fix and update

apps/api-gateway/src/lib/fedcm-config.ts

@@ -0,0 +1,196 @@
+import type { Request } from 'express';
+import { firstValueFrom } from 'rxjs';
+import { CoreGrpcService } from '../core-grpc.service';
+import { resolveFrontendUrl, resolveOAuthIssuer } from './oauth-issuer';
+
+export interface FedcmEndpoints {
+  issuer: string;
+  frontendUrl: string;
+  projectName: string;
+  configUrl: string;
+  accountsEndpoint: string;
+  clientMetadataEndpoint: string;
+  idAssertionEndpoint: string;
+  loginUrl: string;
+  signupUrl: string;
+  webIdentityUrl: string;
+}
+
+function normalizeBaseUrl(url: string) {
+  return url.trim().replace(/\/+$/, '');
+}
+
+function readRequestHost(req?: Request): string | undefined {
+  if (!req) {
+    return undefined;
+  }
+
+  const forwarded = req.headers['x-forwarded-host'];
+  const host = (Array.isArray(forwarded) ? forwarded[0] : forwarded) ?? req.headers.host;
+  return host?.split(',')[0]?.trim() || undefined;
+}
+
+function readRequestProto(req?: Request): string {
+  if (!req) {
+    return 'https';
+  }
+
+  const forwarded = req.headers['x-forwarded-proto'];
+  const proto = (Array.isArray(forwarded) ? forwarded[0] : forwarded) ?? req.protocol;
+  return proto?.split(',')[0]?.trim() || 'https';
+}
+
+function hostsMatch(a: string, b: string) {
+  if (a === b) {
+    return true;
+  }
+
+  return a === 'localhost' && b === 'localhost';
+}
+
+function resolveSameOriginFrontend(storedFrontend: string, req?: Request): string {
+  const host = readRequestHost(req);
+  if (!host) {
+    return storedFrontend;
+  }
+
+  const requestOrigin = normalizeBaseUrl(`${readRequestProto(req)}://${host}`);
+
+  try {
+    const frontendUrl = new URL(storedFrontend);
+    const requestUrl = new URL(requestOrigin);
+
+    if (hostsMatch(frontendUrl.hostname, requestUrl.hostname)) {
+      return requestOrigin;
+    }
+  } catch {
+    return storedFrontend;
+  }
+
+  return storedFrontend;
+}
+
+export function resolveSameOriginIssuer(storedIssuer: string, storedFrontend: string, req?: Request): string {
+  const host = readRequestHost(req);
+  if (!host) {
+    return storedIssuer;
+  }
+
+  const requestOrigin = normalizeBaseUrl(`${readRequestProto(req)}://${host}`);
+  const sameOriginApi = `${requestOrigin}/idp-api`;
+
+  try {
+    const issuerUrl = new URL(storedIssuer);
+    const frontendUrl = new URL(storedFrontend);
+    const requestUrl = new URL(requestOrigin);
+
+    const hostMatches =
+      hostsMatch(issuerUrl.hostname, requestUrl.hostname) || hostsMatch(frontendUrl.hostname, requestUrl.hostname);
+
+    if (!hostMatches) {
+      return storedIssuer;
+    }
+
+    if (normalizeBaseUrl(storedIssuer) !== sameOriginApi) {
+      return sameOriginApi;
+    }
+  } catch {
+    return storedIssuer;
+  }
+
+  return storedIssuer;
+}
+
+function buildFedcmEndpointUrls(issuer: string, frontendUrl: string) {
+  const base = normalizeBaseUrl(issuer);
+  const front = normalizeBaseUrl(frontendUrl);
+
+  let webIdentityOrigin = front;
+  try {
+    webIdentityOrigin = new URL(base).origin;
+  } catch {
+    // keep frontend origin
+  }
+
+  return {
+    configUrl: `${base}/fedcm/config.json`,
+    accountsEndpoint: `${base}/fedcm/accounts`,
+    clientMetadataEndpoint: `${base}/fedcm/client_metadata`,
+    idAssertionEndpoint: `${base}/fedcm/id_assertion`,
+    loginUrl: `${front}/auth/login`,
+    signupUrl: `${front}/auth/register`,
+    webIdentityUrl: `${webIdentityOrigin}/.well-known/web-identity`
+  };
+}
+
+export async function resolveFedcmEndpoints(core: CoreGrpcService, req?: Request): Promise<FedcmEndpoints> {
+  const storedIssuer = await resolveOAuthIssuer(core);
+  const storedFrontend = await resolveFrontendUrl(core);
+  const frontendUrl = resolveSameOriginFrontend(storedFrontend, req);
+  const issuer = resolveSameOriginIssuer(storedIssuer, storedFrontend, req);
+  let projectName = 'MVK ID';
+
+  try {
+    const setting = (await firstValueFrom(core.settings.GetSetting({ key: 'PROJECT_NAME' }))) as { value?: string };
+    if (setting.value?.trim()) {
+      projectName = setting.value.trim();
+    }
+  } catch {
+    // fallback
+  }
+
+  return {
+    issuer,
+    frontendUrl,
+    projectName,
+    ...buildFedcmEndpointUrls(issuer, frontendUrl)
+  };
+}
+
+export function buildFedcmProviderConfig(endpoints: FedcmEndpoints) {
+  return {
+    accounts_endpoint: endpoints.accountsEndpoint,
+    client_metadata_endpoint: endpoints.clientMetadataEndpoint,
+    id_assertion_endpoint: endpoints.idAssertionEndpoint,
+    login_url: endpoints.loginUrl,
+    branding: {
+      background_color: '#ffffff',
+      color: '#3390ec',
+      icons: [{ url: `${endpoints.frontendUrl}/favicon.ico`, size: 32 }]
+    }
+  };
+}
+
+export function buildFedcmWebIdentityManifest(endpoints: FedcmEndpoints) {
+  return {
+    provider_urls: [endpoints.configUrl],
+    accounts_endpoint: endpoints.accountsEndpoint,
+    login_url: endpoints.loginUrl
+  };
+}
+
+export function buildFedcmDiscoverPayload(endpoints: FedcmEndpoints, enabled = true) {
+  return {
+    enabled,
+    apiBase: endpoints.issuer,
+    frontendUrl: endpoints.frontendUrl,
+    projectName: endpoints.projectName,
+    configUrl: endpoints.configUrl,
+    webIdentityUrl: endpoints.webIdentityUrl,
+    accountsEndpoint: endpoints.accountsEndpoint,
+    loginUrl: endpoints.loginUrl
+  };
+}
+
+async function readOneTapEnabled(core: CoreGrpcService): Promise<boolean> {
+  try {
+    const setting = (await firstValueFrom(core.settings.GetSetting({ key: 'ONE_TAP_ENABLED' }))) as { value?: string };
+    const raw = setting.value?.trim().toLowerCase();
+    if (!raw) return true;
+    return ['true', '1', 'yes'].includes(raw);
+  } catch {
+    return true;
+  }
+}
+
+export { readOneTapEnabled };

