功能：支持访问

做完后，一位 BES 员工在限定时间内能进客户的租户（tenant）处理问题，客户能看到这条支持授权（support grant）。

环境	登录地址	带证书调用的接口地址
`local`	https://id.local.globalbes.sg	https://id.local.globalbes.sg:19443
`test`	https://id.test.globalbes.sg	https://id.test.globalbes.sg:9443
`staging`	待定	待定
`prod`	待定	待定

1. 支持授权

1.1

发支持授权

在哪里做：程序代码

BOSS 给员工发支持授权，得到 support_grant_id。员工到 expires_at 前能进这个租户；关闭时填这个 id。

POSTSupport Grant Issue

程序里发这个请求（id 用前面步骤返回的）：

带：证书

请求：

POST https://id.test.globalbes.sg:9443/internal/control/v1/support-grants
Content-Type: application/json

{
  "request_ref": "support-topaz-4821",
  "person_id": "2c7e9b41-5d08-4a3f-b6e2-91f4a8c3d057",
  "tenant_id": "7c0e2a5e-3b1f-4d6a-9a53-1f2f6d0c8a11",
  "product_id": "b41d9a70-6c2e-4a0f-8e7d-52a9c3f0d614",
  "project_id": "e2f7a1c4-0d35-4b8e-a6c9-7d18f4b2a903",
  "role_id": "5c2f8a1d-6e93-4b07-8c4a-d1e6f3b92a75",
  "reason": "Documents missing in Harbour Tower",
  "approved_by": "9a1e5c3b-7d42-4f86-b0a9-c5e3d7f1b284",
  "support_request_ref": "TOPAZ-4821",
  "expires_at": "2026-01-02T08:00:00+00:00"
}

HTTP/1.1 201 Created

{
  "support_grant_id": "a2e6c0f8-4b13-4d97-8c5a-e9b3d7f1a428",
  "person_id": "2c7e9b41-5d08-4a3f-b6e2-91f4a8c3d057",
  "tenant_id": "7c0e2a5e-3b1f-4d6a-9a53-1f2f6d0c8a11",
  "product_id": "b41d9a70-6c2e-4a0f-8e7d-52a9c3f0d614",
  "project_id": "e2f7a1c4-0d35-4b8e-a6c9-7d18f4b2a903",
  "role_id": "5c2f8a1d-6e93-4b07-8c4a-d1e6f3b92a75",
  "reason": "Documents missing in Harbour Tower",
  "approved_by": "9a1e5c3b-7d42-4f86-b0a9-c5e3d7f1b284",
  "support_request_ref": "TOPAZ-4821",
  "emergency": false,
  "effective_at": "2026-01-01T08:00:00+00:00",
  "expires_at": "2026-01-02T08:00:00+00:00",
  "closed_at": null,
  "close_reason": null,
  "status": "active",
  "version": 0
}

person_id：在用的 BES 员工（person_type: staff，建在平台租户里）；员工不会成为客户租户的成员（membership）。
approved_by：批准人，不能是被授权的员工本人。
role_id：本产品（product）预设的角色（role）；授权不会超过普通角色。
同一人、租户、产品和项目（project）同时只能有一条有效授权。
support_request_ref：客户的支持请求编号；只有 emergency: true 时可以不写，这条单独记录，事后要告知客户。

错误：

HTTP	错误码	处理
409	`SUPPORT_GRANT_ACTIVE`	已有有效授权：用 `support-grant.list` 查出来继续用。

1.2

列出支持授权

在哪里做：程序代码

列出租户的支持授权，得到谁被授权、为什么、到什么时候。给客户看。

GETSupport Grant List

程序里发这个请求（id 用前面步骤返回的）：

带：证书

请求：

GET https://id.test.globalbes.sg:9443/internal/control/v1/support-grants?tenant_id=7c0e2a5e-3b1f-4d6a-9a53-1f2f6d0c8a11&product_id=b41d9a70-6c2e-4a0f-8e7d-52a9c3f0d614&status=active

HTTP/1.1 200 OK

{
  "grants": [
    {
      "support_grant_id": "a2e6c0f8-4b13-4d97-8c5a-e9b3d7f1a428",
      "person_id": "2c7e9b41-5d08-4a3f-b6e2-91f4a8c3d057",
      "tenant_id": "7c0e2a5e-3b1f-4d6a-9a53-1f2f6d0c8a11",
      "product_id": "b41d9a70-6c2e-4a0f-8e7d-52a9c3f0d614",
      "project_id": "e2f7a1c4-0d35-4b8e-a6c9-7d18f4b2a903",
      "role_id": "5c2f8a1d-6e93-4b07-8c4a-d1e6f3b92a75",
      "reason": "Documents missing in Harbour Tower",
      "approved_by": "9a1e5c3b-7d42-4f86-b0a9-c5e3d7f1b284",
      "support_request_ref": "TOPAZ-4821",
      "emergency": false,
      "effective_at": "2026-01-01T08:00:00+00:00",
      "expires_at": "2026-01-02T08:00:00+00:00",
      "closed_at": null,
      "close_reason": null,
      "status": "active",
      "version": 0
    }
  ]
}

用 status（active、closed、expired）和 product_id 过滤。
过了 expires_at 的授权立即失效，不管是否已标成 expired。

1.3

关闭支持授权

在哪里做：程序代码

处理完就关闭支持授权，得到 closed 的授权。员工立即不能再进这个租户。

POSTSupport Grant Close

程序里发这个请求（id 用前面步骤返回的）：

带：证书

请求：

POST https://id.test.globalbes.sg:9443/internal/control/v1/support-grants/a2e6c0f8-4b13-4d97-8c5a-e9b3d7f1a428/close
Content-Type: application/json

{
  "request_ref": "close-support-topaz-4821",
  "product_id": "b41d9a70-6c2e-4a0f-8e7d-52a9c3f0d614",
  "reason": "TOPAZ-4821 resolved"
}

HTTP/1.1 200 OK

{
  "support_grant_id": "a2e6c0f8-4b13-4d97-8c5a-e9b3d7f1a428",
  "person_id": "2c7e9b41-5d08-4a3f-b6e2-91f4a8c3d057",
  "tenant_id": "7c0e2a5e-3b1f-4d6a-9a53-1f2f6d0c8a11",
  "product_id": "b41d9a70-6c2e-4a0f-8e7d-52a9c3f0d614",
  "project_id": "e2f7a1c4-0d35-4b8e-a6c9-7d18f4b2a903",
  "role_id": "5c2f8a1d-6e93-4b07-8c4a-d1e6f3b92a75",
  "reason": "Documents missing in Harbour Tower",
  "approved_by": "9a1e5c3b-7d42-4f86-b0a9-c5e3d7f1b284",
  "support_request_ref": "TOPAZ-4821",
  "emergency": false,
  "effective_at": "2026-01-01T08:00:00+00:00",
  "expires_at": "2026-01-02T08:00:00+00:00",
  "closed_at": "2026-01-01T11:30:00+00:00",
  "close_reason": "TOPAZ-4821 resolved",
  "status": "closed",
  "version": 1
}

立即生效：员工在这个范围的会话不再通过验证。
关闭已关闭的授权，返回原来的 closed_at。

做完这一部分，手里有：一条有效的支持授权；员工在到期或关闭前能进客户租户。