fix and update

2026-06-29 14:40:35 +03:00
parent 75ccbe5fc4
commit 0df7240dc8
21 changed files with 934 additions and 113 deletions
--- a/apps/api-gateway/src/controllers/fedcm.controller.ts
+++ b/apps/api-gateway/src/controllers/fedcm.controller.ts
@@ -1,8 +1,10 @@
 import {
+  BadRequestException,
  Controller,
  Get,
  Headers,
  HttpCode,
+  NotFoundException,
  Options,
  Post,
  Query,
@@ -15,9 +17,20 @@ import { ApiOperation, ApiTags } from '@nestjs/swagger';
 import { firstValueFrom } from 'rxjs';
 import type { Request, Response } from 'express';
 import { CoreGrpcService } from '../core-grpc.service';
-import { applyFedcmCorsHeaders, applyFedcmPreflightHeaders } from '../lib/fedcm-cors';
+import {
+  applyFedcmCorsHeaders,
+  applyFedcmLoginStatus,
+  applyFedcmPreflightHeaders,
+  assertFedcmWebIdentityRequest,
+  requireFedcmCorsOrigin
+} from '../lib/fedcm-cors';
+import {
+  buildFedcmDiscoverPayload,
+  buildFedcmProviderConfig,
+  readOneTapEnabled,
+  resolveFedcmEndpoints
+} from '../lib/fedcm-config';
 import { resolveFedcmSessionFromRequest, setFedcmSessionCookie } from '../lib/fedcm-cookie';
-import { resolveFrontendUrl, resolveOAuthIssuer } from '../lib/oauth-issuer';
 import { assertSessionUnlocked, verifyAccessToken } from '../session-auth';

 type FedcmAccountsResponse = {
@@ -39,6 +52,12 @@ export class FedcmController {
    private readonly jwt: JwtService
  ) {}

+  @Options('config.json')
+  @HttpCode(204)
+  configPreflight(@Headers('origin') origin: string | undefined, @Res({ passthrough: true }) res: Response) {
+    applyFedcmPreflightHeaders(res, origin);
+  }
+
  @Options('accounts')
  @HttpCode(204)
  accountsPreflight(@Headers('origin') origin: string | undefined, @Res({ passthrough: true }) res: Response) {
@@ -59,40 +78,33 @@ export class FedcmController {

  @Get('config.json')
  @ApiOperation({ summary: 'FedCM provider config', description: 'Конфигурация Identity Provider для Federated Credential Management API.' })
-  async config(@Res({ passthrough: true }) res: Response) {
-    res.setHeader('Content-Type', 'application/json');
+  async config(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    assertFedcmWebIdentityRequest(req);
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
    res.setHeader('Cache-Control', 'public, max-age=300');

-    const issuer = await resolveOAuthIssuer(this.core);
-    const frontendUrl = await resolveFrontendUrl(this.core);
-    let projectName = 'MVK ID';
-
-    try {
-      const setting = (await firstValueFrom(this.core.settings.GetSetting({ key: 'PROJECT_NAME' }))) as { value?: string };
-      if (setting.value?.trim()) {
-        projectName = setting.value.trim();
-      }
-    } catch {
-      // fallback
+    const enabled = await readOneTapEnabled(this.core);
+    if (!enabled) {
+      throw new NotFoundException('One Tap Login отключён');
    }

-    return {
-      accounts_endpoint: `${issuer}/fedcm/accounts`,
-      client_metadata_endpoint: `${issuer}/fedcm/client_metadata`,
-      id_assertion_endpoint: `${issuer}/fedcm/id_assertion`,
-      login_url: `${frontendUrl}/auth/login`,
-      signup_url: `${frontendUrl}/auth/register`,
-      branding: {
-        background_color: '#ffffff',
-        color: '#3390ec',
-        icons: [{ url: `${frontendUrl}/favicon.ico`, size: 32 }]
-      },
-      accounts: {
-        include_anonymous: false
-      },
-      fields: ['name', 'email', 'picture'],
-      display: projectName
-    };
+    const endpoints = await resolveFedcmEndpoints(this.core, req);
+    return buildFedcmProviderConfig(endpoints);
+  }
+
+  @Get('discover.json')
+  @ApiOperation({
+    summary: 'FedCM discovery',
+    description: 'Публичные URL FedCM для виджета и диагностики (apiBase, configUrl, webIdentityUrl).'
+  })
+  async discover(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Cache-Control', 'public, max-age=60');
+    res.setHeader('Access-Control-Allow-Origin', '*');
+
+    const enabled = await readOneTapEnabled(this.core);
+    const endpoints = await resolveFedcmEndpoints(this.core, req);
+    return buildFedcmDiscoverPayload(endpoints, enabled);
  }

  @Get('accounts')
@@ -102,33 +114,44 @@ export class FedcmController {
    @Headers('origin') origin: string | undefined,
    @Res({ passthrough: true }) res: Response
  ): Promise<FedcmAccountsResponse> {
+    assertFedcmWebIdentityRequest(req);
    applyFedcmCorsHeaders(res, origin);
-    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');

    const session = await resolveFedcmSessionFromRequest(this.jwt, req.headers.cookie);
    if (!session) {
+      applyFedcmLoginStatus(res, false);
      return { accounts: [] };
    }

-    const result = (await firstValueFrom(
-      this.core.fedcm.GetAccounts({ userId: session.sub, sessionId: session.sessionId })
-    )) as FedcmAccountsResponse;
-
-    return result ?? { accounts: [] };
+    try {
+      const result = (await firstValueFrom(
+        this.core.fedcm.GetAccounts({ userId: session.sub, sessionId: session.sessionId })
+      )) as FedcmAccountsResponse;
+      const accounts = result?.accounts ?? [];
+      applyFedcmLoginStatus(res, accounts.length > 0);
+      return { accounts };
+    } catch {
+      applyFedcmLoginStatus(res, false);
+      return { accounts: [] };
+    }
  }

  @Get('client_metadata')
  @ApiOperation({ summary: 'FedCM client metadata', description: 'Метаданные клиента для UI FedCM.' })
  async clientMetadata(
+    @Req() req: Request,
    @Query('client_id') clientId: string | undefined,
    @Headers('origin') origin: string | undefined,
    @Res({ passthrough: true }) res: Response
  ) {
-    applyFedcmCorsHeaders(res, origin);
-    res.setHeader('Content-Type', 'application/json');
+    assertFedcmWebIdentityRequest(req);
+    const rpOrigin = requireFedcmCorsOrigin(origin);
+    applyFedcmCorsHeaders(res, rpOrigin);
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');

    if (!clientId?.trim()) {
-      throw new UnauthorizedException('Передайте client_id');
+      throw new BadRequestException('Передайте client_id');
    }

    return firstValueFrom(this.core.fedcm.GetClientMetadata({ clientId: clientId.trim() }));
@@ -142,8 +165,10 @@ export class FedcmController {
    @Headers('origin') origin: string | undefined,
    @Res({ passthrough: true }) res: Response
  ) {
-    applyFedcmCorsHeaders(res, origin);
-    res.setHeader('Content-Type', 'application/json');
+    assertFedcmWebIdentityRequest(req);
+    const rpOrigin = requireFedcmCorsOrigin(origin);
+    applyFedcmCorsHeaders(res, rpOrigin);
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');

    const session = await resolveFedcmSessionFromRequest(this.jwt, req.headers.cookie);
    if (!session) {
@@ -154,9 +179,11 @@ export class FedcmController {
    const clientId = String(body.client_id ?? body.clientId ?? '').trim();
    const accountId = String(body.account_id ?? body.accountId ?? '').trim();
    if (!clientId || !accountId) {
-      throw new UnauthorizedException('Передайте client_id и account_id');
+      throw new BadRequestException('Передайте client_id и account_id');
    }

