fix and update

apps/frontend/lib/api.ts

@@ -7,16 +7,25 @@ function resolveBrowserApiBaseUrl(): string {
     return configuredApiUrl;
   }
 
-  try {
-    const configured = new URL(configuredApiUrl);
-    if (configured.hostname !== window.location.hostname) {
-      return API_ORIGIN_PROXY_PREFIX;
-    }
-  } catch {
-    // keep configured URL
+  if (configuredApiUrl.startsWith('/')) {
+    return configuredApiUrl.replace(/\/+$/, '') || API_ORIGIN_PROXY_PREFIX;
   }
 
-  return configuredApiUrl;
+  try {
+    const configured = new URL(configuredApiUrl);
+    const sameHost =
+      configured.hostname === window.location.hostname &&
+      (configured.port || (configured.protocol === 'https:' ? '443' : '80')) ===
+        (window.location.port || (window.location.protocol === 'https:' ? '443' : '80'));
+
+    if (sameHost) {
+      return API_ORIGIN_PROXY_PREFIX;
+    }
+
+    return configuredApiUrl.replace(/\/+$/, '');
+  } catch {
+    return API_ORIGIN_PROXY_PREFIX;
+  }
 }
 
 function resolveBrowserWsBaseUrl(): string {

apps/frontend/lib/system-settings-catalog.ts

@@ -31,7 +31,7 @@ export const SYSTEM_SETTING_CATALOG: SystemSettingMeta[] = [
     label: 'URL API (OAuth issuer)',
     group: 'general',
     type: 'text',
-    hint: 'Базовый URL API для OAuth/OIDC и FedCM. При same-origin деплое: https://ваш-домен/idp-api'
+    hint: 'Публичный URL, доступный из браузера пользователя. Не используйте api-gateway или другие Docker-имена. Пример: https://id.lendry.ru/idp-api'
   },
   {
     key: 'PUBLIC_FRONTEND_URL',

apps/frontend/next.config.ts

@@ -1,10 +1,14 @@
 import type { NextConfig } from 'next';
 
-const internalApiUrl = (
-  process.env.INTERNAL_API_URL ??
-  process.env.NEXT_PUBLIC_API_URL ??
-  'http://localhost:3000'
-).replace(/\/$/, '');
+function resolveInternalApiUrl(fallback = 'http://localhost:3000') {
+  const explicit = process.env.INTERNAL_API_URL?.trim();
+  if (explicit) {
+    return explicit.replace(/\/+$/, '');
+  }
+  return fallback.replace(/\/+$/, '');
+}
+
+const internalApiUrl = resolveInternalApiUrl('http://localhost:3000');
 
 const internalWsUrl = (process.env.INTERNAL_WS_URL ?? 'http://media-ws:8085').replace(/\/$/, '');
 

apps/frontend/public/sso-widget.js

@@ -66,19 +66,35 @@
     return 'IdentityCredential' in global && global.navigator && typeof global.navigator.credentials !== 'undefined';
   }
 
+  function isBrowserReachableBaseUrl(url) {
+    try {
+      var parsed = new URL(url);
+      var host = parsed.hostname.toLowerCase();
+      if (host === 'api-gateway' || host === 'sso-core' || host === 'frontend' || host === 'docs') {
+        return false;
+      }
+      if (host.indexOf('.') === -1 && host !== 'localhost') {
+        return false;
+      }
+      return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    } catch (_error) {
+      return false;
+    }
+  }
+
   function loginWithFedCM(idpApiBase, clientId) {
     if (!supportsFedCM()) {
       return Promise.resolve(null);
     }
 
-    function requestFedCM(configBase) {
+    function requestFedCMConfig(configUrl) {
       return global.navigator.credentials
         .get({
           identity: {
             providers: [
               {
-                configURL: configBase + '/fedcm/config.json',
-                configUrl: configBase + '/fedcm/config.json',
+                configURL: configUrl,
+                configUrl: configUrl,
                 clientId: clientId
               }
             ]
@@ -96,40 +112,57 @@
         });
     }
 
+    function requestFedCM(configBase) {
+      return requestFedCMConfig(configBase + '/fedcm/config.json');
+    }
+
     return global.fetch(idpApiBase + '/fedcm/discover.json', { credentials: 'omit' })
       .then(function (response) {
         if (!response.ok) {
-          return idpApiBase;
+          return { mode: 'apiBase', value: idpApiBase };
         }
         return response.json().then(function (payload) {
           if (payload && payload.enabled === false) {
             return null;
           }
-          if (payload && payload.apiBase) {
-            return trimSlash(payload.apiBase);
+          if (payload && payload.configUrl && isBrowserReachableBaseUrl(payload.configUrl)) {
+            return { mode: 'configUrl', value: payload.configUrl, webIdentityUrl: payload.webIdentityUrl };
           }
-          return idpApiBase;
+          if (payload && payload.apiBase && isBrowserReachableBaseUrl(payload.apiBase)) {
+            return { mode: 'apiBase', value: trimSlash(payload.apiBase), webIdentityUrl: payload.webIdentityUrl };
+          }
+          if (isBrowserReachableBaseUrl(idpApiBase)) {
+            return { mode: 'apiBase', value: idpApiBase };
+          }
+          return null;
         });
       })
       .catch(function () {
-        return idpApiBase;
+        if (isBrowserReachableBaseUrl(idpApiBase)) {
+          return { mode: 'apiBase', value: idpApiBase };
+        }
+        return null;
       })
-      .then(function (resolvedBase) {
-        if (!resolvedBase) {
+      .then(function (resolved) {
+        if (!resolved) {
+          if (global.console && typeof global.console.warn === 'function') {
+            global.console.warn(
+              '[MVK ID] FedCM: URL IdP недоступен из браузера. Укажите публичный data-idp-url (например https://id.lendry.ru/idp-api), не внутренний Docker-хост.'
+            );
+          }
           return null;
         }
-        return requestFedCM(resolvedBase);
+        if (resolved.mode === 'configUrl') {
+          return requestFedCMConfig(resolved.value);
+        }
+        return requestFedCM(resolved.value);
       })
       .catch(function (error) {
         if (global.console && typeof global.console.warn === 'function') {
           global.console.warn(
             '[MVK ID] FedCM недоступен:',
             error,
-            'Проверьте доступность',
-            idpApiBase + '/fedcm/config.json',
-            'и',
-            idpApiBase.replace(/\/idp-api$/, '') + '/.well-known/web-identity',
-            '(PUBLIC_API_URL должен совпадать с data-idp-url виджета)'
+            'Проверьте публичный URL IdP в data-idp-url и доступность /.well-known/web-identity на домене IdP (не /idp-api/.well-known).'
           );
         }
         return null;