image/png" href="/img/favicon.png">
     <link rel="stylesheet" href="/css/chat-report.css?v=2026031401">
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/js/api-base.js?v=2026040101"></script>
     <script src="/js/app-init.js?v=2026031401" defer></script>
 </head>
diff --git a/system2-report/web/pages/safety/issue-detail.html b/system2-report/web/pages/safety/issue-detail.html
index c75debf..8df50f8 100644
--- a/system2-report/web/pages/safety/issue-detail.html
+++ b/system2-report/web/pages/safety/issue-detail.html
@@ -8,6 +8,7 @@
     <link rel="stylesheet" href="/css/common.css?v=2026031401">
     <link rel="stylesheet" href="/css/project-management.css?v=2026031401">
     <link rel="icon" type="image/png" href="/img/favicon.png">
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/js/api-base.js?v=2026040101"></script>
     <script src="/js/app-init.js?v=2026031401" defer></script>
     <script src="https://instant.page/5.2.0" type="module"></script>
diff --git a/system2-report/web/pages/safety/issue-report.html b/system2-report/web/pages/safety/issue-report.html
index 84519d1..01d68c4 100644
--- a/system2-report/web/pages/safety/issue-report.html
+++ b/system2-report/web/pages/safety/issue-report.html
@@ -5,6 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
     <title>신고 등록 | (주)테크니컬코리아</title>
     <link rel="icon" type="image/png" href="/img/favicon.png">
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/js/api-base.js?v=2026040101"></script>
     <script src="/js/app-init.js?v=2026031401" defer></script>
     <style>
diff --git a/system2-report/web/pages/safety/report-status.html b/system2-report/web/pages/safety/report-status.html
index 1425836..0796137 100644
--- a/system2-report/web/pages/safety/report-status.html
+++ b/system2-report/web/pages/safety/report-status.html
@@ -8,6 +8,7 @@
     <link rel="stylesheet" href="/css/common.css?v=2026031401">
     <link rel="stylesheet" href="/css/project-management.css?v=2026031401">
     <link rel="icon" type="image/png" href="/img/favicon.png">
+    <script src="/js/sso-relay.js?v=20260401"></script>
     <script src="/js/api-base.js?v=2026040101"></script>
     <script src="/js/app-init.js?v=2026031401" defer></script>
     <script src="https://instant.page/5.2.0" type="module"></script>
diff --git a/system3-nonconformance/web/ai-assistant.html b/system3-nonconformance/web/ai-assistant.html
index 1cbc4a8..8e02d93 100644
--- a/system3-nonconformance/web/ai-assistant.html
+++ b/system3-nonconformance/web/ai-assistant.html
@@ -277,6 +277,7 @@
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/core/page-manager.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
     <script src="/static/js/utils/toast.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/issue-view.html b/system3-nonconformance/web/issue-view.html
index 1676a6b..ae96a9e 100644
--- a/system3-nonconformance/web/issue-view.html
+++ b/system3-nonconformance/web/issue-view.html
@@ -111,6 +111,7 @@
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/core/page-manager.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
     <script src="/static/js/utils/photo-modal.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/issues-archive.html b/system3-nonconformance/web/issues-archive.html
index 2fe5fe4..9dbb274 100644
--- a/system3-nonconformance/web/issues-archive.html
+++ b/system3-nonconformance/web/issues-archive.html
@@ -201,6 +201,7 @@
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/core/page-manager.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
     <script src="/static/js/utils/photo-modal.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/issues-dashboard.html b/system3-nonconformance/web/issues-dashboard.html
index 31568c0..2e5dbd1 100644
--- a/system3-nonconformance/web/issues-dashboard.html
+++ b/system3-nonconformance/web/issues-dashboard.html
@@ -554,6 +554,7 @@
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/core/page-manager.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
     <script src="/static/js/utils/photo-modal.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/issues-inbox.html b/system3-nonconformance/web/issues-inbox.html
index 8d676f2..9ba9d6b 100644
--- a/system3-nonconformance/web/issues-inbox.html
+++ b/system3-nonconformance/web/issues-inbox.html
@@ -373,6 +373,7 @@
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/core/page-manager.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/components/mobile-calendar.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/issues-management.html b/system3-nonconformance/web/issues-management.html
index cfd7e0f..4b8fa42 100644
--- a/system3-nonconformance/web/issues-management.html
+++ b/system3-nonconformance/web/issues-management.html
@@ -343,6 +343,7 @@
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/core/page-manager.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
     <script src="/static/js/utils/photo-modal.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/m/dashboard.html b/system3-nonconformance/web/m/dashboard.html
index b3bd3d5..d433701 100644
--- a/system3-nonconformance/web/m/dashboard.html
+++ b/system3-nonconformance/web/m/dashboard.html
@@ -186,6 +186,7 @@
 