+    applyFedcmLoginStatus(res, true);
+
    return firstValueFrom(
      this.core.fedcm.IssueIdAssertion({
        userId: session.sub,
@@ -187,6 +214,7 @@ export class FedcmController {
      sessionId: payload.sessionId,
      pinVerified: true
    });
+    applyFedcmLoginStatus(res, true);
    return { synced: true };
  }
 }
--- a/apps/api-gateway/src/controllers/well-known.controller.ts
+++ b/apps/api-gateway/src/controllers/well-known.controller.ts
@@ -1,8 +1,9 @@
-import { Controller, Get, Res } from '@nestjs/common';
+import { Controller, Get, Req, Res } from '@nestjs/common';
 import { ApiOperation, ApiTags } from '@nestjs/swagger';
-import type { Response } from 'express';
-import { firstValueFrom } from 'rxjs';
+import type { Request, Response } from 'express';
 import { CoreGrpcService } from '../core-grpc.service';
+import { buildFedcmWebIdentityManifest, resolveFedcmEndpoints } from '../lib/fedcm-config';
+import { assertFedcmWebIdentityRequest } from '../lib/fedcm-cors';
 import { buildOpenIdConfiguration, resolveOAuthIssuer } from '../lib/oauth-issuer';

@ApiTags('OpenID Connect')
@@ -15,13 +16,12 @@ export class WellKnownController {
    summary: 'FedCM web identity manifest',
    description: 'Манифест Federated Credential Management API, указывающий на конфигурацию провайдера.'
  })
-  async webIdentity(@Res({ passthrough: true }) res: Response) {
-    res.setHeader('Content-Type', 'application/json');
+  async webIdentity(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    assertFedcmWebIdentityRequest(req);
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
    res.setHeader('Cache-Control', 'public, max-age=300');
-    const issuer = await resolveOAuthIssuer(this.core);
-    return {
-      provider_urls: [`${issuer}/fedcm/config.json`]
-    };
+    const endpoints = await resolveFedcmEndpoints(this.core, req);
+    return buildFedcmWebIdentityManifest(endpoints);
  }

  @Get('openid-configuration')
--- a/apps/api-gateway/src/grpc-exception.filter.ts
+++ b/apps/api-gateway/src/grpc-exception.filter.ts
@@ -1,8 +1,16 @@
 import { ArgumentsHost, Catch, ExceptionFilter, HttpException } from '@nestjs/common';
 import { status as GrpcStatus } from '@grpc/grpc-js';
+import { applyFedcmCorsHeaders } from './lib/fedcm-cors';

 interface HttpResponseLike {
  status(code: number): { json(body: unknown): unknown };
+  setHeader?(name: string, value: string): void;
+}
+
+interface HttpRequestLike {
+  path?: string;
+  url?: string;
+  headers?: Record<string, string | string[] | undefined>;
 }

 function grpcToHttp(code?: number): number {
@@ -29,7 +37,16 @@ function grpcToHttp(code?: number): number {
@Catch()
 export class AllExceptionsFilter implements ExceptionFilter {
  catch(exception: unknown, host: ArgumentsHost): void {
-    const response = host.switchToHttp().getResponse<HttpResponseLike>();
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<HttpResponseLike>();
+    const request = ctx.getRequest<HttpRequestLike>();
+    const requestPath = request.path ?? request.url ?? '';
+    const originHeader = request.headers?.origin;
+    const origin = Array.isArray(originHeader) ? originHeader[0] : originHeader;
+
+    if ((requestPath.includes('/fedcm/') || requestPath.includes('/.well-known/')) && origin && response.setHeader) {
+      applyFedcmCorsHeaders(response as never, origin);
+    }

