fix and update

apps/frontend/public/sso-widget.js

@@ -66,19 +66,35 @@
     return 'IdentityCredential' in global && global.navigator && typeof global.navigator.credentials !== 'undefined';
   }
 
+  function isBrowserReachableBaseUrl(url) {
+    try {
+      var parsed = new URL(url);
+      var host = parsed.hostname.toLowerCase();
+      if (host === 'api-gateway' || host === 'sso-core' || host === 'frontend' || host === 'docs') {
+        return false;
+      }
+      if (host.indexOf('.') === -1 && host !== 'localhost') {
+        return false;
+      }
+      return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    } catch (_error) {
+      return false;
+    }
+  }
+
   function loginWithFedCM(idpApiBase, clientId) {
     if (!supportsFedCM()) {
       return Promise.resolve(null);
     }
 
-    function requestFedCM(configBase) {
+    function requestFedCMConfig(configUrl) {
       return global.navigator.credentials
         .get({
           identity: {
             providers: [
               {
-                configURL: configBase + '/fedcm/config.json',
-                configUrl: configBase + '/fedcm/config.json',
+                configURL: configUrl,
+                configUrl: configUrl,
                 clientId: clientId
               }
             ]
@@ -96,40 +112,57 @@
         });
     }
 
+    function requestFedCM(configBase) {
+      return requestFedCMConfig(configBase + '/fedcm/config.json');
+    }
+
     return global.fetch(idpApiBase + '/fedcm/discover.json', { credentials: 'omit' })
       .then(function (response) {
         if (!response.ok) {
-          return idpApiBase;
+          return { mode: 'apiBase', value: idpApiBase };
         }
         return response.json().then(function (payload) {
           if (payload && payload.enabled === false) {
             return null;
           }
-          if (payload && payload.apiBase) {
-            return trimSlash(payload.apiBase);
+          if (payload && payload.configUrl && isBrowserReachableBaseUrl(payload.configUrl)) {
+            return { mode: 'configUrl', value: payload.configUrl, webIdentityUrl: payload.webIdentityUrl };
           }
-          return idpApiBase;
+          if (payload && payload.apiBase && isBrowserReachableBaseUrl(payload.apiBase)) {
+            return { mode: 'apiBase', value: trimSlash(payload.apiBase), webIdentityUrl: payload.webIdentityUrl };
+          }
+          if (isBrowserReachableBaseUrl(idpApiBase)) {
+            return { mode: 'apiBase', value: idpApiBase };
+          }
+          return null;
         });
       })
       .catch(function () {
-        return idpApiBase;
+        if (isBrowserReachableBaseUrl(idpApiBase)) {
+          return { mode: 'apiBase', value: idpApiBase };
+        }
+        return null;
       })
-      .then(function (resolvedBase) {
-        if (!resolvedBase) {
+      .then(function (resolved) {
+        if (!resolved) {
+          if (global.console && typeof global.console.warn === 'function') {
+            global.console.warn(
+              '[MVK ID] FedCM: URL IdP недоступен из браузера. Укажите публичный data-idp-url (например https://id.lendry.ru/idp-api), не внутренний Docker-хост.'
+            );
+          }
           return null;
         }
-        return requestFedCM(resolvedBase);
+        if (resolved.mode === 'configUrl') {
+          return requestFedCMConfig(resolved.value);
+        }
+        return requestFedCM(resolved.value);
       })
       .catch(function (error) {
         if (global.console && typeof global.console.warn === 'function') {
           global.console.warn(
             '[MVK ID] FedCM недоступен:',
             error,
-            'Проверьте доступность',
-            idpApiBase + '/fedcm/config.json',
-            'и',
-            idpApiBase.replace(/\/idp-api$/, '') + '/.well-known/web-identity',
-            '(PUBLIC_API_URL должен совпадать с data-idp-url виджета)'
+            'Проверьте публичный URL IdP в data-idp-url и доступность /.well-known/web-identity на домене IdP (не /idp-api/.well-known).'
           );
         }
         return null;