     <!-- 스크립트 -->
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/core/permissions.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/m/inbox.html b/system3-nonconformance/web/m/inbox.html
index d282344..6e70178 100644
--- a/system3-nonconformance/web/m/inbox.html
+++ b/system3-nonconformance/web/m/inbox.html
@@ -194,6 +194,7 @@
 
     <!-- 스크립트 -->
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/core/permissions.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/m/management.html b/system3-nonconformance/web/m/management.html
index c7257f3..58069ea 100644
--- a/system3-nonconformance/web/m/management.html
+++ b/system3-nonconformance/web/m/management.html
@@ -174,6 +174,7 @@
 
     <!-- 스크립트 -->
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
     <script src="/static/js/core/permissions.js?v=2026031401"></script>
     <script src="/static/js/utils/issue-helpers.js?v=2026031401"></script>
diff --git a/system3-nonconformance/web/reports-daily.html b/system3-nonconformance/web/reports-daily.html
index 3fb39f5..46542b3 100644
--- a/system3-nonconformance/web/reports-daily.html
+++ b/system3-nonconformance/web/reports-daily.html
@@ -185,6 +185,7 @@
     <script src="/static/js/core/permissions.js?v=2026031401"></script>
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
 
     <script>
diff --git a/system3-nonconformance/web/reports-monthly.html b/system3-nonconformance/web/reports-monthly.html
index ee837b0..b52d7cf 100644
--- a/system3-nonconformance/web/reports-monthly.html
+++ b/system3-nonconformance/web/reports-monthly.html
@@ -72,6 +72,7 @@
     <script src="/static/js/core/permissions.js?v=2026031401"></script>
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
 
     <script>
diff --git a/system3-nonconformance/web/reports-weekly.html b/system3-nonconformance/web/reports-weekly.html
index 9f984e4..b216c1b 100644
--- a/system3-nonconformance/web/reports-weekly.html
+++ b/system3-nonconformance/web/reports-weekly.html
@@ -71,6 +71,7 @@
     <script src="/static/js/core/permissions.js?v=2026031401"></script>
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
 
     <script>
diff --git a/system3-nonconformance/web/reports.html b/system3-nonconformance/web/reports.html
index a81f976..1de7180 100644
--- a/system3-nonconformance/web/reports.html
+++ b/system3-nonconformance/web/reports.html
@@ -173,6 +173,7 @@
     <script src="/static/js/core/permissions.js?v=2026031401"></script>
     <script src="/static/js/components/common-header.js?v=2026031401"></script>
     <script src="/static/js/api.js?v=2026031401"></script>
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/core/auth-manager.js?v=2026031401"></script>
 
