fix and update

apps/frontend/app/admin/oauth/page.tsx

@@ -13,7 +13,7 @@ import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/u
 import { Input } from '@/components/ui/input';
 import { OAuthClient, OAuthScope, apiFetch } from '@/lib/api';
 import { getAdminLandingPath } from '@/lib/admin-access';
-import { buildAuthorizeUrl, buildOAuthEndpoints, resolveOAuthApiBase } from '@/lib/oauth-url';
+import { buildAuthorizeUrl, buildOAuthEndpoints, resolveFrontendBase, resolveOAuthApiBase } from '@/lib/oauth-url';
 
 export default function AdminOAuthPage() {
   const router = useRouter();
@@ -26,16 +26,22 @@ export default function AdminOAuthPage() {
   const [dialogOpen, setDialogOpen] = useState(false);
   const [selectedClient, setSelectedClient] = useState<OAuthClient | null>(null);
   const [secretDialog, setSecretDialog] = useState<{ clientId: string; clientSecret: string } | null>(null);
-  const [oauthApiBase, setOauthApiBase] = useState('http://localhost:3000');
+  const [oauthApiBase, setOauthApiBase] = useState('http://localhost:3002/idp-api');
+  const [frontendBase, setFrontendBase] = useState('http://localhost:3002');
+  const [projectName, setProjectName] = useState('MVK ID');
   const [form, setForm] = useState({ name: '', redirectUris: '', type: 'CONFIDENTIAL', selectedScopes: ['openid', 'profile', 'email'] as string[] });
 
-  const oauthEndpoints = useMemo(() => buildOAuthEndpoints(oauthApiBase), [oauthApiBase]);
+  const oauthEndpoints = useMemo(() => buildOAuthEndpoints(oauthApiBase, frontendBase), [oauthApiBase, frontendBase]);
 
   const loadPublicSettings = useCallback(async () => {
     try {
       const response = await apiFetch<{ settings: Array<{ key: string; value: string }> }>('/settings/public');
       const settings = Object.fromEntries((response.settings ?? []).map((item) => [item.key, item.value]));
       setOauthApiBase(resolveOAuthApiBase(settings));
+      setFrontendBase(resolveFrontendBase(settings));
+      if (settings.PROJECT_NAME?.trim()) {
+        setProjectName(settings.PROJECT_NAME.trim());
+      }
     } catch {
       // оставляем fallback
     }
@@ -182,11 +188,20 @@ export default function AdminOAuthPage() {
           <p className="text-sm text-[#667085]">
             Issuer: <code className="rounded bg-[#f4f5f8] px-1.5 py-0.5 text-xs">{oauthEndpoints.issuer}</code>
             {' · '}
+            Frontend: <code className="rounded bg-[#f4f5f8] px-1.5 py-0.5 text-xs">{frontendBase}</code>
+            {' · '}
             <a href={oauthEndpoints.openIdConfigurationUrl} target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-[#1d4ed8] hover:underline">
               OpenID Configuration
               <ExternalLink className="h-3.5 w-3.5" />
             </a>
           </p>
+          <p className="mt-1 text-xs text-[#667085]">
+            One Tap Login настраивается в{' '}
+            <a href="/admin/settings" className="text-[#1d4ed8] hover:underline">
+              системных настройках
+            </a>{' '}
+            (PUBLIC_API_URL, PUBLIC_FRONTEND_URL, ONE_TAP_ENABLED).
+          </p>
         </div>
         <Button onClick={() => setDialogOpen(true)} disabled={!user?.canManageOAuth}>
           <Plus className="h-4 w-4" />
@@ -244,6 +259,8 @@ export default function AdminOAuthPage() {
       <OAuthClientDetailDialog
         client={selectedClient}
         endpoints={oauthEndpoints}
+        frontendBase={frontendBase}
+        projectName={projectName}
         open={Boolean(selectedClient)}
         onOpenChange={(open) => !open && setSelectedClient(null)}
         onCopy={copyText}

apps/frontend/app/admin/settings/page.tsx

@@ -25,7 +25,15 @@ const GROUP_LABELS: Record<string, string> = {
   'messaging-sms': 'SMS'
 };
 