    if (exception instanceof HttpException) {
      const statusCode = exception.getStatus();
--- a/apps/api-gateway/src/lib/fedcm-config.ts
+++ b/apps/api-gateway/src/lib/fedcm-config.ts
@@ -0,0 +1,196 @@
+import type { Request } from 'express';
+import { firstValueFrom } from 'rxjs';
+import { CoreGrpcService } from '../core-grpc.service';
+import { resolveFrontendUrl, resolveOAuthIssuer } from './oauth-issuer';
+
+export interface FedcmEndpoints {
+  issuer: string;
+  frontendUrl: string;
+  projectName: string;
+  configUrl: string;
+  accountsEndpoint: string;
+  clientMetadataEndpoint: string;
+  idAssertionEndpoint: string;
+  loginUrl: string;
+  signupUrl: string;
+  webIdentityUrl: string;
+}
+
+function normalizeBaseUrl(url: string) {
+  return url.trim().replace(/\/+$/, '');
+}
+
+function readRequestHost(req?: Request): string | undefined {
+  if (!req) {
+    return undefined;
+  }
+
+  const forwarded = req.headers['x-forwarded-host'];
+  const host = (Array.isArray(forwarded) ? forwarded[0] : forwarded) ?? req.headers.host;
+  return host?.split(',')[0]?.trim() || undefined;
+}
+
+function readRequestProto(req?: Request): string {
+  if (!req) {
+    return 'https';
+  }
+
+  const forwarded = req.headers['x-forwarded-proto'];
+  const proto = (Array.isArray(forwarded) ? forwarded[0] : forwarded) ?? req.protocol;
+  return proto?.split(',')[0]?.trim() || 'https';
+}
+
+function hostsMatch(a: string, b: string) {
+  if (a === b) {
+    return true;
+  }
+
+  return a === 'localhost' && b === 'localhost';
+}
+
+function resolveSameOriginFrontend(storedFrontend: string, req?: Request): string {
+  const host = readRequestHost(req);
+  if (!host) {
+    return storedFrontend;
+  }
+
+  const requestOrigin = normalizeBaseUrl(`${readRequestProto(req)}://${host}`);
+
+  try {
+    const frontendUrl = new URL(storedFrontend);
+    const requestUrl = new URL(requestOrigin);
+
+    if (hostsMatch(frontendUrl.hostname, requestUrl.hostname)) {
+      return requestOrigin;
+    }
+  } catch {
+    return storedFrontend;
+  }
+
+  return storedFrontend;
+}
+
+export function resolveSameOriginIssuer(storedIssuer: string, storedFrontend: string, req?: Request): string {
+  const host = readRequestHost(req);
+  if (!host) {
+    return storedIssuer;
+  }
+
+  const requestOrigin = normalizeBaseUrl(`${readRequestProto(req)}://${host}`);
+  const sameOriginApi = `${requestOrigin}/idp-api`;
+
+  try {
+    const issuerUrl = new URL(storedIssuer);
+    const frontendUrl = new URL(storedFrontend);
+    const requestUrl = new URL(requestOrigin);
+
+    const hostMatches =
+      hostsMatch(issuerUrl.hostname, requestUrl.hostname) || hostsMatch(frontendUrl.hostname, requestUrl.hostname);
+
+    if (!hostMatches) {
+      return storedIssuer;
+    }
+
+    if (normalizeBaseUrl(storedIssuer) !== sameOriginApi) {
+      return sameOriginApi;
+    }
+  } catch {
+    return storedIssuer;
+  }
+
+  return storedIssuer;
+}
+
+function buildFedcmEndpointUrls(issuer: string, frontendUrl: string) {
+  const base = normalizeBaseUrl(issuer);
+  const front = normalizeBaseUrl(frontendUrl);
+
+  let webIdentityOrigin = front;
+  try {
+    webIdentityOrigin = new URL(base).origin;
+  } catch {
+    // keep frontend origin
+  }
+
+  return {
+    configUrl: `${base}/fedcm/config.json`,
+    accountsEndpoint: `${base}/fedcm/accounts`,
+    clientMetadataEndpoint: `${base}/fedcm/client_metadata`,
+    idAssertionEndpoint: `${base}/fedcm/id_assertion`,
+    loginUrl: `${front}/auth/login`,
+    signupUrl: `${front}/auth/register`,
+    webIdentityUrl: `${webIdentityOrigin}/.well-known/web-identity`
+  };
+}
+
+export async function resolveFedcmEndpoints(core: CoreGrpcService, req?: Request): Promise<FedcmEndpoints> {
+  const storedIssuer = await resolveOAuthIssuer(core);
+  const storedFrontend = await resolveFrontendUrl(core);
+  const frontendUrl = resolveSameOriginFrontend(storedFrontend, req);
+  const issuer = resolveSameOriginIssuer(storedIssuer, storedFrontend, req);
+  let projectName = 'MVK ID';
+
+  try {
+    const setting = (await firstValueFrom(core.settings.GetSetting({ key: 'PROJECT_NAME' }))) as { value?: string };
+    if (setting.value?.trim()) {
+      projectName = setting.value.trim();
+    }
+  } catch {
+    // fallback
+  }
+
+  return {
+    issuer,
+    frontendUrl,
+    projectName,
+    ...buildFedcmEndpointUrls(issuer, frontendUrl)
+  };
+}
+
+export function buildFedcmProviderConfig(endpoints: FedcmEndpoints) {
+  return {
+    accounts_endpoint: endpoints.accountsEndpoint,
+    client_metadata_endpoint: endpoints.clientMetadataEndpoint,
+    id_assertion_endpoint: endpoints.idAssertionEndpoint,
+    login_url: endpoints.loginUrl,
+    branding: {
+      background_color: '#ffffff',
+      color: '#3390ec',
+      icons: [{ url: `${endpoints.frontendUrl}/favicon.ico`, size: 32 }]
+    }
+  };
+}
+
+export function buildFedcmWebIdentityManifest(endpoints: FedcmEndpoints) {
+  return {
+    provider_urls: [endpoints.configUrl],
+    accounts_endpoint: endpoints.accountsEndpoint,
+    login_url: endpoints.loginUrl
+  };
+}
+
+export function buildFedcmDiscoverPayload(endpoints: FedcmEndpoints, enabled = true) {
+  return {
+    enabled,
+    apiBase: endpoints.issuer,
+    frontendUrl: endpoints.frontendUrl,
+    projectName: endpoints.projectName,
+    configUrl: endpoints.configUrl,
+    webIdentityUrl: endpoints.webIdentityUrl,
+    accountsEndpoint: endpoints.accountsEndpoint,
+    loginUrl: endpoints.loginUrl
+  };
+}
+
+async function readOneTapEnabled(core: CoreGrpcService): Promise<boolean> {
+  try {
+    const setting = (await firstValueFrom(core.settings.GetSetting({ key: 'ONE_TAP_ENABLED' }))) as { value?: string };
+    const raw = setting.value?.trim().toLowerCase();
+    if (!raw) return true;
+    return ['true', '1', 'yes'].includes(raw);
+  } catch {
+    return true;
+  }
+}
+
+export { readOneTapEnabled };
--- a/apps/api-gateway/src/lib/fedcm-cors.ts
+++ b/apps/api-gateway/src/lib/fedcm-cors.ts
@@ -1,16 +1,45 @@
-import type { Response } from 'express';
+import { BadRequestException } from '@nestjs/common';
+import type { Request, Response } from 'express';
+
+export function normalizeFedcmOrigin(origin?: string) {
+  return origin?.trim().replace(/\/+$/, '') || undefined;
+}

 export function applyFedcmCorsHeaders(res: Response, origin?: string) {
-  if (origin) {
-    res.setHeader('Access-Control-Allow-Origin', origin);
-    res.setHeader('Access-Control-Allow-Credentials', 'true');
-    res.setHeader('Vary', 'Origin');
+  const normalized = normalizeFedcmOrigin(origin);
+  if (!normalized) {
+    return;
  }
+  res.setHeader('Access-Control-Allow-Origin', normalized);
+  res.setHeader('Access-Control-Allow-Credentials', 'true');
+  res.setHeader('Vary', 'Origin');
+}
+
+export function requireFedcmCorsOrigin(origin?: string) {
+  const normalized = normalizeFedcmOrigin(origin);
+  if (!normalized) {
+    throw new BadRequestException('FedCM требует заголовок Origin');
+  }
+  return normalized;
 }

 export function applyFedcmPreflightHeaders(res: Response, origin?: string) {
  applyFedcmCorsHeaders(res, origin);
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site');
+  res.setHeader(
+    'Access-Control-Allow-Headers',
+    'Content-Type, Authorization, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site'
+  );
  res.setHeader('Access-Control-Max-Age', '86400');
 }
+
+export function assertFedcmWebIdentityRequest(req: Request) {
+  const dest = String(req.headers['sec-fetch-dest'] ?? '').toLowerCase();
+  if (dest && dest !== 'webidentity') {
+    throw new BadRequestException('Недопустимый Sec-Fetch-Dest для FedCM');
+  }
+}
+
+export function applyFedcmLoginStatus(res: Response, loggedIn: boolean) {
+  res.setHeader('Set-Login', loggedIn ? 'logged-in' : 'logged-out');
+}
--- a/apps/frontend/app/admin/oauth/page.tsx
+++ b/apps/frontend/app/admin/oauth/page.tsx
@@ -13,7 +13,7 @@ import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/u
 import { Input } from '@/components/ui/input';
 import { OAuthClient, OAuthScope, apiFetch } from '@/lib/api';
 import { getAdminLandingPath } from '@/lib/admin-access';
-import { buildAuthorizeUrl, buildOAuthEndpoints, resolveOAuthApiBase } from '@/lib/oauth-url';
+import { buildAuthorizeUrl, buildOAuthEndpoints, resolveFrontendBase, resolveOAuthApiBase } from '@/lib/oauth-url';

 export default function AdminOAuthPage() {
  const router = useRouter();
@@ -26,16 +26,22 @@ export default function AdminOAuthPage() {
  const [dialogOpen, setDialogOpen] = useState(false);
  const [selectedClient, setSelectedClient] = useState<OAuthClient | null>(null);
  const [secretDialog, setSecretDialog] = useState<{ clientId: string; clientSecret: string } | null>(null);
-  const [oauthApiBase, setOauthApiBase] = useState('http://localhost:3000');
+  const [oauthApiBase, setOauthApiBase] = useState('http://localhost:3002/idp-api');
+  const [frontendBase, setFrontendBase] = useState('http://localhost:3002');
+  const [projectName, setProjectName] = useState('MVK ID');
  const [form, setForm] = useState({ name: '', redirectUris: '', type: 'CONFIDENTIAL', selectedScopes: ['openid', 'profile', 'email'] as string[] });