     <script>
diff --git a/system3-nonconformance/web/static/js/sso-relay.js b/system3-nonconformance/web/static/js/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/system3-nonconformance/web/static/js/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();
diff --git a/tkpurchase/web/accounts.html b/tkpurchase/web/accounts.html
index 11f3abc..4dd9b6f 100644
--- a/tkpurchase/web/accounts.html
+++ b/tkpurchase/web/accounts.html
@@ -133,6 +133,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-accounts.js?v=2026031601"></script>
     <script>initAccountsPage();</script>
diff --git a/tkpurchase/web/daylabor.html b/tkpurchase/web/daylabor.html
index b202841..ee5d6db 100644
--- a/tkpurchase/web/daylabor.html
+++ b/tkpurchase/web/daylabor.html
@@ -148,6 +148,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-daylabor.js?v=2026031601"></script>
     <script>initDayLaborPage();</script>
diff --git a/tkpurchase/web/index.html b/tkpurchase/web/index.html
index 08b91ae..870ea3d 100644
--- a/tkpurchase/web/index.html
+++ b/tkpurchase/web/index.html
@@ -88,6 +88,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-dashboard.js?v=2026031601"></script>
     <script>initDashboard();</script>
diff --git a/tkpurchase/web/partner-history.html b/tkpurchase/web/partner-history.html
index 739c937..a81f6ad 100644
--- a/tkpurchase/web/partner-history.html
+++ b/tkpurchase/web/partner-history.html
@@ -61,6 +61,7 @@
         <div id="historyPagination" class="mt-4 flex justify-center gap-2"></div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-partner-history.js?v=2026031602"></script>
     <script>initPartnerHistory();</script>
diff --git a/tkpurchase/web/partner-portal.html b/tkpurchase/web/partner-portal.html
index bf4b421..63d6b7e 100644
--- a/tkpurchase/web/partner-portal.html
+++ b/tkpurchase/web/partner-portal.html
@@ -81,6 +81,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-partner-portal.js?v=2026031602"></script>
     <script>initPartnerPortal();</script>
diff --git a/tkpurchase/web/partner.html b/tkpurchase/web/partner.html
index ff7ad37..181c343 100644
--- a/tkpurchase/web/partner.html
+++ b/tkpurchase/web/partner.html
@@ -294,6 +294,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-partner.js?v=2026031601"></script>
     <script>initPartnerPage();</script>
diff --git a/tkpurchase/web/schedule.html b/tkpurchase/web/schedule.html
index 6b2d0f3..a7e4517 100644
--- a/tkpurchase/web/schedule.html
+++ b/tkpurchase/web/schedule.html
@@ -275,6 +275,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-schedule.js?v=2026031602"></script>
     <script>initSchedulePage();</script>
diff --git a/tkpurchase/web/static/js/sso-relay.js b/tkpurchase/web/static/js/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/tkpurchase/web/static/js/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();
diff --git a/tkpurchase/web/workreport-summary.html b/tkpurchase/web/workreport-summary.html
index fdc0fc7..0a13e35 100644
--- a/tkpurchase/web/workreport-summary.html
+++ b/tkpurchase/web/workreport-summary.html
@@ -100,6 +100,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-workreport-summary.js?v=2026031601"></script>
     <script>initSummaryPage();</script>
diff --git a/tkpurchase/web/workreport.html b/tkpurchase/web/workreport.html
index 1785e43..3c33453 100644
--- a/tkpurchase/web/workreport.html
+++ b/tkpurchase/web/workreport.html
@@ -114,6 +114,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkpurchase-core.js?v=2026040101"></script>
     <script src="/static/js/tkpurchase-workreport.js?v=2026031601"></script>
     <script>initWorkReportPage();</script>
diff --git a/tksafety/web/checklist.html b/tksafety/web/checklist.html
index 7cb2aa8..aae4da8 100644
--- a/tksafety/web/checklist.html
+++ b/tksafety/web/checklist.html
@@ -164,6 +164,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-checklist.js?v=2026031401"></script>
     <script>initChecklistPage();</script>
diff --git a/tksafety/web/education.html b/tksafety/web/education.html
index 5dc46c6..efe1877 100644
--- a/tksafety/web/education.html
+++ b/tksafety/web/education.html
@@ -190,6 +190,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-education.js?v=2026031401"></script>
     <script>initEducationPage();</script>
diff --git a/tksafety/web/entry-dashboard.html b/tksafety/web/entry-dashboard.html
index 59a1562..90e849a 100644
--- a/tksafety/web/entry-dashboard.html
+++ b/tksafety/web/entry-dashboard.html
@@ -106,6 +106,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-entry-dashboard.js?v=2026031401"></script>
     <script>initEntryDashboard();</script>
diff --git a/tksafety/web/index.html b/tksafety/web/index.html