-const PUBLIC_SETTINGS_REFRESH_KEYS = new Set(['PROJECT_NAME', 'PROJECT_TAGLINE', 'LDAP_ENABLED', 'LDAP_USE_LDAPS']);
+const PUBLIC_SETTINGS_REFRESH_KEYS = new Set([
+  'PROJECT_NAME',
+  'PROJECT_TAGLINE',
+  'PUBLIC_API_URL',
+  'PUBLIC_FRONTEND_URL',
+  'ONE_TAP_ENABLED',
+  'LDAP_ENABLED',
+  'LDAP_USE_LDAPS'
+]);
 
 export default function AdminSettingsPage() {
   const { token, user } = useAuth();

apps/frontend/app/auth/oauth/authorize/page.tsx

@@ -15,6 +15,11 @@ import {
   fetchOAuthClientPublicInfo,
   type OAuthConsentCheckResponse
 } from '@/lib/api';
+import {
+  parseAuthorizationRedirect,
+  parsePopupOAuthParams,
+  postOneTapResult
+} from '@/lib/oauth-popup-bridge';
 
 function buildOAuthQuery(searchParams: URLSearchParams) {
   const params = new URLSearchParams();
@@ -38,6 +43,8 @@ function OAuthAuthorizeContent() {
   const autoApproveStartedRef = useRef(false);
 
   const oauthQuery = useMemo(() => buildOAuthQuery(searchParams), [searchParams]);
+  const popupContext = useMemo(() => parsePopupOAuthParams(searchParams), [searchParams]);
+  const isPopupMode = Boolean(popupContext);
 
   const clientId = searchParams.get('client_id') ?? searchParams.get('clientId');
   const redirectUri = searchParams.get('redirect_uri') ?? searchParams.get('redirectUri');
@@ -99,6 +106,22 @@ function OAuthAuthorizeContent() {
     };
   }, [isLoading, isPinLocked, returnUrl, router, token, user]);
 
+  const finishPopupFlow = useCallback(
+    (redirectUrl: string) => {
+      if (!popupContext) return false;
+      const parsed = parseAuthorizationRedirect(redirectUrl);
+      postOneTapResult(popupContext.popupOrigin, {
+        code: parsed.code ?? undefined,
+        state: parsed.state ?? undefined,
+        token: parsed.code ?? undefined,
+        error: parsed.error ?? undefined,
+        errorDescription: parsed.errorDescription ?? undefined
+      });
+      return true;
+    },
+    [popupContext]
+  );
+
   const approve = useCallback(async () => {
     if (!token || !user || isPinLocked) return;
     setSubmitting(true);
@@ -108,6 +131,9 @@ function OAuthAuthorizeContent() {
       if (!data.redirectUrl) {
         throw new Error('Сервер не вернул redirect URL');
       }
+      if (finishPopupFlow(data.redirectUrl)) {
+        return;
+      }
       window.location.href = data.redirectUrl;
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Ошибка OAuth авторизации');
@@ -115,7 +141,7 @@ function OAuthAuthorizeContent() {
     } finally {
       setSubmitting(false);
     }
-  }, [isPinLocked, oauthQuery, token, user]);
+  }, [finishPopupFlow, isPinLocked, oauthQuery, token, user]);
 
   useEffect(() => {
     if (!token || !clientId || !sessionChecked || isPinLocked) return;
@@ -149,6 +175,14 @@ function OAuthAuthorizeContent() {
   }, [approve, clientId, isPinLocked, oauthQuery, sessionChecked, token]);
 
   const cancel = useCallback(() => {
+    if (popupContext) {
+      postOneTapResult(popupContext.popupOrigin, {
+        error: 'access_denied',
+        errorDescription: 'Пользователь отклонил запрос'
+      });
+      return;
+    }
+
     if (!redirectUri) {
       router.push('/');
       return;
@@ -162,7 +196,7 @@ function OAuthAuthorizeContent() {
     } catch {
       router.push('/');
     }
-  }, [redirectUri, router, state]);
+  }, [popupContext, redirectUri, router, state]);
 
   const authReady = Boolean(user && token && !isPinLocked && sessionChecked);
   const scopeItems = consentInfo?.requestedScopes ?? [];
@@ -205,10 +239,12 @@ function OAuthAuthorizeContent() {
   }
 
   return (
-    <div className="mx-auto flex min-h-[70vh] max-w-lg flex-col justify-center px-4 py-12">
-      <div className="mb-8 flex justify-center">
-        <BrandLogo />
-      </div>
+    <div className={`mx-auto flex min-h-[70vh] max-w-lg flex-col justify-center px-4 ${isPopupMode ? 'py-6' : 'py-12'}`}>
+      {!isPopupMode ? (
+        <div className="mb-8 flex justify-center">
+          <BrandLogo />
+        </div>
+      ) : null}
       <div className="rounded-[24px] border border-[#eceef4] bg-white p-6 shadow-sm">
         <div className="mb-4 flex h-12 w-12 items-center justify-center rounded-2xl bg-[#eef4ff] text-[#3390ec]">
           <ShieldCheck className="h-6 w-6" />