fix and update

apps/frontend/app/auth/login/page.tsx

@@ -1520,13 +1520,13 @@ function LoginPageContent() {
 
         <ProjectTagline className="mt-9 text-center text-sm font-semibold" />
 
-        <a
-          href="/downloads/android"
+        <Link
+          href="/downloads"
           className="mx-auto mt-3 flex w-fit items-center gap-1 rounded-full px-3 py-1.5 text-xs font-medium text-[#b9bdc9] transition hover:bg-white/10 hover:text-white"
         >
           <Download className="h-3.5 w-3.5" />
           Скачать приложение
-        </a>
+        </Link>
 
       </section>
 

apps/frontend/app/download/android/route.ts

@@ -3,6 +3,6 @@ import { NextRequest, NextResponse } from 'next/server';
 export const runtime = 'nodejs';
 
 export async function GET(request: NextRequest) {
-  const target = new URL('/downloads/android', request.nextUrl.origin);
+  const target = new URL('/downloads', request.nextUrl.origin);
   return NextResponse.redirect(target, 302);
 }

apps/frontend/app/downloads/android/[releaseId]/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from 'next/server';
+import { proxyReleaseDownload } from '@/lib/proxy-release-download';
+
+export const runtime = 'nodejs';
+
+export async function GET(request: NextRequest, context: { params: Promise<{ releaseId: string }> }) {
+  const { releaseId } = await context.params;
+  return proxyReleaseDownload(request, 'android', releaseId);
+}

apps/frontend/app/downloads/android/route.ts

@@ -1,15 +1,8 @@
-import { NextRequest, NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import { proxyReleaseDownload } from '@/lib/proxy-release-download';
 
 export const runtime = 'nodejs';
 
-function resolveApiBase(request: NextRequest) {
-  const internal = process.env.INTERNAL_API_URL?.replace(/\/$/, '');
-  if (internal) return internal;
-  const origin = request.nextUrl.origin;
-  return `${origin}/idp-api`;
-}
-
 export async function GET(request: NextRequest) {
-  const target = `${resolveApiBase(request)}/releases/download/android`;
-  return NextResponse.redirect(target, 302);
+  return proxyReleaseDownload(request, 'android');
 }

apps/frontend/app/downloads/windows/[releaseId]/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from 'next/server';
+import { proxyReleaseDownload } from '@/lib/proxy-release-download';
+
+export const runtime = 'nodejs';
+
+export async function GET(request: NextRequest, context: { params: Promise<{ releaseId: string }> }) {
+  const { releaseId } = await context.params;
+  return proxyReleaseDownload(request, 'windows', releaseId);
+}

apps/frontend/app/downloads/windows/route.ts

@@ -1,15 +1,8 @@
-import { NextRequest, NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import { proxyReleaseDownload } from '@/lib/proxy-release-download';
 
 export const runtime = 'nodejs';
 
-function resolveApiBase(request: NextRequest) {
-  const internal = process.env.INTERNAL_API_URL?.replace(/\/$/, '');
-  if (internal) return internal;
-  const origin = request.nextUrl.origin;
-  return `${origin}/idp-api`;
-}
-
 export async function GET(request: NextRequest) {
-  const target = `${resolveApiBase(request)}/releases/download/windows`;
-  return NextResponse.redirect(target, 302);
+  return proxyReleaseDownload(request, 'windows');
 }

apps/frontend/components/id/auth-provider.tsx

@@ -806,7 +806,13 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       ) : (
         children
       )}
-      <PinLockModal open={isPinLocked} isSubmitting={pinSubmitting} error={pinError} onSubmit={handlePinUnlock} />
+      <PinLockModal
+        open={isPinLocked}
+        isSubmitting={pinSubmitting}
+        error={pinError}
+        onSubmit={handlePinUnlock}
+        onLogout={logout}
+      />
       <FedcmApiLoginStatusBridge
         active={isSessionReady && hasStoredSession && Boolean(token)}
         accessToken={token}

apps/frontend/components/id/pin-lock-modal.tsx

@@ -1,7 +1,7 @@
 'use client';
 
 import * as React from 'react';
-import { KeyRound } from 'lucide-react';
+import { DoorOpen, KeyRound } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
 import { PinInput } from '@/components/ui/pin-input';
@@ -12,9 +12,10 @@ interface PinLockModalProps {
   isSubmitting: boolean;
   error?: string | null;
   onSubmit: (pin: string) => Promise<void>;
+  onLogout?: () => void;
 }
 