index 4e336e1..d8827a1 100644
--- a/tksafety/web/index.html
+++ b/tksafety/web/index.html
@@ -277,6 +277,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-visit.js?v=2026031401"></script>
     <script>initVisitPage();</script>
diff --git a/tksafety/web/risk-assess.html b/tksafety/web/risk-assess.html
index ff23ca5..bc9d13f 100644
--- a/tksafety/web/risk-assess.html
+++ b/tksafety/web/risk-assess.html
@@ -210,6 +210,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-risk.js?v=2026031501"></script>
     <script>initRiskAssessPage();</script>
diff --git a/tksafety/web/risk-projects.html b/tksafety/web/risk-projects.html
index 389b373..d591391 100644
--- a/tksafety/web/risk-projects.html
+++ b/tksafety/web/risk-projects.html
@@ -166,6 +166,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-risk.js?v=2026031501"></script>
     <script>
diff --git a/tksafety/web/static/js/sso-relay.js b/tksafety/web/static/js/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/tksafety/web/static/js/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();
diff --git a/tksafety/web/training.html b/tksafety/web/training.html
index 3fabaef..d016d1e 100644
--- a/tksafety/web/training.html
+++ b/tksafety/web/training.html
@@ -214,6 +214,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-training.js"></script>
     <script>initTrainingPage();</script>
diff --git a/tksafety/web/visit-management.html b/tksafety/web/visit-management.html
index 299281b..ab879f4 100644
--- a/tksafety/web/visit-management.html
+++ b/tksafety/web/visit-management.html
@@ -184,6 +184,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-visit-management.js?v=2026031401"></script>
     <script>initVisitManagementPage();</script>
diff --git a/tksafety/web/visit-request.html b/tksafety/web/visit-request.html
index 35c9ad3..ec751b9 100644
--- a/tksafety/web/visit-request.html
+++ b/tksafety/web/visit-request.html
@@ -148,6 +148,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksafety-core.js?v=2026040101"></script>
     <script src="/static/js/tksafety-visit-request.js?v=2026031401"></script>
     <script>initVisitRequestPage();</script>
diff --git a/tksupport/web/company-holidays.html b/tksupport/web/company-holidays.html
index df2e90e..fdd42fb 100644
--- a/tksupport/web/company-holidays.html
+++ b/tksupport/web/company-holidays.html
@@ -108,6 +108,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksupport-core.js?v=2026040101"></script>
     <script>
     async function initPage() {
diff --git a/tksupport/web/index.html b/tksupport/web/index.html
index 74998fc..3955b0b 100644
--- a/tksupport/web/index.html
+++ b/tksupport/web/index.html
@@ -123,6 +123,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksupport-core.js?v=2026040101"></script>
     <script>
     let vacationTypes = [];
diff --git a/tksupport/web/static/js/sso-relay.js b/tksupport/web/static/js/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/tksupport/web/static/js/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();
diff --git a/tksupport/web/vacation-admin.html b/tksupport/web/vacation-admin.html
index 97671c8..a1cf27b 100644
--- a/tksupport/web/vacation-admin.html
+++ b/tksupport/web/vacation-admin.html
@@ -113,6 +113,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksupport-core.js?v=2026040101"></script>
     <script>
     const TYPE_COLOR = {
diff --git a/tksupport/web/vacation-approval.html b/tksupport/web/vacation-approval.html
index bcbe596..6f9da0c 100644
--- a/tksupport/web/vacation-approval.html
+++ b/tksupport/web/vacation-approval.html
@@ -203,6 +203,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksupport-core.js?v=2026040101"></script>
     <script>
     let reviewAction = '';
diff --git a/tksupport/web/vacation-dashboard.html b/tksupport/web/vacation-dashboard.html
index 46f75a1..92b8063 100644
--- a/tksupport/web/vacation-dashboard.html
+++ b/tksupport/web/vacation-dashboard.html
@@ -145,6 +145,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksupport-core.js?v=2026040101"></script>
     <script>
     const TYPE_COLOR = {
diff --git a/tksupport/web/vacation-request.html b/tksupport/web/vacation-request.html
index 2a6c563..3d652a6 100644
--- a/tksupport/web/vacation-request.html
+++ b/tksupport/web/vacation-request.html
@@ -84,6 +84,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksupport-core.js?v=2026040101"></script>
     <script>
     async function initRequestPage() {
diff --git a/tksupport/web/vacation-status.html b/tksupport/web/vacation-status.html
index 282176a..3189d7c 100644
--- a/tksupport/web/vacation-status.html
+++ b/tksupport/web/vacation-status.html
@@ -120,6 +120,7 @@
         </div>
     </div>
 