-  const oauthEndpoints = useMemo(() => buildOAuthEndpoints(oauthApiBase), [oauthApiBase]);
+  const oauthEndpoints = useMemo(() => buildOAuthEndpoints(oauthApiBase, frontendBase), [oauthApiBase, frontendBase]);

  const loadPublicSettings = useCallback(async () => {
    try {
      const response = await apiFetch<{ settings: Array<{ key: string; value: string }> }>('/settings/public');
      const settings = Object.fromEntries((response.settings ?? []).map((item) => [item.key, item.value]));
      setOauthApiBase(resolveOAuthApiBase(settings));
+      setFrontendBase(resolveFrontendBase(settings));
+      if (settings.PROJECT_NAME?.trim()) {
+        setProjectName(settings.PROJECT_NAME.trim());
+      }
    } catch {
      // оставляем fallback
    }
@@ -182,11 +188,20 @@ export default function AdminOAuthPage() {
          <p className="text-sm text-[#667085]">
            Issuer: <code className="rounded bg-[#f4f5f8] px-1.5 py-0.5 text-xs">{oauthEndpoints.issuer}</code>
            {' · '}
+            Frontend: <code className="rounded bg-[#f4f5f8] px-1.5 py-0.5 text-xs">{frontendBase}</code>
+            {' · '}
            <a href={oauthEndpoints.openIdConfigurationUrl} target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-[#1d4ed8] hover:underline">
              OpenID Configuration
              <ExternalLink className="h-3.5 w-3.5" />
            </a>
          </p>
+          <p className="mt-1 text-xs text-[#667085]">
+            One Tap Login настраивается в{' '}
+            <a href="/admin/settings" className="text-[#1d4ed8] hover:underline">
+              системных настройках
+            </a>{' '}
+            (PUBLIC_API_URL, PUBLIC_FRONTEND_URL, ONE_TAP_ENABLED).
+          </p>
        </div>
        <Button onClick={() => setDialogOpen(true)} disabled={!user?.canManageOAuth}>
          <Plus className="h-4 w-4" />
@@ -244,6 +259,8 @@ export default function AdminOAuthPage() {
      <OAuthClientDetailDialog
        client={selectedClient}
        endpoints={oauthEndpoints}
+        frontendBase={frontendBase}
+        projectName={projectName}
        open={Boolean(selectedClient)}
        onOpenChange={(open) => !open && setSelectedClient(null)}
        onCopy={copyText}
--- a/apps/frontend/app/admin/settings/page.tsx
+++ b/apps/frontend/app/admin/settings/page.tsx
@@ -25,7 +25,15 @@ const GROUP_LABELS: Record<string, string> = {
  'messaging-sms': 'SMS'
 };

-const PUBLIC_SETTINGS_REFRESH_KEYS = new Set(['PROJECT_NAME', 'PROJECT_TAGLINE', 'LDAP_ENABLED', 'LDAP_USE_LDAPS']);
+const PUBLIC_SETTINGS_REFRESH_KEYS = new Set([
+  'PROJECT_NAME',
+  'PROJECT_TAGLINE',
+  'PUBLIC_API_URL',
+  'PUBLIC_FRONTEND_URL',
+  'ONE_TAP_ENABLED',
+  'LDAP_ENABLED',
+  'LDAP_USE_LDAPS'
+]);

 export default function AdminSettingsPage() {
  const { token, user } = useAuth();
--- a/apps/frontend/app/auth/oauth/authorize/page.tsx
+++ b/apps/frontend/app/auth/oauth/authorize/page.tsx
@@ -15,6 +15,11 @@ import {
  fetchOAuthClientPublicInfo,
  type OAuthConsentCheckResponse
 } from '@/lib/api';
+import {
+  parseAuthorizationRedirect,
+  parsePopupOAuthParams,
+  postOneTapResult
+} from '@/lib/oauth-popup-bridge';

 function buildOAuthQuery(searchParams: URLSearchParams) {
  const params = new URLSearchParams();
@@ -38,6 +43,8 @@ function OAuthAuthorizeContent() {
  const autoApproveStartedRef = useRef(false);

  const oauthQuery = useMemo(() => buildOAuthQuery(searchParams), [searchParams]);
+  const popupContext = useMemo(() => parsePopupOAuthParams(searchParams), [searchParams]);
+  const isPopupMode = Boolean(popupContext);

  const clientId = searchParams.get('client_id') ?? searchParams.get('clientId');
  const redirectUri = searchParams.get('redirect_uri') ?? searchParams.get('redirectUri');
@@ -99,6 +106,22 @@ function OAuthAuthorizeContent() {
    };
  }, [isLoading, isPinLocked, returnUrl, router, token, user]);

+  const finishPopupFlow = useCallback(
+    (redirectUrl: string) => {
+      if (!popupContext) return false;
+      const parsed = parseAuthorizationRedirect(redirectUrl);
+      postOneTapResult(popupContext.popupOrigin, {
+        code: parsed.code ?? undefined,
+        state: parsed.state ?? undefined,
+        token: parsed.code ?? undefined,
+        error: parsed.error ?? undefined,
+        errorDescription: parsed.errorDescription ?? undefined
+      });
+      return true;
+    },
+    [popupContext]
+  );
+
  const approve = useCallback(async () => {
    if (!token || !user || isPinLocked) return;
    setSubmitting(true);
@@ -108,6 +131,9 @@ function OAuthAuthorizeContent() {
      if (!data.redirectUrl) {
        throw new Error('Сервер не вернул redirect URL');
      }
+      if (finishPopupFlow(data.redirectUrl)) {
+        return;
+      }
      window.location.href = data.redirectUrl;
    } catch (err) {
      setError(err instanceof Error ? err.message : 'Ошибка OAuth авторизации');
@@ -115,7 +141,7 @@ function OAuthAuthorizeContent() {
    } finally {
      setSubmitting(false);
    }
-  }, [isPinLocked, oauthQuery, token, user]);
+  }, [finishPopupFlow, isPinLocked, oauthQuery, token, user]);

  useEffect(() => {
    if (!token || !clientId || !sessionChecked || isPinLocked) return;
@@ -149,6 +175,14 @@ function OAuthAuthorizeContent() {
  }, [approve, clientId, isPinLocked, oauthQuery, sessionChecked, token]);

  const cancel = useCallback(() => {
+    if (popupContext) {
+      postOneTapResult(popupContext.popupOrigin, {
+        error: 'access_denied',
+        errorDescription: 'Пользователь отклонил запрос'
+      });
+      return;
+    }
+
    if (!redirectUri) {
      router.push('/');
      return;
@@ -162,7 +196,7 @@ function OAuthAuthorizeContent() {
    } catch {
      router.push('/');
    }
-  }, [redirectUri, router, state]);
+  }, [popupContext, redirectUri, router, state]);

  const authReady = Boolean(user && token && !isPinLocked && sessionChecked);
  const scopeItems = consentInfo?.requestedScopes ?? [];
@@ -205,10 +239,12 @@ function OAuthAuthorizeContent() {
  }

  return (
-    <div className="mx-auto flex min-h-[70vh] max-w-lg flex-col justify-center px-4 py-12">
-      <div className="mb-8 flex justify-center">
-        <BrandLogo />
-      </div>
+    <div className={`mx-auto flex min-h-[70vh] max-w-lg flex-col justify-center px-4 ${isPopupMode ? 'py-6' : 'py-12'}`}>
+      {!isPopupMode ? (
+        <div className="mb-8 flex justify-center">
+          <BrandLogo />
+        </div>
+      ) : null}
      <div className="rounded-[24px] border border-[#eceef4] bg-white p-6 shadow-sm">
        <div className="mb-4 flex h-12 w-12 items-center justify-center rounded-2xl bg-[#eef4ff] text-[#3390ec]">
          <ShieldCheck className="h-6 w-6" />
--- a/apps/frontend/components/id/auth-provider.tsx
+++ b/apps/frontend/components/id/auth-provider.tsx
@@ -22,7 +22,8 @@ import {
  PublicUser,
  refreshAuthSession,
  resetPinRequiredNotification,
-  setPinRequiredHandler
+  setPinRequiredHandler,
+  syncFedcmSession
 } from '@/lib/api';
 import { useToast } from './toast-provider';
 import { PinLockModal } from './pin-lock-modal';
@@ -89,6 +90,10 @@ function applySessionState(
    setters.activatePinLock(session.sessionId ?? '');
  } else {
    setters.clearPinLock();
+    const accessToken = window.localStorage.getItem(AUTH_TOKEN_KEY);
+    if (accessToken) {
+      void syncFedcmSession(accessToken);
+    }
  }
 }