-export function PinLockModal({ open, isSubmitting, error, onSubmit }: PinLockModalProps) {
+export function PinLockModal({ open, isSubmitting, error, onSubmit, onLogout }: PinLockModalProps) {
   const [pin, setPin] = React.useState('');
 
   React.useEffect(() => {
@@ -30,13 +31,32 @@ export function PinLockModal({ open, isSubmitting, error, onSubmit }: PinLockMod
 
   return (
     <Dialog open={open} onOpenChange={() => undefined}>
-      <DialogContent className="[&>button]:hidden" onPointerDownOutside={(event) => event.preventDefault()} onEscapeKeyDown={(event) => event.preventDefault()}>
+      <DialogContent
+        className="relative [&>button]:hidden"
+        onPointerDownOutside={(event) => event.preventDefault()}
+        onEscapeKeyDown={(event) => event.preventDefault()}
+      >
+        {onLogout ? (
+          <button
+            type="button"
+            onClick={onLogout}
+            disabled={isSubmitting}
+            title="Выйти из аккаунта"
+            aria-label="Выйти из аккаунта"
+            className="absolute left-5 top-5 flex h-9 w-9 items-center justify-center rounded-full text-[#6b6f7b] transition hover:bg-[#f4f5f8] hover:text-[#111] disabled:opacity-50"
+          >
+            <DoorOpen className="h-4 w-4" />
+          </button>
+        ) : null}
+
         <DialogHeader>
           <div className="mx-auto mb-2 flex h-14 w-14 items-center justify-center rounded-full bg-[#f4f5f8]">
             <KeyRound className="h-7 w-7 text-[#111]" />
           </div>
           <DialogTitle className="text-center">Введите PIN-код</DialogTitle>
-          <p className="text-center text-sm text-[#6b6f7b]">Сессия заблокирована из-за бездействия. Подтвердите PIN, чтобы продолжить работу.</p>
+          <p className="text-center text-sm text-[#6b6f7b]">
+            Сессия заблокирована из-за бездействия. Подтвердите PIN, чтобы продолжить работу.
+          </p>
         </DialogHeader>
 
         <form onSubmit={handleSubmit} className="space-y-4">

apps/frontend/lib/api.ts

@@ -1769,9 +1769,8 @@ export async function checkAppUpdate(platform: AppReleasePlatform, versionCode:
 }
 
 export function buildAppReleaseDownloadUrl(platform: AppReleasePlatform, releaseId?: string) {
-  const base = getApiUrl().replace(/\/$/, '');
   const slug = platform.toLowerCase();
-  return releaseId ? `${base}/releases/download/${slug}/${releaseId}` : `${base}/releases/download/${slug}`;
+  return releaseId ? `/downloads/${slug}/${releaseId}` : `/downloads/${slug}`;
 }
 
 export async function fetchAdminAppReleases(token: string, platform?: AppReleasePlatform) {

apps/frontend/lib/proxy-release-download.ts

@@ -0,0 +1,55 @@
+import type { NextRequest } from 'next/server';
+
+function resolveServerApiBase(request: NextRequest) {
+  const internal = process.env.INTERNAL_API_URL?.replace(/\/$/, '');
+  if (internal) return internal;
+  return `${request.nextUrl.origin}/idp-api`;
+}
+
+const PASSTHROUGH_HEADERS = [
+  'content-type',
+  'content-length',
+  'content-disposition',
+  'x-release-version',
+  'x-release-version-code',
+  'x-release-sha256',
+  'cache-control'
+] as const;
+
+export async function proxyReleaseDownload(
+  request: NextRequest,
+  platform: 'android' | 'windows',
+  releaseId?: string
+) {
+  const apiBase = resolveServerApiBase(request);
+  const path = releaseId
+    ? `/releases/download/${platform}/${releaseId}`
+    : `/releases/download/${platform}`;
+
+  const upstream = await fetch(`${apiBase}${path}`, {
+    method: 'GET',
+    cache: 'no-store'
+  });
+
+  if (!upstream.ok) {
+    const message = await upstream.text().catch(() => 'Файл релиза недоступен');
+    return new Response(message, {
+      status: upstream.status,
+      headers: {
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Cache-Control': 'no-store'
+      }
+    });
+  }
+
+  const headers = new Headers();
+  for (const key of PASSTHROUGH_HEADERS) {
+    const value = upstream.headers.get(key);
+    if (value) headers.set(key, value);
+  }
+
+  return new Response(upstream.body, {
+    status: upstream.status,
+    headers
+  });
+}