Cognito get_user_by_access_token failed: Access token decoded but payload is empty, #<Cupix::Auth::VerifiedAccessToken:0x00007fcb7c6e7ea0 @access_token="eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6Im5jcXBkdjdnNzAzbiIsImlzcyI6Imh0dHBzOi8vZmxpbnRjby5jdXBpeC53b3JrcyIsImlhdCI6MTc3NTU4OTE0MSwiZXhwIjoxNzc1NTkyNzQxLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwic2NvcGUiOm51bGx9.t7KPbjgXLs0bshRI7-HBgDdmigBmfUU1Yna4w6eNKUg", @decoded_access_token=nil, @issuer=nil>

# lib/cupix/auth/verification.rb:208-234
def self.verify_jwt_access_token!(access_token: nil)
  jwt = JWT.decode(access_token, nil, false)
  iss = jwt[0]['iss']  # => "https://flintco.cupix.works"
  # ...
  registered_issuers = [Cupix::Auth::Issuers::Cognito, Cupix::Auth::Issuers::Cupixworks]
  decoded_token = nil
  _issuer = nil

  registered_issuers.each do |issuer|
    next unless issuer.match?(iss)  # 두 issuer 모두 매칭 실패 → skip
    decoded_token = issuer.verify!(access_token)
    _issuer = issuer
  end

  # decoded_token=nil, _issuer=nil 상태로 반환
  ::Cupix::Auth::VerifiedAccessToken.new(access_token: access_token, decoded_access_token: decoded_token, issuer: _issuer)
end

# lib/cupix/auth/issuers/cupixworks.rb:94-101
def match?(issuer)
  protocol = Rails.env.development? ? 'https?' : 'https'
  regex_pattern = "^#{protocol}://[a-z0-9-]+\.#{Regexp.escape($APP_HOST)}$"
  regex = Regexp.new(regex_pattern, Regexp::IGNORECASE)
  !!issuer.match(regex)
end
# EU 서버에서 $APP_HOST='cupix-eu.works' → regex: ^https://[a-z0-9-]+\.cupix\-eu\.works$
# issuer 'https://flintco.cupix.works'는 이 패턴에 매칭 안 됨

# lib/cupix/auth/issuers/cognito.rb:38-41
def match?(issuer)
  regex = %r{^https://cognito-idp\.[a-z0-9-]+\.amazonaws\.com/[a-z0-9-_]+$}i
  !!issuer.match(regex)
end
# 'https://flintco.cupix.works'는 Cognito 패턴 아님

# lib/cupix/auth/verification.rb:61-69
begin
  if verified_access_token.decoded_access_token.nil?
    raise Cupix::Errors::Unauthorized.new(
      code: 'AUTH20008',
      reason: 'Access token decoded but payload is empty',
      access_token: verified_access_token.access_token
    )
  end

# lib/cupix/auth/verification.rb:82-88
rescue StandardError => e
  Cupix::Logger.error("Cognito get_user_by_access_token failed: #{e.message}, #{verified_access_token.inspect}",
                      class: 'Verification',
                      function: __method__,
                      module: 'Cupix::Auth',
                      error_type: e.class.name,
                      decoded_token_present: !verified_access_token.decoded_access_token.nil?)

# app/models/concerns/properties/team.rb:21-23
def app_url
  "#{$APP_PROTOCOL}://#{self.domain}.#{$APP_HOST}"
end

# lib/cupix/auth/jwt.rb:23-36
def issuer(any_entity)
  Rails.cache.fetch("cupix:auth:jwt:issuer:#{any_entity.class.name}:#{any_entity.id}", expires_in: 1.week) do
    case any_entity.class.name
    when 'Team'
      any_entity.app_url  # => "https://flintco.cupix.works" (US 서버에서)
    # ...
    end
  end
end

Datadog query: service:cupixworks-api "get_user_by_access_token"
Time range: 2026-04-06T00:00:00Z to 2026-04-08T00:00:00Z

{
  "class": "Verification",
  "function": "verify_authenticated_request!",
  "module": "Cupix::Auth",
  "error_type": "Cupix::Errors::Unauthorized",
  "decoded_token_present": false
}

$APP_HOST = ENV['APP_HOST'] || 'cupix.works'

service:cupixworks-api "Access token decoded but payload is empty" | count by @host

service:cupixworks-api "get_user_by_access_token failed" @decoded_token_present:false | count > 5 in 1h