@@ -154,6 +159,9 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
      cacheUserProfile(auth.user);
      setHasStoredSession(true);
      clearPinLock();
+      if (auth.pinVerified !== false) {
+        void syncFedcmSession(auth.accessToken);
+      }
    },
    [clearPinLock]
  );
--- a/apps/frontend/components/id/oauth-client-detail-dialog.tsx
+++ b/apps/frontend/components/id/oauth-client-detail-dialog.tsx
@@ -6,6 +6,7 @@ import { Button } from '@/components/ui/button';
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
 import { OAuthClient } from '@/lib/api';
 import { OAuthEndpoints, buildAuthorizeUrl } from '@/lib/oauth-url';
+import { OAuthClientOneTapSection } from '@/components/id/oauth-client-one-tap-section';

 function CopyRow({ label, value, onCopy }: { label: string; value: string; onCopy: (value: string, label: string) => void }) {
  return (
@@ -24,6 +25,8 @@ function CopyRow({ label, value, onCopy }: { label: string; value: string; onCop
 export function OAuthClientDetailDialog({
  client,
  endpoints,
+  frontendBase,
+  projectName,
  open,
  onOpenChange,
  onCopy,
@@ -34,6 +37,8 @@ export function OAuthClientDetailDialog({
 }: {
  client: OAuthClient | null;
  endpoints: OAuthEndpoints;
+  frontendBase: string;
+  projectName: string;
  open: boolean;
  onOpenChange: (open: boolean) => void;
  onCopy: (value: string, label: string) => void;
@@ -136,7 +141,7 @@ export function OAuthClientDetailDialog({
          <section className="space-y-3">
            <h3 className="font-medium">Подключение OAuth 2.0 / OpenID Connect</h3>
            <p className="text-xs text-[#667085]">
-              Issuer и endpoints берутся из настройки <strong>PUBLIC_API_URL</strong> в админке. В стороннем сервисе укажите issuer = базовый URL API, не authorization endpoint.
+              Issuer и endpoints берутся из настроек <strong>PUBLIC_API_URL</strong> и <strong>PUBLIC_FRONTEND_URL</strong> в админке.
            </p>
            <CopyRow label="Issuer (PUBLIC_API_URL)" value={endpoints.issuer} onCopy={onCopy} />
            <CopyRow label="Authorization endpoint" value={endpoints.authorizationEndpoint} onCopy={onCopy} />
@@ -146,6 +151,14 @@ export function OAuthClientDetailDialog({
            <CopyRow label="Пример authorize URL" value={sampleAuthorizeUrl} onCopy={onCopy} />
          </section>

+          <OAuthClientOneTapSection
+            client={client}
+            endpoints={endpoints}
+            frontendBase={frontendBase}
+            projectName={projectName}
+            onCopy={onCopy}
+          />
+
          <section className="rounded-2xl border border-[#eceef4] p-4">
            <div className="mb-2 flex items-center gap-2 font-medium">
              <KeyRound className="h-4 w-4" />
--- a/apps/frontend/components/id/oauth-client-one-tap-section.tsx
+++ b/apps/frontend/components/id/oauth-client-one-tap-section.tsx
@@ -0,0 +1,137 @@
+'use client';
+
+import { useMemo, useState } from 'react';
+import { Copy, ExternalLink } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
+import { OAuthClient } from '@/lib/api';
+import { buildOneTapExamples } from '@/lib/one-tap-examples';
+import { OAuthEndpoints } from '@/lib/oauth-url';
+
+function SnippetBlock({ code, onCopy }: { code: string; onCopy: (value: string, label: string) => void }) {
+  return (
+    <div className="relative rounded-2xl bg-[#111827] p-4 text-xs text-[#e5e7eb]">
+      <Button
+        type="button"
+        variant="ghost"
+        size="icon"
+        className="absolute right-2 top-2 h-8 w-8 text-white hover:bg-white/10 hover:text-white"
+        aria-label="Скопировать код"
+        onClick={() => onCopy(code, 'Код интеграции')}
+      >
+        <Copy className="h-4 w-4" />
+      </Button>
+      <pre className="max-h-72 overflow-auto whitespace-pre-wrap break-all pr-10">{code}</pre>
+    </div>
+  );
+}
+
+export function OAuthClientOneTapSection({
+  client,
+  endpoints,
+  frontendBase,
+  projectName,
+  onCopy
+}: {
+  client: OAuthClient;
+  endpoints: OAuthEndpoints;
+  frontendBase: string;
+  projectName: string;
+  onCopy: (value: string, label: string) => void;
+}) {
+  const primaryRedirect = client.redirectUris[0] ?? `${frontendBase}/auth/callback`;
+  const examples = useMemo(
+    () =>
+      buildOneTapExamples(
+        {
+          apiBase: endpoints.issuer,
+          frontendBase,
+          widgetUrl: endpoints.widgetUrl,
+          fedcmConfigUrl: endpoints.fedcmConfigUrl,
+          webIdentityUrl: endpoints.webIdentityUrl,
+          fedcmDiscoverUrl: endpoints.fedcmDiscoverUrl,
+          projectName
+        },
+        client.clientId,
+        primaryRedirect
+      ),
+    [client.clientId, endpoints, frontendBase, primaryRedirect, projectName]
+  );
+  const [activeTab, setActiveTab] = useState(examples[0]?.id ?? 'widget-script');
+
+  return (
+    <section className="space-y-4 rounded-2xl border border-[#eceef4] p-4">
+      <div>
+        <h3 className="font-medium">One Tap Login</h3>
+        <p className="mt-1 text-xs leading-relaxed text-[#667085]">
+          FedCM (Chrome/Edge) и виджет <code className="rounded bg-[#f4f5f8] px-1 py-0.5">sso-widget.js</code> с popup fallback.
+          Убедитесь, что в настройках указаны <strong>PUBLIC_API_URL</strong> и <strong>PUBLIC_FRONTEND_URL</strong>.
+        </p>
+      </div>
+
+      <div className="grid gap-2 sm:grid-cols-2">
+        <CopyRowCompact label="FedCM config" value={endpoints.fedcmConfigUrl} onCopy={onCopy} />
+        <CopyRowCompact label="Web identity" value={endpoints.webIdentityUrl} onCopy={onCopy} />
+        <CopyRowCompact label="Виджет" value={endpoints.widgetUrl} onCopy={onCopy} />
+        <CopyRowCompact label="Discover" value={endpoints.fedcmDiscoverUrl} onCopy={onCopy} />
+      </div>
+
+      <Tabs value={activeTab} onValueChange={setActiveTab}>
+        <TabsList className="mb-2 flex h-auto max-w-full flex-wrap gap-1">
+          {examples.map((example) => (
+            <TabsTrigger key={example.id} value={example.id} className="text-xs">
+              {example.label}
+            </TabsTrigger>
+          ))}
+        </TabsList>
+        {examples.map((example) => (
+          <TabsContent key={example.id} value={example.id}>
+            <SnippetBlock code={example.code} onCopy={onCopy} />
+          </TabsContent>
+        ))}
+      </Tabs>
+
+      <div className="rounded-xl bg-[#eef4ff] px-4 py-3 text-xs text-[#1d4ed8]">
+        <p className="font-medium">Проверка FedCM</p>
+        <ol className="mt-2 list-decimal space-y-1 pl-4">
+          <li>Войдите на IdP ({frontendBase}) в этом браузере.</li>
+          <li>Откройте сайт клиента с виджетом — Chrome покажет нативный диалог или плашку One Tap.</li>
+          <li>
+            При ошибке NetworkError проверьте, что <code>PUBLIC_API_URL</code> = <code>{endpoints.issuer}</code>.
+          </li>
+        </ol>
+        <a
+          href={`${frontendBase.replace(/\/$/, '')}/sso-widget.js`}
+          target="_blank"
+          rel="noreferrer"
+          className="mt-2 inline-flex items-center gap-1 font-medium hover:underline"
+        >
+          Открыть sso-widget.js
+          <ExternalLink className="h-3.5 w-3.5" />
+        </a>
+      </div>
+    </section>
+  );
+}
+
+function CopyRowCompact({
+  label,
+  value,
+  onCopy
+}: {
+  label: string;
+  value: string;
+  onCopy: (value: string, label: string) => void;
+}) {
+  return (
+    <div className="rounded-xl bg-[#f4f5f8] p-3">
+      <div className="mb-1 flex items-center justify-between gap-2">
+        <span className="text-xs font-medium">{label}</span>
+        <Button variant="ghost" size="icon" className="h-7 w-7" aria-label={`Скопировать ${label}`} onClick={() => onCopy(value, label)}>
+          <Copy className="h-3.5 w-3.5" />
+        </Button>
+      </div>
+      <code className="block break-all text-[11px] text-[#667085]">{value}</code>
+    </div>
+  );
+}
--- a/apps/frontend/lib/api.ts
+++ b/apps/frontend/lib/api.ts
@@ -494,6 +494,19 @@ export async function refreshAuthSession(): Promise<RefreshSessionResponse> {
  return response.json() as Promise<RefreshSessionResponse>;
 }