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tksupport-core.js?v=2026040101"></script>
     <script>
     let cachedRequests = [];
diff --git a/user-management/web/index.html b/user-management/web/index.html
index 5a29a7b..d751551 100644
--- a/user-management/web/index.html
+++ b/user-management/web/index.html
@@ -2418,6 +2418,7 @@
     </div>
 
     <!-- JS: Core (config, token, api, toast, helpers, init) -->
+    <script src="/static/js/sso-relay.js?v=20260401"></script>
     <script src="/static/js/tkuser-core.js?v=2026040101"></script>
     <!-- JS: Tabs -->
     <script src="/static/js/tkuser-tabs.js?v=2026032301"></script>
diff --git a/user-management/web/static/js/sso-relay.js b/user-management/web/static/js/sso-relay.js
new file mode 100644
index 0000000..820bdb1
--- /dev/null
+++ b/user-management/web/static/js/sso-relay.js
@@ -0,0 +1,39 @@
+/**
+ * SSO Token Relay — 인앱 브라우저(카카오톡 등) 서브도메인 쿠키 미공유 대응
+ *
+ * Canonical source: shared/frontend/sso-relay.js
+ * 전 서비스 동일 코드 — 수정 시 아래 파일 ���체 갱신 필요:
+ *   system1-factory/web/js/sso-relay.js
+ *   system2-report/web/js/sso-relay.js
+ *   system3-nonconformance/web/static/js/sso-relay.js
+ *   user-management/web/static/js/sso-relay.js
+ *   tkpurchase/web/static/js/sso-relay.js
+ *   tksafety/web/static/js/sso-relay.js
+ *   tksupport/web/static/js/sso-relay.js
+ *
+ * 동작: URL hash에 _sso= 파라미터가 있으면 토큰을 로컬 쿠키+localStorage에 설정하고 hash를 제거.
+ * gateway/dashboard.html에서 로그인 성공 후 redirect URL에 #_sso=<token>을 붙여 전달.
+ */
+(function() {
+  var hash = location.hash;
+  if (!hash || hash.indexOf('_sso=') === -1) return;
+
+  var match = hash.match(/[#&]_sso=([^&]*)/);
+  if (!match) return;
+
+  var token = decodeURIComponent(match[1]);
+  if (!token) return;
+
+  // 로컬(1st-party) 쿠키 설정
+  var cookie = 'sso_token=' + encodeURIComponent(token) + '; path=/; max-age=604800';
+  if (location.hostname.indexOf('technicalkorea.net') !== -1) {
+    cookie += '; domain=.technicalkorea.net; secure; samesite=lax';
+  }
+  document.cookie = cookie;
+
+  // localStorage 폴백
+  try { localStorage.setItem('sso_token', token); } catch (e) {}
+
+  // URL에서 hash 제거
+  history.replaceState(null, '', location.pathname + location.search);
+})();