apps/api-gateway/src/lib/fedcm-cors.ts

@@ -1,16 +1,45 @@
-import type { Response } from 'express';
+import { BadRequestException } from '@nestjs/common';
+import type { Request, Response } from 'express';
+
+export function normalizeFedcmOrigin(origin?: string) {
+  return origin?.trim().replace(/\/+$/, '') || undefined;
+}
 
 export function applyFedcmCorsHeaders(res: Response, origin?: string) {
-  if (origin) {
-    res.setHeader('Access-Control-Allow-Origin', origin);
-    res.setHeader('Access-Control-Allow-Credentials', 'true');
-    res.setHeader('Vary', 'Origin');
+  const normalized = normalizeFedcmOrigin(origin);
+  if (!normalized) {
+    return;
   }
+  res.setHeader('Access-Control-Allow-Origin', normalized);
+  res.setHeader('Access-Control-Allow-Credentials', 'true');
+  res.setHeader('Vary', 'Origin');
+}
+
+export function requireFedcmCorsOrigin(origin?: string) {
+  const normalized = normalizeFedcmOrigin(origin);
+  if (!normalized) {
+    throw new BadRequestException('FedCM требует заголовок Origin');
+  }
+  return normalized;
 }
 
 export function applyFedcmPreflightHeaders(res: Response, origin?: string) {
   applyFedcmCorsHeaders(res, origin);
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site');
+  res.setHeader(
+    'Access-Control-Allow-Headers',
+    'Content-Type, Authorization, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site'
+  );
   res.setHeader('Access-Control-Max-Age', '86400');
 }
+
+export function assertFedcmWebIdentityRequest(req: Request) {
+  const dest = String(req.headers['sec-fetch-dest'] ?? '').toLowerCase();
+  if (dest && dest !== 'webidentity') {
+    throw new BadRequestException('Недопустимый Sec-Fetch-Dest для FedCM');
+  }
+}
+
+export function applyFedcmLoginStatus(res: Response, loggedIn: boolean) {
+  res.setHeader('Set-Login', loggedIn ? 'logged-in' : 'logged-out');
+}