+export async function syncFedcmSession(accessToken: string) {
+  if (typeof window === 'undefined' || !accessToken.trim()) return;
+  try {
+    await fetch(`${getApiUrl()}/fedcm/session/sync`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${accessToken.trim()}` },
+      credentials: 'include'
+    });
+  } catch {
+    // фоновая синхронизация FedCM cookie
+  }
+}
+
 async function trySilentTokenRefresh(): Promise<RefreshSessionResponse | null> {
  try {
    const refreshed = await refreshAuthSession();
--- a/apps/frontend/lib/oauth-popup-bridge.ts
+++ b/apps/frontend/lib/oauth-popup-bridge.ts
@@ -0,0 +1,35 @@
+export const ONE_TAP_MESSAGE_TYPE = 'lendry-sso-onetap';
+
+export function parsePopupOAuthParams(searchParams: URLSearchParams) {
+  const display = searchParams.get('display');
+  const popupOrigin = searchParams.get('popup_origin');
+  if (display !== 'popup' || !popupOrigin?.trim()) {
+    return null;
+  }
+
+  try {
+    return { popupOrigin: new URL(popupOrigin.trim()).origin };
+  } catch {
+    return null;
+  }
+}
+
+export function postOneTapResult(popupOrigin: string, payload: Record<string, unknown>) {
+  if (!window.opener) {
+    return false;
+  }
+
+  window.opener.postMessage({ type: ONE_TAP_MESSAGE_TYPE, ...payload }, popupOrigin);
+  window.close();
+  return true;
+}
+
+export function parseAuthorizationRedirect(redirectUrl: string) {
+  const url = new URL(redirectUrl);
+  return {
+    code: url.searchParams.get('code'),
+    state: url.searchParams.get('state'),
+    error: url.searchParams.get('error'),
+    errorDescription: url.searchParams.get('error_description')
+  };
+}
--- a/apps/frontend/lib/oauth-url.ts
+++ b/apps/frontend/lib/oauth-url.ts
@@ -2,12 +2,29 @@ export function normalizeBaseUrl(url: string) {
  return url.trim().replace(/\/+$/, '');
 }

-export function resolveOAuthApiBase(settings: Record<string, string>, fallback = 'http://localhost:3000') {
+export function resolveOAuthApiBase(settings: Record<string, string>, fallback = 'http://localhost:3002/idp-api') {
  const publicApi = settings.PUBLIC_API_URL?.trim();
  if (publicApi) {
    return normalizeBaseUrl(publicApi);
  }

+  const domain = settings.PROJECT_DOMAIN?.trim();
+  if (domain) {
+    if (domain.startsWith('http://') || domain.startsWith('https://')) {
+      return normalizeBaseUrl(domain);
+    }
+    return `https://${domain.replace(/^\/+/, '')}/idp-api`;
+  }
+
+  return normalizeBaseUrl(fallback);
+}
+
+export function resolveFrontendBase(settings: Record<string, string>, fallback = 'http://localhost:3002') {
+  const publicFrontend = settings.PUBLIC_FRONTEND_URL?.trim();
+  if (publicFrontend) {
+    return normalizeBaseUrl(publicFrontend);
+  }
+
  const domain = settings.PROJECT_DOMAIN?.trim();
  if (domain) {
    if (domain.startsWith('http://') || domain.startsWith('https://')) {
@@ -26,20 +43,48 @@ export interface OAuthEndpoints {
  userInfoEndpoint: string;
  openIdConfigurationUrl: string;
  jwksUrl: string;
+  webIdentityUrl: string;
+  fedcmConfigUrl: string;
+  fedcmDiscoverUrl: string;
+  fedcmAccountsUrl: string;
+  fedcmIdAssertionUrl: string;
+  widgetUrl: string;
 }

-export function buildOAuthEndpoints(apiBase: string): OAuthEndpoints {
+export function buildOAuthEndpoints(apiBase: string, frontendBase?: string): OAuthEndpoints {
  const base = normalizeBaseUrl(apiBase);
+  const front = normalizeBaseUrl(frontendBase ?? deriveFrontendBaseFromApi(base));
+  let webIdentityOrigin = front;
+
+  try {
+    webIdentityOrigin = new URL(base).origin;
+  } catch {
+    // keep frontend origin
+  }
+
  return {
    issuer: base,
    authorizationEndpoint: `${base}/oauth/authorize`,
    tokenEndpoint: `${base}/oauth/token`,
    userInfoEndpoint: `${base}/oauth/userinfo`,
    openIdConfigurationUrl: `${base}/.well-known/openid-configuration`,
-    jwksUrl: `${base}/.well-known/jwks.json`
+    jwksUrl: `${base}/.well-known/jwks.json`,
+    webIdentityUrl: `${webIdentityOrigin}/.well-known/web-identity`,
+    fedcmConfigUrl: `${base}/fedcm/config.json`,
+    fedcmDiscoverUrl: `${base}/fedcm/discover.json`,
+    fedcmAccountsUrl: `${base}/fedcm/accounts`,
+    fedcmIdAssertionUrl: `${base}/fedcm/id_assertion`,
+    widgetUrl: `${front}/sso-widget.js`
  };
 }

