fix and update

apps/api-gateway/src/lib/fedcm-config.ts

@@ -5,6 +5,7 @@ import { resolveFrontendUrl, resolveOAuthIssuer } from './oauth-issuer';
 import {
   normalizePublicBaseUrl,
   preferCanonicalBase,
+  resolveFedcmWebIdentityOrigin,
   resolvePublicApiBaseFromRequest,
   resolvePublicFrontendBaseFromRequest
 } from './public-url';
@@ -25,13 +26,7 @@ export interface FedcmEndpoints {
 function buildFedcmEndpointUrls(issuer: string, frontendUrl: string) {
   const base = normalizePublicBaseUrl(issuer);
   const front = normalizePublicBaseUrl(frontendUrl);
-
-  let webIdentityOrigin = front;
-  try {
-    webIdentityOrigin = new URL(base).origin;
-  } catch {
-    // keep frontend origin
-  }
+  const webIdentityOrigin = resolveFedcmWebIdentityOrigin(base, front);
 
   return {
     configUrl: `${base}/fedcm/config.json`,

apps/api-gateway/src/lib/public-url.ts

@@ -139,3 +139,26 @@ export function hostsMatch(a: string, b: string) {
 
   return a === 'localhost' && b === 'localhost';
 }
+
+/** eTLD+1 для FedCM (sso.idpmvk.lpr → idpmvk.lpr). Совпадает с registrable_domain в install.sh */
+export function resolveRegistrableDomain(hostname: string): string {
+  const host = hostname.trim().toLowerCase();
+  if (!host) return host;
+  const labels = host.split('.').filter(Boolean);
+  if (labels.length <= 2) return host;
+  return `${labels[labels.length - 2]}.${labels[labels.length - 1]}`;
+}
+
+export function resolveFedcmWebIdentityOrigin(issuer: string, frontendUrl: string): string {
+  for (const candidate of [issuer, frontendUrl]) {
+    try {
+      const hostname = new URL(candidate).hostname;
+      const apex = resolveRegistrableDomain(hostname);
+      const proto = new URL(candidate).protocol;
+      return `${proto}//${apex}`;
+    } catch {
+      // try next
+    }
+  }
+  return frontendUrl;
+}