fix and update

apps/frontend/lib/oauth-url.ts

@@ -2,12 +2,29 @@ export function normalizeBaseUrl(url: string) {
   return url.trim().replace(/\/+$/, '');
 }
 
-export function resolveOAuthApiBase(settings: Record<string, string>, fallback = 'http://localhost:3000') {
+export function resolveOAuthApiBase(settings: Record<string, string>, fallback = 'http://localhost:3002/idp-api') {
   const publicApi = settings.PUBLIC_API_URL?.trim();
   if (publicApi) {
     return normalizeBaseUrl(publicApi);
   }
 
+  const domain = settings.PROJECT_DOMAIN?.trim();
+  if (domain) {
+    if (domain.startsWith('http://') || domain.startsWith('https://')) {
+      return normalizeBaseUrl(domain);
+    }
+    return `https://${domain.replace(/^\/+/, '')}/idp-api`;
+  }
+
+  return normalizeBaseUrl(fallback);
+}
+
+export function resolveFrontendBase(settings: Record<string, string>, fallback = 'http://localhost:3002') {
+  const publicFrontend = settings.PUBLIC_FRONTEND_URL?.trim();
+  if (publicFrontend) {
+    return normalizeBaseUrl(publicFrontend);
+  }
+
   const domain = settings.PROJECT_DOMAIN?.trim();
   if (domain) {
     if (domain.startsWith('http://') || domain.startsWith('https://')) {
@@ -26,20 +43,48 @@ export interface OAuthEndpoints {
   userInfoEndpoint: string;
   openIdConfigurationUrl: string;
   jwksUrl: string;
+  webIdentityUrl: string;
+  fedcmConfigUrl: string;
+  fedcmDiscoverUrl: string;
+  fedcmAccountsUrl: string;
+  fedcmIdAssertionUrl: string;
+  widgetUrl: string;
 }
 
-export function buildOAuthEndpoints(apiBase: string): OAuthEndpoints {
+export function buildOAuthEndpoints(apiBase: string, frontendBase?: string): OAuthEndpoints {
   const base = normalizeBaseUrl(apiBase);
+  const front = normalizeBaseUrl(frontendBase ?? deriveFrontendBaseFromApi(base));
+  let webIdentityOrigin = front;
+
+  try {
+    webIdentityOrigin = new URL(base).origin;
+  } catch {
+    // keep frontend origin
+  }
+
   return {
     issuer: base,
     authorizationEndpoint: `${base}/oauth/authorize`,
     tokenEndpoint: `${base}/oauth/token`,
     userInfoEndpoint: `${base}/oauth/userinfo`,
     openIdConfigurationUrl: `${base}/.well-known/openid-configuration`,
-    jwksUrl: `${base}/.well-known/jwks.json`
+    jwksUrl: `${base}/.well-known/jwks.json`,
+    webIdentityUrl: `${webIdentityOrigin}/.well-known/web-identity`,
+    fedcmConfigUrl: `${base}/fedcm/config.json`,
+    fedcmDiscoverUrl: `${base}/fedcm/discover.json`,
+    fedcmAccountsUrl: `${base}/fedcm/accounts`,
+    fedcmIdAssertionUrl: `${base}/fedcm/id_assertion`,
+    widgetUrl: `${front}/sso-widget.js`
   };
 }
 
+function deriveFrontendBaseFromApi(apiBase: string) {
+  if (apiBase.endsWith('/idp-api')) {
+    return apiBase.replace(/\/idp-api$/, '');
+  }
+  return apiBase;
+}
+
 export function buildAuthorizeUrl(
   apiBase: string,
   params: { clientId: string; redirectUri: string; scope: string; userId?: string; state?: string; useStandardParams?: boolean }