+function deriveFrontendBaseFromApi(apiBase: string) {
+  if (apiBase.endsWith('/idp-api')) {
+    return apiBase.replace(/\/idp-api$/, '');
+  }
+  return apiBase;
+}
+
 export function buildAuthorizeUrl(
  apiBase: string,
  params: { clientId: string; redirectUri: string; scope: string; userId?: string; state?: string; useStandardParams?: boolean }
--- a/apps/frontend/lib/one-tap-examples.ts
+++ b/apps/frontend/lib/one-tap-examples.ts
@@ -0,0 +1,130 @@
+export interface OneTapUrls {
+  apiBase: string;
+  frontendBase: string;
+  widgetUrl: string;
+  fedcmConfigUrl: string;
+  webIdentityUrl: string;
+  fedcmDiscoverUrl: string;
+  projectName: string;
+}
+
+export interface OneTapExample {
+  id: string;
+  label: string;
+  language: string;
+  code: string;
+}
+
+export function buildOneTapUrls(
+  apiBase: string,
+  frontendBase: string,
+  projectName = 'MVK ID'
+): OneTapUrls {
+  const base = apiBase.replace(/\/+$/, '');
+  const front = frontendBase.replace(/\/+$/, '');
+  let webIdentityOrigin = front;
+
+  try {
+    webIdentityOrigin = new URL(base).origin;
+  } catch {
+    // keep frontend origin
+  }
+
+  return {
+    apiBase: base,
+    frontendBase: front,
+    widgetUrl: `${front}/sso-widget.js`,
+    fedcmConfigUrl: `${base}/fedcm/config.json`,
+    fedcmDiscoverUrl: `${base}/fedcm/discover.json`,
+    webIdentityUrl: `${webIdentityOrigin}/.well-known/web-identity`,
+    projectName
+  };
+}
+
+export function buildOneTapExamples(urls: OneTapUrls, clientId: string, redirectUri?: string): OneTapExample[] {
+  const { apiBase, frontendBase, widgetUrl, fedcmConfigUrl, webIdentityUrl, projectName } = urls;
+  const callbackUri = redirectUri?.trim() || 'https://app.example.com/auth/callback';
+
+  return [
+    {
+      id: 'widget-script',
+      label: 'Виджет (script)',
+      language: 'html',
+      code: `<script
+  src="${widgetUrl}"
+  data-client-id="${clientId}"
+  data-idp-url="${apiBase}"
+  data-idp-frontend-url="${frontendBase}"
+  data-provider-name="${projectName}"
+  data-redirect-uri="${callbackUri}"
+  data-on-success="handleLendryLogin"
+></script>
+
+<script>
+  function handleLendryLogin(payload) {
+    // payload.method — 'fedcm' | 'popup'
+    // payload.token / payload.idToken / payload.code
+    console.log('Вход через', payload.method, payload);
+  }
+</script>`
+    },
+    {
+      id: 'sdk-manual',
+      label: 'SDK вручную',
+      language: 'javascript',
+      code: `<script src="${widgetUrl}" data-auto-init="false"></script>
+<script>
+  LendryIdOneTap.init({
+    clientId: '${clientId}',
+    idpUrl: '${apiBase}',
+    frontendUrl: '${frontendBase}',
+    providerName: '${projectName}',
+    redirectUri: '${callbackUri}'
+  });
+
+  window.addEventListener('lendry-sso-onetap-success', (event) => {
+    console.log(event.detail);
+  });
+</script>`
+    },
+    {
+      id: 'fedcm-native',
+      label: 'FedCM API',
+      language: 'javascript',
+      code: `const credential = await navigator.credentials.get({
+  identity: {
+    providers: [{
+      configURL: '${fedcmConfigUrl}',
+      clientId: '${clientId}'
+    }]
+  },
+  mediation: 'optional'
+});
+
+const idToken = credential?.token; // JWT — проверьте на backend`
+    },
+    {
+      id: 'postmessage',
+      label: 'Popup postMessage',
+      language: 'javascript',
+      code: `window.addEventListener('message', (event) => {
+  if (event.origin !== '${frontendBase}') return;
+  if (event.data?.type !== 'lendry-sso-onetap') return;
+
+  const { code, idToken, token, error } = event.data;
+  if (error) return console.error(error);
+
+  // code — обменяйте на POST ${apiBase}/oauth/token
+  // idToken / token — проверьте JWT (issuer = ${apiBase})
+});`
+    },
+    {
+      id: 'curl-fedcm',
+      label: 'Диагностика (curl)',
+      language: 'bash',
+      code: `curl -sH "Sec-Fetch-Dest: webidentity" ${webIdentityUrl}
+curl -sH "Sec-Fetch-Dest: webidentity" ${fedcmConfigUrl}
+curl -s ${apiBase}/fedcm/discover.json`
+    }
+  ];
+}
--- a/apps/frontend/lib/system-settings-catalog.ts
+++ b/apps/frontend/lib/system-settings-catalog.ts
@@ -13,6 +13,7 @@ export interface SystemSettingMeta {

 export const SYSTEM_SETTING_GROUPS: Record<string, string> = {
  general: 'Проект и брендинг',
+  onetap: 'One Tap Login / FedCM',
  pin: 'PIN-код и блокировка сессии',
  auth: 'Аутентификация и регистрация',
  ldap: 'LDAP / Active Directory',
@@ -30,7 +31,37 @@ export const SYSTEM_SETTING_CATALOG: SystemSettingMeta[] = [
    label: 'URL API (OAuth issuer)',
    group: 'general',
    type: 'text',
-    hint: 'Базовый URL API для OAuth/OIDC. Пример: https://sso.example.ru/idp-api или https://api.example.ru'
+    hint: 'Базовый URL API для OAuth/OIDC и FedCM. При same-origin деплое: https://ваш-домен/idp-api'
+  },
+  {
+    key: 'PUBLIC_FRONTEND_URL',
+    label: 'URL Frontend IdP',
+    group: 'general',
+    type: 'text',
+    hint: 'Публичный адрес интерфейса IdP. Используется для login_url FedCM и popup OAuth'
+  },
+  {
+    key: 'ONE_TAP_ENABLED',
+    label: 'One Tap Login включён',
+    group: 'onetap',
+    type: 'boolean',
+    hint: 'FedCM и виджет sso-widget.js. При отключении остаётся только стандартный OAuth redirect'
+  },
+  {
+    key: 'FEDCM_PRIVACY_POLICY_URL',
+    label: 'FedCM — политика конфиденциальности',
+    group: 'onetap',
+    type: 'text',
+    hint: 'URL для UI FedCM. Пусто — используется страница «Данные» IdP',
+    showWhen: { key: 'ONE_TAP_ENABLED', equals: 'true' }
+  },
+  {
+    key: 'FEDCM_TERMS_URL',
+    label: 'FedCM — условия использования',
+    group: 'onetap',
+    type: 'text',
+    hint: 'URL для UI FedCM. Пусто — используется страница «Данные» IdP',
+    showWhen: { key: 'ONE_TAP_ENABLED', equals: 'true' }
  },
  { key: 'PIN_LOCK_TIMEOUT_MINUTES', label: 'Таймаут блокировки PIN', group: 'pin', type: 'number', unit: 'мин' },
  { key: 'PIN_DELETE_GRACE_MINUTES', label: 'Задержка удаления PIN', group: 'pin', type: 'number', unit: 'мин', hint: 'Сколько ждать после запроса удаления PIN-кода' },
--- a/apps/frontend/public/sso-widget.js
+++ b/apps/frontend/public/sso-widget.js
@@ -71,30 +71,66 @@
      return Promise.resolve(null);
    }

