fix and update

apps/api-gateway/src/lib/fedcm-cors.ts

@@ -1,16 +1,45 @@
-import type { Response } from 'express';
+import { BadRequestException } from '@nestjs/common';
+import type { Request, Response } from 'express';
+
+export function normalizeFedcmOrigin(origin?: string) {
+  return origin?.trim().replace(/\/+$/, '') || undefined;
+}
 
 export function applyFedcmCorsHeaders(res: Response, origin?: string) {
-  if (origin) {
-    res.setHeader('Access-Control-Allow-Origin', origin);
-    res.setHeader('Access-Control-Allow-Credentials', 'true');
-    res.setHeader('Vary', 'Origin');
+  const normalized = normalizeFedcmOrigin(origin);
+  if (!normalized) {
+    return;
   }
+  res.setHeader('Access-Control-Allow-Origin', normalized);
+  res.setHeader('Access-Control-Allow-Credentials', 'true');
+  res.setHeader('Vary', 'Origin');
+}
+
+export function requireFedcmCorsOrigin(origin?: string) {
+  const normalized = normalizeFedcmOrigin(origin);
+  if (!normalized) {
+    throw new BadRequestException('FedCM требует заголовок Origin');
+  }
+  return normalized;
 }
 
 export function applyFedcmPreflightHeaders(res: Response, origin?: string) {
   applyFedcmCorsHeaders(res, origin);
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site');
+  res.setHeader(
+    'Access-Control-Allow-Headers',
+    'Content-Type, Authorization, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site'
+  );
   res.setHeader('Access-Control-Max-Age', '86400');
 }
+
+export function assertFedcmWebIdentityRequest(req: Request) {
+  const dest = String(req.headers['sec-fetch-dest'] ?? '').toLowerCase();
+  if (dest && dest !== 'webidentity') {
+    throw new BadRequestException('Недопустимый Sec-Fetch-Dest для FedCM');
+  }
+}
+
+export function applyFedcmLoginStatus(res: Response, loggedIn: boolean) {
+  res.setHeader('Set-Login', loggedIn ? 'logged-in' : 'logged-out');
+}