-    return global.navigator.credentials
-      .get({
-        identity: {
-          providers: [
-            {
-              configURL: idpApiBase + '/fedcm/config.json',
-              clientId: clientId
-            }
-          ]
-        },
-        mediation: 'optional'
+    function requestFedCM(configBase) {
+      return global.navigator.credentials
+        .get({
+          identity: {
+            providers: [
+              {
+                configURL: configBase + '/fedcm/config.json',
+                configUrl: configBase + '/fedcm/config.json',
+                clientId: clientId
+              }
+            ]
+          },
+          mediation: 'optional'
+        })
+        .then(function (credential) {
+          if (!credential || typeof credential !== 'object') return null;
+          var token = credential.token;
+          if (!token) return null;
+          return {
+            token: token,
+            method: 'fedcm'
+          };
+        });
+    }
+
+    return global.fetch(idpApiBase + '/fedcm/discover.json', { credentials: 'omit' })
+      .then(function (response) {
+        if (!response.ok) {
+          return idpApiBase;
+        }
+        return response.json().then(function (payload) {
+          if (payload && payload.enabled === false) {
+            return null;
+          }
+          if (payload && payload.apiBase) {
+            return trimSlash(payload.apiBase);
+          }
+          return idpApiBase;
+        });
      })
-      .then(function (credential) {
-        if (!credential || typeof credential !== 'object') return null;
-        var token = credential.token;
-        if (!token) return null;
-        return {
-          token: token,
-          method: 'fedcm'
-        };
+      .catch(function () {
+        return idpApiBase;
+      })
+      .then(function (resolvedBase) {
+        if (!resolvedBase) {
+          return null;
+        }
+        return requestFedCM(resolvedBase);
      })
      .catch(function (error) {
        if (global.console && typeof global.console.warn === 'function') {
-          global.console.warn('[MVK ID] FedCM недоступен:', error);
+          global.console.warn(
+            '[MVK ID] FedCM недоступен:',
+            error,
+            'Проверьте доступность',
+            idpApiBase + '/fedcm/config.json',
+            'и',
+            idpApiBase.replace(/\/idp-api$/, '') + '/.well-known/web-identity',
+            '(PUBLIC_API_URL должен совпадать с data-idp-url виджета)'
+          );
        }
        return null;
      });
@@ -232,10 +268,6 @@
        return;
      }

-      if (supportsFedCM()) {
-        return;
-      }
-
      createWidget(providerName, function () {
        var popupUrl = buildPopupUrl(frontendBase, clientId, global.location.origin, redirectUri, scope);
        openPopup(popupUrl, frontendBase, function (payload) {
--- a/apps/sso-core/src/domain/fedcm.service.ts
+++ b/apps/sso-core/src/domain/fedcm.service.ts
@@ -2,6 +2,7 @@ import { BadRequestException, Injectable, UnauthorizedException } from '@nestjs/
 import { PrismaService } from '../infra/prisma.service';
 import { OAuthCoreService } from './oauth-core.service';
 import { SessionService } from './session.service';
+import { SettingsService } from './settings.service';
 import { assertHumanAccount, HUMAN_USER_WHERE } from './system-account.util';

@Injectable()
@@ -9,7 +10,8 @@ export class FedcmService {
  constructor(
    private readonly prisma: PrismaService,
    private readonly session: SessionService,
-    private readonly oauthCore: OAuthCoreService
+    private readonly oauthCore: OAuthCoreService,
+    private readonly settings: SettingsService
  ) {}

  async getAccounts(userId: string, sessionId: string) {
@@ -81,12 +83,21 @@ export class FedcmService {
      throw new BadRequestException('OAuth-приложение не найдено или отключено');
    }

+    const frontendUrl = (await this.settings.getValue('PUBLIC_FRONTEND_URL', 'http://localhost:3002')).replace(/\/+$/, '');
+    const privacyFallback = `${frontendUrl}/data`;
+    const privacy = (await this.settings.getValue('FEDCM_PRIVACY_POLICY_URL', '')).trim();
+    const terms = (await this.settings.getValue('FEDCM_TERMS_URL', '')).trim();
+
    return {
-      privacy_policy_url: 'https://id.lendry.ru/data',
-      terms_of_service_url: 'https://id.lendry.ru/data'
+      privacy_policy_url: privacy || privacyFallback,
+      terms_of_service_url: terms || privacyFallback
    };
  }

+  async isOneTapEnabled() {
+    return this.settings.getBoolean('ONE_TAP_ENABLED', true);
+  }
+
  private async assertUnlockedSession(userId: string, sessionId: string) {
    const state = await this.session.resolveSessionState(sessionId);
    if (!state || state.userId !== userId) {
--- a/apps/sso-core/src/domain/system-settings.seed.ts
+++ b/apps/sso-core/src/domain/system-settings.seed.ts
@@ -7,9 +7,29 @@ export const DEFAULT_SYSTEM_SETTINGS = [
  { key: 'PROJECT_DOMAIN', value: 'id.lendry.ru', description: 'Основной домен IdP (без пути)' },
  {
    key: 'PUBLIC_API_URL',
-    value: 'http://localhost:3000',
+    value: 'http://localhost:3002/idp-api',
    description: 'Публичный базовый URL API для OAuth и OpenID Connect (issuer). Пример: https://sso.example.ru/idp-api'
  },
+  {
+    key: 'PUBLIC_FRONTEND_URL',
+    value: 'http://localhost:3002',
+    description: 'Публичный URL frontend IdP. Используется для login_url FedCM, popup OAuth и виджета sso-widget.js'
+  },
+  {
+    key: 'ONE_TAP_ENABLED',
+    value: 'true',
+    description: 'Разрешить One Tap Login (FedCM и виджет sso-widget.js) для OAuth-клиентов'
+  },
+  {
+    key: 'FEDCM_PRIVACY_POLICY_URL',
+    value: '',
+    description: 'URL политики конфиденциальности для UI FedCM. Пусто — страница «Данные» IdP'
+  },
+  {
+    key: 'FEDCM_TERMS_URL',
+    value: '',
+    description: 'URL условий использования для UI FedCM. Пусто — страница «Данные» IdP'
+  },
  { key: 'PIN_LOCK_TIMEOUT_MINUTES', value: '15', description: 'Через сколько минут неактивности сессия блокируется PIN-кодом' },
  { key: 'PIN_DELETE_GRACE_MINUTES', value: '1440', description: 'Задержка перед окончательным удалением PIN-кода после запроса (минуты)' },
  { key: 'PIN_REQUIRE_ON_DELETE', value: 'true', description: 'Требовать текущий PIN-код при запросе удаления защиты' },
@@ -102,6 +122,8 @@ export const PUBLIC_SETTING_KEYS = [
  'PROJECT_TAGLINE',
  'PROJECT_DOMAIN',
  'PUBLIC_API_URL',
+  'PUBLIC_FRONTEND_URL',
+  'ONE_TAP_ENABLED',
  'REGISTRATION_ENABLED',
  'MAINTENANCE_MODE',
  'LDAP_ENABLED',
@@ -133,5 +155,18 @@ export class SystemSettingsSeedService implements OnModuleInit {
        update: { value: envPublicApiUrl }
      });
    }
+
+    const envPublicFrontendUrl = process.env.PUBLIC_FRONTEND_URL?.trim();
+    if (envPublicFrontendUrl) {
+      await this.prisma.systemSetting.upsert({
+        where: { key: 'PUBLIC_FRONTEND_URL' },
+        create: {
+          key: 'PUBLIC_FRONTEND_URL',
+          value: envPublicFrontendUrl,
+          description: 'Публичный URL frontend IdP. Используется для login_url FedCM, popup OAuth и виджета sso-widget.js'
+        },
+        update: { value: envPublicFrontendUrl }
+      });
+    }
  }
 }